LG-7014 Device Profiling on the SSN page

app/services/idv/steps/ipp/ssn_step.rb

@@ -6,12 +6,15 @@ class SsnStep < DocAuthBaseStep
 
         def call
           flow_session[:pii_from_user][:ssn] = flow_params[:ssn]
+
+          flow_session[:threatmetrix_session_id] = threatmetrix_session_id unless updating_ssn
+
           idv_session.delete('applicant')
         end
 
         def extra_view_variables
           {
-            updating_ssn: flow_session[:pii_from_user][:ssn].present?,
+            updating_ssn: updating_ssn,
           }
         end
 
@@ -20,6 +23,15 @@ def extra_view_variables
         def form_submit
           Idv::SsnFormatForm.new(current_user).submit(permit(:ssn))
         end
+
+        def updating_ssn
+          flow_session.dig(:pii_from_user, :ssn).present?
+        end
+
+        def threatmetrix_session_id
+          return unless IdentityConfig.store.proofing_device_profiling_collecting_enabled
+          SecureRandom.uuid
+        end
       end
     end
   end

app/services/idv/steps/ssn_step.rb

@@ -7,12 +7,15 @@ def call
         return invalid_state_response if invalid_state?
 
         flow_session[:pii_from_doc][:ssn] = flow_params[:ssn]
+
+        flow_session[:threatmetrix_session_id] = threatmetrix_session_id unless updating_ssn
+
         idv_session.delete('applicant')
       end
 
       def extra_view_variables
         {
-          updating_ssn: flow_session.dig(:pii_from_doc, :ssn).present?,
+          updating_ssn: updating_ssn,
         }
       end
 
@@ -26,10 +29,19 @@ def invalid_state?
         flow_session[:pii_from_doc].nil?
       end
 
+      def updating_ssn
+        flow_session.dig(:pii_from_doc, :ssn).present?
+      end
+
       def invalid_state_response
         mark_step_incomplete(:document_capture)
         FormResponse.new(success: false)
       end
+
+      def threatmetrix_session_id
+        return nil if !IdentityConfig.store.proofing_device_profiling_collecting_enabled
+        SecureRandom.uuid
+      end
     end
   end
 end

app/views/idv/shared/_ssn.html.erb

@@ -28,6 +28,17 @@ locals:
   <%= new_window_link_to(t('doc_auth.instructions.learn_more'), MarketingSite.security_and_privacy_practices_url) %>
 </p>
 
+<% if IdentityConfig.store.proofing_device_profiling_collecting_enabled %>
+  <% unless IdentityConfig.store.lexisnexis_threatmetrix_org_id.empty? || updating_ssn %>
+    <script type="text/javascript" src="https://h.online-metrix.net/fp/tags.js?org_id=<%= IdentityConfig.store.lexisnexis_threatmetrix_org_id %>&session_id=<%= flow_session[:threatmetrix_session_id] %>">
+    </script>
+    <noscript>
+      <iframe style="width: 100px; height: 100px; border: 0; position: absolute; top: -5000px;" src="https://h.online-metrix.net/fp/tags?org_id=<%= IdentityConfig.store.lexisnexis_threatmetrix_org_id %>&session_id=<%= flow_session[:threatmetrix_session_id] %>">
+      </iframe>
+    </noscript>
+  <% end %>
+<% end %>
+
 <% if IdentityConfig.store.proofer_mock_fallback %>
   <div class="usa-alert usa-alert--info margin-bottom-4" role="status">
     <div class="usa-alert__body">

config/application.yml.default

@@ -144,7 +144,7 @@ lexisnexis_trueid_noliveness_nocropping_workflow: customers.gsa.trueid.workflow
 # LexisNexis ThreatMetrix ##########################################
 lexisnexis_threatmetrix_base_url: https://www.example.com
 lexisnexis_threatmetrix_request_mode: testing
-lexisnexis_threatmetrix_account_id: test_account
+lexisnexis_threatmetrix_org_id: test_account
 lexisnexis_threatmetrix_username: test_username
 lexisnexis_threatmetrix_password: test_password
 lexisnexis_threatmetrix_instant_verify_timeout: 1.0

lib/identity_config.rb

@@ -212,7 +212,7 @@ def self.build_store(config_map)
     config.add(:lexisnexis_trueid_timeout, type: :float)
     config.add(:lexisnexis_threatmetrix_base_url, type: :string)
     config.add(:lexisnexis_threatmetrix_request_mode, type: :string)
-    config.add(:lexisnexis_threatmetrix_account_id, type: :string)
+    config.add(:lexisnexis_threatmetrix_org_id, type: :string)
     config.add(:lexisnexis_threatmetrix_username, type: :string)
     config.add(:lexisnexis_threatmetrix_password, type: :string)
     config.add(:lexisnexis_threatmetrix_instant_verify_timeout, type: :float)

spec/views/idv/shared/_ssn.html.erb_spec.rb

@@ -0,0 +1,119 @@
+require 'rails_helper'
+
+describe 'idv/shared/_ssn.html.erb' do
+  include Devise::Test::ControllerHelpers
+
+  let(:proofing_device_profiling_collecting_enabled) { nil }
+  let(:lexisnexis_threatmetrix_org_id) { 'test_org_id' }
+  let(:session_id) { 'ABCD-1234' }
+  let(:updating_ssn) { false }
+  let(:js_domain) { 'h.online-metrix.net' }
+
+  let(:tags_js_url) {
+    "https://#{js_domain}/fp/tags.js?org_id=#{lexisnexis_threatmetrix_org_id}&session_id=#{session_id}"
+  }
+
+  let(:tags_iframe_url) {
+    "https://#{js_domain}/fp/tags?org_id=#{lexisnexis_threatmetrix_org_id}&session_id=#{session_id}"
+  }
+
+  before :each do
+    allow(view).to receive(:url_for).and_return('https://example.com/')
+
+    allow(IdentityConfig.store).
+      to receive(:proofing_device_profiling_collecting_enabled).
+      and_return(proofing_device_profiling_collecting_enabled)
+    allow(IdentityConfig.store).
+      to receive(:lexisnexis_threatmetrix_org_id).and_return(lexisnexis_threatmetrix_org_id)
+
+    render partial: 'idv/shared/ssn', locals: {
+      flow_session: {
+        threatmetrix_session_id: session_id,
+      },
+      success_alert_enabled: false,
+      updating_ssn: updating_ssn,
+    }
+  end
+
+  context 'when threatmetrix collection enabled' do
+    let(:proofing_device_profiling_collecting_enabled) { true }
+
+    context 'and org id specified' do
+      context 'and entering ssn for the first time' do
+        describe '<script> tag' do
+          it 'is rendered' do
+            expect_script_tag_rendered
+          end
+        end
+
+        describe '<noscript> tag' do
+          it 'is rendered' do
+            expect_noscript_tag_rendered
+          end
+        end
+      end
+
+      context 'updating ssn already entered' do
+        let(:updating_ssn) { true }
+
+        it 'does not render <script> tag' do
+          expect_script_tag_not_rendered
+        end
+        it 'does not render <noscript> tag' do
+          expect_noscript_tag_not_rendered
+        end
+      end
+    end
+
+    context 'org id not specified' do
+      let(:lexisnexis_threatmetrix_org_id) { '' }
+
+      it 'does not render <script> tag' do
+        expect_script_tag_not_rendered
+      end
+      it 'does not render <noscript> tag' do
+        expect_noscript_tag_not_rendered
+      end
+    end
+  end
+
+  context 'threatmetrix collection disabled' do
+    let(:proofing_device_profiling_collecting_enabled) { false }
+
+    it 'does not render <script> tag' do
+      expect_script_tag_not_rendered
+    end
+    it 'does not render <noscript> tag' do
+      expect_noscript_tag_not_rendered
+    end
+  end
+
+  def expect_script_tag_rendered
+    expect(rendered).to have_css("script[src='#{tags_js_url}']", visible: false)
+  end
+
+  def expect_noscript_tag_rendered
+    expect(rendered).to have_css("noscript iframe[src='#{tags_iframe_url}']", visible: false)
+  end
+
+  def expect_session_id_input_rendered
+    expect(rendered).
+      to have_css(
+        "input[type=hidden][name='doc_auth[threatmetrix_session_id]'][value='#{session_id}']",
+        visible: false,
+      )
+  end
+
+  def expect_script_tag_not_rendered
+    expect(rendered).not_to have_css("script[src*='#{js_domain}']", visible: false)
+  end
+
+  def expect_noscript_tag_not_rendered
+    expect(rendered).not_to have_css("noscript iframe[src*='#{js_domain}']", visible: false)
+  end
+
+  def expect_session_id_input_not_rendered
+    expect(rendered).
+      not_to have_css('input[name="doc_auth[threatmetrix_session_id]"]', visible: false)
+  end
+end