Add safeguard tests to ensure IRS events are not stored in plaintext

spec/controllers/api/irs_attempts_api_controller_spec.rb

@@ -22,7 +22,9 @@
         event_type: :test_event,
         session_id: 'test-session-id',
         occurred_at: time,
-        event_metadata: {},
+        event_metadata: {
+          first_name: Idp::Constants::MOCK_IDV_APPLICANT[:first_name],
+        },
       )
       jti = event.jti
       jwe = event.to_jwe

spec/services/irs_attempts_api/envelope_encryptor_spec.rb

@@ -4,17 +4,19 @@
   let(:public_key) { private_key.public_key }
   describe '.encrypt' do
     it 'returns encrypted result' do
-      text = 'test'
+      text = Idp::Constants::MOCK_IDV_APPLICANT[:first_name]
       time = Time.zone.now
       result = IrsAttemptsApi::EnvelopeEncryptor.encrypt(
         data: text, timestamp: time, public_key: public_key,
       )
 
       expect(result.encrypted_data).to_not eq text
+      expect(result.encrypted_data).to_not include(text)
+      expect(Base64.decode64(result.encrypted_data)).to_not include(text)
     end
 
     it 'filename includes digest and truncated timestamp' do
-      text = 'test'
+      text = Idp::Constants::MOCK_IDV_APPLICANT[:first_name]
       time = Time.zone.now
       result = IrsAttemptsApi::EnvelopeEncryptor.encrypt(
         data: text, timestamp: time,
@@ -31,7 +33,7 @@
 
   describe '.decrypt' do
     it 'returns decrypted text' do
-      text = 'test'
+      text = Idp::Constants::MOCK_IDV_APPLICANT[:first_name]
       time = Time.zone.now
       result = IrsAttemptsApi::EnvelopeEncryptor.encrypt(
         data: text, timestamp: time,

spec/services/irs_attempts_api/redis_client_spec.rb

@@ -9,7 +9,9 @@
           event_type: 'test_event',
           session_id: 'test-session-id',
           occurred_at: Time.zone.now,
-          event_metadata: { 'foo' => 'bar' },
+          event_metadata: {
+            first_name: Idp::Constants::MOCK_IDV_APPLICANT[:first_name],
+          },
         )
         event_key = event.event_key
         jwe = event.to_jwe
@@ -34,7 +36,9 @@
             event_type: 'test_event',
             session_id: 'test-session-id',
             occurred_at: now,
-            event_metadata: { 'foo' => 'bar' },
+            event_metadata: {
+              first_name: Idp::Constants::MOCK_IDV_APPLICANT[:first_name],
+            },
           )
           event_key = event.event_key
           jwe = event.to_jwe
@@ -57,13 +61,17 @@
         event_type: 'test_event',
         session_id: 'test-session-id',
         occurred_at: time1,
-        event_metadata: { 'foo' => 'bar' },
+        event_metadata: {
+          first_name: Idp::Constants::MOCK_IDV_APPLICANT[:first_name],
+        },
       )
       event2 = IrsAttemptsApi::AttemptEvent.new(
         event_type: 'test_event',
         session_id: 'test-session-id',
         occurred_at: time2,
-        event_metadata: { 'foo' => 'bar' },
+        event_metadata: {
+          first_name: Idp::Constants::MOCK_IDV_APPLICANT[:first_name],
+        },
       )
       jwe1 = event1.to_jwe
       jwe2 = event2.to_jwe

spec/services/irs_attempts_api/tracker_spec.rb

@@ -44,6 +44,17 @@
       end
     end
 
+    it 'does not store events in plaintext in redis' do
+      freeze_time do
+        subject.track_event(:event, first_name: Idp::Constants::MOCK_IDV_APPLICANT[:first_name])
+
+        events = IrsAttemptsApi::RedisClient.new.read_events(timestamp: Time.zone.now)
+
+        expect(events.keys.first).to_not include('first_name')
+        expect(events.values.first).to_not include(Idp::Constants::MOCK_IDV_APPLICANT[:first_name])
+      end
+    end
+
     context 'the current session is not an IRS attempt API session' do
       let(:enabled_for_session) { false }