Release 2024.07.1

.github/workflows/deploy.yml

@@ -52,7 +52,7 @@ jobs:
         uses: docker/setup-buildx-action@v3
 
       - name: Build, tag, and push image to GitHub Container Registry
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6
         with:
           builder: ${{ steps.buildx.outputs.name }}
           build-args: GIT-SHA=${{ github.sha }}

.github/workflows/tests-ui.yml

@@ -22,7 +22,7 @@ jobs:
           docker compose up --detach client
 
       - name: Run Lighthouse tests for a11y
-        uses: treosh/lighthouse-ci-action@11.4.0
+        uses: treosh/lighthouse-ci-action@12.1.0
         with:
           urls: |
             http://localhost:8000

.pre-commit-config.yaml

@@ -41,14 +41,14 @@ repos:
           - python
 
   - repo: https://github.com/PyCQA/flake8
-    rev: 7.0.0
+    rev: 7.1.0
     hooks:
       - id: flake8
         types:
           - python
 
   - repo: https://github.com/pycqa/bandit
-    rev: 1.7.8
+    rev: 1.7.9
     hooks:
       - id: bandit
         args: ["-ll"]

benefits/core/migrations/local_fixtures.json

@@ -131,7 +131,12 @@
     "fields": {
       "name": "calfresh",
       "label": "CalFresh",
-      "group_id": "group123"
+      "group_id": "group123",
+      "supports_expiration": "True",
+      "expiration_days": 5,
+      "expiration_reenrollment_days": 3,
+      "reenrollment_error_template": "enrollment/reenrollment-error--calfresh.html",
+      "enrollment_success_template": "enrollment/success--mst.html"
     }
   },
   {

benefits/core/templates/core/includes/lang-selector.html

@@ -14,6 +14,7 @@
     <form method="post" action="{% url "set_language" %}">
       {% csrf_token %}
       {% get_language_info for code as langinfo %}
+      <input name="next" type="hidden" value="{{ redirect_to }}" />
       <input name="language" type="hidden" value="{{ code }}" />
       <button class="btn btn-lg btn-outline-light" type="submit">{{ langinfo.name_local | capfirst }}</button>
     </form>

benefits/eligibility/templates/eligibility/start--calfresh.html

@@ -12,7 +12,7 @@ <h1>{% translate "You selected a CalFresh Cardholder transit benefit." %}</h1>
 {% endblock headline %}
 
 {% block media-item %}
-  {% include "eligibility/includes/media-item--idcardcheck--start--calfresh.html" %}
+  {% include "eligibility/includes/media-item--idcardcheck--start--login-gov.html" %}
 {% endblock media-item %}
 
 {% block call-to-action %}

benefits/eligibility/templates/eligibility/start--senior.html

@@ -12,7 +12,7 @@ <h1>{% translate "You selected an Older Adult transit benefit." %}</h1>
 {% endblock headline %}
 
 {% block media-item %}
-  {% include "eligibility/includes/media-item--idcardcheck--start--senior.html" %}
+  {% include "eligibility/includes/media-item--idcardcheck--start--login-gov.html" %}
 {% endblock media-item %}
 
 {% block call-to-action %}

benefits/eligibility/templates/eligibility/start--veteran.html

@@ -12,7 +12,7 @@ <h1>{% translate "You selected a Veteran transit benefit." %}</h1>
 {% endblock headline %}
 
 {% block media-item %}
-  {% include "eligibility/includes/media-item--idcardcheck--start--veteran.html" %}
+  {% include "eligibility/includes/media-item--idcardcheck--start--login-gov.html" %}
 {% endblock media-item %}
 
 {% block call-to-action %}

benefits/enrollment/views.py

@@ -3,10 +3,12 @@
 """
 
 import logging
+from datetime import timedelta
 
 from django.http import JsonResponse
 from django.template.response import TemplateResponse
 from django.urls import reverse
+from django.utils import timezone
 from django.utils.decorators import decorator_from_middleware
 from littlepay.api.client import Client
 from requests.exceptions import HTTPError
@@ -92,7 +94,6 @@ def index(request):
         if not form.is_valid():
             raise Exception("Invalid card token form")
 
-        logger.debug("Read tokenized card")
         card_token = form.cleaned_data.get("card_token")
 
         client = Client(
@@ -104,17 +105,69 @@ def index(request):
         client.oauth.ensure_active_token(client.token)
 
         funding_source = client.get_funding_source_by_token(card_token)
+        group_id = eligibility.group_id
 
         try:
-            client.link_concession_group_funding_source(funding_source_id=funding_source.id, group_id=eligibility.group_id)
+            group_funding_source = _get_group_funding_source(
+                client=client, group_id=group_id, funding_source_id=funding_source.id
+            )
+
+            already_enrolled = group_funding_source is not None
+
+            if eligibility.supports_expiration:
+                # set expiry on session
+                if already_enrolled and group_funding_source.expiry_date is not None:
+                    session.update(request, enrollment_expiry=group_funding_source.expiry_date)
+                else:
+                    session.update(request, enrollment_expiry=_calculate_expiry(eligibility.expiration_days))
+
+                if not already_enrolled:
+                    # enroll user with an expiration date, return success
+                    client.link_concession_group_funding_source(
+                        group_id=group_id, funding_source_id=funding_source.id, expiry=session.enrollment_expiry(request)
+                    )
+                    return success(request)
+                else:  # already_enrolled
+                    if group_funding_source.expiry_date is None:
+                        # update expiration of existing enrollment, return success
+                        client.update_concession_group_funding_source_expiry(
+                            group_id=group_id,
+                            funding_source_id=funding_source.id,
+                            expiry=session.enrollment_expiry(request),
+                        )
+                        return success(request)
+                    else:
+                        is_expired = _is_expired(group_funding_source.expiry_date)
+                        is_within_reenrollment_window = _is_within_reenrollment_window(
+                            group_funding_source.expiry_date, session.enrollment_reenrollment(request)
+                        )
+
+                        if is_expired or is_within_reenrollment_window:
+                            # update expiration of existing enrollment, return success
+                            client.update_concession_group_funding_source_expiry(
+                                group_id=group_id,
+                                funding_source_id=funding_source.id,
+                                expiry=session.enrollment_expiry(request),
+                            )
+                            return success(request)
+                        else:
+                            # re-enrollment error, return enrollment error with expiration and reenrollment_date
+                            return reenrollment_error(request)
+            else:  # eligibility does not support expiration
+                if not already_enrolled:
+                    # enroll user with no expiration date, return success
+                    client.link_concession_group_funding_source(group_id=group_id, funding_source_id=funding_source.id)
+                    return success(request)
+                else:  # already_enrolled
+                    if group_funding_source.expiry_date is None:
+                        # no action, return success
+                        return success(request)
+                    else:
+                        # remove expiration date, return success
+                        raise NotImplementedError("Removing expiration date is currently not supported")
+
         except HTTPError as e:
-            # 409 means that customer already belongs to a concession group.
-            # the response JSON will look like:
-            # {"errors":[{"detail":"Conflict (409) - Customer already belongs to a concession group."}]}
-            if e.response.status_code == 409:
-                analytics.returned_success(request, eligibility.group_id)
-                return success(request)
-            elif e.response.status_code >= 500:
+            if e.response.status_code >= 500:
                 analytics.returned_error(request, str(e))
                 sentry_sdk.capture_exception(e)
 
@@ -125,9 +178,6 @@ def index(request):
         except Exception as e:
             analytics.returned_error(request, str(e))
             raise e
-        else:
-            analytics.returned_success(request, eligibility.group_id)
-            return success(request)
 
     # GET enrollment index
     else:
@@ -154,6 +204,37 @@ def index(request):
         return TemplateResponse(request, eligibility.enrollment_index_template, context)
 
 
+def _get_group_funding_source(client: Client, group_id, funding_source_id):
+    group_funding_sources = client.get_concession_group_linked_funding_sources(group_id)
+    matching_group_funding_source = None
+    for group_funding_source in group_funding_sources:
+        if group_funding_source.id == funding_source_id:
+            matching_group_funding_source = group_funding_source
+            break
+
+    return matching_group_funding_source
+
+
+def _is_expired(expiry_date):
+    """Returns whether the passed in datetime is expired or not."""
+    return expiry_date <= timezone.now()
+
+
+def _is_within_reenrollment_window(expiry_date, enrollment_reenrollment_date):
+    """Returns if we are currently within the reenrollment window."""
+    return enrollment_reenrollment_date <= timezone.now() < expiry_date
+
+
+def _calculate_expiry(expiration_days):
+    """Returns the expiry datetime, which should be midnight in our configured timezone of the (N + 1)th day from now,
+    where N is expiration_days."""
+    default_time_zone = timezone.get_default_timezone()
+    expiry_date = timezone.localtime(timezone=default_time_zone) + timedelta(days=expiration_days + 1)
+    expiry_datetime = expiry_date.replace(hour=0, minute=0, second=0, microsecond=0)
+
+    return expiry_datetime
+
+
 @decorator_from_middleware(EligibleSessionRequired)
 def reenrollment_error(request):
     """View handler for a re-enrollment attempt that is not yet within the re-enrollment window."""
@@ -192,6 +273,7 @@ def system_error(request):
 
 
 @pageview_decorator
+@decorator_from_middleware(EligibleSessionRequired)
 @decorator_from_middleware(VerifierSessionRequired)
 def success(request):
     """View handler for the final success page."""
@@ -206,4 +288,6 @@ def success(request):
         # if they click the logout button, they are taken to the new route
         session.update(request, origin=reverse(ROUTE_LOGGED_OUT))
 
-    return TemplateResponse(request, eligibility.enrollment_success_template)
+    analytics.returned_success(request, eligibility.group_id)
+    context = {"redirect_to": request.path}
+    return TemplateResponse(request, eligibility.enrollment_success_template, context)

benefits/oauth/views.py

@@ -101,7 +101,7 @@ def cancel(request):
 def logout(request):
     """View implementing OIDC and application sign out."""
     verifier = session.verifier(request)
-    oauth_client = oauth.create_client(verifier.auth_provider.client_name)
+    oauth_client = create_client(oauth, verifier.auth_provider)
 
     if not oauth_client:
         raise Exception(f"oauth_client not registered: {verifier.auth_provider.client_name}")

benefits/settings.py

@@ -204,7 +204,11 @@ def RUNTIME_ENVIRONMENT():
 
 USE_I18N = True
 
-TIME_ZONE = "UTC"
+# See https://docs.djangoproject.com/en/5.0/ref/settings/#std-setting-TIME_ZONE
+# > Note that this isn’t necessarily the time zone of the server.
+# > When USE_TZ is True, this is the default time zone that Django will use to display datetimes in templates
+# > and to interpret datetimes entered in forms.
+TIME_ZONE = "America/Los_Angeles"
 USE_TZ = True
 
 # https://docs.djangoproject.com/en/5.0/topics/i18n/formatting/#creating-custom-format-files

docs/requirements.txt

@@ -2,5 +2,5 @@ mdx_truly_sane_lists
 mkdocs==1.6.0
 mkdocs-awesome-pages-plugin
 mkdocs-macros-plugin
-mkdocs-material==9.5.26
+mkdocs-material==9.5.27
 mkdocs-redirects

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "benefits"
-version = "2024.06.1"
+version = "2024.07.1"
 description = "Cal-ITP Benefits is an application that enables automated eligibility verification and enrollment for transit benefits onto customers’ existing contactless bank (credit/debit) cards."
 readme = "README.md"
 license = { file = "LICENSE" }
@@ -9,15 +9,15 @@ requires-python = ">=3.9"
 dependencies = [
     "Authlib==1.3.1",
     "azure-keyvault-secrets==4.8.0",
-    "azure-identity==1.16.1",
+    "azure-identity==1.17.1",
     "Django==5.0.6",
     "django-csp==3.8",
     "django-admin-sortable2==2.2.1",
     "django-google-sso==6.2.1",
     "eligibility-api==2023.9.1",
-    "calitp-littlepay==2024.6.1",
+    "calitp-littlepay==2024.7.1",
     "requests==2.32.3",
-    "sentry-sdk==2.5.1",
+    "sentry-sdk==2.7.1",
     "six==1.16.0",
 ]