LG-15216 Handle password reset for in-person enrollments waiting for fraud review

app/controllers/concerns/fraud_review_concern.rb

@@ -32,7 +32,7 @@ def handle_fraud_rejection
   # bypassing the typical flow of showing the Please Call or Fraud Rejection screens.
   def in_person_prevent_fraud_redirection?
     IdentityConfig.store.in_person_proofing_enforce_tmx &&
-      current_user.ipp_enrollment_status_not_passed? &&
+      current_user.ipp_enrollment_status_not_passed_or_in_fraud_review? &&
       (fraud_review_pending? || fraud_rejection?)
   end
 

app/controllers/concerns/verify_profile_concern.rb

@@ -27,7 +27,7 @@ def pending_profile_policy
   # bypassing the typical flow of showing the Please Call or Fraud Rejection screens.
   def user_failed_ipp_with_fraud_review_pending?
     IdentityConfig.store.in_person_proofing_enforce_tmx &&
-      current_user.ipp_enrollment_status_not_passed? &&
+      current_user.ipp_enrollment_status_not_passed_or_in_fraud_review? &&
       current_user.fraud_review_pending?
   end
 end

app/controllers/idv/please_call_controller.rb

@@ -15,12 +15,12 @@ def show
       analytics.idv_please_call_visited
       pending_at = current_user.fraud_review_pending_profile.fraud_review_pending_at
       @call_by_date = pending_at + FRAUD_REVIEW_CONTACT_WITHIN_DAYS
-      @in_person = ipp_enabled_and_enrollment_passed?
+      @in_person = ipp_enabled_and_enrollment_passed_or_in_fraud_review?
     end
 
-    def ipp_enabled_and_enrollment_passed?
+    def ipp_enabled_and_enrollment_passed_or_in_fraud_review?
       return unless in_person_tmx_enabled?
-      in_person_proofing_enabled? && ipp_enrollment_passed?
+      in_person_proofing_enabled? && (ipp_enrollment_passed? || ipp_enrollment_in_fraud_review?)
     end
 
     private
@@ -43,5 +43,9 @@ def in_person_tmx_enabled?
     def ipp_enrollment_passed?
       current_user&.in_person_enrollment_status == 'passed'
     end
+
+    def ipp_enrollment_in_fraud_review?
+      current_user&.in_person_enrollment_status == 'in_fraud_review'
+    end
   end
 end

app/controllers/idv/welcome_controller.rb

@@ -62,8 +62,9 @@ def create_document_capture_session
 
     def cancel_previous_in_person_enrollments
       return unless IdentityConfig.store.in_person_proofing_enabled
-      UspsInPersonProofing::EnrollmentHelper
-        .cancel_establishing_and_pending_enrollments(current_user)
+      UspsInPersonProofing::EnrollmentHelper.cancel_establishing_and_in_progress_enrollments(
+        current_user,
+      )
     end
   end
 end

app/forms/reset_password_form.rb

@@ -70,12 +70,12 @@ def mark_profile_as_password_reset
 
   def password_reset_profile
     FeatureManagement.pending_in_person_password_reset_enabled? ?
-      find_pending_in_person_or_active_profile :
+      find_in_progress_in_person_or_active_profile :
       active_profile
   end
 
-  def find_pending_in_person_or_active_profile
-    user.pending_in_person_enrollment&.profile || active_profile
+  def find_in_progress_in_person_or_active_profile
+    user.current_in_progress_in_person_enrollment_profile || active_profile
   end
 
   # It is possible for an account that is resetting their password to be "invalid".
@@ -104,7 +104,9 @@ def extra_analytics_attributes
 
   def pending_profile_invalidated?
     if FeatureManagement.pending_in_person_password_reset_enabled?
-      pending_profile.present? && !pending_profile.in_person_verification_pending?
+      pending_profile.present? &&
+        !pending_profile.in_person_verification_pending? &&
+        !pending_profile.fraud_deactivation_reason?
     else
       pending_profile.present?
     end

app/jobs/fraud_rejection_daily_job.rb

@@ -5,6 +5,7 @@ class FraudRejectionDailyJob < ApplicationJob
 
   def perform(_date)
     profiles_eligible_for_fraud_rejection.find_each do |profile|
+      profile.in_person_enrollment&.failed!
       profile.reject_for_fraud(notify_user: false)
       analytics(user: profile.user).automatic_fraud_rejection(
         fraud_rejection_at: profile.fraud_rejection_at,

app/jobs/get_usps_proofing_results_job.rb

@@ -34,6 +34,7 @@ def perform(_now)
       enrollments_cancelled: 0,
       enrollments_in_progress: 0,
       enrollments_passed: 0,
+      enrollments_in_fraud_review: 0,
       enrollments_skipped: 0,
     }
 
@@ -142,8 +143,7 @@ def check_enrollment(enrollment)
 
   def cancel_enrollment(enrollment)
     enrollment_outcomes[:enrollments_cancelled] += 1
-    enrollment.cancelled!
-    enrollment.profile.deactivate_due_to_in_person_verification_cancelled
+    enrollment.cancel
   end
 
   def skip_enrollment(enrollment, profile_deactivation_reason)
@@ -484,7 +484,7 @@ def handle_successful_status_update(enrollment, response)
 
   def handle_passed_with_fraud_review_pending(enrollment, response)
     proofed_at = parse_usps_timestamp(response['transactionEndDateTime'])
-    enrollment_outcomes[:enrollments_passed] += 1
+    enrollment_outcomes[:enrollments_in_fraud_review] += 1
     log_enrollment_updated_analytics(
       enrollment: enrollment,
       enrollment_passed: true,
@@ -493,7 +493,7 @@ def handle_passed_with_fraud_review_pending(enrollment, response)
       reason: 'Passed with fraud pending',
     )
     enrollment.update(
-      status: :passed,
+      status: :in_fraud_review,
       proofed_at: proofed_at,
       status_check_completed_at: Time.zone.now,
     )
@@ -641,7 +641,7 @@ def send_enrollment_status_sms_notification(enrollment:)
   end
 
   def notification_delivery_params(enrollment)
-    return {} unless enrollment.passed? || enrollment.failed?
+    return {} unless enrollment.passed? || enrollment.failed? || enrollment.in_fraud_review?
 
     wait_until = enrollment.status_check_completed_at + (
       IdentityConfig.store.in_person_results_delay_in_hours || DEFAULT_EMAIL_DELAY_IN_HOURS

app/models/in_person_enrollment.rb

@@ -13,12 +13,15 @@ class InPersonEnrollment < ApplicationRecord
 
   has_one :notification_phone_configuration, dependent: :destroy, inverse_of: :in_person_enrollment
 
+  IN_PROGRESS_ENROLLMENT_STATUSES = %w[pending in_fraud_review].to_set.freeze
+
   STATUS_ESTABLISHING = 'establishing'
   STATUS_PENDING = 'pending'
   STATUS_PASSED = 'passed'
   STATUS_FAILED = 'failed'
   STATUS_EXPIRED = 'expired'
   STATUS_CANCELLED = 'cancelled'
+  STATUS_IN_FRAUD_REVIEW = 'in_fraud_review'
 
   enum :status, {
     STATUS_ESTABLISHING.to_sym => 0,
@@ -27,6 +30,7 @@ class InPersonEnrollment < ApplicationRecord
     STATUS_FAILED.to_sym => 3,
     STATUS_EXPIRED.to_sym => 4,
     STATUS_CANCELLED.to_sym => 5,
+    STATUS_IN_FRAUD_REVIEW.to_sym => 6,
   }
 
   validate :profile_belongs_to_user

app/models/user.rb

@@ -223,9 +223,14 @@ def in_person_enrollment_status
     pending_profile&.in_person_enrollment&.status
   end
 
-  def ipp_enrollment_status_not_passed?
+  # Whether the user's in person enrollment status is not passed or in_fraud_review. Enrollments
+  # used to go to passed status when profiles were marked as in fraud review. Since LG-15216, this
+  # will no longer be the case.
+  def ipp_enrollment_status_not_passed_or_in_fraud_review?
     !in_person_enrollment_status.blank? &&
-      in_person_enrollment_status != 'passed'
+      [InPersonEnrollment::STATUS_PASSED, InPersonEnrollment::STATUS_IN_FRAUD_REVIEW].exclude?(
+        in_person_enrollment_status,
+      )
   end
 
   def has_in_person_enrollment?
@@ -533,21 +538,28 @@ def last_sign_in_email_address
     email_addresses.confirmed.last_sign_in
   end
 
+  # Find the user's most recent in-progress enrollment profile.
+  def current_in_progress_in_person_enrollment_profile
+    in_person_enrollments
+      .where(status: InPersonEnrollment::IN_PROGRESS_ENROLLMENT_STATUSES)
+      .order(created_at: :desc)
+      .first&.profile
+  end
+
   private
 
   def find_password_reset_profile
     FeatureManagement.pending_in_person_password_reset_enabled? ?
-      find_pending_in_person_or_active_profile :
+      find_in_person_in_progress_or_active_profile :
       find_active_profile
   end
 
   def find_active_profile
     profiles.where.not(activated_at: nil).order(activated_at: :desc).first
   end
 
-  def find_pending_in_person_or_active_profile
-    pending_in_person_enrollment&.profile ||
-      profiles.where.not(activated_at: nil).order(activated_at: :desc).first
+  def find_in_person_in_progress_or_active_profile
+    current_in_progress_in_person_enrollment_profile || find_active_profile
   end
 
   def lockout_period

app/services/analytics_events.rb

@@ -3340,6 +3340,7 @@ def idv_in_person_usps_proofing_enrollment_code_email_received(
   # @param [Integer] enrollments_failed number of enrollments which failed identity proofing
   # @param [Integer] enrollments_in_progress number of enrollments which did not have any change
   # @param [Integer] enrollments_passed number of enrollments which passed identity proofing
+  # @param [Integer] enrollments_in_fraud_review number of enrollments in fraud review
   # @param [Integer] enrollments_skipped number of enrollments skipped
   # @param [Integer] enrollments_network_error
   # @param [Integer] enrollments_cancelled
@@ -3354,6 +3355,7 @@ def idv_in_person_usps_proofing_results_job_completed(
     enrollments_failed:,
     enrollments_in_progress:,
     enrollments_passed:,
+    enrollments_in_fraud_review:,
     enrollments_skipped:,
     enrollments_network_error:,
     enrollments_cancelled:,
@@ -3371,6 +3373,7 @@ def idv_in_person_usps_proofing_results_job_completed(
       enrollments_failed:,
       enrollments_in_progress:,
       enrollments_passed:,
+      enrollments_in_fraud_review:,
       enrollments_skipped:,
       enrollments_network_error:,
       enrollments_cancelled:,

app/services/usps_in_person_proofing/enrollment_helper.rb

@@ -91,13 +91,15 @@ def cancel_stale_establishing_enrollments_for_user(user)
           .find_each(&:cancelled!)
       end
 
-      # Cancel a user's associated establishing and pending in-person enrollments.
+      # Cancel a user's associated establishing, pending, and in_fraud_review in-person enrollments.
       #
       # @param user [User] The user model
-      def cancel_establishing_and_pending_enrollments(user)
+      def cancel_establishing_and_in_progress_enrollments(user)
         user
           .in_person_enrollments
-          .where(status: [:establishing, :pending])
+          .where(status:
+            [InPersonEnrollment::STATUS_ESTABLISHING] +
+            InPersonEnrollment::IN_PROGRESS_ENROLLMENT_STATUSES.to_a)
           .find_each(&:cancel)
       end
 

lib/action_account.rb

@@ -190,6 +190,7 @@ def run(args:, config:)
         elsif FraudReviewChecker.new(user).fraud_review_eligible?
           profile = user.fraud_review_pending_profile
           profile_fraud_review_pending_at = profile.fraud_review_pending_at
+          profile.in_person_enrollment&.failed!
           profile.reject_for_fraud(notify_user: true)
           success = true
 
@@ -281,6 +282,7 @@ def run(args:, config:)
         elsif FraudReviewChecker.new(user).fraud_review_eligible?
           profile = user.fraud_review_pending_profile
           profile_fraud_review_pending_at = profile.fraud_review_pending_at
+          profile.in_person_enrollment&.passed!
           profile.activate_after_passing_review
           success = true
 

spec/controllers/concerns/idv_step_concern_spec.rb

@@ -259,5 +259,28 @@ def show
         expect(response).to redirect_to idv_verify_by_mail_enter_code_url
       end
     end
+
+    context 'with a passed in-person enrollment and a fraudulent profile' do
+      let(:user) do
+        profile = create(:profile, :in_person_fraud_review_pending, in_person_enrollment: nil)
+        create(:in_person_enrollment, :passed, profile:, user: profile.user).user
+      end
+
+      it 'redirects to please call page' do
+        get :show
+
+        expect(response).to redirect_to idv_please_call_url
+      end
+    end
+
+    context 'with a in_fraud_review in-person enrollment and a fraudulent profile' do
+      let(:user) { create(:profile, :in_person_fraud_review_pending).user }
+
+      it 'redirects to please call page' do
+        get :show
+
+        expect(response).to redirect_to idv_please_call_url
+      end
+    end
   end
 end

spec/controllers/idv/please_call_controller_spec.rb

@@ -127,4 +127,66 @@
       end
     end
   end
+
+  describe '#ipp_enabled_and_enrollment_passed_or_in_fraud_review?' do
+    context 'when in person tmx is enabled' do
+      before do
+        allow(IdentityConfig.store).to receive(:in_person_proofing_enforce_tmx).and_return(true)
+      end
+
+      context 'when ipp is enabled' do
+        before do
+          allow(IdentityConfig.store).to receive(:in_person_proofing_enabled).and_return(true)
+        end
+
+        context 'when user has a passed enrollment' do
+          let!(:enrollment) { create(:in_person_enrollment, :passed, user: user, profile: profile) }
+
+          it 'returns true' do
+            expect(subject.ipp_enabled_and_enrollment_passed_or_in_fraud_review?).to be(true)
+          end
+        end
+
+        context 'when user has an in_fraud_review enrollment' do
+          let!(:enrollment) do
+            create(:in_person_enrollment, :in_fraud_review, user: user, profile: profile)
+          end
+
+          it 'returns true' do
+            expect(subject.ipp_enabled_and_enrollment_passed_or_in_fraud_review?).to be(true)
+          end
+        end
+
+        context 'when user has a non passed or in_fraud_review enrollment' do
+          let!(:enrollment) do
+            create(:in_person_enrollment, :pending, user: user, profile: profile)
+          end
+
+          it 'returns false' do
+            expect(subject.ipp_enabled_and_enrollment_passed_or_in_fraud_review?).to be(false)
+          end
+        end
+      end
+
+      context 'when ipp is disabled' do
+        before do
+          allow(IdentityConfig.store).to receive(:in_person_proofing_enabled).and_return(false)
+        end
+
+        it 'returns false' do
+          expect(subject.ipp_enabled_and_enrollment_passed_or_in_fraud_review?).to be(false)
+        end
+      end
+    end
+
+    context 'when in person tmx is disabled' do
+      before do
+        allow(IdentityConfig.store).to receive(:in_person_proofing_enforce_tmx).and_return(false)
+      end
+
+      it 'returns nil' do
+        expect(subject.ipp_enabled_and_enrollment_passed_or_in_fraud_review?).to be_nil
+      end
+    end
+  end
 end

spec/controllers/idv/welcome_controller_spec.rb

@@ -140,16 +140,23 @@
       let!(:pending_enrollment) do
         create(:in_person_enrollment, :pending, user: user, profile: password_reset_profile)
       end
+      let(:fraud_password_reset_profile) { create(:profile, :password_reset, user: user) }
+      let!(:fraud_review_enrollment) do
+        create(
+          :in_person_enrollment, :in_fraud_review, user: user, profile: fraud_password_reset_profile
+        )
+      end
 
       before do
         allow(IdentityConfig.store).to receive(:in_person_proofing_enabled).and_return(true)
       end
 
-      it 'cancels all previous establishing and pending enrollments' do
+      it 'cancels all previous establishing, pending, and in_fraud_review enrollments' do
         put :update
 
         expect(establishing_enrollment.reload.status).to eq(InPersonEnrollment::STATUS_CANCELLED)
         expect(pending_enrollment.reload.status).to eq(InPersonEnrollment::STATUS_CANCELLED)
+        expect(fraud_review_enrollment.reload.status).to eq(InPersonEnrollment::STATUS_CANCELLED)
         expect(user.establishing_in_person_enrollment).to be_blank
         expect(user.pending_in_person_enrollment).to be_blank
       end