Authentication: DAWSON Account Login

cholly75 commented 1 year ago

As a DAWSON user, so that I can have a less confusing and better tailored sign-in process, I want to sign in to DAWSON from a DAWSON URL/domain.

Currently the DAWSON sign-in process is hosted directly on Amazon servers. This is an experiential and technical disconnect from a user experience point of view; the DAWSON link on the USTC website doesn't actually take the user to DAWSON, but a cryptic Amazon URL from which they are presented with a page with none of the DAWSON/USTC stylings and which we have very little control over the look and feel. This has also presented technical problems on occasion as seen with tickets reporting issues with jumping domains during the process and browser behavior.

To streamline this overall experience and open up avenues for customizing the DAWSON sign in process, we would like to move the front-end authentication UI to be within DAWSON itself.

This story will address the sign in process for the user.

Pre-Conditions

Acceptance Criteria

User can log in with credentials from a DAWSON-hosted login page
Login page has links to direct users to current flows for reclaiming forgotten passwords and signing up for new accounts
Errors encountered in logging in are returned and displayed on the same DAWSON-hosted login page

Notes

Post Deployment Tasks

[x] Extract application.getCognito() into application.getUserGateway() (Abstract away from cognito specific syntax in interactors)
[x] Remove switch-cognito-triggers-color.js as we do not have cognito triggers - Rachel (https://github.com/flexion/ef-cms/pull/10277)
[x] Remove cognito triggers from terraform - Rachel (https://github.com/flexion/ef-cms/pull/10277)
[x] Search for TODO 10007 - Rachel (https://github.com/flexion/ef-cms/pull/10277)

Test Cases

Story Definition of Ready (updated on 12/23/22)

The following criteria must be met in order for the user story to be picked up by the Flexion development team. The user story must:

[ ] Is framed in business/user need, the value has been addressed.
[ ] Includes acceptance criteria
[ ] Has been refined
[ ] Pre conditions have been satisfied. Process: Flexion developers and designers will test if the story meets acceptance criteria and test cases in Flexion dev and staging environments (“standard testing”). If additional acceptance criteria or testing scenarios are discovered while the story is in progress, a new story should be created, added to the backlog and prioritized by the product owner.

Definition of Done (Updated 5-19-22)

Product Owner

[ ] Acceptance criteria have been met and validated on the Court's migration environment
[ ] Add scenario to testing document, if applicable (https://docs.google.com/spreadsheets/d/1FUHKC_YrT-PosaWD5gRVmsDzI1HS_U-8CyMIb-qX9EA/edit?usp=sharing)

UX

[ ] Business test scenarios have been refined to meet all acceptance criteria
[ ] Usability has been validated
[ ] Wiki has been updated (if applicable)
[ ] Story has been tested on a mobile device (for external users only)

Engineering

[ ] Automated test scripts have been written, including visual tests for newly added PDFs
[ ] Field level and page level validation errors (front-end and server-side) integrated and functioning
[ ] Verify that language for docket record for internal users and external users is identical
[ ] New screens have been added to pa11y scripts
[ ] All new functionality verified to work with keyboard and macOS voiceover https://www.apple.com/voiceover/info/guide/_1124.html
[ ] READMEs, other appropriate docs, JSDocs and swagger/APIs fully updated
[ ] UI should be touch optimized and responsive for external only (functions on supported mobile devices and optimized for screen sizes as required)
[ ] Interactors should validate entities before calling persistence methods
[ ] Code refactored for clarity and to remove any known technical debt
[ ] Acceptance criteria for the story has been met
[ ] If there are special instructions in order to deploy into the next environment, add them as a comment in the story
[ ] Reviewed by UX on a deployed environment.
[ ] Reviewed by PO on a deployed environment. Can be deployed to the Court's test environment if prod-like data is required. Otherwise deployed to any experimental environment.
[ ] Deployed to the Court's staging environment.

swongCO commented 1 year ago

Questions/comments from pre-refinement: Look at login.gov for reference. Jenna may be able to help with questions.

katiecissell commented 1 year ago

Utilize the USWDS sign in template as a good jumping off point.

Use Dawson's header and Footer
Use the Figma file for specific font size, color and spacing. (Background is #1a4480)

Private Zenhub Image

Validation

Do not enable the log in button until both email and password fields have something in them (Disabled button should be #c9c9c9) Make sure that saved password/emails from third parties will still work well with this.
Follow existing validation behavior and display an alert when an invalid email or password is used. The alert will need to be shortened width wise to match the log in box's width.

Private Zenhub Image

During the account creation process, after a user has verified their email, display the sign in UI with a green alert banner:

Email address verified
Your email address is verified. You can now log in to DAWSON.

Private Zenhub Image

If they started to create an account, but didn’t confirm their email and try to sign in, display the sign in UI with a red alert banner:

Email address not verified
The email address is associated with an account but is not verified. We sent an email with a link to verify the email address. If you don’t see it, check your spam folder. If you’re still having trouble, email u>dawson.support@ustaxcourt.gov</u.

Private Zenhub Image

Note: Also need to hide the 'log in' link on the verification email sent page now that we will have the correct page to display. This is a followup from the sign up ticket.

Updated email verification sent mockup 1/15/24

Mobile

Fields/text should maintain their spacing and respond as the width of the page shrinks

Private Zenhub Image

Figma File

ttlenard commented 1 year ago

Test Cases

1) User navigates to DAWSON login page; Page has look and feel as per design, link to the page is no longer a Cognito url.

Navigate to the DAWSON Login Page (devs will provide this link)
Review the Page

Expected Results:

[x] NEW FUNCTIONALITY - Page matches what is in the mockups above
[x] NEW FUNCTIONALITY - The URL is no longer for Cognito, but rather a DAWSON login page.

2) User views DAWSON login page; links to Forgot your password and sign up are present, and direct users to appropriately.

Continuing from the previous test
Confirm that there are links to the forgot password and for Create your account now.
Click on each of those links

Expected Results:

[x] NEW FUNCTIONALITY - Forgot password: New reset password page displays
[x] NEW FUNCTIONALITY - Create New Account - User is routed to the newly deployed Create Petitioner Account page.

3) Log in button on the DAWSON login page is not active until there is both an email and password entered.

Part 1

Continuing from the previous test
Ensure that the Log In button is not enabled
Input an email, but do not input any password

Expected Results:

[x] NEW FUNCTIONALITY - The Log in button is still disabled

Part 2

Input a password

Expected results:

[x] NEW FUNCTIONALITY - The Log in button is enabled after both fields have inputs in them

Repeat this test, but add in a password first, followed by the email.
Repeat this test, but after the button is enabled, delete either the email or password - the Log in button should disable if both fields are not filled in.

4) User attempts to login with an email or password that does not exist (or that are in the wrong case); error message is displayed.

Part 1

Continuing from the previous test
Input an email and password that does not exist in DAWSON
click Log in

Expected Results:

[x] NEW FUNCTIONALITY - Validation error message that states "The email address or password you entered is invalid."

Part 2

Input an email that DOES exist in DAWSON but change the case.
Click Log in

Expected Results:

[x] NEW FUNCTIONALITY - Validation error message that states "The email address or password you entered is invalid."

5) User enters a valid email address and password; User is logged in to DAWSON as per normal.

Continuing from the previous test
Input a valid email and password
Click Log in

Expected Results

[x] NEW FUNCTIONALITY - User is logged in as per normal with their appropriate role

*Repeat this test with various users (internal/external)

6) User creates an account using the newly deployed Create Petitioner account page; After verifying their email, user is routed to a new email address verified page.

Go to the DAWSON homepage
Click Create Account
Create a new account with an email that you have access to
Click Continue
Navigate to your email
Click the Verify email button

Expected Results:

[x] NEW FUNCTIONALITY - The Email address verified page displays and it matches the mockup above. This is no longer the Cognito page.
[x] NEW FUNCTIONALITY - There is no longer the "Log In" link at the top of this page.

7) User creates an account using the newly deployed Create Petitioner account page; User does not verify their account. When attempting to log in, the user is routed to a new email address not verified page.

Part 1

Go to the DAWSON homepage
Click Create Account
Create a new account with an email that you have access to
Click Continue
Do not go to your email and verify the account
Navigate to the DAWSON homepage and click log in
Input the non-verified email address and password
Click Log in

Expected Results:

[x] NEW FUNCTIONALITY - The Email address not verified page displays and it matches the mockup above. This is no longer the Cognito page.
[x] NEW FUNCTIONALITY - There is no longer the "Log In" link at the top of this page.

Part 2

Navigate to your email
Verify the email

Expected Results:

[x] NEW FUNCTIONALITY - The Email address verified page displays and it matches the mockup above. This is no longer the Cognito page.
[x] NEW FUNCTIONALITY - There is no longer the "Log In" link at the top of this page.

8) User clicks on the create account link on the DAWSON homepage, then clicks on the Log in Link on the newly deployed Create Petitioner Account page; User is navigated to the new DAWSON Log in Page.

Navigate to the DAWSON Homepage
Click on Create Account link
Click on the Log in Link on this page

Expected Results:

[x] NEW FUNCTIONALITY - User is navigated to the new log in page.

9) Test on Mobile

[x] All Tests pass on various mobile devices (android and iOS), and the content on the screen is readable and has an overall nice user experience.

10) Kibana logs - Check to see what is getting logged

[x] This is just a test to review the logs to ensure that we are logging when a user logs in to DAWSON.
[x] We don't want to be exposing any user password data here.

Updated Test Cases - Added 3/6/24 to account for the other scenarios that are included in this story besides just log in

11) User that has an account clicks on the Forgot password link, new modal for forgot password displays

Navigate to the DAWSON log in page
Click on Forgot password

Expected Results:

[x] NEW FUNCTIONALITY - A "Forgot Password?" modal displays.
[x] NEW FUNCTIONALITY - There is an Email address field
[x] NEW FUNCTIONALITY - The Send Password reset button is not active until there is data in the email address field

12) User types in a valid email address that is does not have an account in DAWSON; no email is sent.

Continuing from the previous test
Type in a valid email that you have access to, but does not have an account in DAWSON
Click Send Password Reset button

Expected Results:

[x] NEW FUNCTIONALITY - Green confirmation that states, "Password reset code sent. If there is a DAWSON account for [email entered] we'll send an email with a code. This code will expire in 1 hour. If you don't see the email, check your spam folder.".
[x] NEW FUNCTIONALITY - There is a log in page that includes a text box for the user to input the code, and a new password (twice).
[x] NEW FUNCTIONALITY - Upon checking the email inbox, there is no email from noreply.

13) User types in a valid email address associated with a DAWSON Account in the forgot password modal; email is in inbox.

Navigate to the DAWSON log in page
Click on the forgot password link
Input a valid email that you have access to, and that has a DAWSON account.
Click Send Password Reset button

Expected Results:

[x] NEW FUNCTIONALITY - Green confirmation that states, "Password reset code sent. If there is a DAWSON account for [email entered] we'll send an email with a code. This code will expire in 1 hour. If you don't see the email, check your spam folder.".
[x] NEW FUNCTIONALITY - There is a log in page that includes a text box for the user to input the code, and a new password (twice).
[x] NEW FUNCTIONALITY - Upon checking the email inbox, there is an email titled, "U.S. Tax Court DAWSON: Password Reset Code. This email incudes the expiration of 1 hour, a 6 digit code, dawson support email if they did not request to reset password, and the "we cannot respond to this email" message.

14) User inputs an incorrect Password reset code, enters a new password (twice) and clicks Change Password and log in button; User receives error message.

Continuing from the previous test
Input an incorrect code into the code box
Input a valid password (twice)
Click on the Change Password and Log in button

Expected Results:

[x] NEW FUNCTIONALITY - User receives error message indicating Invalid Verification Code. The code you entered is incorrect or expired. You can request a new code. If you're still having trouble contact dawson.support@ustaxcourt.gov.
[x] Clicking on the dawson support email link navigates the user to their default email.

15) User clicks the link in the error message to request a new code; User is navigated to the Reset Password Page.

Continuing from the previous test
Click on the link in the red validation alert for "You can request a new code".

Expected Results:

[x] NEW FUNCTIONALITY - User is navigated to the Reset Password page where they can input their email and click on the Send Password Reset button again.

16) User inputs Password reset code from email, enters a new password (twice) and clicks Change Password and log in button; User is logged in successfully.

User with an account navigates to the DAWSON Login page
Click on the Forgot password link.
Input a valid email that you have access to and click the button to send the code
Receive the code in your email
Copy/paste the password reset code into the code field
Input a valid password (twice)
Click on the Change password and login button

Expected Results:

[x] NEW FUNCTIONALITY - User is logged in successfully.

17) User that requested a Password reset code does not log in within 1 hour; user receives an error.

User with an account navigates to the DAWSON Login page
Click on the Forgot password link.
Input a valid email that you have access to and click the button to send the code
Receive the code in your email
Do no input the code, let the code expire
After one hour, input the code from the email into the code field on the DAWSON Reset password screen.

Expected Results:

[x] NEW FUNCTIONALITY - User receives error alert message indicating Invalid Verification Code. The code you entered is incorrect or expired. You can request a new code. If you're still having trouble contact dawson.support@ustaxcourt.gov.
[x] NEW FUNCTIONALITY - Clicking on the dawson support email link navigates the user to their default email.
[x] NEW FUNCTIONALITY - Clicking on the Request a new code link should work as expected (per test case 15 above).

18) Admissions clerk creates a new account for a practitioner, Practitioner user receives email, can input temp PW, create a new PW, and can log in.

Log in as an admissions clerk
Click on the Advanced link
Click on the Practitioner tab
Click on Add New Practitioner button
Add in the contact information for the Practitioner
Add in an email that you have access to that does not already have an account in DAWSON
Click the Add Practitioner button
You should get the Practitioner added banner and be routed to the new Practitioner page.
The email address you just added should be pending.
Next, log out of DAWSON and navigate to your email.

Expected Results:

[x] NEW FUNCTIONALITY - Practitioner user receives the "U.S Tax Court DAWSON: Account Created" email
- [x] Email is in the new updated formatting (standard title, updated beginning paragraph, if you did not request this, do not reply)
[x] NEW FUNCTIONALITY - User clicks on the link to log into DAWSON from the email, it directs the user to the new log in page
[x] NEW FUNCTIONALITY - User can type in their email and the temp PW into the log in page
[x] NEW FUNCTIONALITY - Once the user clicks log in, they receive the new Reset Password modal.
- [x] New reset PW modal has the show password link
- [x] New reset PW modal displays PW rules (same as on account creation) upon typing in the PW
- [x] The Change Password and Log In button does not activate until PW rules are met.
[x] NEW FUNCTIONALITY - Once the PW matches and the user clicks Change PW and Log in Button, user is logged in successfully and navigated to their My Cases page.

*Note: Need to be sure that the resend automation in Zendesk works for folks that had a temp PW sent to them prior to this release that has expired.

19) Admissions clerk creates a new account for a Petitioner; Petitioner user receives email, can input temp PW, create a new PW, and can log in

Log in as an admissions clerk
Navigate to a case
Click on Case information tab
Click on the parties tab, and make sure that the petitioner receives paper service and that they are not represented by counsel
Click on the edit link on the petitioner card
Add in an email address that you have access to that does not yet have an account created.
Click save
You should get a modal that says that a new account will be created, click Yes, Continue
You should see that the email address for the petitioner is pending
Next, log out of DAWSON and navigate to your email.

Expected Results:

[x] NEW FUNCTIONALITY - Practitioner user receives the "U.S Tax Court DAWSON: Account Created" email
- [x] Email is in the new updated formatting (standard title, updated beginning paragraph, if you did not request this, do not reply)
[x] NEW FUNCTIONALITY - User clicks on the link to log into DAWSON from the email, it directs the user to the new log in page
[x] NEW FUNCTIONALITY - User can type in their email and the temp PW into the log in page
[x] NEW FUNCTIONALITY - Once the user clicks log in, they receive the new Reset Password modal.
- [x] New reset PW modal has the show password link
- [x] New reset PW modal displays PW rules (same as on account creation) upon typing in the PW
- [x] The Change Password and Log In button does not activate until PW rules are met.
[x] NEW FUNCTIONALITY - Once the PW matches and the user clicks Change PW and Log in Button, user is logged in successfully and navigated to their My Cases page.

*Note: Need to be sure that the resend automation in Zendesk works for folks that had a temp PW sent to them prior to this release that has expired.

20) Practitioner (IRS/Private) associated with cases changes their email; user can log in with new email; Cases associated with the user have the updated contact information for the Practitioner.

Log in as a Private Practitioner that already has an account in DAWSON and has a few cases
Click on the dropdown arrow next to the little man in the upper right corner of DAWSON screen
Select My account
Click on the Change Email link in the Login & Service Email Address card
Input a new email address that you have access to and re-enter it
Click save
You will receive a Verify you new email modal, click OK
You should see a yellow banner at the top of the page that says the verification email was sent to the new email address.
DO NOT LOG OUT OF DAWSON, but navigate to your email

Expected Results:

[x] NEW FUNCTIONALITY - User should have a "U.S. Tax Court DAWSON: Verify your new email" message in their inbox.
[x] NEW FUNCTIONALITY -The email is in the new format (includes consistent title, verify email button, also includes the URL, if you did not make this change text, and the do not reply to this message text)
[x] NEW FUNCTIONALITY - After user clicks on the Verify Email button, they are routed to the Log in to DAWSON screen with a green alert that reads, "Email Address verified"
[x] NEW FUNCTIONALITY - User can no longer log in with the old email address. If attempted, they will get the Email address or PW you entered is invalid message.
[x] NEW FUNCTIONALITY - User can input the new email address and same PW and log in successfully
[x] NEW FUNCTIONALITY - Upon navigating to the existing cases that the practitioner was associated with, their email address displayed for them is the new email address.

Repeat this test and do the following:

[x] Repeat this test by clicking on the URL link in the email instead of the verify Email button.
[x] Repeat this test with an IRS Practitioner
[x] Repeat this test by doing a Load Test for both IRS and Private Practitioners - Practitioner user associated with lots of cases changes their email
[x] Repeat this test by changing an email for a Practitioner that is associated with some/not all cases in consolidated group. Email changes should work as described above.

21) Petitioner associated with cases changes their email; user can log in with new email; Cases associated with the user have the updated contact information for the petitioner and Notice of Change documents are docketed appropriately.

Log in as a Petitioner that already has an account in DAWSON and is associated with a few cases
Click on the dropdown arrow next to the little man in the upper right corner of DAWSON screen
Select My account
Click on the Change Email link in the Login & Service Email Address card
Input a new email address that you have access to and re-enter it
Click save
You will receive a Verify you new email modal, click OK
You should see a yellow banner at the top of the page that says the verification email was sent to the new email address.
DO NOT LOG OUT OF DAWSON, but navigate to your email

Expected Results:

[x] NEW FUNCTIONALITY - User should have a "U.S. Tax Court DAWSON: Verify your new email" message in their inbox.
[x] NEW FUNCTIONALITY -The email is in the new format (includes consistent title, verify email button, also includes the URL, if you did not make this change text, and the do not reply to this message text)
[x] NEW FUNCTIONALITY - After user clicks on the Verify Email button, they are routed to the Log in to DAWSON screen with a green alert that reads, "Email Address verified"
[x] NEW FUNCTIONALITY - User can no longer log in with the old email address. If attempted, they will get the Email address or PW you entered is invalid message.
[x] NEW FUNCTIONALITY - User can input the new email address and same PW and log in successfully
[x] NEW FUNCTIONALITY - Upon navigating to the existing cases that the user was associated with, their email address displayed for them is the new email address.
[x] NEW FUNCTIONALITY - Upon reviewing the docket record of each case, there is a Notice of Change of Email Address document correctly docketed that includes the changed email information.

Repeat this test and do the following:

[x] Repeat this test by clicking on the URL link in the email instead of the verify Email button.
[x] Repeat this test by doing a Load Test - Petitioner user associated with lots of cases changes their email, ensure contact info on all cases is updated and there is a Notice of change of email on all cases.
[x] Repeat this test by changing an email for a Petitioner that is associated with some/not all cases in consolidated group. Email changes should work as described above.

22) User clicks on the verify email link in the account creation email after it has already been verified; User receives the "unable to verify e-mail address" alert.

Create a Petitioner account
You should receive an account creation email in your inbox.
Click on the verify email button or URL
You should be able to log in to DAWSON.
Log out of DAWSON
Next, go back to your email and click on the verify Email or click on the URL link again.

Expected Results:

[x] NEW FUNCTIONALITY - User is navigated to the Log in to DAWSON screen and there is a "Verification email link expired" alert.

23) User clicks on the verify your new email link in the "Verify your new email" email after it has already been verified; User receives the "unable to complete request" alert.

Log in as a user that already has an account in DAWSON
Update your email
Receive a "Verify your new email" in your inbox
Click on the Verify email button or click on the URL to verify the new email
Log out of DAWSON
Next, go back to your email and click on the verify Email button or click on the URL Link again.

Expected Results:

[x] NEW FUNCTIONALITY - User is navigated to the Log in to DAWSON screen and there is the "Unable to complete request" alert.

24) Petitioner user creates a new account; Does not verify email within 24 hours; User receives alert.

Petitioner creates an account
Receives the verification email, but does not verify email within 24 hours (or you can go into dynamo and erase the verification record)
Petitioner clicks on the verify email link from their email

Expected Results:

[x] NEW FUNCTIONALITY - User receives a "Verification email link expired. Enter your email address and password below, then log in to be sent a new verification email."
[x] NEW FUNCTIONALITY - After user inputs their email again, another alert is displayed: "Email address not verified. The email address is associated with an account but is not verified. We sent an email with a link to verify the email address. If you don’t see it, check your spam folder. If you’re still having trouble, email dawson.support@ustaxcourt.gov.
[x] NEW FUNCTIONALITY - User receives a new email with a new verify email link.
[x] NEW FUNCTIONALITY - User can click on the link and the email is verified. User can log in successfully.

25) Admissions clerk sets up an account for a Petitioner; Petitioner does not log in with their temporary password within 7 days; User receives alert

Log in as an admissions clerk
Navigate to a case that has a paper petitioner
Click on the Case information tab
Click on the edit link for the petitioner
Input an email that you have access to for the petitioner (be sure that the account does not already exist)
Click save
Log out
Next, as the Petitioner, verify that you received the email that an account was created for you
Do not sign in to DAWSON with this user - we need to let the Temp PW expire (you can manually adjust this in Cognito to be 1 day instead of 7 days)
After 7 days (or 1 day if you edited it) has passed, attempt to log in using the temporary password in the email

Expected Results:

[x] NEW FUNCTIONALITY - User receives an alert on the log in screen that says "Temporary Password expired. The temporary password you entered has expired. We sent an email with a new temporary password that expires in 7 days. If you don’t see it, check your spam folder. If you’re still having trouble, email dawson.support@ustaxcourt.gov."
[ ] NEW FUNCTIONALITY - User receives a new email in their inbox with a new temporary password.
[ ] NEW FUNCTIONALITY - User can input the new temp PW and log in successfully.

Repeat some tests with different users:

[ ] This test passes with IRS Practitioner
[ ] This test passes with Private Practitioner

26) Petitioner updates their email address to a new email; Does not verify email within 24 hours;

Log in as a Petitioner, be sure that you have access to the email account associated with this user
Click on the dropdown next to the person icon in the top right of the screen
Select My Account
Click on the Change Email link
Add in a new email that you have access to (twice)
Click Save
You should see a yellow banner in DAWSON indicating you need to verify the new email address
Ensure that you received the email in your inbox
Do not click on the Verify email link or the URL for 24 hours
After 24 hours, click on the verify email link in your email

Expected Results: I think this is what would happen? Need to test this

[ ] NEW FUNCTIONALITY - User receives a "Verification email link expired. Enter your email address and password below, then log in to be sent a new verification email."
[ ] NEW FUNCTIONALITY - After user inputs their email again, another alert is displayed: "Email address not verified. The email address is associated with an account but is not verified. We sent an email with a link to verify the email address. If you don’t see it, check your spam folder. If you’re still having trouble, email dawson.support@ustaxcourt.gov.
[ ] NEW FUNCTIONALITY - User receives a new email with a new verify email link.
[ ] NEW FUNCTIONALITY - User can click on the link and the email is verified. User can log in successfully.

Repeat this test with different users:

[ ] This test passes with IRS Practitioner
[ ] This test passes with Private Practitioner

27) User attempts to input an invalid email/password combination multiple times, User receives the "Too many unsuccessful log ins" error and account is locked for a bit of time before the user can retry. (Max of 15 min)

Navigate to the DAWSON Login page
Input an incorrect username/password into the modal
Click Login
You should receive the invalid username or password error.
Continue to click login multiple times

Expected Results:

[x] NEW FUNCTIONALITY - User will receive the Too may unsuccessful log ins. You can try again later or reset your password. If you are still having problems, contact dawson support."
[x] NEW FUNCTIONALITY - If you continue to input an incorrect username/password, you will continue to receive this error message after a few attempts
[x] NEW FUNCTIONALITY - The more times that you input an incorrect username/password, the longer the locked account will be.
[x] NEW FUNCTIONALITY - If you type in a correct username/password after you receive this error, user can log in successfully.
[x] NEW FUNCTIONALITY - Error logs display the "password attempts exceeded"

28) Regression test that Internal Users can log in.

[x] Petitions Clerk
[x] Admissions Clerk
[x] Judge
[x] Chambers
[x] Docket Clerk
[x] Reporters Office
[x] Clerk of the Court
[x] Case Services Supervisor
[x] General User
[x] ADC
[x] Floater
[x] Trial Clerk

29) Regression test using a screen reader tool to ensure screen reader/tabbing order is correct.

[x] This test passes.

30) Test Zendesk Automations - Mike to set up Zendesk sandbox to point to DEV to test that these automations still work.

[x] update-email-no-access (There is a step in the instructions that is no longer working correctly, but I think this is happening on Production as well. User can still log in just fine, so checking this one as working. I have notified Mike about the small issue.)
[x] resend
[x] add-to-closed
[x] deactivate-court-user
[x] create-court-user
[x] reg-status
[x] overwrite-email
[ ] practitioner report

31) Test to ensure that the above test cases work on Other browsers besides Edge.

[x] The test cases above work fine for the external user on a FireFox, Safari, and Chrome browser.
[x] Look and feel on the other browsers is consistent with Edge

Things to be aware of - Users that were in a pending status prior to the release of this code will not be able to use their verification link.

swongCO commented 9 months ago

Added mockups from 10011 re email verification banners on the sign in page.

swongCO commented 9 months ago

Pre refinement

talk to Mike about cognito pool of users

rachelschneiderman commented 7 months ago

@ttlenard As a part of this story we have changed just slightly how maintenance mode works. When you have time, let's get together so we can show you what has changed and see if any documentation or screenshots need to be updated.

ttlenard commented 7 months ago

There are a few more things to consider with this story. Not sure if this handing the things below should be a separate story or included. @cholly75 @rachelschneiderman @zRogersFlexion @pixiwyn @TomElliottFlexion

1 - Practitioner changes employers. Admissions clerk goes into practitioner profile in DAWSON, ensures that they are not associated with any open cases, then changes the employer. This works fine, but we had an instance where the practitioner was logged in on their DAWSON account when the employer change occurred, and they subsequently filed an EA on a case. This filed the EA incorrectly (said Resp. instead of private). The practitioner then logged out/back in, and re-attempted. This resulted in the correct filing (EA for petitioner) but the privatePractitioner record on the case wasn't created, and the practitioner was not associated with the case (they were not listed as counsel for petitioner). Furthermore, the Practitioner didn't have access to the case documents on the case. Need to be able to gracefully handle this scenario.

2 - Another scenario to think about is when an Admissions clerk creates an account for someone (can be admitting a practitioner or adding in an eAccess email to a Petitioner). When they do this, DAWSON currently generates a temporary password for the user that is valid for 7 days. We have multiple instances per week where the user doesn't log in with the temp pw within the 7 days, and they have to email dawson support and request a new temp pw. Mike has created a Zendesk automation that will resend the user an email with a new temp PW. The Court would like to be able to let the user get a new temp PW themselves, rather than having them submit an email to dawson support. Can this be considered with this ticket?

cholly75 commented 7 months ago

I think we need separate stories on both of these.

swongCO commented 6 months ago

UX feedback on exp2

The title font should be Source Sans Pro:

Screenshot 2024-02-02 at 12.14.49 PM.png

In mobile and smaller screens, I'm getting the menu in the right corner. That should not be there:

Screenshot 2024-02-02 at 12.22.18 PM.png

Screenshot 2024-02-02 at 12.25.00 PM.png

For the alert banners, is there a way to decrease the padding on the right side so that text will flow into that area? In the screenshot above, "DAWSON" should ideally be on the same line as the first and not wrap. In the mobile screenshot, there's enough space to accommodate some of the text that's wrapping.

zachrog commented 6 months ago

@ttlenard @cholly75 FYI we have addressed scenario #2 that Tenille mentioned a few comments above (practitioner does not verify their account within 7 day time limit) as a part of this story. We have NOT addressed scenario #1 as a part of this story.

ttlenard commented 6 months ago

Thanks @zRogersFlexion. Looking forward to seeing a demo of this!

ttlenard commented 6 months ago

Testing Feedback:

Getting a 400 error in the following scenario:

Petitioner creates a new account, but does not verify their email address
As an Admissions Clerk, navigate to a case with a paper service Petitioner and click on case info/parties tab
Click edit for the paper service petitioner
Add in the email that you created in step 1 (the one in pending status - has not been verified)
Click save
You will get the "matching email found" pop-up
Click ok
Receive a 400 error

swongCO commented 5 months ago

UX feedback (on Dev)

Hide password links: change to lowercase p for password (on Create acct, Log in and Reset password flows)
Success alert for email verified: change second sentence to "You can now log in to DAWSON."
Reduce side padding in mobile view for Create acct flow to match Log in:

Look into changing cognito email sender name to "U.S. Tax Court" instead of "noreply" for account verification email (sender email will remain "noreply@xxxxx.ustaxcourt.gov":

ttlenard commented 5 months ago

Some testing Feedback:

@rachelschneiderman @zRogersFlexion @pixiwyn @TomElliottFlexion

Looks like the DAWSON icon is now pointing to the login page instead of the DAWSON home page. Please update.
Looks like the validation has changed for the PW. I'm now getting validation errors when I have a space in the middle of my PW. It does not do this on TEST.

Some comments regarding the emails. See comments in screen grabs:

For all of the alerts, it appears that the header font is smaller than the message? It is hard for me to tell. Should the header text be bigger in size? See examples in the screen grabs below:

ttlenard commented 5 months ago

Some additional comments re: the logs:

I noticed that the user email is still appearing in the user.email column if you take the following steps.

Have the logs open for Dev. I was filtering by the dev environment.stage, and /auth/login for the request.url.
Log in successfully as a user
Log out
On the log in page, enter a bogus email address (or the wrong email/PW combo)
Receive the error on the UI (good)
Next, review the logs
Notice how the "good" email is showing in the user.email column for the entry that shows the "bad" email in the request.body.
Now, click refresh on the login page
Type in some bogus email
Receive the error on the UI (good)
Review the logs again
Notice that the "good" email is no longer showing in the user.email column.
I think somehow the good email was getting saved in state????

swongCO commented 5 months ago

UX is fine with all of the above changes. For the alert banner, in Dawson Test, the header is 17px and the body is 16px. Please match the font sizes for this story. Thank you!

ttlenard commented 5 months ago

@pixiwyn @rachelschneiderman @zRogersFlexion @TomElliottFlexion

I've created a quick video of a small issue I found.

Private Zenhub Video

ttlenard commented 5 months ago

@rachelschneiderman @zRogersFlexion @pixiwyn @TomElliottFlexion

More testing feedback:

User has a DAWSON account and then they go into my account and update their own email
They receive the email in their inbox and they verify it. They can log into DAWSON just fine with their new email.
Then, at some point they go back into their email and click on the verify email button again.
They get this error:

We might want to enhance the messaging on this error? In this scenario, the email address is already verified which is why the link isn't working, but the error message doesn't really say that. Not sure if we want it to be that specific? Are there other scenarios where a user would receive this error message? If so, we could at least add in the "dawson.support@ustaxcourt.gov" instead of the generic DAWSON support. What are your thoughts on this error?
Note that we are not getting any returns in the logs for when this validation message displays for the user. Can we get something for when this happens in the logs? Thanks!

swongCO commented 5 months ago

Update alert in Tenille's comment above:

Unable to complete your request Your request cannot be completed. Please try to log in. If you’re still having trouble, email dawson.support@ustaxcourt.gov.

ttlenard commented 5 months ago

Based off of our conversation at Standup this morning, I've added in number 6 in the above comment to mention logs.

ttlenard commented 5 months ago

@cholly75 For your consideration on either this story or a follow up story. This issue that is existing in production today and is still present in Dev causes so much confusion to the public users.

This has to do with the verify email link that a user receives when they change their email. If the user isn't logged in on another tab with their previous email, the user get's a 401 error. When helpdesk staff respond to tickets, and in our training materials, we have to bold/capitalize all over the place that the user must remain logged in on their other tab. Sure would be nice to not have to explain this constantly.

Steps to reproduce:

Log in as a Petitioner
Click on My account
Update the email to a different email address
You will see that the new email is pending.
Log out of DAWSON
Navigate to your email, and click on the verify email button in the email that you received
The user will get the Unable to complete your request error:

Note: If the user stays logged in to DAWSON with their old email, or if they just close the tab, then the verification button works fine and their new email is verified.

@ttlenard - this is coming as #10314

ttlenard commented 5 months ago

Some more testing feedback: @rachelschneiderman @pixiwyn

cc: @cholly75

Issue 1

User with an account clicks the forgot password button.
Input the valid email address that you have access to
You should receive the email with the password reset code
On the DAWSON screen, input an incorrect password reset code
You should get the Invalid Verification code error.
Click on the link to request a new code.
Notice that nothing happens when clicking on this link.

Issue 2

The formatting for the "Welcome to DAWSON" header and the USTC icon in the upper left side of the screen is off when viewing the Account creating and Log in screens. Note that this is not currently formatted this way on any of the other environments. Seems to only be occurring on DEV.

Dev Environment: Create Petitioner Account page

Log in page:

IRS Environment:

Issue 3

This isn't necessarily and issue, but some more formatting questions/thoughts for the "An account has been created for you with the U.S. Tax Court" email. This is what is sent when an admissions clerk sets up an account for someone. Comments/Questions are in the screen capture

katiecissell commented 5 months ago

Updated account created email mock:

ttlenard commented 5 months ago

@rachelschneiderman @zRogersFlexion @pixiwyn

Looks like if a user has an account created for them by an admissions clerk, but they do not log in within 7 days, they are getting an incorrect error message.

Currently in Cognito, the user will get this error message that tells them that their temp PW expired:

At a minimum, we need to update the error message, ideally it would be great if the user could get a new temp PW resent to them to start the 7 day cycle again.

swongCO commented 5 months ago

New alert text for expired temp password

Header: Temporary password has expired

Body: The temporary password you entered has expired. We sent an email with a new temporary password that expires in 7 days. If you don’t see it, check your spam folder. If you’re still having trouble, email dawson.support@ustaxcourt.gov.

rachelschneiderman commented 5 months ago

@cholly75 @ttlenard

If an external user (petitioner/practitioner) changes their login and service email, they will receive an email that they need to click a link to verify the change. The email states the verification link will expire in 24 hours, right now that is NOT true, the link will never expire.

At some point we need a story to address the expiration of that link.

cholly75 commented 5 months ago

@rachelschneiderman - documented verification link behavior as #10313

flexion / ef-cms