LG-14282 | Pass phone number to Socure proofer #11272

n1zyy · 2024-09-20T20:33:34Z

🎫 Ticket

Link to the relevant ticket:
LG-14282

🛠 Summary of changes

When Socure is running in shadow mode (to allow us to evaluate Socure without gating results on it), this will send our best guess for the user's phone number to also be proofed.

It is very possible for there to not be a phone number available yet in the flow, and the story suggested variable naming to reflect that it should not be treated as a reliable indicator of phone number.

Privacy

Most privacy concerns are mooted by the fact that all of Socure is feature-flagged off in all environments (except my laptop), and all that work is undergoing detailed security+privacy review before it can be enabled. This Socure code is unreachable in production.

There is a trivial change in that we are sourcing the phone number from a different (less reliable) user input. Normally, on the page after this code executes, the user is prompted for a phone number to verify. Because the Socure call happens before that, we rely on the number provided for MFA or the hybrid-handoff flow. The user has to have consented to sharing data with a proofing provider to get this far, so this shouldn't have a privacy impact.

📜 Testing Plan

You can enable Socure locally in application.yml(.default) with creds from their sandbox dashboard to test this. (Be sure to not submit any actual PII!)

When doing so, you should then receive a beautiful event in events.log like this one:

{"name":"idv_socure_shadow_mode_proofing_result","properties":{"event_properties":{"resolution_result":{"success":true,"errors":{},"exception":null,"timed_out":false,"threatmetrix_review_status":"pass","context":{"device_profiling_adjudication_reason":"device_profiling_result_pass","resolution_adjudication_reason":"pass_resolution_and_state_id","should_proof_state_id":true,"stages":{"resolution":{"success":true,"errors":{},"exception":null,"timed_out":false,"transaction_id":"resolution-mock-transaction-id-123","reference":"aaa-bbb-ccc","can_pass_with_additional_verification":false,"attributes_requiring_additional_verification":[],"vendor_name":"ResolutionMock","vendor_workflow":null,"verified_attributes":null},"residential_address":{"success":true,"errors":{},"exception":null,"timed_out":false,"transaction_id":"","reference":"","can_pass_with_additional_verification":false,"attributes_requiring_additional_verification":[],"vendor_name":"ResidentialAddressNotRequired","vendor_workflow":null,"verified_attributes":null},"state_id":{"success":true,"errors":{},"exception":null,"mva_exception":null,"requested_attributes":{},"timed_out":false,"transaction_id":"state-id-mock-transaction-id-456","vendor_name":"StateIdMock","verified_attributes":[],"jurisdiction_in_maintenance_window":false},"threatmetrix":{"client":null,"success":true,"errors":{},"exception":null,"timed_out":false,"transaction_id":"ddp-mock-transaction-id-123","review_status":"pass","account_lex_id":"super-cool-test-lex-id","session_id":"super-cool-test-session-id"}}},"biographical_info":{"state":"MT","identity_doc_address_state":null,"state_id_jurisdiction":"ND","state_id_number":"#############","same_address_as_id":null},"ssn_is_unique":true},"phone_source":"mfa","socure_result":{"success":true,"errors":{"reason_codes":["I919"]},"exception":null,"timed_out":false,"transaction_id":"71db11df-86f5-4b8e-881c-8191efa6fe5f","reference":"","can_pass_with_additional_verification":false,"attributes_requiring_additional_verification":[],"vendor_name":"socure_kyc","vendor_workflow":null,"verified_attributes":["address","first_name","last_name","phone","ssn","dob"]}},"new_event":true,"path":null,"session_duration":null,"user_id":"2167e49a-5366-4678-8856-da1c7009a018","locale":"en"},"time":"2024-09-24T19:09:01.246Z","id":"b46a83e2-1741-4557-8575-7817175e8e61","visitor_id":"86498e6e-5836-46bf-a34a-514437d82a2d","visit_id":"9cd41eb6-2dc9-4803-95ce-a6540726fe0c","log_filename":"events.log"}

You are specifically looking for socure_result to include 'phone' in verified_attributes indicating that it was passed successfully.

Another option...

...is to litter `puts` statements all throughout the code. Just hypothetically. Why doesn't Markdown work in here?

[changelog: Upcoming Features, Identity verification, send phone number to Socure]

spec/jobs/socure_shadow_mode_proofing_job_spec.rb

changelog: Upcoming Features, Identity verification, send phone number to Socure

app/jobs/socure_shadow_mode_proofing_job.rb

n1zyy · 2024-09-24T19:32:01Z

app/controllers/concerns/idv/verify_info_concern.rb

+
+
+      user_pii = pii
+      user_pii[:best_effort_phone_number_for_socure] = best_effort_phone


Because we're doing something slightly unusual, we tack this onto the PII bundle so it's available for Socure, but omit it other places it might be used.

The naming is meant to convey that we accept that the phone number may not be present and shouldn't be relied on for other purposes.

n1zyy · 2024-09-24T19:34:53Z

app/jobs/socure_shadow_mode_proofing_job.rb

@@ -91,6 +92,10 @@ def build_applicant(
    )

    applicant_pii = decrypted_arguments[:applicant_pii]
+    if applicant_pii[:phone].nil? && applicant_pii[:best_effort_phone_number_for_socure]


Note that, in actuality, nothing is passing :phone into the Socure proofer today, so this conditional isn't strictly necessary. But it feels cleaner, and IMHO makes clearer what we're doing. (Plus it frees me from needing nil-safe operators on applicant_pii[:best_effort_phone_number_for_socure] and keeps phone and phone_source together.)

app/services/analytics_events.rb

n1zyy · 2024-09-24T19:37:40Z

app/services/proofing/resolution/progressive_proofer.rb

@@ -32,7 +32,7 @@ def proof(
        ipp_enrollment_in_progress:,
        current_sp:
      )
-        @applicant_pii = applicant_pii
+        @applicant_pii = applicant_pii.except(:best_effort_phone_number_for_socure)


AAMVA and LexisNexis are not expecting this key.

n1zyy · 2024-09-24T19:37:55Z

app/services/proofing/socure/id_plus/proofer.rb

@@ -33,7 +33,7 @@ def initialize(config)
        # @param [Hash] applicant
        # @return [Proofing::Resolution::Result]
        def proof(applicant)
-          input = Input.new(applicant)
+          input = Input.new(applicant.except(:phone_source))


And phone_source is just along for the ride into logs.

spec/jobs/socure_shadow_mode_proofing_job_spec.rb

matthinz · 2024-09-24T22:50:15Z

spec/jobs/socure_shadow_mode_proofing_job_spec.rb

@@ -18,7 +18,7 @@
  end

  let(:applicant_pii) do
-    Idp::Constants::MOCK_IDV_APPLICANT_WITH_PHONE
+    Idp::Constants::MOCK_IDV_APPLICANT_WITH_SSN


Maybe one more test in this file asserting that phone_source makes it into the logged event

matthinz · 2024-09-24T22:51:38Z

app/controllers/concerns/idv/verify_info_concern.rb

@@ -48,6 +51,14 @@ def log_event_for_missing_threatmetrix_session_id
      analytics.idv_verify_info_missing_threatmetrix_session_id if idv_session.ssn_step_complete?
    end

+    def best_effort_phone


Probably want test coverage for this method. I don't think we have a spec for VerifyInfoConcern, but you could either write one or put a test in the VerifyInfoController spec.

n1zyy · 2024-09-26T14:24:42Z

spec/controllers/idv/verify_info_controller_spec.rb

@@ -491,4 +491,36 @@
      end
    end
  end
+
+  describe '#best_effort_phone' do


@matthinz I did end up adding this in the controller spec based on your feedback. I set out to add a test for VerifyInfoConcern but it was turtles all the way down.

changelog: Upcoming Features, Identity verification, send phone number to Socure

n1zyy added 2 commits September 20, 2024 16:20

LG-14282 | Pass phone number to Socure proofer

49056a3

[changelog: Upcoming Features, Identity verification, send phone number to Socure]

Merge branch 'main' into mattw/LG-14282_shadow_mode_phone

398a24c

n1zyy added the status - work in progress label Sep 20, 2024

n1zyy commented Sep 20, 2024

View reviewed changes

spec/jobs/socure_shadow_mode_proofing_job_spec.rb Show resolved Hide resolved

n1zyy added 2 commits September 24, 2024 15:19

Make it all work

d38b6c4

changelog: Upcoming Features, Identity verification, send phone number to Socure

Merge branch 'main' into mattw/LG-14282_shadow_mode_phone

8285d8b

n1zyy commented Sep 24, 2024

View reviewed changes

n1zyy added 2 commits September 24, 2024 15:51

Apply suggestions from code review

4dddc2d

Test cleanup, mostly

5b3e76e

n1zyy marked this pull request as ready for review September 24, 2024 20:14

n1zyy changed the title ~~[WIP] LG-14282 | Pass phone number to Socure proofer~~ LG-14282 | Pass phone number to Socure proofer Sep 24, 2024

Remove errant inclusion of demo data

e8c92b0

n1zyy requested a review from a team September 24, 2024 22:13

matthinz reviewed Sep 24, 2024

View reviewed changes

n1zyy added 2 commits September 25, 2024 11:21

Merge branch 'main' into mattw/LG-14282_shadow_mode_phone

69fd1a4

Address failing test + feedback on missing test cases

80a8281

n1zyy removed the status - work in progress label Sep 26, 2024

n1zyy requested a review from a team September 26, 2024 14:22

n1zyy commented Sep 26, 2024

View reviewed changes

matthinz approved these changes Sep 26, 2024

View reviewed changes

n1zyy merged commit 9e0a5db into main Sep 26, 2024
2 checks passed

n1zyy deleted the mattw/LG-14282_shadow_mode_phone branch September 26, 2024 18:19

AShukla-GSA pushed a commit that referenced this pull request Sep 27, 2024

LG-14282 | Pass phone number to Socure proofer (#11272)

863f761

changelog: Upcoming Features, Identity verification, send phone number to Socure

AShukla-GSA pushed a commit that referenced this pull request Sep 30, 2024

LG-14282 | Pass phone number to Socure proofer (#11272)

ace575a

changelog: Upcoming Features, Identity verification, send phone number to Socure

eileen-nava mentioned this pull request Oct 1, 2024

Deploy RC 418 to Production #11300

Merged

MrNagoo pushed a commit that referenced this pull request Oct 3, 2024

LG-14282 | Pass phone number to Socure proofer (#11272)

6d60df2

changelog: Upcoming Features, Identity verification, send phone number to Socure

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

LG-14282 | Pass phone number to Socure proofer #11272

LG-14282 | Pass phone number to Socure proofer #11272

n1zyy commented Sep 20, 2024 •

edited

Loading

n1zyy Sep 24, 2024

n1zyy Sep 24, 2024

n1zyy Sep 24, 2024

n1zyy Sep 24, 2024

matthinz Sep 24, 2024

matthinz Sep 24, 2024

n1zyy Sep 26, 2024



		user_pii = pii
		user_pii[:best_effort_phone_number_for_socure] = best_effort_phone

LG-14282 | Pass phone number to Socure proofer #11272

LG-14282 | Pass phone number to Socure proofer #11272

Conversation

n1zyy commented Sep 20, 2024 • edited Loading

🎫 Ticket

🛠 Summary of changes

Privacy

📜 Testing Plan

n1zyy Sep 24, 2024

Choose a reason for hiding this comment

n1zyy Sep 24, 2024

Choose a reason for hiding this comment

n1zyy Sep 24, 2024

Choose a reason for hiding this comment

n1zyy Sep 24, 2024

Choose a reason for hiding this comment

matthinz Sep 24, 2024

Choose a reason for hiding this comment

matthinz Sep 24, 2024

Choose a reason for hiding this comment

n1zyy Sep 26, 2024

Choose a reason for hiding this comment

n1zyy commented Sep 20, 2024 •

edited

Loading