[FE, BE] My VA Forms Status: (QA bug) submitted forms not showing for LOA1 users

[ajakabcin]

Background

On staging we should be able to see certain submitted forms (see below) when submitted by LOA1 users but we are only seeing draft forms.

the following forms allow the user to submit as LOA1 (signed in but without being verified):

• 21-10210 (staging link)
• 21-0972 (staging link)
• 21P-0847 (staging link)

the following forms require the user to be LOA3 (signed in and verified) in order to submit:

• 21-4142/21-4142A (staging link)
• 21-0845 (staging link)
• 21-0966 (staging link)
• 20-10206 (staging link)
• 20-10207 (staging link)

Steps to reproduce:

1. Log into staging as an LOA1 user
2. Navigate to any of the three forms linked above that an LOA1 user is able to submit
3. Complete the steps to submit the form
4. Navigate back to My VA
5. See that the submitted form is not shown in the Benefit applications and forms section

Tasks

• [x] Investigate the issue
• [ ] Consult with BE
• [ ] Implement fix

Acceptance Criteria

• We can see forms submitted by LOA1 users on My VA on staging

[allisonlu]

After syncing with @DanielMiller-agile6 and @tpharrison, we found out:

1. when we call /submission_statuses/ endpoint, the controller will check if the user is authorized according to the Lighthouse policy:

  def access?
    user.icn.present? && user.participant_id.present?
  end

i.e. user needs to have both

1. a ICN (Integration Control Number?) and
2. participant ID

Relevant Slack convos

• LOA1 accounts don't get anything from MPI nor do we attempt to call MPI to get those attributes (via Joe Niquette)
• LOA3 accounts means ICN and EDIPI should have been established (via Thomas Blackwell)

tl;dr

We think LOA1 users don't have ICNs (and that's why they're not seeing submitted forms on My VA), but we can change the restriction listed in the code above. Tom will reach out to Eric to see what VFF team has done so we can stay aligned.

[ajakabcin]

Spoke with @tpharrison and @allisonlu about this and we believe we have a solution - we need to implement a more lenient check on LOA1 users that doesn't require an ICN. Tom plans to make this change on Monday to resolve this ticket.

[tpharrison]

@ajakabcin I have this draft PR ready to go. It will allow both LOA1 and LOA3 users to view their submission statuses. Just let me know when we're set and I'll mark it as ready for review.

cc/ @allisonlu @DanielMiller-agile6

[tpharrison]

@allisonlu The PR to allow access for LOA1 users was just merged, so you should be able to test in staging on Monday. Let me know if you have any questions.

[ajakabcin]

Confirmed on staging that I'm able to see forms I submitted (with submission in progress status) on my LOA1 account - thank you @tpharrison and @allisonlu for the quick work on this!