[Representative Status] 135311: Log Details about POA Unauthorized Errors

app/policies/power_of_attorney_policy.rb

@@ -2,6 +2,21 @@
 
 PowerOfAttorneyPolicy = Struct.new(:user, :power_of_attorney) do
   def access?
-    user.loa3? && user.icn.present? && user.participant_id.present?
+    unless user.loa3? && user.icn.present? && user.participant_id.present?
+      log_access_denied
+      return false
+    end
+
+    true
+  end
+
+  private
+
+  def log_access_denied
+    Rails.logger.info('POA ACCESS DENIED',
+                      loa_current: user.loa&.dig(:current),
+                      loa3: user.loa3?,
+                      icn_present: user.icn.present?,
+                      participant_id_present: user.participant_id.present?)
   end
 end

spec/policies/power_of_attorney_policy_spec.rb

@@ -9,31 +9,59 @@
     context 'when user is LOA3, has an ICN, and has a participant_id' do
       let(:user) { build(:user, :loa3) }
 
-      it 'grants access' do
+      it 'grants access and does not log' do
+        expect(Rails.logger).not_to receive(:info).with('POA ACCESS DENIED', anything)
         expect(subject).to permit(user, :power_of_attorney)
       end
     end
 
     context 'when user is LOA3 but does not have an ICN' do
       let(:user) { build(:user, :loa3, icn: nil) }
 
-      it 'denies access due to missing ICN' do
+      it 'denies access due to missing ICN and logs the access denial details' do
+        expect(Rails.logger).to receive(:info).with(
+          'POA ACCESS DENIED',
+          hash_including(
+            loa_current: 3,
+            loa3: true,
+            icn_present: false,
+            participant_id_present: true
+          )
+        )
         expect(subject).not_to permit(user, :power_of_attorney)
       end
     end
 
     context 'when user is LOA3 but does not have a participant_id' do
       let(:user) { build(:user, :loa3, participant_id: nil) }
 
-      it 'denies access due to missing participant_id' do
+      it 'denies access due to missing participant_id and logs the access denial details' do
+        expect(Rails.logger).to receive(:info).with(
+          'POA ACCESS DENIED',
+          hash_including(
+            loa_current: 3,
+            loa3: true,
+            icn_present: true,
+            participant_id_present: false
+          )
+        )
         expect(subject).not_to permit(user, :power_of_attorney)
       end
     end
 
     context 'when user is not LOA3' do
       let(:user) { build(:user, :loa1) }
 
-      it 'denies access due to not being LOA3' do
+      it 'denies access due to not being LOA3 and logs the access denial details' do
+        expect(Rails.logger).to receive(:info).with(
+          'POA ACCESS DENIED',
+          hash_including(
+            loa_current: 1,
+            loa3: false,
+            icn_present: true,
+            participant_id_present: false
+          )
+        )
         expect(subject).not_to permit(user, :power_of_attorney)
       end
     end