POC: Authorize with ID.me, remove devise gems

dpc-portal-test.sh

@@ -18,7 +18,7 @@ make portal
 
 # Prepare the environment 
 docker compose -p start-v1-portals -f docker-compose.yml -f docker-compose.portals.yml up db --wait
-docker compose -p start-v1-portals -f docker-compose.yml -f docker-compose.portals.yml run --entrypoint "bundle exec rails db:create db:migrate RAILS_ENV=test" dpc_portal
+docker compose -p start-v1-portals -f docker-compose.yml -f docker-compose.portals.yml run --entrypoint "bundle exec rails db:create db:migrate db:seed RAILS_ENV=test" dpc_portal
 docker compose -p start-v1-portals -f docker-compose.yml -f docker-compose.portals.yml run --entrypoint "bundle exec rails assets:clobber" dpc_portal
 
 # Run the tests

dpc-portal/Gemfile

@@ -35,7 +35,7 @@ gem 'lograge'
 gem 'lookbook', '>= 2.3.3' # install lookbook so it can be deployed in lower environments.
 gem 'luhnacy', '~> 0.2.1'
 gem 'macaroons'
-gem 'net-imap', '>= 0.5.14'
+gem 'net-imap', '>= 0.6.4.1'
 gem 'newrelic_rpm', '~> 8.10'
 gem 'nokogiri', '>= 1.19.3'
 gem 'omniauth_openid_connect', '~> 0.8.0'

dpc-portal/Gemfile.lock

@@ -360,7 +360,7 @@ GEM
     omniauth_openid_connect (0.8.0)
       omniauth (>= 1.9, < 3)
       openid_connect (~> 2.2)
-    openid_connect (2.3.0)
+    openid_connect (2.3.1)
       activemodel
       attr_required (>= 1.0.0)
       email_validator
@@ -400,7 +400,7 @@ GEM
     raabro (1.4.0)
     racc (1.8.1)
     rack (3.2.6)
-    rack-oauth2 (2.2.1)
+    rack-oauth2 (2.3.0)
       activesupport
       attr_required
       faraday (~> 2.0)
@@ -649,7 +649,7 @@ DEPENDENCIES
   lookbook (>= 2.3.3)
   luhnacy (~> 0.2.1)
   macaroons
-  net-imap (>= 0.5.14)
+  net-imap (>= 0.6.4.1)
   newrelic_rpm (~> 8.10)
   nokogiri (>= 1.19.3)
   omniauth-rails_csrf_protection

dpc-portal/README.md

@@ -25,7 +25,7 @@ The following commands can be useful for manual interaction:
 
     ```sh
     $ make portal-sh
-    > rails db:create db:migrate RAILS_ENV=test # Create the test database
+    > rails db:create db:migrate db:seed RAILS_ENV=test # Create the test database
     > bundle exec rspec path/to/test # Run individual test files
     ```
 

dpc-portal/app/components/page/utility/error_component.html.erb

@@ -18,20 +18,20 @@
       <% when :cd_accepted %>
         <%= link_to 'Go to DPC home', root_url, class: 'usa-button margin-right-0' %>
       <% when :pii_mismatch %>
-        <%= render Core::Button::ButtonComponent.new(label: "Sign out of Login.gov",
-            destination: login_dot_gov_logout_path(invitation_id: @invitation.id),
+        <%= render Core::Button::ButtonComponent.new(label: "Sign out of #{@csp_display_name}",
+            destination: csp_logout_path(invitation_id: @invitation.id),
             method: :delete) %>
       <% when :email_mismatch %>
-        <%= render Core::Button::ButtonComponent.new(label: "Sign out of Login.gov",
-            destination: login_dot_gov_logout_path(invitation_id: @invitation.id),
+        <%= render Core::Button::ButtonComponent.new(label: "Sign out of #{@csp_display_name}",
+            destination: csp_logout_path(invitation_id: @invitation.id),
             method: :delete) %>
       <% when :no_account %>
-        <%= render Core::Button::ButtonComponent.new(label: "Sign out of Login.gov",
-            destination: login_dot_gov_logout_path,
+        <%= render Core::Button::ButtonComponent.new(label: "Sign out of #{@csp_display_name}",
+            destination: csp_logout_path,
             method: :delete) %>
-      <% when :login_gov_signin_cancel %>
+      <% when /signin_cancel/ %>
         <%= link_to 'Back to portal home', sign_in_path, class: 'usa-button usa-button--outline', data: { turbo: false }%>
-      <% when :login_gov_signin_fail %>
+      <% when /signin_fail/ %>
         <%= link_to 'Back to portal home', sign_in_path, class: 'usa-button usa-button--outline', data: { turbo: false }%>
     <% end %>
 </div>

dpc-portal/app/components/page/utility/error_component.rb

@@ -4,20 +4,28 @@ module Page
   module Utility
     # Displays unfixable error message in accept invitation process
     class ErrorComponent < ViewComponent::Base
-      def initialize(invitation, reason)
+      DISPLAY_NAMES = {
+        login_dot_gov: 'Login.gov',
+        id_me: 'ID.me'
+      }.freeze
+
+      def initialize(invitation, reason, csp: :login_dot_gov)
         super()
         @invitation = invitation
         @org_name = invitation&.provider_organization&.name
         @ao_full_name = invitation&.invited_by_full_name
         @ao_email = invitation&.invited_by&.email
-        @reason = if AoVerificationService::SERVER_ERRORS.include?(reason)
-                    :server_error
-                  else
-                    reason.to_sym
-                  end
+        @csp_display_name = DISPLAY_NAMES.fetch(csp, 'CSP')
+        @reason = resolve_reason(reason)
         @status = "verification.#{@reason}_status"
         @text = "verification.#{@reason}_text"
       end
+
+      private
+
+      def resolve_reason(reason)
+        AoVerificationService::SERVER_ERRORS.include?(reason) ? :server_error : reason.to_sym
+      end
     end
   end
 end

dpc-portal/app/components/page/utility/error_component_preview.rb

@@ -77,13 +77,15 @@ def no_account
         render(Page::Utility::ErrorComponent.new(nil, reason))
       end
 
-      def login_gov_signin_cancel
-        reason = 'login_gov_signin_cancel'
+      # @param csp select { choices: [:login_dot_gov, :id_me] }
+      def csp_signin_cancel(csp)
+        reason = "#{csp}_signin_cancel"
         render(Page::Utility::ErrorComponent.new(nil, reason))
       end
 
-      def login_gov_signin_fail
-        reason = 'login_gov_signin_fail'
+      # @param csp select { choices: [:login_dot_gov, :id_me] }
+      def csp_signin_fail(csp)
+        reason = "#{csp}_signin_fail"
         render(Page::Utility::ErrorComponent.new(nil, reason))
       end
     end

dpc-portal/app/controllers/application_controller.rb

@@ -1,7 +1,10 @@
 # frozen_string_literal: true
 
 # Parent class of all controllers
-class ApplicationController < ActionController::Base # rubocop:disable Metrics/ClassLength
+class ApplicationController < ActionController::Base
+  include CspLogout
+  include OrganizationAccess
+
   before_action :check_session_length
   before_action :set_current_request_attributes
   before_action :no_store
@@ -13,7 +16,7 @@ def active_url
   end
 
   def current_user
-    @current_user ||= User.where(id: session['user']).first
+    @current_user ||= User.find_by(id: session[:user])
   end
 
   def authenticate_user!
@@ -24,8 +27,8 @@ def authenticate_user!
     redirect_to sign_in_path
   end
 
-  def sign_in(user, csp: 'login_dot_gov')
-    session['user'] = user.id
+  def sign_in(user:, csp:)
+    session[:user] = user.id
     session[:csp] = csp.to_s
   end
 
@@ -37,54 +40,9 @@ def check_user_verification
     render(Page::Utility::AccessDeniedComponent.new(failure_code: "verification.#{current_user.verification_reason}"))
   end
 
-  def tos_accepted
-    return if @organization.terms_of_service_accepted_by.present?
-
-    if current_user.ao?(@organization)
-      render(Page::Organization::TosFormComponent.new(@organization))
-    else
-      flash[:notice] = 'Organization is not ready for credential management'
-      redirect_to organizations_path
-    end
-  end
-
-  def url_for_logout(csp)
-    case csp.to_s
-    when :id_me.to_s
-      url_for_id_me_logout
-    when :login_dot_gov.to_s
-      url_for_login_dot_gov_logout
-    else
-      raise UnknownCSPError, csp
-    end
-  end
-
-  # Documentation at https://developers.login.gov/oidc/logout/
-  def url_for_login_dot_gov_logout
-    state = SecureRandom.hex(16)
-    session['omniauth.state'] = state
-    csp_config = CspConfig.for(:login_dot_gov)
-    URI::HTTPS.build(host: csp_config.host,
-                     path: csp_config.log_out_path,
-                     query: { client_id: csp_config.identifier,
-                              post_logout_redirect_uri: "#{root_url}auth/logged_out",
-                              state: }.to_query)
-  end
-
-  def url_for_id_me_logout
-    state = SecureRandom.hex(16)
-    session['omniauth.state'] = state
-    URI::HTTPS.build(host: CspConfig.for(:id_me).host,
-                     path: CspConfig.for(:id_me).log_out_path,
-                     query: { client_id: CspConfig.for(:id_me).identifier,
-                              redirect_uri: "#{root_url}auth/logged_out" }.to_query)
-  end
-
-  # rubocop:disable Metrics/AbcSize
   def check_session_length
-    session[:logged_in_at] = Time.now if session[:logged_in_at].nil?
-    max_session = User.remember_for.to_i / 60
-    return unless max_session.minutes.ago > session[:logged_in_at]
+    session[:logged_in_at] ||= Time.now
+    return unless session_timed_out?
 
     reset_session
     flash[:notice] = t('devise.failure.max_session_timeout', default: 'Your session has timed out.')
@@ -93,47 +51,9 @@ def check_session_length
                          actionType: LoggingConstants::ActionType::SessionTimedOut }])
     redirect_to sign_in_path
   end
-  # rubocop:enable Metrics/AbcSize
-
-  def organization_id
-    params[:organization_id]
-  end
-
-  def load_organization
-    @organization = ProviderOrganization.find(organization_id)
-    CurrentAttributes.save_organization_attributes(@organization, current_user)
-  rescue ActiveRecord::RecordNotFound
-    render file: "#{Rails.root}/public/404.html", layout: false, status: :not_found
-  end
 
-  def require_can_access
-    redirect_to organizations_path unless current_user.can_access?(@organization)
-
-    verify_status
-  end
-
-  def require_ao
-    redirect_to organizations_path unless current_user.ao?(@organization)
-
-    verify_status
-  end
-
-  def verify_status
-    if @organization.rejected?
-      failure_code = "#{code_prefix}.#{@organization.verification_reason}"
-      return render(Page::Utility::AccessDeniedComponent.new(organization: @organization, failure_code:))
-    end
-
-    links = current_user.ao_org_links.where(provider_organization: @organization)
-    return if links.empty? || links.any?(&:verification_status?)
-
-    failure_code = "verification.#{links.first.verification_reason}"
-    render(Page::Utility::AccessDeniedComponent.new(organization: @organization, failure_code:))
-  end
-
-  def code_prefix
-    has_ao_link = current_user.ao_org_links.where(provider_organization: @organization).exists?
-    has_ao_link ? 'verification' : 'cd_access'
+  def session_timed_out?
+    User.remember_for.ago > session[:logged_in_at]
   end
 
   def set_current_request_attributes
@@ -154,15 +74,6 @@ def log_credential_action(credential_type, dpc_api_credential_id, action)
 
   # Helper method for logging csp with actionContext and actionType whenever it's available on the session
   def csp_log_context
-    return {} if session[:csp].blank?
-
-    { csp: session[:csp] }
-  end
-end
-
-# Error class to handle unknow CSP
-class UnknownCSPError < StandardError # rubocop:disable Style/OneClassPerFile
-  def initialize(provider)
-    super("Unknown CSP: #{provider}")
+    session[:csp].present? ? { csp: session[:csp] } : {}
   end
 end

dpc-portal/app/controllers/concerns/csp_email_sync.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+# Handles CSP emails
+module CspEmailSync
+  def sync_csp_emails(csp_user, new_emails, primary_email)
+    return unless csp_user
+
+    existing_emails = csp_user.user_emails
+
+    # Scan through all of the emails from the CSP and add or update as necessary.
+    ActiveRecord::Base.transaction do
+      add_or_activate_new_email(csp_user, new_emails, existing_emails)
+      deactivate_old_email(new_emails, existing_emails)
+      update_primary_email(csp_user, primary_email)
+    end
+  end
+
+  private
+
+  def add_or_activate_new_email(csp_user, new_emails, existing_emails)
+    new_emails&.each do |new_email|
+      existing_email = existing_emails.find { |e| e.email == new_email }
+      existing_email ? activate_email(existing_email) : UserEmail.create!(csp_user:, email: new_email, active: true)
+    end
+  end
+
+  def deactivate_old_email(new_emails, existing_emails)
+    # If an existing email is no longer in the list provided by the CSP, deactivate it.
+    existing_emails&.each do |existing_email|
+      next if new_emails&.include?(existing_email.email)
+
+      existing_email.update!(active: false, deactivated_at: Time.current, reactivated_at: nil)
+    end
+  end
+
+  def activate_email(user_email)
+    return if user_email.active?
+
+    user_email.update!(active: true, deactivated_at: nil, reactivated_at: Time.current)
+  end
+
+  def update_primary_email(csp_user, primary_email)
+    current_email = csp_user.user_emails.find_by(email: primary_email)
+    current_email&.update!(primary: true) unless current_email&.primary?
+  end
+end

dpc-portal/app/controllers/concerns/csp_error_handling.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+# Handles errors in CSP flow
+module CspErrorHandling
+  extend ActiveSupport::Concern
+
+  def handle_invitation_flow_failure(invitation_id)
+    Rails.logger.info(['Failed invitation flow',
+                       { actionContext: LoggingConstants::ActionContext::Registration,
+                         actionType: LoggingConstants::ActionType::FailedLogin,
+                         **csp_log_context }])
+    invitation = Invitation.find(invitation_id)
+    if invitation.credential_delegate?
+      render(Page::Utility::ErrorComponent.new(invitation, 'fail_to_proof'), status: :forbidden)
+    else
+      render(Page::Invitations::AoFlowFailComponent.new(invitation, 'fail_to_proof', 1), status: :forbidden)
+    end
+  end
+
+  def handle_signin_fail(csp)
+    Rails.logger.error 'CSP Configuration error'
+    render(Page::Utility::ErrorComponent.new(nil, "#{csp || 'csp'}_signin_fail"))
+  end
+
+  def handle_signin_cancel(csp)
+    Rails.logger.info(['User cancelled login',
+                       { actionContext: LoggingConstants::ActionContext::Authentication,
+                         actionType: LoggingConstants::ActionType::UserCancelledLogin,
+                         **csp_log_context }])
+    render(Page::Utility::ErrorComponent.new(nil, "#{csp || 'csp'}_signin_cancel"))
+  end
+end