[Epic] Complete your user profile (first time user)

[kristenshaw4]

Milestone: Authorize

The shared data filing platform will be used by filers of small business lending (SBL) and mortgage lending (HMDA) data to centrally manage their account (user profile, financial institution details, login through Login,gov, etc.).

Epic: Complete your user profile (first time user)

Overview

• The user will arrive at this page on their first visit after creating their Login.gov account and/or logging in with Login.gov
• This screen will act as a gate to insure the user is fully configured prior to entering the rest of the system.
• Once the user has a user profile and is authorized they will not see this page again.
• For an authorized user any changes to their user profile will be handled on the "Request changes to your user profile" page.

Steps:

• The user logs in through Login.gov and lands on this page
• The user will be asked to enter their First name and Last name
• Their email address will auto-populate based on the email address they used to sign in with Login.gov.
• They will be able to associate with one or more financial institutions either by selecting from a pre-populated list of financial institutions/LEIs OR by filling out and submitting the Salesforce form.
• Only the selections from the pre-populated list of financial institutions/LEIs that match their email domain will allow a user immediate access to the system.
• Submissions via the Salesforce form will be handled by the support staff (SBL help).

Tasks

• [x] Pull together the relevant user stories for this epic
• [X] Make a list of the content requirements for this epic
• [X] Make a list of the technical requirements for this epic
• [X] Post current wireframes and mock-ups
• [x] Review wireframes and mock-ups with FEWD, BEWD, Data, SBL Help, Content team members
• [ ] Refine user stories to prepare for development phase
• [x] Identify tasks for user testing (to validate findability of information, clarity of content and layout, users able to successfully complete important tasks)

User stories

Prioritized for MVP:

• [x] #17
• [x] #18
• [x] #19
• [x] #23
• [x] #27
• [x] #62

Backlog

• [ ] #22
• Given a user's financial institution email address does not match any of our approved email domains and their application for an LEI is in process with GLEIF, when the user tries to complete their user profile, then they will be redirected to the Update your user profile (Salesforce form) and will be alerted that their profile may take longer to complete while GLEIF processes their application.

Technical requirements

1. User management API
   1. Reads data from and writes data back to Keycloak
2. Institutions API
   1. Retrieve institution data by LEI and email domain

User testing

Task ideation

Scenario 1: The user sees all of the financial institutions they are authorized to file for

• What do users expect the system to do to verify that they should be associated with an institution?
• How much do users trust our system to correctly associate individuals with institutions?
• Do users understand how to get additional help?

Scenario 2: The user does not see all of the financial institutions they are authorized to file for

• What does the user expect to do so that they can be associated with their institution(s)?
• Do users understand each piece of information we are asking them to provide?
• What do users expect to happen after submitting this information?

Scenario 3: User logs in to Login.gov using a personal email address

• Does the user understand what went wrong?
• Does the user know what to do next?

Current designs (MVP)

Updated: 12/28/2023

Scenarios for financial institution association/email domain/email address

Scenario 1: The user sees all of the financial institutions they are authorized to file for

• User logs in through Login.gov with their financial institution’s email address.
• Front end calls the back end to check for personal email address. This passes.
• The front end calls the back end to see if there are any matches between the user’s email domain and a financial institution email domain in our financial institution database.
• The user's email domain matches the email domain of a financial institution in our financial institution database
• The back end returns the list of matches and the front end presents those matches to the user.
• The user sees a list of one or more matches and selects the financial institution(s) that they are authorized to file for by clicking the checkbox.
• If the user does not see the financial institution that they are authorized to file for in the list they click on the "Contact support staff" link.
• The user clicks submit to submit their first name, last name, and financial institution.
• On the back end Keycloak gets updated with the user’s first name, and last name, and the user is added to the Keycloak group (the institution)
• The user advances to the shared landing page (authenticated). 


Scenario 1

Scenario 2: The user does not see all of the financial institutions they are authorized to file for

• User logs in with their financial institution email address.
• Front end calls the back end to check for personal email address. This passes.
• The front end calls the back end to see if there are any matches between the user’s email domain and a financial institution email domain in our financial institution database.
• On the back end the user’s email domain does not match the email domain of a financial institution in our database. The backend does not return any matches.
• The front end displays a Salesforce form.
• The user fills out the Salesforce form and submits to the support staff.
• The support staff receives the form output via email.
• [See specific help process - by the end of this process the user's email domain has been associated with the financial institution and their user profile is complete.
• The user receives an email from the help team which includes a link to the shared landing unauthenticated page.
• The user clicks the log in link, logs in with Login.gov, and advances directly to the shared landing (authenticated) page.

Salesforce form	Salesforce notification

Scenario 3: User logs in to Login.gov using a personal email address

• User logs in to Login.gov using their personal email address
• On the back end the user’s email address is checked against the deny list and matches one of the denied email domains.
• User sees a notification message indicating that they must log in again using their financial institutions email address.
• User returns to Login.gov and logs in with their financial institution email address. 


User logs in with personal email address

Scenario 4: User submits form without filling out all the required fields

User submits incomplete form

[natalia-fitzgerald]

Archive of steps (prior to MVP definition):

Steps:

• The user logs in through Login.gov and lands on this page
• The user will be asked to enter their First name and Last name
• Their email address will auto-populate based on the email address they used to sign in with Login.gov.
• They will be able to associate with one or more financial institutions either by selecting from a pre-populated list of financial institutions/LEIs that match their email domain or by manually searching and selecting from the full database.
• Only the selections from the pre-populated list of financial institutions/LEIs that match their email domain will allow a user immediate access to the system.
• Selections using the search and select will be sent to the technical help team for review.

Archive of scenarios prior to MVP definition:

• Scenario 1, A-C = successful account creation, email domain matches to 1 or more FIs
  • task 1
• Scenario 2 = the email used was on the deny list
  • Imagine you completed the previous steps successfully and then you run into this message, what is your initial reaction?
  • does the message clearly communicate what went wrong?
  • Is it clear how you should proceed?
• Scenario 3 = no email domain matches, user must use search and select feature
  • Proceed as if you you work for Bank 1 bank.
  • have user complete the form and observe if there are any places they seem to struggle
  • Is the search and select form intuitive and easy to use?
    • what could be improved?
  • user profile submission status page
    • is it clear what to expect next?
• Scenario 4 = FI not in our database error message
  • What would you do next?
• Scenario 5 = a bug; probably don't need to test with users?

Current designs

Updated: 9/22/2023

Scenarios for financial institution association/email domain/email address

1. User logs in with Login.gov using their financial institution's email address. We have their email domain in our system. Their financial institution/LEI is in our database.
2. User logs in with Login.gov using their financial institution email address. We do not have their financial institution's email domain in our system. We do have their financial institution/LEI in our database.
3. User logs in with Login.gov using a personal email address.
4. User logs in with Login.gov using their financial institution email address. We do not have their financial institution's email domain in our system. We do not have their financial institution/LEI in our system.
5. User logs in with Login.gov using their financial institution email address. We do have their financial institution's email domain in our system. We do not have their financial institution/LEI in our system.

Scenario 1:

User logs in with Login.gov using their financial institution's email address. We have their email domain in our system and their financial institution/LEI is in our database.

1A. User selects from the financial institution/LEI(s) that match by email domain

• After user clicks "submit" they are directed to a page that indicates that they have successfully completed their user profile.
• The user now has a user profile, is associated with one or more financial institutions, and is authorized to proceed with filing data.
• They can click the button to proceed to the shared data filing platform landing (authenticated)

Initial screen	Selection made	Success notification

1B. User searches and selects from the full database

• After user clicks "submit" they are directed to a page that indicates that the user's selection has been submitted to SBL Help for review and that they will have to wait for an email from SBL Help that their account is approved and they are able to proceed.
• The user does not have the option of proceeding to the CFPB shared data filing platform landing page (authenticated) page.

Initial screen	Selection made	Warning notification

1C. User selects from the financial institution/LEI(s) that match by email domain and searches and selects from the full database

• After the user clicks "submit" they are directed to a page that indicates that they can proceed with filing for the financial institutions that were pulled from email domain matches but that their self-selection(s) (from the search and select) have been submitted to SBL Help for review. They will have to wait for an email from SBL Help indicating that their account is approved and they are able to proceed with filing for the additional institutions.
• The user now has a user profile, is associated with a financial institution, and is authorized to proceed with filing data (for only the financial institution(s) that they selected from the matches by email domain)

Initial screen	Selection made	Warning/Partial success

Scenario 2:

User logs in with Login.gov using a personal email address.

• If the email domain that the user logs in with is on our list of denied email domains (gmail.com, yahoo.com, hotmail.com, etc.) they will be directed to a page with an error notification that states that we don't support non-financial institution email addresses and that they should go back to Login.gov and login with their financial institution email address.

Initial screen

Scenario 3A:

User logs in with Login.gov using their financial institution email address. We do not have their financial institution's email domain in our system. We do not have their financial institution/LEI in our system.

• In this scenario the user would use the search and select feature to search for their financial institution and/or LEI but find no matches to their search terms
• An inline error notification displays below the search and select indicating that no results were found.
• This should only occur in the following cases:
  • The entity has not registered,
  • Our data from GLEIF does not contain the entity because they registered recently
• In this scenario the error message should tell the user that they either need to register for an LEI with GLEIF, or that if they recently registered for an LEI it’s not in our system yet and they should check back in _____ days?

Initial screen	No results found

Scenario 3B:

User logs in with Login.gov using their financial institution email address. We do not have their financial institution's email domain in our system. We do have their financial institution/LEI in our database.

• In this scenario the user would use the search and select feature to find their financial institution and/or LEI and select one or more.
• After the user clicks "submit" they are directed to a page that indicates that their selection has been submitted to SBL Help for review and that they will have to wait for an email from SBL Help that their account is approved and they are able to proceed.
• The user does not have the option of proceeding to the CFPB shared data filing platform landing page (authenticated) page.

Initial screen	Selections made	Warning notification

Scenario 4:

User logs in with Login.gov using their financial institution email address. We do have their financial institution's email domain in our system. We do not have their financial institution/LEI in our system.

• This scenario probably isn't possible if we structure the data appropriately...and even if it is, it should be considered a bug if that state gets makes it out to the UI. It's a good one to think about, though. If we have Fis and domains as a many-to-many relationship...🤔 theoretically possible I suppose.
• If the user logs in with their FI email and we do have their email domain in our system and do not have their FI/LEI in our system then this is a bug and the user should contact SBL Help.

Discussions

(pulled from the features doc)

Questions

To what extent can we streamline the process of what HMDA does today?

• Auto-create a Salesforce ticket?
• Proactively call users?
• Some means of viewing a queue/list of users who've logged in, but cannot use the system due no institution associations.

Is the email address used for anything other than associating a user with a financial institution?

• The email address is used to associate a user with a financial institution and is where submission confirmations are sent

Login.gov process for updating an email address:

• Go to Login.gov & log in with email+password+2FA
• • Add new email (requires email validation link, re-sign in with original email+password+2FA)
• Can delete original email address

[natalia-fitzgerald]

@meissadia @shindigira In order to be sure that we're capturing the component work as we work through epics and stories I added the tasks related to the React component library here: https://github.com/cfpb/sbl-project/issues/12#issue-1830018225.

[natalia-fitzgerald]

Task:

Write additional user stories for the following:

• Error state/messaging approach for when a user clicks on the submit button but hasn't field out the required fields (First name, Last name, financial institution selection)
• General unknown error state for when something unexpected goes wrong with the page
  • Inline message or page level notification

[natalia-fitzgerald]

Additional design tasks:

1. Create a generic error for when things go wrong (For example a 505 error)

2. Error states for incomplete submission

• I did some thinking and instead of using a disabled button on the form I'll leave the button active which will allow the user to click the submit button and will give us the opportunity to visually indicate what's missing or what went wrong.
• Scenarios 1: User does not input first name and/or last name but does select a financial institution:
  • What happens on the back-end here?
  • On the front end: First name and last name fields are highlighted with error styling and a message. If there are multiple errors (or maybe for any number of errors) an error notification also appears at the top of the page (under the heading and subheading listing out what went wrong and linking to the sections that are missing information)
• Scenario 2: User does enter a first name and last name but does not select a financial institution
  • On the front end: Financial institution field is highlighted in red with an inline error message below. If there are multiple errors (or maybe for any number of errors) an error notification also appears at the top of the page (under the heading and subheading listing out what went wrong and linking to the sections that are missing information)
  • What happens on the back-end here?

    3. Add privacy statement content

    4. Continue to work through relevant components in the React component library

    5. Provide review and feedback on prototype

    6. Figure out where we should accommodate the information related to registering for an LEI with GLEIF.

    This content is currently in the subheading but this area really should be for very top level information related to the page. With that being said adding this information to a notification could prove problematic because we will likely have other notification content related to the form

    7. Discuss using the global header until a user has completed the authorization step.

    Because a user isn't logged in to the system (from the user perspective) when they access this page I've been thinking that it may be more appropriate to use the CFPB global header here (instead of the filing platform header space). Then when they are finally authorized to continue to the platform there is a visual change in where they are - they have entered.

@kristenshaw4 - Let's discuss

[natalia-fitzgerald]

@hkeeler @kristenshaw4 I have now updated the images posted here: https://github.com/cfpb/sbl-project/issues/12#issue-1830018225. Please let me know if any additional updates need to be made.

[natalia-fitzgerald]

@angelcardoz @dan-padgett I have now updated this post to include the most up-to-date scenarios and mock-ups. Now that we have de-prioritized the user story related to search and select (https://github.com/cfpb/sbl-project/issues/22) might we want to capture a user story related to a user wanting to associate with a financial institution that is not associated with the user's email domain (i.e. Salesforce form path)? It seems like there will be a lot of work related to that so we should probably capture it in a story.

+Adding @sthomas93 @chynnakeys @hkeeler for awareness

[natalia-fitzgerald]

@angelcardoz @dan-padgett Tasks related to the Salesforce form and flow should be children of this story issue.

[Story] Get help associating email domain with financial institution in our database #62

User story: As a filer, I would like to be able to get help associating my email domain with the financial institution I am authorized to file for, so that I can complete my user profile and access the filing platform.

[dan-padgett]

I think this only requires a little bit of rewriting/clarification of language, but there is overlap between scenarios 1 and 2 in cases where a filer needs to be associated with multiple institutions and only one shows up in the list. I think the easy revision is to just say:

• Scenario 1: The filer sees all the institutions they are authorized to file for
• Scenario 2: The filer doesn't see all the institutions they are authorized to file for This matters only insofar as it tracks the flows we've been building, since the current thought is that we send a filer to the help form anytime they need an institutional association that isn't an option.

For scenario 2, we'll have #62 and another story for the cases where the filer ends up needing to register with GLEIF first (since we have that mapped in our workflow for support). I've created #63 and we can discuss whether it's needed.

[natalia-fitzgerald]

Next steps

• @natalia-fitzgerald - Will update the scenarios to reflect the additional path for a user that does see a match that wants to add an institution that's not a match

[dan-padgett]

@angelcardoz User testing section has been updated and the relevant checklist item has been marked complete.