🎫 Ticket

Link to the relevant ticket:
LG-14196

🛠 Summary of changes

This is the first of a two-part series; part 1 needs to be released before part 2.

Socure's API requires us to pass the time when a user consented to IdV. We currently store a boolean, idv_consent_given, on the user session, tracking whether they have agreed to sharing their data for IdV. This moves to storing a timestamp, idv_consent_given_at, so that we can stop answering "When did the user consent?" with "Yes." (Pragmatically, because it's stored on the session, we know they consented very recently. But we should store the actual timestamp.)

N.B. also that we are not currently sending any data to Socure in production environments; it is all feature-flagged off.

I am currently leaving the old idv_consent_given logic intact. We can release this and start setting idv_consent_given_at in sessions.

The second PR, after it's being set on new sessions, will replace the existing idv_consent_given boolean logic with checking the timestamp instead.

I expanded the AgreementController test to assert that it was set correctly. The not-nil idv_consent_given assertion will be short-lived, but it's correct for now.