From ef33b3c2ef0e2fa677e13d50053f93c0e16a195d Mon Sep 17 00:00:00 2001 From: Zach Margolis Date: Wed, 6 Sep 2023 11:45:46 -0700 Subject: [PATCH 01/28] Move user suspended check for sign-in (#9147) - This path is more in-line with other post-2fa steps for sign in - Bring back before_filter in accounts controller changelog: Internal, User suspension, Update suspended user check --- app/controllers/application_controller.rb | 8 ++++++-- spec/controllers/accounts_controller_spec.rb | 7 +------ .../application_controller_spec.rb | 20 +++++++++++++++++++ spec/features/users/sign_in_spec.rb | 15 ++++++++++++++ 4 files changed, 42 insertions(+), 8 deletions(-) diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index ee85bbe5536..82e90938767 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -218,6 +218,7 @@ def fix_broken_personal_key_url def after_sign_in_path_for(_user) accept_rules_of_use_url || + user_suspended_url || service_provider_mfa_setup_url || add_piv_cac_setup_url || fix_broken_personal_key_url || @@ -228,7 +229,6 @@ def after_sign_in_path_for(_user) def signed_in_url return user_two_factor_authentication_url unless user_fully_authenticated? - return user_please_call_url if current_user.suspended? return reactivate_account_url if user_needs_to_reactivate_account? return url_for_pending_profile_reason if user_has_pending_profile? return backup_code_reminder_url if user_needs_backup_code_reminder? @@ -292,7 +292,7 @@ def user_fully_authenticated? end def confirm_user_is_not_suspended - redirect_to user_please_call_url if current_user.suspended? + redirect_to user_suspended_url if user_suspended_url end def confirm_two_factor_authenticated @@ -350,6 +350,10 @@ def prompt_to_verify_sp_required_mfa redirect_to sp_required_mfa_verification_url end + def user_suspended_url + user_please_call_url if current_user.suspended? + end + def sp_required_mfa_verification_url return login_two_factor_piv_cac_url if service_provider_mfa_policy.piv_cac_required? diff --git a/spec/controllers/accounts_controller_spec.rb b/spec/controllers/accounts_controller_spec.rb index 1ad01244680..f55c61097aa 100644 --- a/spec/controllers/accounts_controller_spec.rb +++ b/spec/controllers/accounts_controller_spec.rb @@ -79,14 +79,9 @@ end context 'when a user is suspended' do - render_views it 'redirects to contact support page' do - user = create( - :user, - :fully_registered, - ) + user = create(:user, :fully_registered, :suspended) - user.suspend! sign_in user get :show diff --git a/spec/controllers/application_controller_spec.rb b/spec/controllers/application_controller_spec.rb index b0fbf257112..f8d4e8838b1 100644 --- a/spec/controllers/application_controller_spec.rb +++ b/spec/controllers/application_controller_spec.rb @@ -210,6 +210,26 @@ def index end end + describe '#user_suspended_url' do + before { sign_in(user) } + + context 'when user is suspended' do + let(:user) { create(:user, :suspended) } + + it 'is the please call url' do + expect(controller.send(:user_suspended_url)).to eq(user_please_call_url) + end + end + + context 'when user is not suspended' do + let(:user) { create(:user) } + + it 'is nil' do + expect(controller.send(:user_suspended_url)).to be_nil + end + end + end + describe '#confirm_two_factor_authenticated' do controller do before_action :confirm_two_factor_authenticated diff --git a/spec/features/users/sign_in_spec.rb b/spec/features/users/sign_in_spec.rb index a44a596e527..1f5a37a1290 100644 --- a/spec/features/users/sign_in_spec.rb +++ b/spec/features/users/sign_in_spec.rb @@ -62,6 +62,21 @@ expect(current_path).to eq account_path end + scenario 'user is suspended, gets show please call page after 2fa' do + user = create(:user, :fully_registered, :suspended) + service_provider = ServiceProvider.find_by(issuer: OidcAuthHelper::OIDC_IAL1_ISSUER) + IdentityLinker.new(user, service_provider).link_identity( + verified_attributes: %w[openid email], + ) + + visit_idp_from_sp_with_ial1(:oidc) + fill_in_credentials_and_submit(user.email, user.password) + fill_in_code_with_last_phone_otp + click_submit_default + + expect(current_path).to eq(user_please_call_path) + end + scenario 'user opts to add piv/cac card' do perform_steps_to_get_to_add_piv_cac_during_sign_up nonce = piv_cac_nonce_from_form_action From fa4183da3f73799ee10c78f4c0aaa1067f1955f1 Mon Sep 17 00:00:00 2001 From: Zach Margolis Date: Wed, 6 Sep 2023 11:46:02 -0700 Subject: [PATCH 02/28] Update IDV report to support multiple issuers (LG-10875) (#9148) - Expanding use so we can support a specific one-off request, but seemed easier to expand all reports at once - Update YARD params docs changelog: Internal, Reporting, Update funnel reports to accept multiple issuers --- .../reports/identity_verification_report.rb | 2 +- lib/reporting/authentication_report.rb | 14 ++++++------- lib/reporting/command_line_options.rb | 8 ++++---- lib/reporting/identity_verification_report.rb | 14 ++++++------- lib/reporting/monthly_proofing_report.rb | 3 ++- .../reporting/authentication_report_spec.rb | 4 ++-- .../reporting/command_line_options_spec.rb | 20 +++++++++++++++++-- .../identity_verification_report_spec.rb | 8 +++++--- 8 files changed, 46 insertions(+), 27 deletions(-) diff --git a/app/jobs/reports/identity_verification_report.rb b/app/jobs/reports/identity_verification_report.rb index 8943374b7c8..ed516fd2fe8 100644 --- a/app/jobs/reports/identity_verification_report.rb +++ b/app/jobs/reports/identity_verification_report.rb @@ -16,7 +16,7 @@ def perform(report_date) def report_maker Reporting::IdentityVerificationReport.new( - issuer: nil, + issuers: [], time_range: report_date.all_day, slice: 4.hours, ) diff --git a/lib/reporting/authentication_report.rb b/lib/reporting/authentication_report.rb index 8924c0f9c5e..f13bfc14f0c 100644 --- a/lib/reporting/authentication_report.rb +++ b/lib/reporting/authentication_report.rb @@ -14,7 +14,7 @@ module Reporting class AuthenticationReport include Reporting::CloudwatchQueryQuoting - attr_reader :issuer, :time_range + attr_reader :issuers, :time_range module Events OIDC_AUTH_REQUEST = 'OpenID Connect: authorization request' @@ -28,17 +28,17 @@ def self.all_events end end - # @param [String] isssuer + # @param [Array] issuers # @param [Range