Merge branch 'GREG-202-prevent-verify-fnr-flag' into 'master'

Add flag to prevent nin verification in frontend

See merge request !275

frontend/.env

@@ -10,3 +10,5 @@ REACT_APP_SUPPORT_URL_EN=https://example.org/en
 
 REACT_APP_RESPONSIBLE_ORGANIZATION='Seksjon for integrasjon og elektroniske identiteter (INT)'
 REACT_APP_RESPONSIBLE_ORGANIZATION_LINK='https://www.usit.uio.no/om/organisasjon/bnt/usitint/'
+
+REACT_APP_DISABLE_NIN_VERIFICATION='false'

frontend/src/appConfig.ts

@@ -31,6 +31,10 @@ export const guestConsentStepEnabled: boolean =
 export const availableInSearchEnabled: boolean =
   env.REACT_APP_AVAILABLE_IN_SEARCH_ENABLED === 'true'
 
+/* Should nin verification be disabled for sponsors? */
+export const disableNinVerification: boolean =
+  env.REACT_APP_DISABLE_NIN_VERIFICATION === 'true'
+
 /* Footer content */
 export const responsibleOrganization: string =
   env.REACT_APP_RESPONSIBLE_ORGANIZATION as string

frontend/src/components/identityLine/index.tsx

@@ -6,7 +6,7 @@ import { submitJsonOpts } from 'utils'
 import CheckIcon from '@mui/icons-material/Check'
 import { useTranslation } from 'react-i18next'
 import { TableCell } from 'components/table'
-import { appInst } from 'appConfig'
+import { appInst, disableNinVerification } from 'appConfig'
 
 interface IdentityLineProps {
   text: string
@@ -53,7 +53,11 @@ const IdentityLine = ({
             <Button
               aria-label={t('button.verify')}
               onClick={() => setConfirmOpen(true)}
-              disabled={!identity}
+              disabled={
+                !identity ||
+                (disableNinVerification &&
+                  identity.type === 'norwegian_national_id_number')
+              }
             >
               {t('button.verify')}
             </Button>

gregsite/settings/base.py

@@ -334,3 +334,7 @@ NOTIFIER_SCHEDULE_TYPE = "W"
 # Source used when creating identities that do not have a clear source like
 # feide/id-porten
 DEFAULT_IDENTITY_SOURCE = "greg"
+
+# Toggle to prevent verification of NIN from the sponsor frontend.
+# Introduced to prevent using greg for takeover of existing accounts in IGA.
+DISABLE_NIN_VERIFY = False

gregui/api/serializers/identity.py

+from django.conf import settings
 from django.utils import timezone
 from rest_framework import serializers
+from rest_framework.exceptions import ValidationError
 
 from greg.models import Identity
 from gregui.models import GregUserProfile
@@ -46,6 +48,15 @@ class IdentitySerializer(serializers.ModelSerializer):
 
         Note: Get requests do not use this method, making it safe.
         """
+        # Prevent nin verification. (This will only trigger if someone is posting the
+        # requests themselves. The frontend has its own setting disabling the button
+        # used against this endpoint.)
+        if settings.DISABLE_NIN_VERIFY and self.instance.type == str(
+            Identity.IdentityType.NORWEGIAN_NATIONAL_ID_NUMBER
+        ):
+            raise ValidationError(
+                detail="NIN verification currently disabled.",
+            )
         attrs["verified"] = Identity.Verified.MANUAL
         attrs["verified_by"] = self._get_sponsor()
         attrs["verified_at"] = timezone.now()