Deploy RC 309 to Prod

.gitlab-ci.yml

@@ -9,6 +9,7 @@ variables:
   JUNIT_OUTPUT: 'true'
   ECR_REGISTRY: '${AWS_ACCOUNT_ID}.dkr.ecr.${AWS_REGION}.amazonaws.com'
   IDP_CI_SHA: 'sha256:6915b54a913ebcb9066fdfaa88c3d42bda1f4505cfb59b9d5848576705954621'
+  PKI_IMAGE_TAG: 'main'
 
 default:
   image: '${ECR_REGISTRY}/idp/ci@${IDP_CI_SHA}'
@@ -95,8 +96,12 @@ build-idp-image:
   stage: review
   needs: []
   interruptible: true
+  variables:
+    BRANCH_TAGGING_STRING: ""
   rules:
     - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
+      variables:
+        BRANCH_TAGGING_STRING: "--destination ${ECR_REGISTRY}/identity-idp/review:${$CI_DEFAULT_BRANCH}"
     - if: $CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH
     - if: $CI_PIPELINE_SOURCE != "merge_request_event"
       when: never
@@ -119,6 +124,7 @@ build-idp-image:
       --context "${CI_PROJECT_DIR}"
       --dockerfile "${CI_PROJECT_DIR}/Dockerfile"
       --destination "${ECR_REGISTRY}/identity-idp/review:${CI_COMMIT_SHA}"
+      ${BRANCH_TAGGING_STRING}
       --cache-repo="${ECR_REGISTRY}/identity-idp/review/cache"
       --cache-ttl=168h
       --cache=true
@@ -312,25 +318,27 @@ review-app:
       [
         {"name": "POSTGRES_SSLMODE", "value": "prefer"},
         {"name": "POSTGRES_NAME", "value": "idp"},
-        {"name": "POSTGRES_HOST","value": "$CI_ENVIRONMENT_SLUG-identity-idp-chart-postgres.review-apps"},
+        {"name": "POSTGRES_HOST","value": "$CI_ENVIRONMENT_SLUG-login-chart-pg.review-apps"},
         {"name": "POSTGRES_USERNAME", "value": "postgres"},
         {"name": "POSTGRES_PASSWORD", "value": "postgres"},
         {"name": "POSTGRES_WORKER_SSLMODE", "value": "prefer"},
         {"name": "POSTGRES_WORKER_NAME", "value": "idp-worker-jobs"},
-        {"name": "POSTGRES_WORKER_HOST", "value": "$CI_ENVIRONMENT_SLUG-identity-idp-chart-postgres.review-apps"},
+        {"name": "POSTGRES_WORKER_HOST", "value": "$CI_ENVIRONMENT_SLUG-login-chart-pg.review-apps"},
         {"name": "POSTGRES_WORKER_USERNAME", "value": "postgres"},
         {"name": "POSTGRES_WORKER_PASSWORD", "value": "postgres"},
         {"name": "RAILS_OFFLINE", "value": "true"},
-        {"name": "REDIS_IRS_ATTEMPTS_API_URL", "value": "redis://$CI_ENVIRONMENT_SLUG-identity-idp-chart-redis.review-apps:6379/2"},
-        {"name": "REDIS_THROTTLE_URL", "value": "redis://$CI_ENVIRONMENT_SLUG-identity-idp-chart-redis.review-apps:6379/1"},
-        {"name": "REDIS_URL", "value": "redis://$CI_ENVIRONMENT_SLUG-identity-idp-chart-redis.review-apps:6379"},
+        {"name": "REDIS_IRS_ATTEMPTS_API_URL", "value": "redis://$CI_ENVIRONMENT_SLUG-login-chart-redis.review-apps:6379/2"},
+        {"name": "REDIS_THROTTLE_URL", "value": "redis://$CI_ENVIRONMENT_SLUG-login-chart-redis.review-apps:6379/1"},
+        {"name": "REDIS_URL", "value": "redis://$CI_ENVIRONMENT_SLUG-login-chart-redis.review-apps:6379"},
         {"name": "ASSET_HOST", "value": "https://$CI_ENVIRONMENT_SLUG.review-app.identitysandbox.gov"},
         {"name": "DOMAIN_NAME", "value": "$CI_ENVIRONMENT_SLUG.review-app.identitysandbox.gov"},
         {"name": "LOGIN_DATACENTER", "value": "true" },
         {"name": "LOGIN_DOMAIN", "value": "identitysandbox.gov"},
         {"name": "LOGIN_ENV", "value": "$CI_ENVIRONMENT_SLUG" },
         {"name": "LOGIN_HOST_ROLE", "value": "idp" },
-        {"name": "LOGIN_SKIP_REMOTE_CONFIG", "value": "true" }
+        {"name": "LOGIN_SKIP_REMOTE_CONFIG", "value": "true" },
+        {"name": "PIV_CAC_SERVICE_URL", "value": "https://$CI_ENVIRONMENT_SLUG-review-app.pivcac.identitysandbox.gov/"},
+        {"name": "PIV_CAC_VERIFY_TOKEN_URL", "value": "https://$CI_ENVIRONMENT_SLUG-review-app.pivcac.identitysandbox.gov/"}
       ]
       EOF
       )
@@ -339,43 +347,67 @@ review-app:
       [
         {"name": "POSTGRES_SSLMODE", "value": "prefer"},
         {"name": "POSTGRES_NAME", "value": "idp"},
-        {"name": "POSTGRES_HOST", "value": "$CI_ENVIRONMENT_SLUG-identity-idp-chart-postgres.review-apps"},
+        {"name": "POSTGRES_HOST", "value": "$CI_ENVIRONMENT_SLUG-login-chart-pg.review-apps"},
         {"name": "POSTGRES_USERNAME", "value": "postgres"},
         {"name": "POSTGRES_PASSWORD", "value": "postgres"},
         {"name": "POSTGRES_WORKER_SSLMODE", "value": "prefer"},
         {"name": "POSTGRES_WORKER_NAME", "value": "idp-worker-jobs"},
-        {"name": "POSTGRES_WORKER_HOST", "value": "$CI_ENVIRONMENT_SLUG-identity-idp-chart-postgres.review-apps"},
+        {"name": "POSTGRES_WORKER_HOST", "value": "$CI_ENVIRONMENT_SLUG-login-chart-pg.review-apps"},
         {"name": "POSTGRES_WORKER_USERNAME", "value": "postgres"},
         {"name": "POSTGRES_WORKER_PASSWORD", "value": "postgres"},
         {"name": "RAILS_OFFLINE", "value": "true"},
-        {"name": "REDIS_IRS_ATTEMPTS_API_URL", "value": "redis://$CI_ENVIRONMENT_SLUG-identity-idp-chart-redis.review-apps:6379/2"},
-        {"name": "REDIS_THROTTLE_URL", "value": "redis://$CI_ENVIRONMENT_SLUG-identity-idp-chart-redis.review-apps:6379/1"},
-        {"name": "REDIS_URL", "value": "redis://$CI_ENVIRONMENT_SLUG-identity-idp-chart-redis.review-apps:6379"},
+        {"name": "REDIS_IRS_ATTEMPTS_API_URL", "value": "redis://$CI_ENVIRONMENT_SLUG-login-chart-redis.review-apps:6379/2"},
+        {"name": "REDIS_THROTTLE_URL", "value": "redis://$CI_ENVIRONMENT_SLUG-login-chart-redis.review-apps:6379/1"},
+        {"name": "REDIS_URL", "value": "redis://$CI_ENVIRONMENT_SLUG-login-chart-redis.review-apps:6379"},
         {"name": "ASSET_HOST", "value": "https://$CI_ENVIRONMENT_SLUG.review-app.identitysandbox.gov"},
         {"name": "DOMAIN_NAME", "value": "$CI_ENVIRONMENT_SLUG.review-app.identitysandbox.gov"},
         {"name": "LOGIN_DATACENTER", "value": "true" },
         {"name": "LOGIN_DOMAIN", "value": "identitysandbox.gov"},
         {"name": "LOGIN_ENV", "value": "$CI_ENVIRONMENT_SLUG" },
         {"name": "LOGIN_HOST_ROLE", "value": "worker" },
-        {"name": "LOGIN_SKIP_REMOTE_CONFIG", "value": "true" }
+        {"name": "LOGIN_SKIP_REMOTE_CONFIG", "value": "true" },
+        {"name": "PIV_CAC_SERVICE_URL", "value": "https://$CI_ENVIRONMENT_SLUG-review-app.pivcac.identitysandbox.gov/"},
+        {"name": "PIV_CAC_VERIFY_TOKEN_URL", "value": "https://$CI_ENVIRONMENT_SLUG-review-app.pivcac.identitysandbox.gov/"}
+      ]
+      EOF
+      )
+    - |-
+      export PIVCAC_ENV=$(cat <<EOF
+      [
+        {"name": "CLIENT_CERT_S3_BUCKET", "value": "login-gov-pivcac-public-cert-reviewapp.894947205914-us-west-2"},
+        {"name": "POSTGRES_SSLMODE", "value": "prefer"},
+        {"name": "POSTGRES_NAME", "value": "identity_pki_production"},
+        {"name": "POSTGRES_HOST","value": "$CI_ENVIRONMENT_SLUG-login-chart-pivcac-pg.review-apps"},
+        {"name": "POSTGRES_USERNAME", "value": "postgres"},
+        {"name": "POSTGRES_PASSWORD", "value": "pivcac"},
+        {"name": "IDP_HOST", "value": "$CI_ENVIRONMENT_SLUG.review-app.identitysandbox.gov"},
+        {"name": "DOMAIN_NAME", "value": "$CI_ENVIRONMENT_SLUG-review-app.pivcac.identitysandbox.gov"}
       ]
       EOF
       )
+    - git clone -b main --single-branch https://gitlab-ci-token:${CI_JOB_TOKEN}@gitlab.login.gov/lg-public/identity-idp-helm-chart.git
     - >-
       helm upgrade --install --namespace review-apps
       --debug
       --set idp.image.repository="${ECR_REGISTRY}/identity-idp/review"
       --set idp.image.tag="${CI_COMMIT_SHA}"
       --set worker.image.repository="${ECR_REGISTRY}/identity-idp/review"
       --set worker.image.tag="${CI_COMMIT_SHA}"
-      --set idp.ingress.enabled=true
+      --set pivcac.image.repository="${ECR_REGISTRY}/identity-pivcac/review"
+      --set pivcac.image.tag="${PKI_IMAGE_TAG}"
       --set-json idp.env="$IDP_ENV"
       --set-json worker.env="$WORKER_ENV"
+      --set-json pivcac.env="$PIVCAC_ENV"
       --set-json idp.ingress.hosts="[{\"host\": \"$CI_ENVIRONMENT_SLUG.review-app.identitysandbox.gov\", \"paths\": [{\"path\": \"/\", \"pathType\": \"Prefix\"}]}]"
-      $CI_ENVIRONMENT_SLUG ./charts
+      --set-json pivcac.ingress.hosts="[{\"host\": \"$CI_ENVIRONMENT_SLUG-review-app.pivcac.identitysandbox.gov\", \"paths\": [{\"path\": \"/\", \"pathType\": \"Prefix\"}]}]"
+      $CI_ENVIRONMENT_SLUG ./identity-idp-helm-chart
     - echo "DNS may take a while to propagate, so be patient if it doesn't show up right away"
     - echo "To access the rails console, first run 'aws-vault exec sandbox-power -- aws eks update-kubeconfig --name review_app'"
-    - echo "Then run aws-vault exec sandbox-power -- kubectl exec -it service/$CI_ENVIRONMENT_SLUG-identity-idp-chart-idp -n review-apps -- /app/bin/rails console"
+    - echo "Then run aws-vault exec sandbox-power -- kubectl exec -it service/$CI_ENVIRONMENT_SLUG-login-chart-idp -n review-apps -- /app/bin/rails console"
+    - echo "Address of IDP review app:"
+    - echo https://$CI_ENVIRONMENT_SLUG.review-app.identitysandbox.gov
+    - echo "Address of PIVCAC review app:"
+    - echo https://$CI_ENVIRONMENT_SLUG-review-app.pivcac.identitysandbox.gov
   environment:
     name: review/$CI_COMMIT_REF_NAME
     url: https://$CI_ENVIRONMENT_SLUG.review-app.identitysandbox.gov
@@ -548,4 +580,4 @@ ecr-scan:
     paths: 
       - gl-container-scanning-report.json
     reports:
-      container_scanning: gl-container-scanning-report.json
+      container_scanning: gl-container-scanning-report.json

Dockerfile

@@ -27,6 +27,8 @@ ENV REDIS_THROTTLE_URL redis://redis:6379/1
 ENV REDIS_URL redis://redis:6379
 ENV ASSET_HOST http://localhost:3000
 ENV DOMAIN_NAME localhost:3000
+ENV PIV_CAC_SERVICE_URL https://localhost:8443/
+ENV PIV_CAC_VERIFY_TOKEN_URL https://localhost:8443/ 
 
 # Prevent documentation installation
 RUN echo 'path-exclude=/usr/share/doc/*' > /etc/dpkg/dpkg.cfg.d/00_nodoc && \

Gemfile

@@ -8,6 +8,7 @@ gem 'rails', '~> 7.0.0'
 gem 'activerecord-postgis-adapter'
 gem 'ahoy_matey', '~> 3.0'
 gem 'aws-sdk-kms', '~> 1.4'
+gem 'aws-sdk-cloudwatchlogs', require: false
 gem 'aws-sdk-pinpoint'
 gem 'aws-sdk-pinpointsmsvoice'
 gem 'aws-sdk-ses', '~> 1.6'
@@ -17,6 +18,7 @@ gem 'barby', '~> 0.6.8'
 gem 'base32-crockford'
 gem 'bootsnap', '~> 1.0', require: false
 gem 'browser'
+gem 'concurrent-ruby'
 gem 'connection_pool'
 gem 'cssbundling-rails'
 gem 'devise', '~> 4.8'
@@ -92,7 +94,6 @@ group :development do
 end
 
 group :development, :test do
-  gem 'aws-sdk-cloudwatchlogs', require: false
   gem 'brakeman', require: false
   gem 'bullet', '~> 7.0'
   gem 'capybara-webmock', git: 'https://github.com/hashrocket/capybara-webmock.git', ref: 'd3f3b7c'

Gemfile.lock

@@ -734,6 +734,7 @@ DEPENDENCIES
   bullet (~> 7.0)
   bundler-audit
   capybara-webmock!
+  concurrent-ruby
   connection_pool
   cssbundling-rails
   derailed_benchmarks

app/controllers/concerns/idv/document_capture_concern.rb

@@ -23,7 +23,7 @@ def successful_response
 
     # copied from Flow::Failure module
     def failure(message, extra = nil)
-      flow_session[:error_message] = message if defined?(flow_session)
+      flash[:error] = message
       form_response_params = { success: false, errors: { message: message } }
       form_response_params[:extra] = extra unless extra.nil?
       FormResponse.new(**form_response_params)

app/controllers/concerns/idv/phone_otp_rate_limitable.rb

@@ -3,7 +3,6 @@ module PhoneOtpRateLimitable
     extend ActiveSupport::Concern
 
     included do
-      before_action :confirm_two_factor_authenticated
       before_action :handle_locked_out_user
     end
 

app/controllers/concerns/idv/phone_otp_sendable.rb

@@ -3,7 +3,6 @@ module PhoneOtpSendable
     extend ActiveSupport::Concern
 
     included do
-      before_action :confirm_two_factor_authenticated
       before_action :handle_locked_out_user
     end
 

app/controllers/concerns/idv/verify_info_concern.rb

@@ -191,7 +191,7 @@ def async_state_done(current_async_state)
         state_id_number: pii[:state_id_number],
         # todo: add other edited fields?
         extra: {
-          address_edited: !!(idv_session.address_edited || flow_session['address_edited']),
+          address_edited: !!idv_session.address_edited,
           address_line2_present: !pii[:address2].blank?,
           pii_like_keypaths: [[:errors, :ssn], [:response_body, :first_name],
                               [:same_address_as_id],

app/controllers/idv/address_controller.rb

@@ -44,7 +44,6 @@ def profile_params
 
     def capture_address_edited(result)
       address_edited = result.to_h[:address_edited]
-      flow_session['address_edited'] = address_edited if address_edited
       idv_session.address_edited = true if address_edited
     end
   end

app/controllers/idv/agreement_controller.rb

@@ -13,8 +13,6 @@ def show
         'agreement', :view,
         true
       )
-
-      render :show, locals: { flow_session: flow_session }
     end
 
     def update

app/controllers/idv/getting_started_controller.rb

@@ -15,8 +15,6 @@ def show
 
       @sp_name = decorated_session.sp_name || APP_NAME
       @title = t('doc_auth.headings.getting_started', sp_name: @sp_name)
-
-      render :show, locals: { flow_session: flow_session }
     end
 
     def update

app/controllers/idv/hybrid_handoff_controller.rb

@@ -183,7 +183,7 @@ def rate_limited_failure
 
     # copied from Flow::Failure module
     def failure(message, extra = nil)
-      flow_session[:error_message] = message
+      flash[:error] = message
       form_response_params = { success: false, errors: { message: message } }
       form_response_params[:extra] = extra unless extra.nil?
       FormResponse.new(**form_response_params)

app/controllers/idv/in_person/verify_info_controller.rb

@@ -48,7 +48,7 @@ def invalid_state?
       end
 
       def prev_url
-        idv_in_person_proofing_ssn_url
+        idv_in_person_ssn_url
       end
 
       def pii

app/controllers/idv/in_person_controller.rb

@@ -16,7 +16,7 @@ class InPersonController < ApplicationController
 
     FLOW_STATE_MACHINE_SETTINGS = {
       step_url: :idv_in_person_step_url,
-      final_url: :idv_in_person_proofing_ssn_url,
+      final_url: :idv_in_person_ssn_url,
       flow: Idv::Flows::InPersonFlow,
       analytics_id: 'In Person Proofing',
     }.freeze

app/controllers/idv/otp_verification_controller.rb

@@ -4,7 +4,7 @@ class OtpVerificationController < ApplicationController
     include StepIndicatorConcern
     include PhoneOtpRateLimitable
 
-    # confirm_two_factor_authenticated before action is in PhoneOtpRateLimitable
+    before_action :confirm_two_factor_authenticated
     before_action :confirm_step_needed
     before_action :confirm_otp_sent
     before_action :set_code

app/controllers/idv/resend_otp_controller.rb

@@ -4,7 +4,7 @@ class ResendOtpController < ApplicationController
     include PhoneOtpRateLimitable
     include PhoneOtpSendable
 
-    # confirm_two_factor_authenticated before action is in PhoneOtpRateLimitable
+    before_action :confirm_two_factor_authenticated
     before_action :confirm_user_phone_confirmation_needed
     before_action :confirm_user_phone_confirmation_session_started
 

app/controllers/service_provider_controller.rb

@@ -3,8 +3,12 @@ class ServiceProviderController < ApplicationController
 
   def update
     authorize do
-      ServiceProviderUpdater.new.run(sp_params[:service_provider]) if
-        FeatureManagement.use_dashboard_service_providers?
+      if !FeatureManagement.use_dashboard_service_providers?
+        render json: { status: 'Service providers updater has not been enabled.' }
+        return
+      end
+
+      ServiceProviderUpdater.new.run(sp_params['service_provider'])
 
       render json: { status: 'If the feature is enabled, service providers have been updated.' }
     end
@@ -32,6 +36,15 @@ def authorization_token
   end
 
   def sp_params
-    params.permit(service_provider: {})
+    if request.headers['Content-Type'] == 'gzip/json'
+      body = request.body.read
+      if body.present?
+        JSON.parse(Zlib.gunzip(body))
+      else
+        {}
+      end
+    else
+      params.permit(service_provider: {})
+    end
   end
 end

app/controllers/users/backup_code_setup_controller.rb

@@ -22,7 +22,7 @@ def index
     def create
       generate_codes
       result = BackupCodeSetupForm.new(current_user).submit
-      analytics_properties = result.to_h
+      analytics_properties = result.to_h.merge(analytics_properties_for_visit)
       analytics.backup_code_setup_visit(**analytics_properties)
       irs_attempts_api_tracker.mfa_enroll_backup_code(success: result.success?)
 
@@ -65,7 +65,7 @@ def confirm_backup_codes; end
     private
 
     def analytics_properties_for_visit
-      ParseControllerFromReferer.new(request.referer).call
+      { in_multi_mfa_selection_flow: in_multi_mfa_selection_flow? }
     end
 
     def track_backup_codes_created
@@ -82,6 +82,7 @@ def mfa_user
     def track_backup_codes_confirmation_setup_visit
       analytics.multi_factor_auth_enter_backup_code_confirmation_visit(
         enabled_mfa_methods_count: mfa_user.enabled_mfa_methods_count,
+        in_multi_mfa_selection_flow: in_multi_mfa_selection_flow?,
       )
     end