Merge branch 'master' into API-35478-synchronous-request

merges master

.github/CODEOWNERS

@@ -664,6 +664,7 @@ config/form_profile_mappings/0873.yml @department-of-veterans-affairs/vfs-virtua
 config/form_profile_mappings/1010ez.yml @department-of-veterans-affairs/vfs-10-10 @department-of-veterans-affairs/va-api-engineers @department-of-veterans-affairs/backend-review-group
 config/form_profile_mappings/10-10EZR.yml @department-of-veterans-affairs/vfs-10-10 @department-of-veterans-affairs/va-api-engineers @department-of-veterans-affairs/backend-review-group
 config/form_profile_mappings/10182.yml @department-of-veterans-affairs/Benefits-Team-1 @department-of-veterans-affairs/va-api-engineers @department-of-veterans-affairs/backend-review-group
+config/form_profile_mappings/10-7959F-1.yml @department-of-veterans-affairs/champva-engineering @department-of-veterans-affairs/va-api-engineers @department-of-veterans-affairs/backend-review-group
 config/form_profile_mappings/20-0995.yml @department-of-veterans-affairs/Benefits-Team-1 @department-of-veterans-affairs/va-api-engineers @department-of-veterans-affairs/backend-review-group
 config/form_profile_mappings/20-0996.yml @department-of-veterans-affairs/Benefits-Team-1 @department-of-veterans-affairs/va-api-engineers @department-of-veterans-affairs/backend-review-group
 config/form_profile_mappings/21-526EZ.yml @department-of-veterans-affairs/Disability-Experience @department-of-veterans-affairs/va-api-engineers @department-of-veterans-affairs/backend-review-group

Dockerfile

@@ -1,5 +1,4 @@
-ARG RELEASE=bullseye
-FROM ruby:3.2.3-slim-${RELEASE} as rubyimg
+FROM ruby:3.2.3-slim-bookworm as rubyimg
 
 # XXX: using stretch here for pdftk dep, which is not availible after
 #      stretch (or in alpine) and is switched automatically to pdftk-java in buster
@@ -18,21 +17,15 @@ RUN find modules -type f ! \( -name Gemfile -o -name "*.gemspec" -o -path "*/lib
 # shared build/settings for all child images, reuse these layers yo
 ###
 FROM rubyimg AS base
-ARG RELEASE
-ENV RELEASE="$RELEASE"
 
 ARG userid=993
 SHELL ["/bin/bash", "-c"]
 RUN groupadd -g $userid -r vets-api && \
     useradd -u $userid -r -m -d /srv/vets-api -g vets-api vets-api
-RUN echo "APT::Default-Release \"${RELEASE}\";" >> /etc/apt/apt.conf.d/99defaultrelease
-RUN mv /etc/apt/sources.list /etc/apt/sources.list.d/stable.list
-RUN echo "deb http://ftp.debian.org/debian testing main contrib non-free" >> /etc/apt/sources.list.d/testing.list
-RUN echo "deb http://deb.debian.org/debian unstable main" >> /etc/apt/sources.list.d/unstable.list
-RUN apt-get update
-RUN DEBIAN_FRONTEND=noninteractive apt-get install -y -t "${RELEASE}" \
-    dumb-init imagemagick pdftk poppler-utils curl libpq5 vim libboost-all-dev \
-    clamav clamdscan clamav-daemon
+RUN apt-get update --fix-missing
+RUN DEBIAN_FRONTEND=noninteractive apt-get install -y ca-certificates-java && \
+    DEBIAN_FRONTEND=noninteractive apt-get install -y dumb-init imagemagick pdftk poppler-utils curl \
+    libpq5 vim libboost-all-dev clamav clamdscan clamav-daemon
 
 # The pki work below is for parity with the non-docker BRD deploys to mount certs into
 # the container, we need to get rid of it and refactor the configuration bits into

Gemfile

@@ -58,7 +58,7 @@ gem 'carrierwave-aws'
 gem 'clam_scan'
 gem 'combine_pdf'
 gem 'config'
-gem 'connect_vbms', git: 'https://github.com/department-of-veterans-affairs/connect_vbms.git', branch: 'master', require: 'vbms'
+gem 'connect_vbms', git: 'https://github.com/adhocteam/connect_vbms', tag: 'v2.0.0.rc', require: 'vbms'
 gem 'date_validator'
 gem 'ddtrace'
 gem 'dogstatsd-ruby', '5.6.1'

Gemfile.lock

@@ -1,3 +1,17 @@
+GIT
+  remote: https://github.com/adhocteam/connect_vbms
+  revision: 6e5dc751afaf0da9c7cbc10c94b909f114f3a156
+  tag: v2.0.0.rc
+  specs:
+    connect_vbms (2.0.0.rc)
+      httpclient (~> 2.8.0)
+      httpi (~> 2.4)
+      mail
+      nokogiri (>= 1.8.4)
+      nori
+      xmldsig (~> 0.3.1)
+      xmlenc
+
 GIT
   remote: https://github.com/department-of-veterans-affairs/apivore
   revision: f8ccd476f6c5301f5ebe4e2dd5b30ff0e567ffc1
@@ -30,20 +44,6 @@ GIT
       nokogiri (>= 1.13.6)
       savon (= 2.12)
 
-GIT
-  remote: https://github.com/department-of-veterans-affairs/connect_vbms.git
-  revision: 1834cf61310001c82e2e96d665518407c3bce947
-  branch: master
-  specs:
-    connect_vbms (1.4.0)
-      httpclient (~> 2.8.0)
-      httpi (~> 2.4)
-      mail
-      nokogiri (>= 1.8.4)
-      nori
-      xmldsig (~> 0.3.1)
-      xmlenc
-
 GIT
   remote: https://github.com/department-of-veterans-affairs/fhir_client.git
   revision: 52e0197dcb1f940a1f0b28bfa983699f0c199696
@@ -243,21 +243,21 @@ GEM
     attr_extras (7.1.0)
     awesome_print (1.9.2)
     aws-eventstream (1.3.0)
-    aws-partitions (1.914.0)
-    aws-sdk-core (3.192.0)
+    aws-partitions (1.920.0)
+    aws-sdk-core (3.193.0)
       aws-eventstream (~> 1, >= 1.3.0)
       aws-partitions (~> 1, >= 1.651.0)
       aws-sigv4 (~> 1.8)
       jmespath (~> 1, >= 1.6.1)
     aws-sdk-kms (1.79.0)
       aws-sdk-core (~> 3, >= 3.191.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-s3 (1.147.0)
-      aws-sdk-core (~> 3, >= 3.192.0)
+    aws-sdk-s3 (1.148.0)
+      aws-sdk-core (~> 3, >= 3.193.0)
       aws-sdk-kms (~> 1)
       aws-sigv4 (~> 1.8)
-    aws-sdk-sns (1.73.0)
-      aws-sdk-core (~> 3, >= 3.191.0)
+    aws-sdk-sns (1.74.0)
+      aws-sdk-core (~> 3, >= 3.193.0)
       aws-sigv4 (~> 1.1)
     aws-sigv4 (1.8.0)
       aws-eventstream (~> 1, >= 1.0.2)
@@ -317,7 +317,7 @@ GEM
     content_disposition (1.0.0)
     cork (0.3.0)
       colored2 (~> 3.1)
-    coverband (6.1.0)
+    coverband (6.1.1)
       redis (>= 3.0)
     crack (1.0.0)
       bigdecimal
@@ -663,7 +663,8 @@ GEM
     nokogiri (1.16.4)
       mini_portile2 (~> 2.8.2)
       racc (~> 1.4)
-    nori (2.6.0)
+    nori (2.7.0)
+      bigdecimal
     notiffany (0.1.3)
       nenv (~> 0.1)
       shellany (~> 0.0)
@@ -692,7 +693,7 @@ GEM
     os (1.1.4)
     ox (2.14.18)
     parallel (1.24.0)
-    parallel_tests (4.6.1)
+    parallel_tests (4.7.1)
       parallel
     parser (3.3.0.5)
       ast (~> 2.4.1)
@@ -890,7 +891,7 @@ GEM
     rswag-ui (2.13.0)
       actionpack (>= 3.1, < 7.2)
       railties (>= 3.1, < 7.2)
-    rubocop (1.63.2)
+    rubocop (1.63.3)
       json (~> 2.3)
       language_server-protocol (>= 3.17.0)
       parallel (~> 1.10)
@@ -997,7 +998,7 @@ GEM
     stringio (3.1.0)
     strong_migrations (1.8.0)
       activerecord (>= 5.2)
-    super_diff (0.11.0)
+    super_diff (0.12.0)
       attr_extras (>= 6.2.4)
       diff-lcs
       patience_diff

app/controllers/v0/profile/direct_deposits_controller.rb

@@ -11,8 +11,7 @@ module Profile
     class DirectDepositsController < ApplicationController
       service_tag 'direct-deposit'
       before_action { authorize :lighthouse, :direct_deposit_access? }
-      before_action :payment_account, only: :update
-      before_action :control_information, only: :update
+
       after_action :log_sso_info, only: :update
 
       rescue_from(*Lighthouse::ServiceException::ERROR_MAP.values) do |exception|
@@ -28,12 +27,19 @@ class DirectDepositsController < ApplicationController
       def show
         response = client.get_payment_info
 
+        set_control_information(response.body[:control_information])
+        log_control_info(@control_information, 'Show')
+
         render status: response.status,
                json: response.body,
                serializer: DisabilityCompensationsSerializer
       end
 
       def update
+        set_control_information(control_info_params)
+        set_payment_account(payment_account_params)
+
+        log_control_info(@control_information, 'Update')
         response = client.update_payment_info(@payment_account)
         send_confirmation_email
 
@@ -44,6 +50,15 @@ def update
 
       private
 
+      def log_control_info(control_info, action)
+        ::Rails.logger.info("Direct Deposit Control Info: #{action}",
+                            { benefit_type: control_info.benefit_type,
+                              updatable: control_info.account_updatable?,
+                              valid: control_info.valid?,
+                              restrictions: control_info.restrictions.join(', '),
+                              errors: control_info.errors.join(', ') })
+      end
+
       def single_form_enabled?
         Flipper.enabled?(:profile_show_direct_deposit_single_form, @current_user)
       end
@@ -56,12 +71,13 @@ def client
         @client ||= DirectDeposit::Client.new(@current_user.icn)
       end
 
-      def payment_account
-        @payment_account ||= Lighthouse::DirectDeposit::PaymentAccount.new(payment_account_params)
+      def set_payment_account(params)
+        @payment_account ||= Lighthouse::DirectDeposit::PaymentAccount.new(params)
       end
 
-      def control_information
-        @control_information ||= Lighthouse::DirectDeposit::ControlInformation.new(control_info_params)
+      def set_control_information(params)
+        @control_information ||= Lighthouse::DirectDeposit::ControlInformation.new
+        @control_information.assign_attributes(params)
       end
 
       def payment_account_params
@@ -84,7 +100,7 @@ def control_info_params
                       :has_no_fiduciary_assigned,
                       :is_not_deceased,
                       :has_payment_address,
-                      :has_indentity)
+                      :has_identity)
       end
 
       def send_confirmation_email

app/controllers/v0/sign_in_controller.rb

@@ -369,7 +369,8 @@ def cookie_authentication?(client_id)
     end
 
     def client_config(client_id)
-      @client_config ||= SignIn::ClientConfig.find_by(client_id:)
+      @client_config ||= {}
+      @client_config[client_id] ||= SignIn::ClientConfig.find_by(client_id:)
     end
 
     def sign_in_logger

app/models/form526_submission.rb

@@ -18,7 +18,8 @@ class Form526Submission < ApplicationRecord
     state :unprocessed, initial: true
     state :delivered_to_primary, :failed_primary_delivery, :rejected_by_primary,
           :delivered_to_backup, :failed_backup_delivery, :rejected_by_backup,
-          :in_remediation, :finalized_as_successful, :unprocessable
+          :in_remediation, :finalized_as_successful, :unprocessable,
+          :processed_in_batch_remediation, :ignorable_duplicate
 
     # - a submission has been delivered to our happy path
     # - requires polling to finalize
@@ -62,7 +63,6 @@ class Form526Submission < ApplicationRecord
       transitions to: :in_remediation
     end
 
-    # TODO: add this transition when we add 526 completion polling
     # - The only state that means we no longer own completion of this submission
     # - There is nothing more to do.  E.G.
     #   - VBMS has accepted and returned the applicable status to us via
@@ -78,6 +78,33 @@ class Form526Submission < ApplicationRecord
     event :mark_as_unprocessable do
       transitions to: :unprocessable
     end
+
+    # A special state to indicate this was part of our remediation 'batching'
+    # process in 2023.  These were handled manually and are distinct from `in_remediation`
+    # in that they were not tracked at the time of remediation, but rather later in
+    # the 2024 526 State audit.
+    #
+    # This state is useful to us at the time of creation, but may be something
+    # to flatten to a simple `finalized_as_successful` in the future.
+    event :process_in_batch_remediation do
+      transitions to: :processed_in_batch_remediation
+    end
+
+    # A special state to indicate this was part of our remediation 'batching'
+    # process in 2023.  These submissions may have been processed or not, but
+    # we don't care because they have an earlier, successful duplicate.
+    #
+    # Duplicates are identified by comparing form_json, using this script:
+    # https://github.com/department-of-veterans-affairs/va.gov-team-sensitive/blob/master/teams/benefits/scripts/526/submission_deduper.rb
+    # The result of this script can be evaluated by a qualified stakeholder to make
+    # a judgement call on whether or not a submission is a 'perfect' duplicate.
+    #
+    # IF a submission is found to be an exact duplicate of another
+    # AND its duplicate was previously submitted / remediated successfully
+    # THEN we can ignore it as a duplicate
+    event :ignore_as_duplicate do
+      transitions to: :ignorable_duplicate
+    end
   end
 
   wrap_with_logging(:start_evss_submission_job,

app/models/form_profile.rb

@@ -101,7 +101,8 @@ class FormProfile
     vre_readiness: ['28-1900'],
     coe: ['26-1880'],
     adapted_housing: ['26-4555'],
-    intent_to_file: ['21-0966']
+    intent_to_file: ['21-0966'],
+    ivc_champva: ['10-7959F-1']
   }.freeze
 
   FORM_ID_TO_CLASS = {
@@ -138,7 +139,8 @@ class FormProfile
     '22-1990EZ' => ::FormProfiles::VA1990ez,
     '26-1880' => ::FormProfiles::VA261880,
     '26-4555' => ::FormProfiles::VA264555,
-    '21-0966' => ::FormProfiles::VA210966
+    '21-0966' => ::FormProfiles::VA210966,
+    '10-7959F-1' => ::FormProfiles::VA107959f1
   }.freeze
 
   APT_REGEX = /\S\s+((apt|apartment|unit|ste|suite).+)/i

app/models/form_profiles/va_107959f1.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+class FormProfiles::VA107959f1 < FormProfile
+  FORM_ID = '10-7959F-1'
+
+  def metadata
+    {
+      version: 0,
+      prefill: true,
+      returnUrl: '/review-and-submit'
+    }
+  end
+end

config/features.yml

@@ -77,6 +77,10 @@ features:
     actor_type: user
     description: Enables Toxic Exposure questions for 10-10EZR applicants.
     enable_in_development: true
+  ezr_auth_only_enabled:
+    actor_type: user
+    description: Enables the auth-only experience, allowing only authenticated users to view any part of the form.
+    enable_in_development: true
   cerner_override_653:
     actor_type: user
     description: This will show the Cerner facility 653 as `isCerner`.
@@ -730,6 +734,9 @@ features:
     actor_type: user
     description: Enables/disables refill-related content for Medications on VA.gov
     enable_in_development: true
+  mhv_landing_page_enable_va_gov_health_tools_links:
+    actor_type: user
+    description: Enables VA.gov Health Tools links (Appts, SM, Rx, Records) on MHV-on-VA.gov Landing Page
   mhv_to_logingov_account_transition:
     actor_type: cookie_id
     description: Enables/disables MHV to Login.gov account transfer experience (Identity)

config/form_profile_mappings/10-7959F-1.yml

@@ -0,0 +1,22 @@
+
+veteran:
+  date_of_birth: [identity_information, date_of_birth]
+  full_name: [identity_information, full_name]
+  first: [identity_information, first]
+  middle: [identity_information, middle]
+  last: [identity_information, last]
+physical_address:
+  country: [contact_information, country]
+  street: [contact_information, street]
+  city: [contact_information, city]
+  state: [contact_information, state]
+  postal_code: [contact_information, postal_code]
+mailing_address:
+  country: [contact_information, country]
+  street: [contact_information, street]
+  city: [contact_information, city]
+  state: [contact_information, state]
+  postal_code: [contact_information, postal_code]
+ssn: [identity_information, ssn]
+phone_number: [contact_information, us_phone]
+email_address: [contact_information, email]

config/settings.yml

@@ -404,6 +404,9 @@ adapted_housing:
 intent_to_file:
   prefill: true
 
+ivc_champva:
+  prefill: true
+
 # Settings for Expiry Scanner
 expiry_scanner:
   slack:

db/migrate/20240425231104_add_ssn_and_icen_from_vye_tables.vye.rb

@@ -0,0 +1,10 @@
+class AddSsnAndIcenFromVyeTables < ActiveRecord::Migration[7.1]
+  def change
+    add_column :vye_user_infos, :icn, :string, if_not_exists: true
+    add_column :vye_user_infos, :ssn_ciphertext, :text, if_not_exists: true
+    add_column :vye_user_infos, :ssn_digest, :string, if_not_exists: true
+    add_column :vye_pending_documents, :claim_no_ciphertext, :string, if_not_exists: true
+    add_column :vye_pending_documents, :ssn_ciphertext, :text, if_not_exists: true
+    add_column :vye_pending_documents, :ssn_digest, :string, if_not_exists: true
+  end
+end