LG-11695 enforce selfie capture performed

[soniaconnolly]

🎫 Ticket

LG-11695

🛠 Summary of changes

This is Part 1 of several PRs for this ticket, and addresses AC1: If an SP requests a selfie check and the user has not performed a selfie check, we send the user back to the start of proofing before re-directing to the SP (edge case)

• Add :unsupervised_with_selfie value to Profile idv_level enum
• Add User#identity_verified_with_selfie? which checks the active profile idv_level
• In completions_controller, add before_action that checks whether the user was verified with selfie if the SP requires it and doc_auth_selfie_capture_enabled is true.
• In OpenidConnect::AuthorizationController#index, redirect to idv_url if a selfie is required and user did not verify at that level.
• Leaving out SamlIdpController#auth for now because it's not wired up for biometric_comparison_needed.

📜 Testing Plan

Provide a checklist of steps to confirm the changes.

• In application.yml, set doc_auth_selfie_capture_enabled: true
• Starting from sample SP, sign in with biometric_comparison_required
• Complete IdV
• Expect to be redirected to idv_url (and then "Your identity has already been verified") without being redirected to SP, because idv_level is not yet being updated during proofing
• Starting from sample SP, sign in with identity_verification required
• Complete IdV
• Expect to be redirected to SP
• In application.yml, set doc_auth_selfie_capture_enabled: false
• Starting from sample SP, sign in with biometric_comparison_required
• Complete IdV
• Expect to be redirected to SP

[jmhooper]

I am not sure the completions controller is the correct place for this logic. The completions controller is not what is responsible for redirecting the user to the service provider or checking that the user has satisfied all of the requirements for being redirected. That is the OpenidConnect::AuthorizationController#index and the SamlIdpController#auth action.

[soniaconnolly]

The before_action on line 6 was already there. I just renamed it. Do you recommend removing that, or leaving it alone, or adding the before_action here and also modifying the places you mentioned?

[jmhooper]

I looked at the latest changes and I think it is probably fine to leave those checks in here. They are shortcutting the effect that an eventual redirect to the authorization controller or SAML IdP controller would have.