Non-gov access to information (Evaluators)

[r-bartlett-gsa]

User story

As a security officer, in order to ensure only users with verified identities have access to controlled or sensitive information, I would like to restrict non-government user access, regardless of assigned user role, to submissions and public solvers data.

Acceptance criteria:

• [ ] The following applies to an evaluator role (https://github.com/GSA/Challenge_gov/issues/1360 )
  • [ ] Evaluators should not be able to access any portal features, if they do access it via direct URL or any other link, they will be redirected back to the Rails and and an error message will be displayed that they do not have access to that
  • [ ] Evaluators will receive their submission materials offline/off-platform, and they will be able to enter their evaluations normally through the Submissions route on their dashboard
  • [ ] If user's email address is not ending in .gov or .mil, the user does not have access to any submissions data (PII & CUI)
  • [ ] If user's email address is not ending in .gov or .mil, the user does not have access to any public solvers data (PII & CUI)
• [ ] If user is assigned an evaluator role, but their email address does not end in .gov or .mil, then the originator type designation in security logs is evaluator_ng

Note: public solvers with non .gov or .mil accounts continue have access to submissions and public solvers data they inputted into challenge.gov

Definition of Done

Doing (dev team)

• [ ] Code complete
• [ ] Code is organized appropriately
• [ ] Any known trade offs are documented in the associated GH issue
• [ ] Code is documented, modules, shared functions, etc.
• [ ] Automated testing has been added or updated in response to changes in this PR
• [ ] The feature is smoke tested to confirm it meets requirements
• [ ] Database changes have been peer reviewed for index changes and performance bottlenecks
• [ ] PR that changes or adds UI
  • [ ] include a screenshot of the WAVE report for the altered pages
  • [ ] Confirm changes were validated for mobile responsiveness
• [ ] PR approved / Peer reviewed
• [ ] Security scans passed
• [ ] Automate accessibility tests passed
• [ ] Build process and deployment is automated and repeatable
• [ ] Feature toggles if appropriate
• [ ] Deploy to staging

• [ ] Move card to testing column in the board

  Staging

• [ ] Accessibility tested (Marni)
  • [ ] Keyboard navigation
  • [ ] Focus confirmed
  • [ ] Color contrast compliance
  • [ ] Screen reader testing
• [ ] Usability testing: mobile and desktop (Tracy or Marni)
• [ ] Cross browser testing (tool to be determined) (Tracy or Marni)
  • [ ] UI rendering is performant
• [ ] AC review (Renata)
• [ ] Deploy to production (production-like environment for eval capability) (dev team)

• [ ] Move to production column in the board

  Production

• [ ] User and security documentation has been reviewed for necessary updates (Renata/Tracy/Dev team)
• [ ] PO / PM approved (Jarah or Renata)
• [ ] AC is met and it works as expected (Jarah or Renata)
• [ ] Move to done column in the board (Jarah or Renata)

[stepchud]

@r-bartlett-gsa I am unclear what a non-gov evaluator would be able to access in the system? They will not have any evaluation functionality, right?

[TCKapGrp]

@stepchud The evaluator will have access to the evaluation form but not the submission data. The evaluator will not have access to view other evaluator's data for that submission. The evaluator will receive that submission offline. The challenge manager will have access to this evaluator's results.

[stepchud]

@mhotch24 @r-bartlett-gsa can we have a mockup for the non-gov evaluators view of the Submission when they are evaluating it?

[r-bartlett-gsa]

@stepchud