Send Identity Verification Email [#1010] #1115

pattisdr · 2022-08-19T21:45:39Z

Purpose

If subject identity verification is turned on, have the user verify their identity before queuing the request for execution.

Changes

Update existing create_privacy_request endpoint to check if identity verification is on
- If yes, set privacy request status to identity_unverified
- Caches a 6 digit code in Redis that lasts for ten minutes
- Emails that code to the user
- Suspends further processing of that request.
To resume where we left off, send a POST to /privacy-request/{{privacy_request_id}}/verify added here Send Identity Verification Email [#1010] #1115

Checklist

Ticket

Fixes #1010

…rification code.

… autouse override for just the tests where we want to turn on identity verification.

Start with identity_verification_required set to False for now until all the related pieces are in.

pattisdr · 2022-08-22T16:22:11Z

src/fidesops/ops/core/config.py

@@ -38,6 +38,7 @@ class ExecutionSettings(FidesSettings):
    task_retry_count: int
    task_retry_delay: int  # In seconds
    task_retry_backoff: int
+    identity_verification_required: bool = False


I am just setting a config variable for now, but this is subject to change with #1009. I think we should leave this as False until all the relevant pieces of this epic are in.

pattisdr · 2022-08-22T16:24:29Z

src/fidesops/ops/api/v1/endpoints/privacy_request_endpoints.py

+def _send_verification_code_to_user(
+    db: Session, privacy_request: PrivacyRequest, email: Optional[str]
+) -> None:
+    """Generate and cache a verification code, and then email to the user"""
+    verification_code: str = generate_id_verification_code()
+    privacy_request.cache_identity_verification_code(verification_code)
+    dispatch_email(
+        db,
+        action_type=EmailActionType.SUBJECT_IDENTITY_VERIFICATION,
+        to_email=email,
+        email_body_params=SubjectIdentityVerificationBodyParams(
+            access_code=verification_code
+        ),
+    )
+


Verified in local integration testing, after setting identity_verification_required to True and setting up a separate mailgun EmailConfig, submitting a privacy request for an email address I own, sent the following to my email:

Your one-time code is XXXXXX. Hurry! It expires in 10 minutes.

seanpreston · 2022-08-22T21:09:17Z

clients/ops/admin-ui/src/features/privacy-requests/constants.ts

@@ -10,4 +10,5 @@ export const SubjectRequestStatusMap = new Map<string, string>([
  ["In Progress", "in_processing"],
  ["New", "pending"],
  ["Paused", "paused"],
+  ["Unverified", "identity_unverified"],


Thanks for adding these frontend elements

I didn't have a choice! If a privacy request exists in the database, and it had this new request status, you'd get a UI error on the privacy request page that made it unusable.

docs/fidesops/docs/guides/configuration_reference.md

seanpreston · 2022-08-22T21:22:15Z

src/fidesops/ops/api/v1/endpoints/privacy_request_endpoints.py

@@ -212,7 +226,14 @@ def create_privacy_request(
                    },
                )
                queue_privacy_request(privacy_request.id)
-
+        except EmailDispatchException as exc:


I think it's possible for this exception to be thrown when FIDESOPS__EXECUTION__IDENTITY_VERIFICATION_REQUIRED is toggled off? if so we should check whether to enforce it in this or otherwise move this try / except block closer to _send_verification_code_to_user?

I don't think we're triggering an email send anywhere else in the flow right now?

We'll do it via tasks too as part of #1088, so maybe it's best to leave this for then

seanpreston · 2022-08-22T21:52:42Z

tests/ops/api/v1/endpoints/test_privacy_request_endpoints.py

+            email_config=email_config,
+            email=EmailForActionType(
+                subject="Your one-time code",
+                body=f"<html>Your one-time code is {pr.get_cached_verification_code()}. Hurry! It expires in 10 minutes.</html>",


It would be better to refer directly to config.redis.identity_verification_code_ttl_seconds in the copy for this email — that way if that value is updated the emails will still show correct information

It seems like @TheAndrewJackson 's templating work covers this, I think there's just a little bit of merging effort, depending on whose PR goes in first. https://github.com/ethyca/fidesops/pull/1123/files#diff-aa27823caeff69b0d8b6124395820278bd5708e9a6ce0aa8521c5f5d5ad00f5eR36

seanpreston

Just two minor changes:

Update the email copy to directly refer to config.redis.identity_verification_code_ttl_seconds
Update the toggle var name to include __SUBJECT_ to be clearer

pattisdr · 2022-08-22T22:06:13Z

Thank you for the review @seanpreston!

…n_required for clarity.

pattisdr · 2022-08-23T17:15:02Z

Verified I received new email with Andrew's templating merge with:

Your privacy request verification code is 442512. Please return to the Privacy Center and enter the code to continue. This code will expire in 10 minutes

^ Note this code is just for my local environment, nothing secure is pasted here.

* If identity verification required, send email to the user with the verification code. * Adjust the identity_verification_required autouse fixture, and add an autouse override for just the tests where we want to turn on identity verification. * Add starting docs and updating the changelog. Start with identity_verification_required set to False for now until all the related pieces are in. * Update some of the docstrings. * Add unverified status color in the FE. * Add new privacy request status to types and constants. * Restore trailing comma. * Update identity_verification_required to subject_identity_verification_required for clarity. * Adjust email_body_params to accommodate new template. Co-authored-by: Sean Preston <sean@ethyca.com>

If identity verification required, send email to the user with the ve…

f3b600f

…rification code.

pattisdr changed the title ~~Send Identity Verification Email [#1010]~~ [Draft] Send Identity Verification Email [#1010] Aug 19, 2022

pattisdr added 2 commits August 22, 2022 09:47

Adjust the identity_verification_required autouse fixture, and add an…

4f50937

… autouse override for just the tests where we want to turn on identity verification.

Add starting docs and updating the changelog.

d52e317

Start with identity_verification_required set to False for now until all the related pieces are in.

pattisdr changed the title ~~[Draft] Send Identity Verification Email [#1010]~~ Send Identity Verification Email [#1010] Aug 22, 2022

pattisdr commented Aug 22, 2022

View reviewed changes

Update some of the docstrings.

583ad25

pattisdr marked this pull request as ready for review August 22, 2022 16:45

pattisdr added 3 commits August 22, 2022 13:39

Add unverified status color in the FE.

71f28f3

Add new privacy request status to types and constants.

7ba67f3

Restore trailing comma.

1b25252

seanpreston reviewed Aug 22, 2022

View reviewed changes

docs/fidesops/docs/guides/configuration_reference.md Outdated Show resolved Hide resolved

seanpreston reviewed Aug 22, 2022

View reviewed changes

seanpreston suggested changes Aug 22, 2022

View reviewed changes

seanpreston self-assigned this Aug 23, 2022

Update identity_verification_required to subject_identity_verificatio…

9d9736e

…n_required for clarity.

seanpreston approved these changes Aug 23, 2022

View reviewed changes

Sean Preston and others added 3 commits August 23, 2022 11:46

Merge branch 'main' into fidesops_1010_validation_email

056aec9

Merge branch 'main' into fidesops_1010_validation_email

01e78bc

Adjust email_body_params to accommodate new template.

b32adfe

seanpreston merged commit 7193f3c into main Aug 23, 2022

seanpreston deleted the fidesops_1010_validation_email branch August 23, 2022 20:34

TheAndrewJackson mentioned this pull request Aug 31, 2022

#1008 User identity verification flow #1231

Merged

10 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Send Identity Verification Email [#1010] #1115

Send Identity Verification Email [#1010] #1115

pattisdr commented Aug 19, 2022 •

edited

Loading

pattisdr Aug 22, 2022 •

edited

Loading

pattisdr Aug 22, 2022

seanpreston Aug 22, 2022

pattisdr Aug 23, 2022

seanpreston Aug 22, 2022

pattisdr Aug 23, 2022

seanpreston Aug 23, 2022

seanpreston Aug 22, 2022

pattisdr Aug 23, 2022 •

edited

Loading

seanpreston left a comment

pattisdr commented Aug 22, 2022

pattisdr commented Aug 23, 2022 •

edited

Loading

Send Identity Verification Email [#1010] #1115

Send Identity Verification Email [#1010] #1115

Conversation

pattisdr commented Aug 19, 2022 • edited Loading

Purpose

Changes

Checklist

Ticket

pattisdr Aug 22, 2022 • edited Loading

Choose a reason for hiding this comment

pattisdr Aug 22, 2022

Choose a reason for hiding this comment

seanpreston Aug 22, 2022

Choose a reason for hiding this comment

pattisdr Aug 23, 2022

Choose a reason for hiding this comment

seanpreston Aug 22, 2022

Choose a reason for hiding this comment

pattisdr Aug 23, 2022

Choose a reason for hiding this comment

seanpreston Aug 23, 2022

Choose a reason for hiding this comment

seanpreston Aug 22, 2022

Choose a reason for hiding this comment

pattisdr Aug 23, 2022 • edited Loading

Choose a reason for hiding this comment

seanpreston left a comment

Choose a reason for hiding this comment

pattisdr commented Aug 22, 2022

pattisdr commented Aug 23, 2022 • edited Loading

pattisdr commented Aug 19, 2022 •

edited

Loading

pattisdr Aug 22, 2022 •

edited

Loading

pattisdr Aug 23, 2022 •

edited

Loading

pattisdr commented Aug 23, 2022 •

edited

Loading