LG-9634: "Use another phone number" when adding phone does not return user to phone page

[jmdembe]

🎫 Ticket

LG-9634: "Use another phone number" when adding phone does not return user to phone page

🛠 Summary of changes

Expected behavior: When a user has an existing account and wants to set up an additional phone number, they should be able to click "Use another phone number" to restart the phone setup with a new number.

Current behavior: When you click "Use another phone number", we are then re-routed to the account page.

[mitchellhenke]

I don't think we can remove this entire check. It was added in #8265 because this controller doesn't have the same authentication requirements in terms of re-authentication. Is there a way to fix this check so it allows a user in account setup to access it, but prevents users that are no longer in account setup from using it?

[jmdembe]

I am messing around with this, but this check failing causes the bug that we are trying to address. What we want is that in any instance of a unconfirmed phone number, whether it be during account setup or after, we want to provide a flow that will allow a user to return to the phone setup path one the "Enter your one-time code" screen.

[aduth]

Can we add a feature spec which checks this behavior to avoid any future regressions? I feel like this is one flow where we've had a handful of regressions already, so it'd be good to include.

[aduth]

LGTM 👍

[aduth]

I think one of the problems we keep running into is that we have separate controllers for setting up a phone for a new account vs. adding one to an existing account. These changes do fix the issue since it allows a user to continue entering a phone, but it still creates a "jump" where someone may start at the phone_setup view or add_phone view, and here we'll always direct them back to add_phone, and not actually where they started from.

This seems like a good fix. I think it also leads nicely into a follow-up to consolidate to one controller, since Users::PhoneController could now probably handle the phone setup flow with the change to use confirm_user_authenticated_for_2fa_setup instead of confirm_two_factor_authenticated? What do you think? Should we write a ticket for that?

[jmdembe]

I agree with consolidating the controllers. Let's write a ticket for that work.