diff --git a/app/policies/power_of_attorney_policy.rb b/app/policies/power_of_attorney_policy.rb index 5c11c1d3bf4..5c1ca093256 100644 --- a/app/policies/power_of_attorney_policy.rb +++ b/app/policies/power_of_attorney_policy.rb @@ -2,6 +2,21 @@ PowerOfAttorneyPolicy = Struct.new(:user, :power_of_attorney) do def access? - user.loa3? && user.icn.present? && user.participant_id.present? + unless user.loa3? && user.icn.present? && user.participant_id.present? + log_access_denied + return false + end + + true + end + + private + + def log_access_denied + Rails.logger.info('POA ACCESS DENIED', + loa_current: user.loa&.dig(:current), + loa3: user.loa3?, + icn_present: user.icn.present?, + participant_id_present: user.participant_id.present?) end end diff --git a/spec/policies/power_of_attorney_policy_spec.rb b/spec/policies/power_of_attorney_policy_spec.rb index dc69776d8c3..c9c27733395 100644 --- a/spec/policies/power_of_attorney_policy_spec.rb +++ b/spec/policies/power_of_attorney_policy_spec.rb @@ -9,7 +9,8 @@ context 'when user is LOA3, has an ICN, and has a participant_id' do let(:user) { build(:user, :loa3) } - it 'grants access' do + it 'grants access and does not log' do + expect(Rails.logger).not_to receive(:info).with('POA ACCESS DENIED', anything) expect(subject).to permit(user, :power_of_attorney) end end @@ -17,7 +18,16 @@ context 'when user is LOA3 but does not have an ICN' do let(:user) { build(:user, :loa3, icn: nil) } - it 'denies access due to missing ICN' do + it 'denies access due to missing ICN and logs the access denial details' do + expect(Rails.logger).to receive(:info).with( + 'POA ACCESS DENIED', + hash_including( + loa_current: 3, + loa3: true, + icn_present: false, + participant_id_present: true + ) + ) expect(subject).not_to permit(user, :power_of_attorney) end end @@ -25,7 +35,16 @@ context 'when user is LOA3 but does not have a participant_id' do let(:user) { build(:user, :loa3, participant_id: nil) } - it 'denies access due to missing participant_id' do + it 'denies access due to missing participant_id and logs the access denial details' do + expect(Rails.logger).to receive(:info).with( + 'POA ACCESS DENIED', + hash_including( + loa_current: 3, + loa3: true, + icn_present: true, + participant_id_present: false + ) + ) expect(subject).not_to permit(user, :power_of_attorney) end end @@ -33,7 +52,16 @@ context 'when user is not LOA3' do let(:user) { build(:user, :loa1) } - it 'denies access due to not being LOA3' do + it 'denies access due to not being LOA3 and logs the access denial details' do + expect(Rails.logger).to receive(:info).with( + 'POA ACCESS DENIED', + hash_including( + loa_current: 1, + loa3: false, + icn_present: true, + participant_id_present: false + ) + ) expect(subject).not_to permit(user, :power_of_attorney) end end