18F · jmdembe · Dec 21, 2023 · Dec 19, 2023 · Dec 19, 2023 · Dec 19, 2023
diff --git a/Gemfile b/Gemfile
@@ -74,7 +74,7 @@ gem 'strong_migrations', '>= 0.4.2'
 gem 'subprocess', require: false
 gem 'terminal-table', require: false
 gem 'valid_email', '>= 0.1.3'
-gem 'view_component', '~> 3.0.0'
+gem 'view_component', '~> 3.0'
 gem 'webauthn', '~> 2.5.2'
 gem 'xmldsig', '~> 0.6'
 gem 'xmlenc', '~> 0.7', '>= 0.7.1'

diff --git a/Gemfile.lock b/Gemfile.lock
@@ -212,7 +212,7 @@ GEM
     bindata (2.4.15)
     bootsnap (1.17.0)
       msgpack (~> 1.2)
-    brakeman (6.0.1)
+    brakeman (6.1.0)
     browser (5.3.1)
     builder (3.2.4)
     bullet (7.1.4)
@@ -684,7 +684,7 @@ GEM
       activemodel
       mail (>= 2.6.1)
       simpleidn
-    view_component (3.0.0)
+    view_component (3.8.0)
       activesupport (>= 5.2.0, < 8.0)
       concurrent-ruby (~> 1.0)
       method_source (~> 1.0)
@@ -842,7 +842,7 @@ DEPENDENCIES
   tableparser
   terminal-table
   valid_email (>= 0.1.3)
-  view_component (~> 3.0.0)
+  view_component (~> 3.0)
   webauthn (~> 2.5.2)
   webmock
   xmldsig (~> 0.6)

diff --git a/app/assets/stylesheets/components/_password.scss b/app/assets/stylesheets/components/_password.scss
@@ -1,39 +1,34 @@
 @use 'uswds-core' as *;
 
-$weak: #e80e0e;
-$average: #ffac00;
-$good: #9ac056;
-$great: #00b200;
-
-.pw-bar {
-  background-color: #e9e9e9;
-  border: units(0.5) solid #fff;
-  border-radius: 6px;
-  float: left;
-  height: 16px;
-  width: 25%;
+.password-strength__meter {
+  display: flex;
+  margin-top: units(1);
+  margin-bottom: units(0.5);
 }
 
-.pw-weak {
-  .pw-bar:nth-child(-n + 1) {
-    background-color: $weak;
+.password-strength__meter-bar {
+  flex-basis: 25%;
+  background-color: color('base-lighter');
+  border-radius: 2px;
+  height: units(1);
+
+  & + & {
+    margin-left: units(1);
   }
-}
 
-.pw-average {
-  .pw-bar:nth-child(-n + 2) {
-    background-color: $average;
+  .pw-weak &:nth-child(-n + 1) {
+    background-color: color('error');
   }
-}
 
-.pw-good {
-  .pw-bar:nth-child(-n + 3) {
-    background-color: $good;
+  .pw-average &:nth-child(-n + 2) {
+    background-color: color('warning');
+  }
+
+  .pw-good &:nth-child(-n + 3) {
+    background-color: color('success-light');
   }
-}
 
-.pw-great {
-  .pw-bar {
-    background-color: $great;
+  .pw-great &:nth-child(-n + 4) {
+    background-color: color('success');
   }
 }
diff --git a/app/controllers/concerns/idv/ab_test_analytics_concern.rb b/app/controllers/concerns/idv/ab_test_analytics_concern.rb
@@ -1,11 +1,13 @@
 module Idv
   module AbTestAnalyticsConcern
     include AcuantConcern
+    include OptInHelper
 
     def ab_test_analytics_buckets
       buckets = {}
       if defined?(idv_session)
         buckets[:skip_hybrid_handoff] = idv_session&.skip_hybrid_handoff
+        buckets = buckets.merge(opt_in_analytics_properties)
       end
 
       if defined?(document_capture_session_uuid)

diff --git a/app/controllers/concerns/idv/verify_info_concern.rb b/app/controllers/concerns/idv/verify_info_concern.rb
@@ -315,6 +315,10 @@ def add_proofing_costs(results)
         if stage == :resolution
           # transaction_id comes from ConversationId
           add_cost(:lexis_nexis_resolution, transaction_id: hash[:transaction_id])
+        elsif stage == :residential_address
+          next if pii[:same_address_as_id] == 'true'
+          next if hash[:vendor_name] == 'ResidentialAddressNotRequired'
+          add_cost(:lexis_nexis_resolution, transaction_id: hash[:transaction_id])
         elsif stage == :state_id
           next if hash[:exception].present?
           next if hash[:vendor_name] == 'UnsupportedJurisdiction'

diff --git a/app/controllers/concerns/idv_step_concern.rb b/app/controllers/concerns/idv_step_concern.rb
@@ -119,6 +119,10 @@ def url_for_latest_step
   end
 
   def clear_future_steps!
-    flow_policy.undo_future_steps_from_controller!(controller: self.class)
+    clear_future_steps_from!(controller: self.class)
+  end
+
+  def clear_future_steps_from!(controller:)
+    flow_policy.undo_future_steps_from_controller!(controller: controller)
   end
 end
diff --git a/app/controllers/frontend_log_controller.rb b/app/controllers/frontend_log_controller.rb
@@ -47,6 +47,11 @@ class FrontendLogController < ApplicationController
   # rubocop:enable Layout/LineLength
 
   ALLOWED_EVENTS = %i[
+    idv_sdk_selfie_image_added
+    idv_sdk_selfie_image_capture_closed_without_photo
+    idv_sdk_selfie_image_capture_failed
+    idv_sdk_selfie_image_capture_opened
+    idv_selfie_image_file_uploaded
     phone_input_country_changed
   ].freeze
 

diff --git a/app/controllers/idv/by_mail/request_letter_controller.rb b/app/controllers/idv/by_mail/request_letter_controller.rb
@@ -5,7 +5,6 @@ class RequestLetterController < ApplicationController
       include IdvStepConcern
       skip_before_action :confirm_no_pending_gpo_profile
       include Idv::StepIndicatorConcern
-      include OptInHelper
 
       before_action :confirm_mail_not_rate_limited
       before_action :confirm_step_allowed
@@ -81,7 +80,6 @@ def update_tracking
             gpo_mail_service.hours_since_first_letter(first_letter_requested_at),
           phone_step_attempts: gpo_mail_service.phone_step_attempts,
           **ab_test_analytics_buckets,
-          **opt_in_analytics_properties,
         )
         irs_attempts_api_tracker.idv_gpo_letter_requested(resend: resend_requested?)
         create_user_event(:gpo_mail_sent, current_user)

diff --git a/app/controllers/idv/enter_password_controller.rb b/app/controllers/idv/enter_password_controller.rb
@@ -77,7 +77,7 @@ def self.step_info
         key: :enter_password,
         controller: self,
         action: :new,
-        next_steps: [FlowPolicy::FINAL],
+        next_steps: [:personal_key],
         preconditions: ->(idv_session:, user:) do
           idv_session.phone_or_address_step_complete?
         end,

diff --git a/app/controllers/idv/in_person/address_controller.rb b/app/controllers/idv/in_person/address_controller.rb
@@ -3,10 +3,10 @@ module InPerson
     class AddressController < ApplicationController
       include Idv::AvailabilityConcern
       include IdvStepConcern
-      include OptInHelper
 
       before_action :render_404_if_in_person_residential_address_controller_enabled_not_set
       before_action :confirm_in_person_state_id_step_complete
+      ## before_action :confirm_step_allowed # pending FSM removal of state id step
       before_action :confirm_in_person_address_step_needed, only: :show
 
       def show
@@ -16,6 +16,8 @@ def show
       end
 
       def update
+        # don't clear the ssn when updating address, clear after SsnController
+        clear_future_steps_from!(controller: Idv::InPerson::SsnController)
         attrs = Idv::InPerson::AddressForm::ATTRIBUTES.difference([:same_address_as_id])
         pii_from_user[:same_address_as_id] = 'false' if updating_address?
         form_result = form.submit(flow_params)
@@ -43,6 +45,24 @@ def extra_view_variables
         }
       end
 
+      # update Idv::DocumentCaptureController.step_info.next_steps to include
+      # :ipp_address instead of :ipp_ssn in delete PR
+      def self.step_info
+        Idv::StepInfo.new(
+          key: :ipp_address,
+          controller: self,
+          next_steps: [:ipp_ssn],
+          preconditions: ->(idv_session:, user:) { idv_session.ipp_state_id_complete? },
+          undo_step: ->(idv_session:, user:) do
+            flow_session[:pii_from_user][:address1] = nil
+            flow_session[:pii_from_user][:address2] = nil
+            flow_session[:pii_from_user][:city] = nil
+            flow_session[:pii_from_user][:zipcode] = nil
+            flow_session[:pii_from_user][:state] = nil
+          end,
+        )
+      end
+
       private
 
       def flow_session
@@ -76,8 +96,7 @@ def analytics_arguments
           analytics_id: 'In Person Proofing',
           irs_reproofing: irs_reproofing?,
         }.merge(ab_test_analytics_buckets).
-          merge(extra_analytics_properties).
-          merge(opt_in_analytics_properties)
+          merge(extra_analytics_properties)
       end
 
       def redirect_to_next_page

diff --git a/app/controllers/idv/in_person/ssn_controller.rb b/app/controllers/idv/in_person/ssn_controller.rb
@@ -6,7 +6,6 @@ class SsnController < ApplicationController
       include StepIndicatorConcern
       include Steps::ThreatMetrixStepHelper
       include ThreatMetrixConcern
-      include OptInHelper
 
       before_action :confirm_not_rate_limited_after_doc_auth
       before_action :confirm_in_person_address_step_complete
@@ -97,8 +96,7 @@ def analytics_arguments
           analytics_id: 'In Person Proofing',
           irs_reproofing: irs_reproofing?,
         }.merge(ab_test_analytics_buckets).
-          merge(**extra_analytics_properties).
-          merge(**opt_in_analytics_properties)
+          merge(**extra_analytics_properties)
       end
 
       def confirm_in_person_address_step_complete

diff --git a/app/controllers/idv/in_person/verify_info_controller.rb b/app/controllers/idv/in_person/verify_info_controller.rb
@@ -6,7 +6,6 @@ class VerifyInfoController < ApplicationController
       include StepIndicatorConcern
       include Steps::ThreatMetrixStepHelper
       include VerifyInfoConcern
-      include OptInHelper
 
       before_action :confirm_not_rate_limited_after_doc_auth, except: [:show]
       before_action :confirm_ssn_step_complete
@@ -88,8 +87,7 @@ def analytics_arguments
           analytics_id: 'In Person Proofing',
           irs_reproofing: irs_reproofing?,
         }.merge(ab_test_analytics_buckets).
-          merge(**extra_analytics_properties).
-          merge(**opt_in_analytics_properties)
+          merge(**extra_analytics_properties)
       end
 
       def confirm_ssn_step_complete

diff --git a/app/controllers/idv/otp_verification_controller.rb b/app/controllers/idv/otp_verification_controller.rb
@@ -4,7 +4,6 @@ class OtpVerificationController < ApplicationController
     include IdvStepConcern
     include StepIndicatorConcern
     include PhoneOtpRateLimitable
-    include OptInHelper
 
     before_action :confirm_two_factor_authenticated
     before_action :confirm_step_allowed
@@ -20,7 +19,7 @@ def show
     def update
       clear_future_steps!
       result = phone_confirmation_otp_verification_form.submit(code: params[:code])
-      analytics.idv_phone_confirmation_otp_submitted(**result.to_h, **opt_in_analytics_properties)
+      analytics.idv_phone_confirmation_otp_submitted(**result.to_h, **ab_test_analytics_buckets)
 
       irs_attempts_api_tracker.idv_phone_otp_submitted(
         success: result.success?,

diff --git a/app/controllers/idv/personal_key_controller.rb b/app/controllers/idv/personal_key_controller.rb
@@ -1,17 +1,21 @@
 module Idv
   class PersonalKeyController < ApplicationController
     include Idv::AvailabilityConcern
-    include IdvSession
+    include IdvStepConcern
     include StepIndicatorConcern
     include SecureHeadersConcern
-    include FraudReviewConcern
     include OptInHelper
 
     before_action :apply_secure_headers_override
-    before_action :confirm_two_factor_authenticated
-    before_action :confirm_phone_or_address_confirmed
-    before_action :confirm_profile_has_been_created
-    before_action :confirm_personal_key_not_acknowledged
+    before_action :confirm_step_allowed
+
+    # Personal key is kind of a special case, since you're always meant to
+    # look at it after your profile has been minted. We opt out of a few
+    # standard before_actions and handle them in our own special way below.
+    skip_before_action :confirm_idv_needed
+    skip_before_action :confirm_personal_key_acknowledged_if_needed
+    skip_before_action :confirm_no_pending_in_person_enrollment
+    skip_before_action :handle_fraud
 
     def show
       analytics.idv_personal_key_visited(
@@ -38,6 +42,22 @@ def update
       redirect_to next_step
     end
 
+    def self.step_info
+      Idv::StepInfo.new(
+        key: :personal_key,
+        controller: self,
+        next_steps: [FlowPolicy::FINAL],
+        preconditions: ->(idv_session:, user:) do
+          idv_session.phone_or_address_step_complete? &&
+            user.active_or_pending_profile &&
+            !idv_session.personal_key_acknowledged
+        end,
+        undo_step: ->(idv_session:, user:) {
+          idv_session.invalidate_personal_key!
+        },
+      )
+    end
+
     private
 
     def next_step
@@ -52,20 +72,6 @@ def next_step
       end
     end
 
-    def confirm_phone_or_address_confirmed
-      return if idv_session.address_confirmed? || idv_session.phone_confirmed?
-
-      redirect_to idv_enter_password_url
-    end
-
-    def confirm_personal_key_not_acknowledged
-      redirect_to next_step if idv_session.personal_key_acknowledged
-    end
-
-    def confirm_profile_has_been_created
-      redirect_to account_url if profile.blank?
-    end
-
     def add_proofing_component
       ProofingComponent.find_or_create_by(user: current_user).update(verified_at: Time.zone.now)
     end

diff --git a/app/controllers/idv/phone_controller.rb b/app/controllers/idv/phone_controller.rb
@@ -5,7 +5,6 @@ class PhoneController < ApplicationController
     include StepIndicatorConcern
     include PhoneOtpRateLimitable
     include PhoneOtpSendable
-    include OptInHelper
 
     attr_reader :idv_form
 
@@ -33,7 +32,6 @@ def new
 
         analytics.idv_phone_of_record_visited(
           **ab_test_analytics_buckets,
-          **opt_in_analytics_properties,
         )
         render :new, locals: { gpo_letter_available: gpo_letter_available }
       elsif async_state.missing?

diff --git a/app/decorators/service_provider_session.rb b/app/decorators/service_provider_session.rb
@@ -70,6 +70,11 @@ def sp_issuer
     sp.issuer
   end
 
+  def selfie_required?
+    !!(IdentityConfig.store.doc_auth_selfie_capture_enabled &&
+      sp_session[:biometric_comparison_required])
+  end
+
   def cancel_link_url
     view_context.new_user_session_url(request_id: sp_session[:request_id])
   end