From 84b694dc47ebabd57bf64b446b5cee48f2f9ead0 Mon Sep 17 00:00:00 2001 From: Amir Reavis-Bey Date: Thu, 24 Aug 2023 12:43:29 -0400 Subject: [PATCH 1/5] fix ordering of confirm_two_factor_authenticated filter in phone controller changelog: Bug Fixes, Identity Verification, Presence of user verified before requesting session for user --- app/controllers/concerns/idv/phone_otp_rate_limitable.rb | 1 - app/controllers/concerns/idv/phone_otp_sendable.rb | 1 - app/controllers/idv/otp_verification_controller.rb | 2 +- app/controllers/idv/resend_otp_controller.rb | 2 +- 4 files changed, 2 insertions(+), 4 deletions(-) diff --git a/app/controllers/concerns/idv/phone_otp_rate_limitable.rb b/app/controllers/concerns/idv/phone_otp_rate_limitable.rb index 598d0f74ad8..791ea9b4580 100644 --- a/app/controllers/concerns/idv/phone_otp_rate_limitable.rb +++ b/app/controllers/concerns/idv/phone_otp_rate_limitable.rb @@ -3,7 +3,6 @@ module PhoneOtpRateLimitable extend ActiveSupport::Concern included do - before_action :confirm_two_factor_authenticated before_action :handle_locked_out_user end diff --git a/app/controllers/concerns/idv/phone_otp_sendable.rb b/app/controllers/concerns/idv/phone_otp_sendable.rb index 8a657ed53d1..0d6c5c77b4f 100644 --- a/app/controllers/concerns/idv/phone_otp_sendable.rb +++ b/app/controllers/concerns/idv/phone_otp_sendable.rb @@ -3,7 +3,6 @@ module PhoneOtpSendable extend ActiveSupport::Concern included do - before_action :confirm_two_factor_authenticated before_action :handle_locked_out_user end diff --git a/app/controllers/idv/otp_verification_controller.rb b/app/controllers/idv/otp_verification_controller.rb index 57f80b68968..9f690b6bb62 100644 --- a/app/controllers/idv/otp_verification_controller.rb +++ b/app/controllers/idv/otp_verification_controller.rb @@ -4,7 +4,7 @@ class OtpVerificationController < ApplicationController include StepIndicatorConcern include PhoneOtpRateLimitable - # confirm_two_factor_authenticated before action is in PhoneOtpRateLimitable + before_action :confirm_two_factor_authenticated before_action :confirm_step_needed before_action :confirm_otp_sent before_action :set_code diff --git a/app/controllers/idv/resend_otp_controller.rb b/app/controllers/idv/resend_otp_controller.rb index 917f12d3a2b..febd4b4a1ef 100644 --- a/app/controllers/idv/resend_otp_controller.rb +++ b/app/controllers/idv/resend_otp_controller.rb @@ -4,7 +4,7 @@ class ResendOtpController < ApplicationController include PhoneOtpRateLimitable include PhoneOtpSendable - # confirm_two_factor_authenticated before action is in PhoneOtpRateLimitable + before_action :confirm_two_factor_authenticated before_action :confirm_user_phone_confirmation_needed before_action :confirm_user_phone_confirmation_session_started From 859a292f601fd44ad2a7183d18c61ba6c2f80478 Mon Sep 17 00:00:00 2001 From: Amir Reavis-Bey Date: Thu, 24 Aug 2023 14:34:52 -0400 Subject: [PATCH 2/5] test hybrid doc user via sendlink on desktop to access phone step --- .../idv/hybrid_mobile/hybrid_mobile_spec.rb | 48 +++++++++++++++++++ 1 file changed, 48 insertions(+) diff --git a/spec/features/idv/hybrid_mobile/hybrid_mobile_spec.rb b/spec/features/idv/hybrid_mobile/hybrid_mobile_spec.rb index b4b5d9874c9..6f5d8229d15 100644 --- a/spec/features/idv/hybrid_mobile/hybrid_mobile_spec.rb +++ b/spec/features/idv/hybrid_mobile/hybrid_mobile_spec.rb @@ -169,4 +169,52 @@ end end end + + it 'does not allow hybrid doc capture user to access phone step', js: true do + user = nil + + perform_in_browser(:desktop) do + visit_idp_from_sp_with_ial2(sp) + user = sign_up_and_2fa_ial1_user + + complete_doc_auth_steps_before_hybrid_handoff_step + clear_and_fill_in(:doc_auth_phone, phone_number) + click_send_link + + expect(page).to have_content(t('doc_auth.headings.text_message')) + expect(page).to have_content(t('doc_auth.info.you_entered')) + expect(page).to have_content('+1 415-555-0199') + + # Confirm that Continue button is not shown when polling is enabled + expect(page).not_to have_content(t('doc_auth.buttons.continue')) + end + + expect(@sms_link).to be_present + + perform_in_browser(:desktop) do + visit @sms_link + + # Confirm that jumping to LinkSent page does not cause errors + visit idv_link_sent_url + expect(page).to have_current_path(root_url) + visit idv_hybrid_mobile_document_capture_url + + # Confirm that jumping to Welcome page does not cause errors + # This was added for the GettingStarted A/B Test + visit idv_welcome_url + expect(page).to have_current_path(root_url) + visit idv_hybrid_mobile_document_capture_url + + attach_and_submit_images + + expect(page).to have_current_path(idv_hybrid_mobile_capture_complete_url) + expect(page).to have_content(t('doc_auth.headings.capture_complete').tr(' ', ' ')) + expect(page).to have_text(t('doc_auth.instructions.switch_back')) + expect_step_indicator_current_step(t('step_indicator.flows.idv.verify_id')) + + # Confirm app disallows jumping back to DocumentCapture page + visit idv_phone_path + expect(page.status_code).to eq(200) + end + end end From 7b09c08eacda0626faf3d6042c2cb95ac098bc61 Mon Sep 17 00:00:00 2001 From: Amir Reavis-Bey Date: Thu, 24 Aug 2023 14:40:34 -0400 Subject: [PATCH 3/5] verify user is logged out --- spec/features/idv/hybrid_mobile/hybrid_mobile_spec.rb | 1 + 1 file changed, 1 insertion(+) diff --git a/spec/features/idv/hybrid_mobile/hybrid_mobile_spec.rb b/spec/features/idv/hybrid_mobile/hybrid_mobile_spec.rb index 6f5d8229d15..e10841ba228 100644 --- a/spec/features/idv/hybrid_mobile/hybrid_mobile_spec.rb +++ b/spec/features/idv/hybrid_mobile/hybrid_mobile_spec.rb @@ -215,6 +215,7 @@ # Confirm app disallows jumping back to DocumentCapture page visit idv_phone_path expect(page.status_code).to eq(200) + expect(page).to have_current_path(new_user_session_path) end end end From 8a29667028aa74523ddaf75f2fbb8cac6ec2f066 Mon Sep 17 00:00:00 2001 From: Sonia Connolly Date: Thu, 24 Aug 2023 14:17:25 -0700 Subject: [PATCH 4/5] Regression spec - jump to Phone step to confirm it doesn't cause errors --- spec/features/idv/hybrid_mobile/hybrid_mobile_spec.rb | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/spec/features/idv/hybrid_mobile/hybrid_mobile_spec.rb b/spec/features/idv/hybrid_mobile/hybrid_mobile_spec.rb index e10841ba228..45d0a16a356 100644 --- a/spec/features/idv/hybrid_mobile/hybrid_mobile_spec.rb +++ b/spec/features/idv/hybrid_mobile/hybrid_mobile_spec.rb @@ -48,6 +48,11 @@ expect(page).to have_current_path(root_url) visit idv_hybrid_mobile_document_capture_url + # Confirm that jumping to Phone page does not cause errors + visit idv_phone_url + expect(page).to have_current_path(root_url) + visit idv_hybrid_mobile_document_capture_url + # Confirm that jumping to Welcome page does not cause errors # This was added for the GettingStarted A/B Test visit idv_welcome_url From 8fcbcff2dc4d0282eaffa36e19221db5ea7e810d Mon Sep 17 00:00:00 2001 From: Amir Reavis-Bey Date: Thu, 24 Aug 2023 17:19:06 -0400 Subject: [PATCH 5/5] remove test not needed --- .../idv/hybrid_mobile/hybrid_mobile_spec.rb | 49 ------------------- 1 file changed, 49 deletions(-) diff --git a/spec/features/idv/hybrid_mobile/hybrid_mobile_spec.rb b/spec/features/idv/hybrid_mobile/hybrid_mobile_spec.rb index 45d0a16a356..e48caf2b801 100644 --- a/spec/features/idv/hybrid_mobile/hybrid_mobile_spec.rb +++ b/spec/features/idv/hybrid_mobile/hybrid_mobile_spec.rb @@ -174,53 +174,4 @@ end end end - - it 'does not allow hybrid doc capture user to access phone step', js: true do - user = nil - - perform_in_browser(:desktop) do - visit_idp_from_sp_with_ial2(sp) - user = sign_up_and_2fa_ial1_user - - complete_doc_auth_steps_before_hybrid_handoff_step - clear_and_fill_in(:doc_auth_phone, phone_number) - click_send_link - - expect(page).to have_content(t('doc_auth.headings.text_message')) - expect(page).to have_content(t('doc_auth.info.you_entered')) - expect(page).to have_content('+1 415-555-0199') - - # Confirm that Continue button is not shown when polling is enabled - expect(page).not_to have_content(t('doc_auth.buttons.continue')) - end - - expect(@sms_link).to be_present - - perform_in_browser(:desktop) do - visit @sms_link - - # Confirm that jumping to LinkSent page does not cause errors - visit idv_link_sent_url - expect(page).to have_current_path(root_url) - visit idv_hybrid_mobile_document_capture_url - - # Confirm that jumping to Welcome page does not cause errors - # This was added for the GettingStarted A/B Test - visit idv_welcome_url - expect(page).to have_current_path(root_url) - visit idv_hybrid_mobile_document_capture_url - - attach_and_submit_images - - expect(page).to have_current_path(idv_hybrid_mobile_capture_complete_url) - expect(page).to have_content(t('doc_auth.headings.capture_complete').tr(' ', ' ')) - expect(page).to have_text(t('doc_auth.instructions.switch_back')) - expect_step_indicator_current_step(t('step_indicator.flows.idv.verify_id')) - - # Confirm app disallows jumping back to DocumentCapture page - visit idv_phone_path - expect(page.status_code).to eq(200) - expect(page).to have_current_path(new_user_session_path) - end - end end