pulled from master

.github/CODEOWNERS

@@ -186,6 +186,8 @@ app/mailers/views/veteran_readiness_employment_cmp.html.erb @department-of-veter
 app/mailers/views/veteran_readiness_employment.html.erb @department-of-veterans-affairs/Benefits-Team-1 @department-of-veterans-affairs/va-api-engineers @department-of-veterans-affairs/backend-review-group
 app/models/account_login_stat.rb @department-of-veterans-affairs/octo-identity
 app/models/account.rb @department-of-veterans-affairs/octo-identity
+app/models/accredited_individual.rb @department-of-veterans-affairs/accredited-representation-management @department-of-veterans-affairs/backend-review-group @department-of-veterans-affairs/benefits-accredited-rep-facing
+app/models/accredited_organization.rb @department-of-veterans-affairs/accredited-representation-management @department-of-veterans-affairs/backend-review-group @department-of-veterans-affairs/benefits-accredited-rep-facing
 app/models/adapters/payment_history_adapter.rb @department-of-veterans-affairs/vfs-authenticated-experience-backend @department-of-veterans-affairs/backend-review-group @department-of-veterans-affairs/va-api-engineers
 app/models/appeal_submission.rb @department-of-veterans-affairs/Benefits-Team-1 @department-of-veterans-affairs/va-api-engineers @department-of-veterans-affairs/backend-review-group
 app/models/appeal_submission_upload.rb @department-of-veterans-affairs/Benefits-Team-1 @department-of-veterans-affairs/va-api-engineers @department-of-veterans-affairs/backend-review-group
@@ -662,6 +664,7 @@ config/form_profile_mappings/0873.yml @department-of-veterans-affairs/vfs-virtua
 config/form_profile_mappings/1010ez.yml @department-of-veterans-affairs/vfs-10-10 @department-of-veterans-affairs/va-api-engineers @department-of-veterans-affairs/backend-review-group
 config/form_profile_mappings/10-10EZR.yml @department-of-veterans-affairs/vfs-10-10 @department-of-veterans-affairs/va-api-engineers @department-of-veterans-affairs/backend-review-group
 config/form_profile_mappings/10182.yml @department-of-veterans-affairs/Benefits-Team-1 @department-of-veterans-affairs/va-api-engineers @department-of-veterans-affairs/backend-review-group
+config/form_profile_mappings/10-7959F-1.yml @department-of-veterans-affairs/champva-engineering @department-of-veterans-affairs/va-api-engineers @department-of-veterans-affairs/backend-review-group
 config/form_profile_mappings/20-0995.yml @department-of-veterans-affairs/Benefits-Team-1 @department-of-veterans-affairs/va-api-engineers @department-of-veterans-affairs/backend-review-group
 config/form_profile_mappings/20-0996.yml @department-of-veterans-affairs/Benefits-Team-1 @department-of-veterans-affairs/va-api-engineers @department-of-veterans-affairs/backend-review-group
 config/form_profile_mappings/21-526EZ.yml @department-of-veterans-affairs/Disability-Experience @department-of-veterans-affairs/va-api-engineers @department-of-veterans-affairs/backend-review-group
@@ -787,6 +790,7 @@ docs/setup/codespaces.md @department-of-veterans-affairs/backend-review-group @d
 docs/setup/va_forms.md @department-of-veterans-affairs/platform-va-product-forms @department-of-veterans-affairs/backend-review-group @department-of-veterans-affairs/va-api-engineers
 docs/setup/virtual_machine_access.md @department-of-veterans-affairs/backend-review-group @department-of-veterans-affairs/va-api-engineers
 .github @department-of-veterans-affairs/backend-review-group
+lib/accredited_representation/constants.rb @department-of-veterans-affairs/accredited-representation-management @department-of-veterans-affairs/backend-review-group @department-of-veterans-affairs/benefits-accredited-rep-facing
 lib/aes_256_cbc_encryptor.rb @department-of-veterans-affairs/va-api-engineers @department-of-veterans-affairs/backend-review-group
 lib/apps @department-of-veterans-affairs/vfs-facilities-frontend @department-of-veterans-affairs/lighthouse-pivot
 lib/bb @department-of-veterans-affairs/vfs-vaos @department-of-veterans-affairs/va-api-engineers @department-of-veterans-affairs/backend-review-group
@@ -1069,6 +1073,8 @@ spec/factories/686c/form_686c_674.rb @department-of-veterans-affairs/benefits-de
 spec/factories/686c/spouse.rb @department-of-veterans-affairs/benefits-dependents-management @department-of-veterans-affairs/va-api-engineers @department-of-veterans-affairs/backend-review-group
 spec/factories/686c/step_child_lives_with_veteran.rb @department-of-veterans-affairs/benefits-dependents-management @department-of-veterans-affairs/va-api-engineers @department-of-veterans-affairs/backend-review-group
 spec/factories/accounts.rb @department-of-veterans-affairs/octo-identity
+spec/factories/accredited_individuals.rb @department-of-veterans-affairs/accredited-representation-management @department-of-veterans-affairs/backend-review-group @department-of-veterans-affairs/benefits-accredited-rep-facing
+spec/factories/accredited_organizations.rb @department-of-veterans-affairs/accredited-representation-management @department-of-veterans-affairs/backend-review-group @department-of-veterans-affairs/benefits-accredited-rep-facing
 spec/factories/appeal_submissions.rb @department-of-veterans-affairs/vfs-authenticated-experience-backend @department-of-veterans-affairs/va-api-engineers @department-of-veterans-affairs/backend-review-group
 spec/factories/appeal_submission_uploads.rb @department-of-veterans-affairs/vfs-authenticated-experience-backend @department-of-veterans-affairs/va-api-engineers @department-of-veterans-affairs/backend-review-group
 spec/factories/ask.rb @department-of-veterans-affairs/Benefits-Team-1 @department-of-veterans-affairs/va-api-engineers @department-of-veterans-affairs/backend-review-group
@@ -1431,6 +1437,8 @@ spec/mailers/transactional_email_mailer_spec.rb @department-of-veterans-affairs/
 spec/mailers/veteran_readiness_employment_mailer_spec.rb @department-of-veterans-affairs/Benefits-Team-1 @department-of-veterans-affairs/va-api-engineers @department-of-veterans-affairs/backend-review-group
 spec/middleware @department-of-veterans-affairs/va-api-engineers @department-of-veterans-affairs/backend-review-group
 spec/models/account_spec.rb @department-of-veterans-affairs/octo-identity
+spec/models/accredited_individual_spec.rb @department-of-veterans-affairs/accredited-representation-management @department-of-veterans-affairs/backend-review-group @department-of-veterans-affairs/benefits-accredited-rep-facing
+spec/models/accredited_organization_spec.rb @department-of-veterans-affairs/accredited-representation-management @department-of-veterans-affairs/backend-review-group @department-of-veterans-affairs/benefits-accredited-rep-facing
 spec/models/async_transaction/base_spec.rb @department-of-veterans-affairs/vfs-authenticated-experience-backend @department-of-veterans-affairs/va-api-engineers @department-of-veterans-affairs/backend-review-group
 spec/models/async_transaction/va_profile @department-of-veterans-affairs/vfs-authenticated-experience-backend @department-of-veterans-affairs/va-api-engineers @department-of-veterans-affairs/backend-review-group
 spec/models/async_transaction/vet360 @department-of-veterans-affairs/vfs-authenticated-experience-backend @department-of-veterans-affairs/va-api-engineers @department-of-veterans-affairs/backend-review-group

Dockerfile

@@ -1,5 +1,4 @@
-ARG RELEASE=bullseye
-FROM ruby:3.2.3-slim-${RELEASE} as rubyimg
+FROM ruby:3.2.3-slim-bookworm as rubyimg
 
 # XXX: using stretch here for pdftk dep, which is not availible after
 #      stretch (or in alpine) and is switched automatically to pdftk-java in buster
@@ -18,21 +17,15 @@ RUN find modules -type f ! \( -name Gemfile -o -name "*.gemspec" -o -path "*/lib
 # shared build/settings for all child images, reuse these layers yo
 ###
 FROM rubyimg AS base
-ARG RELEASE
-ENV RELEASE="$RELEASE"
 
 ARG userid=993
 SHELL ["/bin/bash", "-c"]
 RUN groupadd -g $userid -r vets-api && \
     useradd -u $userid -r -m -d /srv/vets-api -g vets-api vets-api
-RUN echo "APT::Default-Release \"${RELEASE}\";" >> /etc/apt/apt.conf.d/99defaultrelease
-RUN mv /etc/apt/sources.list /etc/apt/sources.list.d/stable.list
-RUN echo "deb http://ftp.debian.org/debian testing main contrib non-free" >> /etc/apt/sources.list.d/testing.list
-RUN echo "deb http://deb.debian.org/debian unstable main" >> /etc/apt/sources.list.d/unstable.list
-RUN apt-get update
-RUN DEBIAN_FRONTEND=noninteractive apt-get install -y -t "${RELEASE}" \
-    dumb-init imagemagick pdftk poppler-utils curl libpq5 vim libboost-all-dev \
-    clamav clamdscan clamav-daemon
+RUN apt-get update --fix-missing
+RUN DEBIAN_FRONTEND=noninteractive apt-get install -y ca-certificates-java && \
+    DEBIAN_FRONTEND=noninteractive apt-get install -y dumb-init imagemagick pdftk poppler-utils curl \
+    libpq5 vim libboost-all-dev clamav clamdscan clamav-daemon
 
 # The pki work below is for parity with the non-docker BRD deploys to mount certs into
 # the container, we need to get rid of it and refactor the configuration bits into

Gemfile

@@ -58,7 +58,7 @@ gem 'carrierwave-aws'
 gem 'clam_scan'
 gem 'combine_pdf'
 gem 'config'
-gem 'connect_vbms', git: 'https://github.com/department-of-veterans-affairs/connect_vbms.git', branch: 'master', require: 'vbms'
+gem 'connect_vbms', git: 'https://github.com/adhocteam/connect_vbms', tag: 'v2.0.0.rc', require: 'vbms'
 gem 'date_validator'
 gem 'ddtrace'
 gem 'dogstatsd-ruby', '5.6.1'

Gemfile.lock

@@ -1,3 +1,17 @@
+GIT
+  remote: https://github.com/adhocteam/connect_vbms
+  revision: 6e5dc751afaf0da9c7cbc10c94b909f114f3a156
+  tag: v2.0.0.rc
+  specs:
+    connect_vbms (2.0.0.rc)
+      httpclient (~> 2.8.0)
+      httpi (~> 2.4)
+      mail
+      nokogiri (>= 1.8.4)
+      nori
+      xmldsig (~> 0.3.1)
+      xmlenc
+
 GIT
   remote: https://github.com/department-of-veterans-affairs/apivore
   revision: f8ccd476f6c5301f5ebe4e2dd5b30ff0e567ffc1
@@ -30,20 +44,6 @@ GIT
       nokogiri (>= 1.13.6)
       savon (= 2.12)
 
-GIT
-  remote: https://github.com/department-of-veterans-affairs/connect_vbms.git
-  revision: 1834cf61310001c82e2e96d665518407c3bce947
-  branch: master
-  specs:
-    connect_vbms (1.4.0)
-      httpclient (~> 2.8.0)
-      httpi (~> 2.4)
-      mail
-      nokogiri (>= 1.8.4)
-      nori
-      xmldsig (~> 0.3.1)
-      xmlenc
-
 GIT
   remote: https://github.com/department-of-veterans-affairs/fhir_client.git
   revision: 52e0197dcb1f940a1f0b28bfa983699f0c199696
@@ -317,7 +317,7 @@ GEM
     content_disposition (1.0.0)
     cork (0.3.0)
       colored2 (~> 3.1)
-    coverband (6.1.0)
+    coverband (6.1.1)
       redis (>= 3.0)
     crack (1.0.0)
       bigdecimal
@@ -663,7 +663,8 @@ GEM
     nokogiri (1.16.4)
       mini_portile2 (~> 2.8.2)
       racc (~> 1.4)
-    nori (2.6.0)
+    nori (2.7.0)
+      bigdecimal
     notiffany (0.1.3)
       nenv (~> 0.1)
       shellany (~> 0.0)
@@ -692,7 +693,7 @@ GEM
     os (1.1.4)
     ox (2.14.18)
     parallel (1.24.0)
-    parallel_tests (4.6.1)
+    parallel_tests (4.7.0)
       parallel
     parser (3.3.0.5)
       ast (~> 2.4.1)
@@ -890,7 +891,7 @@ GEM
     rswag-ui (2.13.0)
       actionpack (>= 3.1, < 7.2)
       railties (>= 3.1, < 7.2)
-    rubocop (1.63.2)
+    rubocop (1.63.3)
       json (~> 2.3)
       language_server-protocol (>= 3.17.0)
       parallel (~> 1.10)
@@ -997,7 +998,7 @@ GEM
     stringio (3.1.0)
     strong_migrations (1.8.0)
       activerecord (>= 5.2)
-    super_diff (0.11.0)
+    super_diff (0.12.0)
       attr_extras (>= 6.2.4)
       diff-lcs
       patience_diff

app/controllers/v0/profile/direct_deposits_controller.rb

@@ -11,8 +11,7 @@ module Profile
     class DirectDepositsController < ApplicationController
       service_tag 'direct-deposit'
       before_action { authorize :lighthouse, :direct_deposit_access? }
-      before_action :payment_account, only: :update
-      before_action :control_information, only: :update
+
       after_action :log_sso_info, only: :update
 
       rescue_from(*Lighthouse::ServiceException::ERROR_MAP.values) do |exception|
@@ -28,12 +27,19 @@ class DirectDepositsController < ApplicationController
       def show
         response = client.get_payment_info
 
+        set_control_information(response.body[:control_information])
+        log_control_info(@control_information, 'Show')
+
         render status: response.status,
                json: response.body,
                serializer: DisabilityCompensationsSerializer
       end
 
       def update
+        set_control_information(control_info_params)
+        set_payment_account(payment_account_params)
+
+        log_control_info(@control_information, 'Update')
         response = client.update_payment_info(@payment_account)
         send_confirmation_email
 
@@ -44,6 +50,15 @@ def update
 
       private
 
+      def log_control_info(control_info, action)
+        ::Rails.logger.info("Direct Deposit Control Info: #{action}",
+                            { benefit_type: control_info.benefit_type,
+                              updatable: control_info.account_updatable?,
+                              valid: control_info.valid?,
+                              restrictions: control_info.restrictions.join(', '),
+                              errors: control_info.errors.join(', ') })
+      end
+
       def single_form_enabled?
         Flipper.enabled?(:profile_show_direct_deposit_single_form, @current_user)
       end
@@ -56,12 +71,13 @@ def client
         @client ||= DirectDeposit::Client.new(@current_user.icn)
       end
 
-      def payment_account
-        @payment_account ||= Lighthouse::DirectDeposit::PaymentAccount.new(payment_account_params)
+      def set_payment_account(params)
+        @payment_account ||= Lighthouse::DirectDeposit::PaymentAccount.new(params)
       end
 
-      def control_information
-        @control_information ||= Lighthouse::DirectDeposit::ControlInformation.new(control_info_params)
+      def set_control_information(params)
+        @control_information ||= Lighthouse::DirectDeposit::ControlInformation.new
+        @control_information.assign_attributes(params)
       end
 
       def payment_account_params
@@ -84,7 +100,7 @@ def control_info_params
                       :has_no_fiduciary_assigned,
                       :is_not_deceased,
                       :has_payment_address,
-                      :has_indentity)
+                      :has_identity)
       end
 
       def send_confirmation_email

app/controllers/v0/terms_of_use_agreements_controller.rb

@@ -17,19 +17,17 @@ def latest
 
     def accept
       terms_of_use_agreement = acceptor.perform!
-
-      recache_user
+      recache_user unless terms_code_temporary_auth?
       render_success(action: 'accept', body: { terms_of_use_agreement: }, status: :created)
     rescue TermsOfUse::Errors::AcceptorError => e
       render_error(action: 'accept', message: e.message)
     end
 
     def accept_and_provision
       terms_of_use_agreement = acceptor(async: false).perform!
-
       if terms_of_use_agreement.accepted? && provisioner.perform
         create_cerner_cookie
-        recache_user
+        recache_user unless terms_code_temporary_auth?
         render_success(action: 'accept_and_provision', body: { terms_of_use_agreement:, provisioned: true },
                        status: :created)
       else
@@ -41,8 +39,7 @@ def accept_and_provision
 
     def decline
       terms_of_use_agreement = decliner.perform!
-
-      recache_user
+      recache_user unless terms_code_temporary_auth?
       render_success(action: 'decline', body: { terms_of_use_agreement: }, status: :created)
     rescue TermsOfUse::Errors::DeclinerError => e
       render_error(action: 'decline', message: e.message)
@@ -63,27 +60,27 @@ def update_provisioning
 
     def acceptor(async: true)
       TermsOfUse::Acceptor.new(
-        user_account: current_user.user_account,
-        common_name: current_user.common_name,
+        user_account: @user_account,
+        common_name:,
         version: params[:version],
         async:
       )
     end
 
     def decliner
       TermsOfUse::Decliner.new(
-        user_account: current_user.user_account,
-        common_name: current_user.common_name,
+        user_account: @user_account,
+        common_name:,
         version: params[:version]
       )
     end
 
     def provisioner
       TermsOfUse::Provisioner.new(
-        icn: current_user.icn,
-        first_name: current_user.first_name,
-        last_name: current_user.last_name,
-        mpi_gcids: current_user.mpi_gcids
+        icn: @user_account.icn,
+        first_name: mpi_profile.given_names.first,
+        last_name: mpi_profile.family_name,
+        mpi_gcids: mpi_profile.full_mvi_ids
       )
     end
 
@@ -102,29 +99,51 @@ def create_cerner_cookie
     end
 
     def find_latest_agreement_by_version(version)
-      current_user.user_account.terms_of_use_agreements.where(agreement_version: version).last
+      @user_account.terms_of_use_agreements.where(agreement_version: version).last
     end
 
     def authenticate_one_time_terms_code
       terms_code_container = SignIn::TermsCodeContainer.find(params[:terms_code])
-      @current_user = User.find(terms_code_container.user_uuid)
+      return unless terms_code_container
+
+      @user_account = UserAccount.find(terms_code_container.user_account_uuid)
     ensure
       terms_code_container&.destroy
     end
 
+    def authenticate_current_user
+      load_user(skip_terms_check: true)
+      return unless current_user
+
+      @user_account = current_user.user_account
+    end
+
+    def terms_code_temporary_auth?
+      params[:terms_code].present?
+    end
+
     def terms_authenticate
-      params[:terms_code].present? ? authenticate_one_time_terms_code : load_user(skip_terms_check: true)
+      terms_code_temporary_auth? ? authenticate_one_time_terms_code : authenticate_current_user
+
+      raise Common::Exceptions::Unauthorized unless @user_account
+    end
+
+    def mpi_profile
+      @mpi_profile ||= MPI::Service.new.find_profile_by_identifier(identifier: @user_account.icn,
+                                                                   identifier_type: MPI::Constants::ICN)&.profile
+    end
 
-      raise Common::Exceptions::Unauthorized unless @current_user
+    def common_name
+      "#{mpi_profile.given_names.first} #{mpi_profile.family_name}"
     end
 
     def render_success(action:, body:, status: :ok)
-      Rails.logger.info("[TermsOfUseAgreementsController] #{action} success", { icn: current_user.icn })
+      Rails.logger.info("[TermsOfUseAgreementsController] #{action} success", { icn: @user_account.icn })
       render json: body, status:
     end
 
     def render_error(action:, message:, status: :unprocessable_entity)
-      Rails.logger.error("[TermsOfUseAgreementsController] #{action} error: #{message}", { icn: current_user.icn })
+      Rails.logger.error("[TermsOfUseAgreementsController] #{action} error: #{message}", { icn: @user_account.icn })
       render json: { error: message }, status:
     end
   end