diff --git a/.erdconfig b/.erdconfig new file mode 100644 index 00000000000..d7d6f323776 --- /dev/null +++ b/.erdconfig @@ -0,0 +1,9 @@ +title: login.gov IdP entity-relationship diagram +notation: bachman +filename: idp_erd +filetype: svg +attributes: + - primary_keys + - foreign_keys + - content +sort: false diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 0dfcf3388a2..526a85657c4 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -746,3 +746,32 @@ deploy_eks: IMAGE_TAG: $CI_COMMIT_SHA rules: - if: $CI_COMMIT_BRANCH == "main" + +publish_er_diagram: + stage: .post + needs: + - job: build-ci-image + variables: + DOCKER_DB_HOST: db-postgres + POSTGRES_DB: identity_idp_test + POSTGRES_USER: postgres_user + POSTGRES_PASSWORD: postgres_password + POSTGRES_HOST_AUTH_METHOD: trust + RAILS_ENV: test + services: + - name: public.ecr.aws/docker/library/postgres:16.4 + alias: db-postgres + command: ['--fsync=false', '--synchronous_commit=false', '--full_page_writes=false'] + cache: + - <<: *ruby_cache + rules: + - if: $CI_COMMIT_BRANCH == "main" + - if: $CI_COMMIT_BRANCH == "vm-reinstate-erd" + image: "${ECR_REGISTRY}/idp/ci:${CI_COMMIT_SHA}" + script: + - *bundle_install + - bundle exec rake db:create db:migrate --trace + - bundle exec rails erd + artifacts: + paths: + - idp_erd.svg diff --git a/Gemfile b/Gemfile index ee19f1969e6..ef22ea502a2 100644 --- a/Gemfile +++ b/Gemfile @@ -116,6 +116,7 @@ group :development, :test do gem 'pry-doc' gem 'pry-rails' gem 'psych' + gem 'rails-erd' gem 'rspec', '~> 3.13.0' gem 'rspec-rails', '~> 7.0' gem 'rubocop', '~> 1.69.1', require: false diff --git a/Gemfile.lock b/Gemfile.lock index 037d8d04e17..b3da7b0bd4e 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -253,6 +253,7 @@ GEM nokogiri (~> 1.10, >= 1.10.4) rubyzip (>= 1.3.0, < 3) cbor (0.5.9.8) + choice (0.2.0) chunky_png (1.4.0) coderay (1.1.3) coercible (1.0.0) @@ -544,6 +545,11 @@ GEM activesupport (>= 5.0.0) minitest nokogiri (>= 1.6) + rails-erd (1.7.2) + activerecord (>= 4.2) + activesupport (>= 4.2) + choice (~> 0.2.0) + ruby-graphviz (~> 1.2) rails-html-sanitizer (1.6.1) loofah (~> 2.21) nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0) @@ -634,6 +640,8 @@ GEM rubocop-ast (>= 1.31.1, < 2.0) rubocop-rspec (3.2.0) rubocop (~> 1.61) + ruby-graphviz (1.2.5) + rexml ruby-progressbar (1.13.0) ruby-saml (1.17.0) nokogiri (>= 1.13.10) @@ -833,6 +841,7 @@ DEPENDENCIES rack_session_access (>= 0.2.0) rails (~> 7.2.1) rails-controller-testing (>= 1.0.4) + rails-erd redacted_struct redis (>= 3.2.0) redis-session-store! diff --git a/dockerfiles/idp_ci.Dockerfile b/dockerfiles/idp_ci.Dockerfile index d09f0814808..5c378d0ecb4 100644 --- a/dockerfiles/idp_ci.Dockerfile +++ b/dockerfiles/idp_ci.Dockerfile @@ -21,6 +21,7 @@ RUN apt-get update -qq && \ nodejs \ locales \ google-chrome-stable \ + graphviz \ yarn RUN curl -Ss "https://storage.googleapis.com/chrome-for-testing-public/$(google-chrome --version | grep -Po '\d+\.\d+\.\d+\.\d+' | tr -d '\n')/linux64/chromedriver-linux64.zip" > /tmp/chromedriver.zip && \ diff --git a/docs/erd.svg b/docs/erd.svg new file mode 100644 index 00000000000..f44cf061467 --- /dev/null +++ b/docs/erd.svg @@ -0,0 +1,1712 @@ + + + + + + +Identity + +login.gov IdP entity-relationship diagram + + +m_AccountResetRequest + +AccountResetRequest + +id +integer (8) PK +user_id +integer ∗ FK +requested_at +datetime +request_token +string +cancelled_at +datetime +granted_at +datetime +granted_token +string +requesting_issuer +string FK + + + +m_Agency + +Agency + +id +integer (8) PK +name +string ∗ +abbreviation +string U + + + +m_AgencyIdentity + +AgencyIdentity + +id +integer (8) PK +user_id +integer ∗ FK +agency_id +integer ∗ FK +uuid +string ∗ + + + +m_Agency->m_AgencyIdentity + + + + + + + +m_Agreements::PartnerAccount + +Agreements::PartnerAccount + +id +integer (8) PK +name +string ∗ U +description +text +requesting_agency +string ∗ U +became_partner +date +agency_id +integer (8) FK +partner_account_status_id +integer (8) FK +crm_id +integer (8) + + + +m_Agency->m_Agreements::PartnerAccount + + + + + + + +m_ServiceProvider + +ServiceProvider + +id +integer PK +issuer +string ∗ FK +friendly_name +string ∗ +description +text +metadata_url +text +acs_url +text +assertion_consumer_logout_service_url +text +logo +text +signature +string +block_encryption +string ∗ +sp_initiated_login_url +text +return_to_sp_url +text +attribute_bundle +json +active +boolean ∗ +approved +boolean ∗ +native +boolean ∗ +redirect_uris +string +agency_id +integer FK +failure_to_proof_url +text +ial +integer +piv_cac +boolean +piv_cac_scoped_by_email +boolean +pkce +boolean +push_notification_url +string +help_text +jsonb +allow_prompt_login +boolean +signed_response_message_requested +boolean +remote_logo_key +string +launch_date +date +iaa +string +iaa_start_date +date +iaa_end_date +date +app_id +string +default_aal +integer +certs +string +email_nameid_format_allowed +boolean +use_legacy_name_id_behavior +boolean +irs_attempts_api_enabled +boolean +in_person_proofing_enabled +boolean +post_idv_follow_up_url +string + + + +m_Agency->m_ServiceProvider + + + + + + + +m_Agreements::IaaGtc + +Agreements::IaaGtc + +id +integer (8) PK +gtc_number +string ∗ U +mod_number +integer ∗ +start_date +date ∗ +end_date +date ∗ +estimated_amount +decimal (12,2) +partner_account_id +integer (8) FK + + + +m_Agreements::IaaOrder + +Agreements::IaaOrder + +id +integer (8) PK +order_number +integer ∗ U +mod_number +integer ∗ +start_date +date ∗ +end_date +date ∗ +estimated_amount +decimal (12,2) +pricing_model +integer ∗ +iaa_gtc_id +integer (8) FK + + + +m_Agreements::IaaGtc->m_Agreements::IaaOrder + + + + + + + +m_Agreements::Integration + +Agreements::Integration + +id +integer (8) PK +issuer +string ∗ FK +name +string ∗ +dashboard_identifier +integer U +partner_account_id +integer (8) FK +integration_status_id +integer (8) FK +service_provider_id +integer (8) + + + +m_Agreements::IaaGtc->m_ServiceProvider + + + + + + + +m_Agreements::IntegrationUsage + +Agreements::IntegrationUsage + +id +integer (8) PK +iaa_order_id +integer (8) FK +integration_id +integer (8) FK + + + +m_Agreements::IaaOrder->m_Agreements::IntegrationUsage + + + + + + + +m_Agreements::Integration->m_Agreements::IaaOrder + + + + + + + +m_Agreements::Integration->m_Agreements::IntegrationUsage + + + + + + + +m_Agreements::IntegrationStatus + +Agreements::IntegrationStatus + +id +integer (8) PK +name +string ∗ U +order +integer ∗ U +partner_name +string + + + +m_Agreements::IntegrationStatus->m_Agreements::Integration + + + + + + + +m_Agreements::IntegrationUsage->m_Agreements::PartnerAccount + + + + + + +m_Agreements::PartnerAccount->m_Agreements::IaaGtc + + + + + + + +m_Agreements::PartnerAccount->m_Agreements::IaaOrder + + + + + + + +m_Agreements::PartnerAccount->m_Agreements::Integration + + + + + + + +m_Agreements::PartnerAccountStatus + +Agreements::PartnerAccountStatus + +id +integer (8) PK +name +string ∗ U +order +integer ∗ U +partner_name +string + + + +m_Agreements::PartnerAccountStatus->m_Agreements::PartnerAccount + + + + + + + +m_AuthAppConfiguration + +AuthAppConfiguration + +id +integer (8) PK +user_id +integer ∗ FK +encrypted_otp_secret_key +string ∗ +name +string ∗ +totp_timestamp +integer + + + +m_BackupCodeConfiguration + +BackupCodeConfiguration + +id +integer (8) PK +user_id +integer ∗ FK +used_at +datetime +salted_code_fingerprint +string +code_salt +string +code_cost +string + + + +m_DeletedUser + +DeletedUser + +id +integer (8) PK +user_id +integer ∗ FK +uuid +string ∗ +user_created_at +datetime ∗ +deleted_at +datetime ∗ + + + +m_ServiceProviderIdentity + +ServiceProviderIdentity + +id +integer PK +service_provider +string (255) ∗ FK +last_authenticated_at +datetime +user_id +integer FK +session_uuid +string (255) +uuid +string ∗ +nonce +string +ial +integer +access_token +string +scope +string +code_challenge +string +rails_session_id +string +verified_attributes +json +verified_at +datetime +last_consented_at +datetime +last_ial1_authenticated_at +datetime +last_ial2_authenticated_at +datetime +deleted_at +datetime +aal +integer +requested_aal_value +text +vtr +string +acr_values +string +email_address_id +integer (8) FK + + + +m_DeletedUser->m_ServiceProviderIdentity + + + + + + + +m_Device + +Device + +id +integer (8) PK +user_id +integer ∗ FK +cookie_uuid +string ∗ +user_agent +string ∗ +last_used_at +datetime ∗ +last_ip +string (255) ∗ + + + +m_Event + +Event + +id +integer PK +user_id +integer ∗ FK +event_type +integer ∗ +device_id +integer FK +ip +string +disavowed_at +datetime +disavowal_token_fingerprint +string + + + +m_Device->m_Event + + + + + + + +m_DisposableEmailDomain + +DisposableEmailDomain + +id +integer (8) PK +name +citext ∗ + + + +m_DocAuthLog + +DocAuthLog + +id +integer (8) PK +user_id +integer ∗ FK +welcome_view_at +datetime +welcome_view_count +integer +upload_view_at +datetime +upload_view_count +integer +link_sent_view_at +datetime +link_sent_view_count +integer +front_image_view_at +datetime +front_image_view_count +integer +front_image_submit_count +integer +front_image_error_count +integer +back_image_view_at +datetime +back_image_view_count +integer +back_image_submit_count +integer +back_image_error_count +integer +mobile_front_image_view_at +datetime +mobile_front_image_view_count +integer +mobile_back_image_view_at +datetime +mobile_back_image_view_count +integer +ssn_view_at +datetime +ssn_view_count +integer +verify_view_at +datetime +verify_view_count +integer +verify_submit_count +integer +verify_error_count +integer +verify_phone_view_at +datetime +verify_phone_view_count +integer +usps_address_view_at +datetime +usps_address_view_count +integer +encrypt_view_at +datetime +encrypt_view_count +integer +verified_view_at +datetime +verified_view_count +integer +mobile_front_image_submit_count +integer +mobile_front_image_error_count +integer +mobile_back_image_submit_count +integer +mobile_back_image_error_count +integer +usps_letter_sent_submit_count +integer +usps_letter_sent_error_count +integer +capture_mobile_back_image_view_at +datetime +capture_mobile_back_image_view_count +integer +capture_complete_view_at +datetime +capture_complete_view_count +integer +capture_mobile_back_image_submit_count +integer +capture_mobile_back_image_error_count +integer +no_sp_session_started_at +datetime +choose_method_view_at +datetime +choose_method_view_count +integer +present_cac_view_at +datetime +present_cac_view_count +integer +present_cac_submit_count +integer +present_cac_error_count +integer +enter_info_view_at +datetime +enter_info_view_count +integer +success_view_at +datetime +success_view_count +integer +selfie_view_count +integer +selfie_submit_count +integer +selfie_error_count +integer +issuer +string FK +last_document_error +string +document_capture_view_at +datetime +document_capture_view_count +integer +document_capture_submit_count +integer +document_capture_error_count +integer +agreement_view_at +datetime +agreement_view_count +integer +state +string +verify_submit_at +datetime +verify_phone_submit_count +integer +verify_phone_submit_at +datetime +document_capture_submit_at +datetime +back_image_submit_at +datetime +capture_mobile_back_image_submit_at +datetime +mobile_back_image_submit_at +datetime + + + +m_DocumentCaptureSession + +DocumentCaptureSession + +id +integer (8) PK +uuid +string +result_id +string +user_id +integer (8) FK +requested_at +datetime +issuer +string +cancelled_at +datetime +ocr_confirmation_pending +boolean +last_doc_auth_result +string +socure_docv_transaction_token +string +socure_docv_capture_app_url +string + + + +m_EmailAddress + +EmailAddress + +id +integer (8) PK +user_id +integer (8) FK +confirmation_token +string (255) +confirmed_at +datetime +confirmation_sent_at +datetime +email_fingerprint +string ∗ +encrypted_email +string ∗ +last_sign_in_at +datetime + + + +m_EmailAddress->m_ServiceProviderIdentity + + + + + + + +m_SuspendedEmail + +SuspendedEmail + +id +integer (8) PK +email_address_id +integer (8) ∗ FK +digested_base_email +string ∗ + + + +m_EmailAddress->m_SuspendedEmail + + + + + + +m_FederalEmailDomain + +FederalEmailDomain + +id +integer (8) PK +name +citext ∗ + + + +m_FraudReviewRequest + +FraudReviewRequest + +id +integer (8) PK +user_id +integer FK +uuid +string +irs_session_id +string +login_session_id +string + + + +m_GoodJob::BatchRecord + +GoodJob::BatchRecord + +id +uuid PK +description +text +serialized_properties +jsonb +on_finish +text +on_success +text +on_discard +text +callback_queue_name +text +callback_priority +integer +enqueued_at +datetime (6,0) +discarded_at +datetime (6,0) +finished_at +datetime (6,0) +jobs_finished_at +datetime (6,0) + + + +m_GoodJob::Job + +GoodJob::Job + +id +uuid PK +queue_name +text +priority +integer +serialized_params +jsonb +scheduled_at +datetime +performed_at +datetime +finished_at +datetime +error +text +active_job_id +uuid FK +concurrency_key +text +cron_key +text +cron_at +datetime +batch_id +uuid FK +batch_callback_id +uuid FK +executions_count +integer +job_class +text +error_event +integer (2) +labels +text +locked_by_id +uuid FK +locked_at +datetime (6,0) + + + +m_GoodJob::BatchRecord->m_GoodJob::Job + + + + + + + +m_GoodJob::DiscreteExecution + +GoodJob::DiscreteExecution + +id +uuid PK +active_job_id +uuid ∗ +job_class +text +queue_name +text +serialized_params +jsonb +scheduled_at +datetime (6,0) +finished_at +datetime (6,0) +error +text +error_event +integer (2) +error_backtrace +text +process_id +uuid +duration +interval + + + +m_GoodJob::Execution + +GoodJob::Execution + +id +uuid PK +active_job_id +uuid ∗ FK +job_class +text +queue_name +text +serialized_params +jsonb +scheduled_at +datetime (6,0) +finished_at +datetime (6,0) +error +text +error_event +integer (2) +error_backtrace +text +process_id +uuid +duration +interval + + + +m_GoodJob::Job->m_GoodJob::Execution + + + + + + + +m_GoodJob::Process + +GoodJob::Process + +id +uuid PK +state +jsonb +lock_type +integer (2) + + + +m_GoodJob::Process->m_GoodJob::Job + + + + + + + +m_GoodJob::Setting + +GoodJob::Setting + +id +uuid PK +key +text +value +jsonb + + + +m_GpoConfirmation + +GpoConfirmation + +id +integer PK +entry +text ∗ +entry_multi_region +text + + + +m_GpoConfirmationCode + +GpoConfirmationCode + +id +integer (8) PK +profile_id +integer ∗ FK +otp_fingerprint +string ∗ +code_sent_at +datetime ∗ +reminder_sent_at +datetime + + + +m_InPersonEnrollment + +InPersonEnrollment + +id +integer (8) PK +user_id +integer (8) ∗ FK +profile_id +integer (8) FK +enrollment_code +string +status_check_attempted_at +datetime +status_updated_at +datetime +status +integer +current_address_matches_id +boolean +selected_location_details +jsonb +unique_id +string +enrollment_established_at +datetime (6,0) +issuer +string FK +follow_up_survey_sent +boolean +early_reminder_sent +boolean +late_reminder_sent +boolean +deadline_passed_sent +boolean +proofed_at +datetime +capture_secondary_id_enabled +boolean +status_check_completed_at +datetime (6,0) +ready_for_status_check +boolean +notification_sent_at +datetime (6,0) +last_batch_claimed_at +datetime (6,0) +sponsor_id +string ∗ +doc_auth_result +string + + + +m_NotificationPhoneConfiguration + +NotificationPhoneConfiguration + +id +integer (8) PK +in_person_enrollment_id +integer (8) ∗ FK +encrypted_phone +text ∗ + + + +m_InPersonEnrollment->m_NotificationPhoneConfiguration + + + + + + +m_LetterRequestsToGpoFtpLog + +LetterRequestsToGpoFtpLog + +id +integer (8) PK +ftp_at +datetime ∗ +letter_requests_count +integer ∗ + + + +m_PhoneConfiguration + +PhoneConfiguration + +id +integer (8) PK +user_id +integer (8) ∗ FK +encrypted_phone +text ∗ +delivery_preference +integer ∗ +mfa_enabled +boolean ∗ +confirmation_sent_at +datetime +confirmed_at +datetime +made_default_at +datetime + + + +m_PhoneNumberOptOut + +PhoneNumberOptOut + +id +integer (8) PK +encrypted_phone +string +phone_fingerprint +string ∗ +uuid +string + + + +m_PivCacConfiguration + +PivCacConfiguration + +id +integer (8) PK +user_id +integer ∗ FK +x509_dn_uuid +string ∗ +name +string ∗ +x509_issuer +string + + + +m_Profile + +Profile + +id +integer PK +user_id +integer ∗ FK +active +boolean ∗ U +verified_at +datetime +activated_at +datetime +encrypted_pii +text +ssn_signature +string (64) +encrypted_pii_recovery +text +deactivation_reason +integer +proofing_components +jsonb +name_zip_birth_year_signature +string +initiating_service_provider_issuer +string FK +fraud_review_pending_at +datetime (6,0) +fraud_rejection_at +datetime (6,0) +gpo_verification_pending_at +datetime (6,0) +fraud_pending_reason +integer +in_person_verification_pending_at +datetime (6,0) +encrypted_pii_multi_region +text +encrypted_pii_recovery_multi_region +text +gpo_verification_expired_at +datetime (6,0) +idv_level +integer + + + +m_Profile->m_GpoConfirmationCode + + + + + + + +m_Profile->m_InPersonEnrollment + + + + + + +m_RegistrationLog + +RegistrationLog + +id +integer (8) PK +user_id +integer ∗ FK +registered_at +datetime + + + +m_SecurityEvent + +SecurityEvent + +id +integer (8) PK +user_id +integer (8) ∗ FK +event_type +string ∗ +jti +string +issuer +string +occurred_at +datetime + + + +m_ServiceProvider->m_AccountResetRequest + + + + + + + +m_ServiceProvider->m_Agreements::Integration + + + + + + +m_ServiceProvider->m_DocAuthLog + + + + + + + +m_ServiceProvider->m_InPersonEnrollment + + + + + + + +m_ServiceProvider->m_Profile + + + + + + + +m_ServiceProvider->m_ServiceProviderIdentity + + + + + + + +m_SpReturnLog + +SpReturnLog + +id +integer (8) PK +requested_at +datetime ∗ +request_id +string ∗ +ial +integer ∗ +issuer +string ∗ FK +user_id +integer FK +returned_at +datetime +billable +boolean +profile_id +integer (8) +profile_verified_at +datetime (6,0) +profile_requested_issuer +string FK + + + +m_ServiceProvider->m_SpReturnLog + + + + + + + +m_ServiceProviderIdentity->m_Agency + + + + + + +m_SignInRestriction + +SignInRestriction + +id +integer (8) PK +user_id +integer ∗ FK +service_provider +string + + + +m_SocureReasonCode + +SocureReasonCode + +id +integer (8) PK +code +string +group +string +description +text +added_at +datetime (6,0) +deactivated_at +datetime (6,0) + + + +m_SpCost + +SpCost + +id +integer (8) PK +issuer +string ∗ +agency_id +integer ∗ +cost_type +string ∗ +ial +integer +transaction_id +string + + + +m_SpUpgradedFacialMatchProfile + +SpUpgradedFacialMatchProfile + +id +integer (8) PK +upgraded_at +datetime (6,0) ∗ +user_id +integer (8) ∗ FK +idv_level +string ∗ +issuer +string ∗ + + + +m_User + +User + +id +integer PK +reset_password_token +string (255) +reset_password_sent_at +datetime +confirmed_at +datetime +second_factor_attempts_count +integer +uuid +string (255) ∗ +second_factor_locked_at +datetime +phone_confirmed_at +datetime +direct_otp +string +direct_otp_sent_at +datetime +unique_session_id +string +otp_delivery_preference +integer ∗ +encrypted_password_digest +string +encrypted_recovery_code_digest +string +remember_device_revoked_at +datetime +email_language +string (10) +accepted_terms_at +datetime +encrypted_recovery_code_digest_generated_at +datetime +suspended_at +datetime (6,0) +reinstated_at +datetime (6,0) +encrypted_password_digest_multi_region +string +encrypted_recovery_code_digest_multi_region +string +second_mfa_reminder_dismissed_at +datetime (6,0) +piv_cac_recommended_dismissed_at +datetime (6,0) +sign_in_new_device_at +datetime (6,0) +password_compromised_checked_at +datetime (6,0) +webauthn_platform_recommended_dismissed_at +datetime (6,0) + + + +m_User->m_AccountResetRequest + + + + + + +m_User->m_AgencyIdentity + + + + + + + +m_User->m_AuthAppConfiguration + + + + + + + +m_User->m_BackupCodeConfiguration + + + + + + + +m_User->m_Device + + + + + + + +m_User->m_DocAuthLog + + + + + + + +m_User->m_DocumentCaptureSession + + + + + + + +m_User->m_EmailAddress + + + + + + + +m_User->m_Event + + + + + + + +m_User->m_FraudReviewRequest + + + + + + + +m_User->m_GpoConfirmationCode + + + + + + + +m_User->m_InPersonEnrollment + + + + + + + +m_User->m_PhoneConfiguration + + + + + + + +m_User->m_PivCacConfiguration + + + + + + + +m_User->m_Profile + + + + + + + +m_User->m_RegistrationLog + + + + + + +m_User->m_SecurityEvent + + + + + + + +m_User->m_ServiceProviderIdentity + + + + + + + +m_User->m_SignInRestriction + + + + + + + +m_User->m_SpReturnLog + + + + + + + +m_User->m_SpUpgradedFacialMatchProfile + + + + + + + +m_WebauthnConfiguration + +WebauthnConfiguration + +id +integer (8) PK +user_id +integer (8) ∗ FK +name +string ∗ +credential_id +text ∗ +credential_public_key +text ∗ +platform_authenticator +boolean +transports +string +authenticator_data_flags +jsonb +aaguid +string + + + +m_User->m_WebauthnConfiguration + + + + + + +