Fyst 2144 verification code (#68)

* add i18n and styling for landing page

* rubocop

* pr comments

* remove unused flash messages styles

* git ignore

* restore DS store

* rubocop

* client menu component

* wip dropdown menu'

* rubocop

* use unless prod for environemntal warning

* wip

* wip

* wip

* add specs

* rubocop

* clean up some unneeded changes

* wip

* Re-render show to show the error message but with error_status

* Pin necessary modules and include "application" since thats the entrypoint - without this importmap will load without executing application.js

* Fix rubocop

* Use the already available activestorage

* fix changed variable in honeycrisp

* try precomplie in app.json

* try fixing some css

* remove asset precompile

* add email address page

* rubocop

* i18n

* wip

* bring up to main

* fix year select controller spec

* little more clean up

* add the whole form into one div

* put the inside of the form in one div

* git rid of form actions div

* turbo false in the form

* generic support for blank error message

* update test

* implement knockout page

* wip

* update path in is intake locked

* wip

* wip

* wip

* pr updates

* pr changes

* wip

* rubocop

* return contact preference to schema

* add is locked tests

* wip

* add sms functionality

* merge main

* contact preference controller redirects

* touch up

* new migration

* update contact preference case

* contact preference form no longer saves anything

* restore some development artificats

* wip

* contact preference is not a form

* remove unneeded files

* remove devise migration

* annotate

* make enum

* rubocop

* wip

* wip

* wip

* fix tests

* rubocop

* fix some html

* wip

* add turbo false to phone number

* restore accidental html changes

* default turbo to false

* turbo false for v code

* clean up

* merge main

* pr changes

* remove devise test

* restore gemfile.lock

* pr_updates

---------

Co-authored-by: Drew Proebstel <dproebstel@codeforamerica.org>
Co-authored-by: Arin Choi <achoi@codeforamerica.org>

Author: 3 people

Gemfile

@@ -9,6 +9,7 @@ gem "rails-i18n"
 gem "valid_email2", "~> 4.0.6"
 gem "phony"
 gem "auto_strip_attributes"
+gem "devise"
 
 # Use the Puma web server [https://github.com/puma/puma]
 gem "puma", ">= 5.0"

Gemfile.lock

@@ -113,6 +113,7 @@ GEM
     aws-sigv4 (1.12.1)
       aws-eventstream (~> 1, >= 1.0.2)
     base64 (0.3.0)
+    bcrypt (3.1.20)
     benchmark (0.4.1)
     bigdecimal (3.2.2)
     bindex (0.8.1)
@@ -144,6 +145,12 @@ GEM
     debug (1.11.0)
       irb (~> 1.10)
       reline (>= 0.3.8)
+    devise (4.9.4)
+      bcrypt (~> 3.0)
+      orm_adapter (~> 0.1)
+      railties (>= 4.1.0)
+      responders
+      warden (~> 1.2.3)
     diff-lcs (1.6.2)
     dotenv (3.1.8)
     drb (2.2.3)
@@ -255,6 +262,7 @@ GEM
       racc (~> 1.4)
     nokogiri (1.18.8-x86_64-linux-musl)
       racc (~> 1.4)
+    orm_adapter (0.5.0)
     parallel (1.27.0)
     parser (3.3.8.0)
       ast (~> 2.4.1)
@@ -338,6 +346,9 @@ GEM
     regexp_parser (2.10.0)
     reline (0.6.1)
       io-console (~> 0.5)
+    responders (3.1.1)
+      actionpack (>= 5.2)
+      railties (>= 5.2)
     rexml (3.4.1)
     rspec-core (3.13.5)
       rspec-support (~> 3.13.0)
@@ -453,6 +464,8 @@ GEM
     valid_email2 (4.0.6)
       activemodel (>= 3.2)
       mail (~> 2.5)
+    warden (1.2.9)
+      rack (>= 2.0.9)
     web-console (4.2.1)
       actionview (>= 6.0.0)
       activemodel (>= 6.0.0)
@@ -491,6 +504,7 @@ DEPENDENCIES
   cfa-styleguide (= 0.16.0)!
   dartsass-rails (~> 0.5.1)
   debug
+  devise
   dotenv
   factory_bot_rails
   http_accept_language

app/controllers/base_controller.rb

@@ -17,4 +17,9 @@ def current_archived_intake
       existing || StateFileArchivedIntake.create(email_address: email, contact_preference: "email")
     end
   end
+  def is_intake_locked
+    if current_archived_intake.nil? || current_archived_intake.access_locked? || current_archived_intake.permanently_locked_at.present?
+      redirect_to knock_out_path
+    end
+  end
 end

app/controllers/email_address_controller.rb

@@ -13,10 +13,9 @@ def update
         session[:email_address] = @form.email_address
         session[:phone_number] = nil
         current_archived_intake
-        # TODO Add some kind of logging here
-        # https://codeforamerica.atlassian.net/browse/FYST-2088
+        # TODO Add some kind of logging here https://codeforamerica.atlassian.net/browse/FYST-2088
 
-        redirect_to root_path
+        redirect_to edit_verification_code_path
       else
         render :edit
       end

app/controllers/pages_controller.rb

@@ -1,4 +1,8 @@
-class PagesController < ApplicationController
+class PagesController < BaseController
   def home
   end
+
+  def knock_out
+    @intake = current_archived_intake
+  end
 end

app/controllers/phone_number_controller.rb

@@ -15,7 +15,7 @@ def update
       current_archived_intake
       # TODO Add some kind of logging here. https://codeforamerica.atlassian.net/browse/FYST-2088
 
-      redirect_to root_path
+      redirect_to edit_verification_code_path
     else
       render :edit
     end

app/controllers/verification_code_controller.rb

@@ -0,0 +1,65 @@
+class VerificationCodeController < BaseController
+  before_action :is_intake_locked
+  before_action :setup_contact
+
+  def setup_contact
+    @contact_type = current_archived_intake.contact_preference
+    @contact_info = current_archived_intake.contact
+  end
+
+  def edit
+    @form = VerificationCodeForm.new(contact_info: @contact_info)
+    case current_archived_intake.contact_preference
+    when "text"
+      # @phone_number = current_archived_intake.phone_number
+      # ArchivedIntakeTextVerificationCodeJob.perform_later(
+      #   phone_number: @phone_number,
+      #   locale: I18n.locale
+      # )
+    when "email"
+      # @email_address = current_archived_intake.email_address
+      # ArchivedIntakeEmailVerificationCodeJob.perform_later(
+      #   email_address: @email_address,
+      #   locale: I18n.locale
+      # )
+    else
+      redirect_to root_path
+    end
+  end
+
+  def update
+    @form = VerificationCodeForm.new(verification_code_form_params, contact_info: current_archived_intake.contact)
+
+    if @form.valid?
+      case current_archived_intake.contact_preference
+      when "text"
+        # TODO: Some kind of logging here
+      when "email"
+        # TODO: Some kind of logging here
+      end
+      current_archived_intake.reset_failed_attempts!
+      session[:code_verified] = true
+      redirect_to root_path
+    else
+      case current_archived_intake.contact_preference
+      when "text"
+        # TODO: Some kind of logging here
+      when "email"
+        # TODO: Some kind of logging here
+      end
+      current_archived_intake.increment_failed_attempts
+      if current_archived_intake.access_locked?
+        # TODO: Some kind of logging here
+        redirect_to knock_out_path
+        return
+      end
+      render :edit
+    end
+  end
+
+  private
+
+  def verification_code_form_params
+    params.require(:verification_code_form).permit(:verification_code)
+  end
+end

app/forms/verification_code_form.rb

@@ -0,0 +1,23 @@
+class VerificationCodeForm < Form
+  attr_accessor :verification_code, :contact_info
+
+  validates :verification_code, presence: true
+  def initialize(attributes = {}, contact_info: nil)
+    super(attributes)
+    @contact_info = contact_info
+  end
+
+  def valid?
+    return true if Rails.configuration.allow_magic_verification_code && verification_code == "000000"
+
+    # hashed_verification_code = VerificationCodeService.hash_verification_code_with_contact_info(@email_address, verification_code)
+    #
+    # valid_code = EmailAccessToken.lookup(hashed_verification_code).exists?
+
+    valid_code = nil
+
+    errors.add(:verification_code, I18n.t("errors.attributes.verification_code.invalid")) unless valid_code
+
+    valid_code.present?
+  end
+end

app/models/state_file_archived_intake.rb

@@ -5,14 +5,17 @@
 #  id                      :bigint           not null, primary key
 #  contact_preference      :integer          default("unfilled"), not null
 #  email_address           :string
+#  failed_attempts         :integer          default(0), not null
 #  fake_address_1          :string
 #  fake_address_2          :string
 #  hashed_ssn              :string
+#  locked_at               :datetime
 #  mailing_apartment       :string
 #  mailing_city            :string
 #  mailing_state           :string
 #  mailing_street          :string
 #  mailing_zip             :string
+#  permanently_locked_at   :datetime
 #  phone_number            :string
 #  state_code              :string
 #  tax_year                :integer
@@ -23,11 +26,25 @@
 class StateFileArchivedIntake < ApplicationRecord
   has_one_attached :submission_pdf
   has_many :state_file_archived_intake_access_logs, class_name: "StateFileArchivedIntakeAccessLog"
+  devise :lockable, unlock_in: 60.minutes, unlock_strategy: :time
 
   enum :contact_preference, { unfilled: 0, email: 1, text: 2 }, prefix: :contact_preference
 
   def full_address
     address_parts = [ mailing_street, mailing_apartment, mailing_city, mailing_state, mailing_zip ]
     address_parts.compact_blank.join(", ")
   end
+
+  def self.maximum_attempts
+    2
+  end
+
+  def increment_failed_attempts
+    super
+    lock_access! if attempts_exceeded? && !access_locked?
+  end
+
+  def contact
+    contact_preference == "text" ? phone_number : email_address
+  end
 end

app/views/pages/knock_out.html.erb

@@ -0,0 +1,31 @@
+<% title = t("views.pages.knock_out.title") %>
+<% content_for :page_title, title %>
+
+<section class="slab question-layout <%= controller_name.gsub("_", "-") %>-outer">
+  <div class="grid">
+    <h1 class="h2"><%= title %></h1>
+    <p><%= t("views.pages.knock_out.locked_due_to") %></p>
+    <% if @intake.present? && @intake&.permanently_locked_at.nil? %>
+      <p><%= t("views.pages.knock_out.one_hour")%></p>
+    <% end %>
+    <p><%= t("views.pages.knock_out.also_visit_html", year: session[:year_selected] || "")%></p>
+    <% if @intake.present? %>
+      <div class="bulleted">
+        <ul>
+          <li><a href="https://azdor.gov/forms/other-forms/request-copies-tax-documents"><%= t("views.pages.knock_out.az_dor") %></a></li>
+          <% if session[:year_selected] == "2023" %>
+            <li><a href="https://www.tax.ny.gov/help/contact/get-copy-of-return.htm"><%= t("views.pages.knock_out.ny_dor") %></a></li>
+          <% end %>
+          <% if session[:year_selected] == "2024" %>
+            <li><a href="https://www.marylandcomptroller.gov/content/dam/mdcomp/tax/forms/2023/129.pdf"><%= t("views.pages.knock_out.md_form") %></a></li>
+            <li><a href="https://www.ncdor.gov/taxes-forms/individual-income-tax/customer-education-individuals/how-get-copy-your-north-carolina-return"><%= t("views.pages.knock_out.nc_dor") %></a></li>
+            <li><a href="https://www.nj.gov/treasury/taxation/pdf/other_forms/misc/dcc.pdf"><%= t("views.pages.knock_out.nj_dot") %></a></li>
+          <% end %>
+        </ul>
+      </div>
+    <% end %>
+    <%= link_to root_path, class: "button button--primary button--wide text--centered spacing-above-25", role: "button" do %>
+      <%=t("views.pages.knock_out.return_to_home") %>
+    <% end %>
+  </div>
+</section>