Skip to content

Demandeur d’emploi : Empêcher l’édition de l’identité pivot pour les candidats identifiés par l’API Particulier [GEN-1380]#5749

Merged
francoisfreitag merged 1 commit into
masterfrom
ff/ro-fields-2
Apr 28, 2025
Merged

Demandeur d’emploi : Empêcher l’édition de l’identité pivot pour les candidats identifiés par l’API Particulier [GEN-1380]#5749
francoisfreitag merged 1 commit into
masterfrom
ff/ro-fields-2

Conversation

@francoisfreitag

@francoisfreitag francoisfreitag commented Mar 11, 2025

Copy link
Copy Markdown
Member

🤔 Pourquoi ?

Les candidats dont l’identité a été reconnue par l’API particulier ne doivent plus pouvoir changer d’identité.

🏝️ Comment tester ?

Bien penser aux cas suivants :

  • Mise à jour d’un compte candidat par un employeur à l’acceptation de la candidature
  • Mise à jour d’un compte candidat par un tiers
    • employeur
    • orienteur
    • PH
  • Mise à jour d’un candidat à la création de la fiche salarié
  • Mise à jour par le candidat
  • SSO (FranceConnect et PE Connect)

💻 Captures d'écran

Details screenshot-20250313-181532 screenshot-20250313-174207 screenshot-20250313-173959 screenshot-20250313-171853 screenshot-20250313-171828
  • Protéger l’admin contre les changements d’identité pour les candidats certifiés.

@francoisfreitag francoisfreitag added the modifié Modifié dans le changelog. label Mar 11, 2025
@francoisfreitag francoisfreitag self-assigned this Mar 11, 2025
@francoisfreitag francoisfreitag changed the title Demandeur d’emploi : Empêcher l’édition de l’identité pivot pour les candidats certifiés par l’API Particulier Demandeur d’emploi : Empêcher l’édition de l’identité pivot pour les candidats certifiés par l’API Particulier [GEN-1380] Mar 11, 2025
@notion-workspace

Copy link
Copy Markdown

@francoisfreitag

Copy link
Copy Markdown
Member Author

Je préparerai une recette jetable avec des belles données factices jeudi.

@xavfernandez

Copy link
Copy Markdown
Contributor

Il manque le message expliquant pourquoi les champs ne sont pas modifiables non ?

@francoisfreitag

Copy link
Copy Markdown
Member Author

En effet, merci. C'était le plus facile alors je l'ai occulté 🫣

@francoisfreitag francoisfreitag added the 1-recette-jetable [Payé à l’heure] Crée une recette jetable sur CC label Mar 13, 2025
@github-actions

Copy link
Copy Markdown

🥁 La recette jetable est prête ! 👉 Je veux tester cette PR !

@francoisfreitag francoisfreitag force-pushed the ff/ro-fields-2 branch 2 times, most recently from ce6a55a to 87dc1c8 Compare March 17, 2025 11:09

@celine-m-s celine-m-s left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Youhou ! Un grand pas en avant ! 👍
Le message de ton premier commit ne me semble plus à jour car j'ai l'impression que la TODO a été faite (SSO plus tests).

Comment thread itou/users/models.py Outdated
Comment thread itou/users/forms.py
Comment thread tests/www/apply/test_process.py
Comment thread tests/www/employee_record_views/test_create.py
Comment thread tests/www/job_seekers_views/test_create_or_update.py
Comment thread itou/templates/includes/job_seekers/readonly_form.html Outdated
Comment thread tests/users/constants.py Outdated
@francoisfreitag francoisfreitag force-pushed the ff/ro-fields-2 branch 2 times, most recently from d5f7bb3 to d99a013 Compare March 25, 2025 09:09
@francoisfreitag

Copy link
Copy Markdown
Member Author

@celine-m-s J’ai fait des fixups, je squasherai quand tu auras revu et sera d’accord :)

@celine-m-s

Copy link
Copy Markdown
Contributor

C'est tout bon pour moi ! :) 🚀
Je n'ai pas fait de test manuel. Dis-moi si tu l'estimes nécessaire.

@francoisfreitag

Copy link
Copy Markdown
Member Author

Joffrey est sur le coup (via la recette jetable) !

@francoisfreitag

Copy link
Copy Markdown
Member Author

Je viens d’ajouter un commit a939b1d @celine-m-s

L’idée est de bloquer l’édition des informations personnelles dès qu’un candidat est reconnu, peu importe s’il a un critère certifié.

@francoisfreitag francoisfreitag changed the title Demandeur d’emploi : Empêcher l’édition de l’identité pivot pour les candidats certifiés par l’API Particulier [GEN-1380] Demandeur d’emploi : Empêcher l’édition de l’identité pivot pour les candidats identifiés par l’API Particulier [GEN-1380] Apr 3, 2025
francoisfreitag added a commit that referenced this pull request Apr 7, 2025
This denormalized field caches when a job seeker has been recognized by
an external identity certifier. It means that person is known from
trusted identity referential and their identity should not change.

An upcoming migration will populate the field, and
#5749 will rely on it.
francoisfreitag added a commit that referenced this pull request Apr 7, 2025
When a job seeker identity is certified by an external source, populate
this field to record when the certification occurred.

This will be used for several purposes:
1. Centralize certification to make corresponding fields read only, and
   providing details to users
2. Prevent users from changing identities after the system has confirmed
   their eligibility (eg. BRSA on API Particulier)
3. Refresh certified identities once in a while
4. When the CNAV identity provider is available, the certified fields
   should depend on each user. Using a ManyToManyField with a through
   table will facilitate storing what fields have been certified.

An upcoming migration will populate the field, and
#5749 will rely on it.
francoisfreitag added a commit that referenced this pull request Apr 7, 2025
When a job seeker identity is certified by an external source, populate
this field to record when the certification occurred.

This will be used for several purposes:
1. Centralize certification to make corresponding fields read only, and
   providing details to users
2. Prevent users from changing identities after the system has confirmed
   their eligibility (eg. BRSA on API Particulier)
3. Refresh certified identities once in a while
4. When the CNAV identity provider is available, the certified fields
   should depend on each user. Using a ManyToManyField with a through
   table will facilitate storing what fields have been certified.

An upcoming migration will populate the field, and
#5749 will rely on it.
francoisfreitag added a commit that referenced this pull request Apr 7, 2025
When a job seeker identity is certified by an external source, populate
this field to record when the certification occurred.

This will be used for several purposes:
1. Centralize certification to make corresponding fields read only, and
   providing details to users
2. Prevent users from changing identities after the system has confirmed
   their eligibility (eg. BRSA on API Particulier)
3. Refresh certified identities once in a while
4. When the CNAV identity provider is available, the certified fields
   should depend on each user. Using a ManyToManyField with a through
   table will facilitate storing what fields have been certified.

An upcoming migration will populate the field, and
#5749 will rely on it.
francoisfreitag added a commit that referenced this pull request Apr 7, 2025
When a job seeker identity is certified by an external source, populate
this field to record when the certification occurred.

This will be used for several purposes:
1. Centralize certification to make corresponding fields read only, and
   providing details to users
2. Prevent users from changing identities after the system has confirmed
   their eligibility (eg. BRSA on API Particulier)
3. Refresh certified identities once in a while
4. When the CNAV identity provider is available, the certified fields
   should depend on each user. Using a ManyToManyField with a through
   table will facilitate storing what fields have been certified.

An upcoming migration will populate the field, and
#5749 will rely on it.
francoisfreitag added a commit that referenced this pull request Apr 7, 2025
When a job seeker identity is certified by an external source, populate
this field to record when the certification occurred.

This will be used for several purposes:
1. Centralize certification to make corresponding fields read only, and
   providing details to users
2. Prevent users from changing identities after the system has confirmed
   their eligibility (eg. BRSA on API Particulier)
3. Refresh certified identities once in a while
4. When the CNAV identity provider is available, the certified fields
   should depend on each user. Using a ManyToManyField with a through
   table will facilitate storing what fields have been certified.

An upcoming migration will populate the field, and
#5749 will rely on it.
@francoisfreitag francoisfreitag force-pushed the ff/ro-fields-2 branch 2 times, most recently from 7b2ac25 to cf3764d Compare April 14, 2025 13:36
@francoisfreitag

Copy link
Copy Markdown
Member Author

Je crois avoir pris en compte toute tes remarques avec les derniers fixups ?

Comment thread itou/openid_connect/models.py Outdated
francoisfreitag added a commit that referenced this pull request Apr 14, 2025
The birthdate was treated separately, and multiple code path had to act
special case that field. A new code path would again have to special
case that field:
#5749 (comment)

Instead, dispatch data from the SSO:
- `sso_data_dict` comes from the SSO (excluding empty values)
- `user_data_dict` stores User data
- `jobseeker_data_dict` stores JobSeekerProfile data
francoisfreitag added a commit that referenced this pull request Apr 14, 2025
The birthdate was treated separately, and multiple code path had to act
special case that field. A new code path would again have to special
case that field:
#5749 (comment)

Instead, dispatch data from the SSO:
- `sso_data_dict` comes from the SSO (excluding empty values)
- `user_data_dict` stores User data
- `jobseeker_data_dict` stores JobSeekerProfile data
francoisfreitag added a commit that referenced this pull request Apr 14, 2025
The birthdate was treated separately, and multiple code path had to act
special case that field. A new code path would again have to special
case that field:
#5749 (comment)

Instead, dispatch data from the SSO:
- `sso_data_dict` comes from the SSO (excluding empty values)
- `user_data_dict` stores User data
- `jobseeker_data_dict` stores JobSeekerProfile data
francoisfreitag added a commit that referenced this pull request Apr 14, 2025
The birthdate was treated separately, and multiple code path had to act
special case that field. A new code path would again have to special
case that field:
#5749 (comment)

Instead, dispatch data from the SSO:
- `sso_data_dict` comes from the SSO (excluding empty values)
- `user_data_dict` stores User data
- `jobseeker_data_dict` stores JobSeekerProfile data
francoisfreitag added a commit that referenced this pull request Apr 14, 2025
The birthdate was treated separately, and multiple code path had to act
special case that field. A new code path would again have to special
case that field:
#5749 (comment)

Instead, dispatch data from the SSO:
- `sso_data_dict` comes from the SSO (excluding empty values)
- `user_data_dict` stores User data
- `jobseeker_data_dict` stores JobSeekerProfile data
francoisfreitag added a commit that referenced this pull request Apr 14, 2025
The birthdate was treated separately, and multiple code path had to act
special case that field. A new code path would again have to special
case that field:
#5749 (comment)

Instead, dispatch data from the SSO:
- `sso_data_dict` comes from the SSO (excluding empty values)
- `user_data_dict` stores User data
- `jobseeker_data_dict` stores JobSeekerProfile data
francoisfreitag added a commit that referenced this pull request Apr 14, 2025
The birthdate was treated separately, and multiple code path had to act
special case that field. A new code path would again have to special
case that field:
#5749 (comment)

Instead, dispatch data from the SSO:
- `sso_data_dict` comes from the SSO (excluding empty values)
- `user_data_dict` stores User data
- `jobseeker_data_dict` stores JobSeekerProfile data
@francoisfreitag francoisfreitag force-pushed the ff/ro-fields-2 branch 2 times, most recently from 280c141 to f433486 Compare April 14, 2025 15:58

@xavfernandez xavfernandez left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍

francoisfreitag added a commit that referenced this pull request Apr 15, 2025
The birthdate was treated separately, and multiple code path had to act
special case that field. A new code path would again have to special
case that field:
#5749 (comment)

Instead, dispatch data from the SSO:
- `sso_data_dict` comes from the SSO (excluding empty values)
- `user_data_dict` stores User data
- `jobseeker_data_dict` stores JobSeekerProfile data
github-merge-queue Bot pushed a commit that referenced this pull request Apr 15, 2025
The birthdate was treated separately, and multiple code path had to act
special case that field. A new code path would again have to special
case that field:
#5749 (comment)

Instead, dispatch data from the SSO:
- `sso_data_dict` comes from the SSO (excluding empty values)
- `user_data_dict` stores User data
- `jobseeker_data_dict` stores JobSeekerProfile data
@francoisfreitag francoisfreitag force-pushed the ff/ro-fields-2 branch 2 times, most recently from 950f353 to 30e6488 Compare April 17, 2025 09:45
@francoisfreitag

Copy link
Copy Markdown
Member Author

Je viens d’ajouter 30e6488, je vais le squash une fois qu’il sera relu.

Comment thread itou/users/admin.py
"fields_history_formatted",
]
if obj:
readonly_fields.extend(obj.readonly_pii_fields())

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Django ne se plaint pas quand on lui fournit le nom d'un champ qui n'existe pas sur le modèle ? (birthdate pour User ou first_name pour JobSeekerProfile)

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nope :)

@francoisfreitag francoisfreitag removed the 1-recette-jetable [Payé à l’heure] Crée une recette jetable sur CC label Apr 17, 2025
The job seeker identity is used to certify eligibility against the API
Particuliers. When eligibility is certified, the hire will be removed
from siae evaluations.

In order to prevent employers to reuse an identity for multiple job
seekers, make sure the job seeker personal data is locked when their
eligibility has been confirmed.

Also, since the job seeker has been found in an external certification
authority, make their fields read-only to increase the likelihood of
success for next API particulier calls.

To better show the dependency between read-only form fields and the API
Particuliers, factor out the required fields for the API into constants
that can be reused across the codebase.
@francoisfreitag francoisfreitag added this pull request to the merge queue Apr 28, 2025
Merged via the queue into master with commit 1f63fcd Apr 28, 2025
@francoisfreitag francoisfreitag deleted the ff/ro-fields-2 branch April 28, 2025 10:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

modifié Modifié dans le changelog.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants