Dp/use warden to manage sessions (#162)

* add logging to debug staging

* test it out

* make linter and tests happy

* add logging

* add logging

* add logging

* remove timeout

* comment out tests

* remove current state file archived intake

* fixes tests

* rename find_or_create_state_file_archived_intake

* fix seeds and find and create method

---------

Co-authored-by: Drew Proebstel <dproebstel@codeforamerica.org>

Author: DrewProebstel

app/controllers/base_controller.rb

@@ -1,28 +1,35 @@
 class BaseController < ApplicationController
-  def current_archived_intake
-    return current_state_file_archived_intake if state_file_archived_intake_signed_in?
-    # If a user does not have an associated email or phone, we still create an ArchivedIntake
-    # so they can go through the flow. This prevents it from being obvious whether
-    # an email or phone is linked to an existing intake.
-    #
-    # These intakes are created without an IP address, meaning the user will not
-    # be able to pass the identification number controller.
-    return nil if session[:year_selected].nil?
+  def create_and_login_state_file_archived_intake(phone_number: nil, email_address: nil)
+    if session[:year_selected].blank?
+      return redirect_to(root_path)
+    end
+
     tax_year = session[:year_selected].to_i
 
-    if session[:phone_number].present?
-      phone = session[:phone_number]
-      existing = StateFileArchivedIntake.find_by(phone_number: phone, tax_year: tax_year)
-      existing || StateFileArchivedIntake.create(phone_number: phone, contact_preference: "text", tax_year: tax_year)
-    elsif session[:email_address].present?
-      email = session[:email_address].downcase
-      existing = StateFileArchivedIntake.find_by("LOWER(email_address) = ? AND tax_year = ?", email, tax_year)
-      existing || StateFileArchivedIntake.create(email_address: email, contact_preference: "email", tax_year: tax_year)
+    if phone_number.present?
+      existing = StateFileArchivedIntake.find_by(phone_number: phone_number, tax_year: tax_year)
+      intake = existing || StateFileArchivedIntake.create!(
+        phone_number: phone_number,
+        contact_preference: "text",
+        tax_year: tax_year
+      )
+    elsif email_address.present?
+      email_downcase = email_address.downcase
+      existing = StateFileArchivedIntake.find_by(email_address: email_downcase, tax_year: tax_year)
+      intake = existing || StateFileArchivedIntake.create!(
+        email_address: email_downcase,
+        contact_preference: "email",
+        tax_year: tax_year
+      )
+    else
+      return redirect_to(root_path)
     end
+
+    sign_in intake
   end
 
   def is_intake_unavailable
-    if current_archived_intake.nil? || current_archived_intake.access_locked? || current_archived_intake.permanently_locked_at.present?
+    if current_state_file_archived_intake.nil? || current_state_file_archived_intake.access_locked? || current_state_file_archived_intake.permanently_locked_at.present?
       redirect_to knock_out_path
     end
   end

app/controllers/email_address_controller.rb

@@ -10,11 +10,9 @@ def update
       session[:ssn_verified] = false
       session[:mailing_verified] = false
       session[:code_verified] = false
-      session[:email_address] = @form.email_address
-      session[:phone_number] = nil
 
-      intake = current_archived_intake
-      sign_in intake
+      create_and_login_state_file_archived_intake(email_address: @form.email_address)
+      return if performed?
 
       redirect_to edit_verification_code_path
     else

app/controllers/identification_number_controller.rb

@@ -4,24 +4,24 @@ class IdentificationNumberController < BaseController
   before_action :is_intake_unavailable
 
   def edit
-    @form = IdentificationNumberForm.new(archived_intake: current_archived_intake)
+    @form = IdentificationNumberForm.new(archived_intake: current_state_file_archived_intake)
     render :edit
   end
 
   def update
-    @form = IdentificationNumberForm.new(current_archived_intake, identification_number_form_params)
+    @form = IdentificationNumberForm.new(current_state_file_archived_intake, identification_number_form_params)
 
     if @form.valid?
-      EventLogger.log("correct ssn challenge", current_archived_intake.id)
-      current_archived_intake.reset_failed_attempts!
+      EventLogger.log("correct ssn challenge", current_state_file_archived_intake.id)
+      current_state_file_archived_intake.reset_failed_attempts!
       session[:ssn_verified] = true
-      EventLogger.log("issued mailing address challenge", current_archived_intake.id)
+      EventLogger.log("issued mailing address challenge", current_state_file_archived_intake.id)
       redirect_to edit_mailing_address_validation_path
     else
-      EventLogger.log("incorrect ssn challenge", current_archived_intake.id)
-      current_archived_intake.increment_failed_attempts
-      if current_archived_intake.access_locked?
-        EventLogger.log("client lockout begin", current_archived_intake.id)
+      EventLogger.log("incorrect ssn challenge", current_state_file_archived_intake.id)
+      current_state_file_archived_intake.increment_failed_attempts
+      if current_state_file_archived_intake.access_locked?
+        EventLogger.log("client lockout begin", current_state_file_archived_intake.id)
         redirect_to knock_out_path
         return
       end
@@ -35,7 +35,7 @@ def identification_number_form_params
 
   def confirm_code_verification
     unless session[:code_verified]
-      EventLogger.log("unauthorized ssn attempt", current_archived_intake&.id)
+      EventLogger.log("unauthorized ssn attempt", current_state_file_archived_intake&.id)
       redirect_to root_path
     end
   end

app/controllers/mailing_address_validation_controller.rb

@@ -4,22 +4,22 @@ class MailingAddressValidationController < BaseController
   before_action :confirm_code_and_ssn_verification
 
   def edit
-    @addresses = current_archived_intake.address_challenge_set
-    @year = current_archived_intake.tax_year
-    @form = MailingAddressValidationForm.new(addresses: @addresses, current_address: current_archived_intake.full_address)
+    @addresses = current_state_file_archived_intake.address_challenge_set
+    @year = current_state_file_archived_intake.tax_year
+    @form = MailingAddressValidationForm.new(addresses: @addresses, current_address: current_state_file_archived_intake.full_address)
   end
 
   def update
-    @addresses = current_archived_intake.address_challenge_set
-    @form = MailingAddressValidationForm.new(mailing_address_validation_form_params, addresses: @addresses, current_address: current_archived_intake.full_address)
+    @addresses = current_state_file_archived_intake.address_challenge_set
+    @form = MailingAddressValidationForm.new(mailing_address_validation_form_params, addresses: @addresses, current_address: current_state_file_archived_intake.full_address)
     if @form.valid?
-      EventLogger.log("correct mailing address", current_archived_intake.id)
+      EventLogger.log("correct mailing address", current_state_file_archived_intake.id)
       session[:mailing_verified] = true
 
       redirect_to pdf_index_path
     elsif params["mailing_address_validation_form"].present?
-      EventLogger.log("incorrect mailing address", current_archived_intake.id)
-      current_archived_intake.update(permanently_locked_at: Time.now)
+      EventLogger.log("incorrect mailing address", current_state_file_archived_intake.id)
+      current_state_file_archived_intake.update(permanently_locked_at: Time.now)
       redirect_to knock_out_path
     else
       render :edit
@@ -30,7 +30,7 @@ def update
 
   def confirm_code_and_ssn_verification
     unless session[:code_verified] && session[:ssn_verified]
-      EventLogger.log("unauthorized mailing attempt", current_archived_intake&.id)
+      EventLogger.log("unauthorized mailing attempt", current_state_file_archived_intake&.id)
       redirect_to root_path
     end
   end

app/controllers/pages_controller.rb

@@ -3,6 +3,6 @@ def home
   end
 
   def knock_out
-    @intake = current_archived_intake
+    @intake = current_state_file_archived_intake
   end
 end

app/controllers/pdf_controller.rb

@@ -1,7 +1,6 @@
 class PdfController < BaseController
   prepend_before_action :authenticate_state_file_archived_intake!
   before_action :is_intake_unavailable
-  before_action :require_contact_preference
   before_action :require_verification_code_verified
   before_action :require_ssn_verified
   before_action :require_mailing_address_verified
@@ -13,14 +12,14 @@ class PdfController < BaseController
   end
 
   def index
-    EventLogger.log("issued pdf download link", current_archived_intake.id)
-    @state = current_archived_intake.state_name
+    EventLogger.log("issued pdf download link", current_state_file_archived_intake.id)
+    @state = current_state_file_archived_intake.state_name
     @year = session[:year_selected]
   end
 
   def log_and_redirect
-    EventLogger.log("client pdf download click", current_archived_intake.id)
-    pdf_url = current_archived_intake.submission_pdf.url(expires_in: pdf_expiration_time, disposition: "inline")
+    EventLogger.log("client pdf download click", current_state_file_archived_intake.id)
+    pdf_url = current_state_file_archived_intake.submission_pdf.url(expires_in: pdf_expiration_time, disposition: "inline")
     redirect_to pdf_url, allow_other_host: true
   end
 
@@ -34,12 +33,6 @@ def pdf_expiration_time
     end
   end
 
-  def require_contact_preference
-    return if session[:email_address].present? || session[:phone_number].present?
-
-    redirect_to knock_out_path
-  end
-
   def require_verification_code_verified
     return if session[:code_verified].present?
 

app/controllers/phone_number_controller.rb

@@ -10,11 +10,9 @@ def update
       session[:ssn_verified] = false
       session[:mailing_verified] = false
       session[:code_verified] = false
-      session[:phone_number] = @form.phone_number
-      session[:email_address] = nil
 
-      intake = current_archived_intake
-      sign_in intake
+      create_and_login_state_file_archived_intake(phone_number: @form.phone_number)
+      return if performed?
 
       redirect_to edit_verification_code_path
     else

app/controllers/verification_code_controller.rb

@@ -4,23 +4,23 @@ class VerificationCodeController < BaseController
   before_action :setup_contact
 
   def setup_contact
-    @contact_type = current_archived_intake.contact_preference
-    @contact_info = current_archived_intake.contact
+    @contact_type = current_state_file_archived_intake.contact_preference
+    @contact_info = current_state_file_archived_intake.contact
   end
 
   def edit
-    @form = VerificationCodeForm.new(contact_info: @contact_info, contact_preference: current_archived_intake.contact_preference)
-    case current_archived_intake.contact_preference
+    @form = VerificationCodeForm.new(contact_info: @contact_info, contact_preference: current_state_file_archived_intake.contact_preference)
+    case current_state_file_archived_intake.contact_preference
     when "text"
-      @phone_number = current_archived_intake.phone_number
-      EventLogger.log("issued text challenge", current_archived_intake.id)
+      @phone_number = current_state_file_archived_intake.phone_number
+      EventLogger.log("issued text challenge", current_state_file_archived_intake.id)
       TextMessageVerificationCodeJob.perform_later(
         phone_number: @phone_number,
         locale: I18n.locale
       )
     when "email"
-      @email_address = current_archived_intake.email_address
-      EventLogger.log("issued email challenge", current_archived_intake.id)
+      @email_address = current_state_file_archived_intake.email_address
+      EventLogger.log("issued email challenge", current_state_file_archived_intake.id)
       EmailVerificationCodeJob.perform_later(
         email_address: @email_address,
         locale: I18n.locale
@@ -31,28 +31,28 @@ def edit
   end
 
   def update
-    @form = VerificationCodeForm.new(verification_code_form_params, contact_info: current_archived_intake.contact, contact_preference: current_archived_intake.contact_preference)
+    @form = VerificationCodeForm.new(verification_code_form_params, contact_info: current_state_file_archived_intake.contact, contact_preference: current_state_file_archived_intake.contact_preference)
     if @form.valid?
-      case current_archived_intake.contact_preference
+      case current_state_file_archived_intake.contact_preference
       when "text"
-        EventLogger.log("correct text challenge", current_archived_intake.id)
+        EventLogger.log("correct text challenge", current_state_file_archived_intake.id)
       when "email"
-        EventLogger.log("correct email code", current_archived_intake.id)
+        EventLogger.log("correct email code", current_state_file_archived_intake.id)
       end
-      current_archived_intake.reset_failed_attempts!
+      current_state_file_archived_intake.reset_failed_attempts!
       session[:code_verified] = true
-      EventLogger.log("issued ssn challenge", current_archived_intake.id)
+      EventLogger.log("issued ssn challenge", current_state_file_archived_intake.id)
       redirect_to edit_identification_number_path
     else
-      case current_archived_intake.contact_preference
+      case current_state_file_archived_intake.contact_preference
       when "text"
-        EventLogger.log("incorrect text code", current_archived_intake.id)
+        EventLogger.log("incorrect text code", current_state_file_archived_intake.id)
       when "email"
-        EventLogger.log("incorrect email code", current_archived_intake.id)
+        EventLogger.log("incorrect email code", current_state_file_archived_intake.id)
       end
-      current_archived_intake.increment_failed_attempts
-      if current_archived_intake.access_locked?
-        EventLogger.log("client lockout begin", current_archived_intake.id)
+      current_state_file_archived_intake.increment_failed_attempts
+      if current_state_file_archived_intake.access_locked?
+        EventLogger.log("client lockout begin", current_state_file_archived_intake.id)
         redirect_to knock_out_path
         return
       end

app/lib/custom_failure_app.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+class CustomFailureApp < Devise::FailureApp
+  def redirect_url
+    if locked_out?
+      knock_out_path
+    else
+      super
+    end
+  end
+
+  private
+
+  def locked_out?
+    warden_message == :locked
+  end
+
+  def locked_out_path
+    Rails.application.routes.url_helpers.knock_out_path(locale: i18n_locale)
+  end
+end

config/initializers/devise.rb

@@ -9,6 +9,9 @@
 # Use this hook to configure devise mailer, warden hooks and so forth.
 # Many of these configuration options can be set straight in your model.
 Devise.setup do |config|
+  config.warden do |manager|
+    manager.failure_app = CustomFailureApp
+  end
   # The secret key used by Devise. Devise uses this key to generate
   # random tokens. Changing this key will render invalid all existing
   # confirmation, reset password and unlock tokens in the database.