MOSIP-41021: OTP is being sent to blocked, deactivated, and locked channels for UIN/VID.

[Ivanmeneges]

6 scenarios are getting failed, attaching the report for the reference.

mosip-api-internal.released-auth-2025-03-25_05-26-full-report_T-603_P-577_S-1_F-20_I-5_KI-0 (1).html
mosip-api-internal.qa-java21-auth-2025-03-20_09-30-full-report_T-603_P-576_S-0_F-22_I-5_KI-0.html

|[TC_IDA_SendOTP_10|]|Send otp to blocked VID| |
|[TC_IDA_SendOTP_03|]|Send otp to deactivated UIN| |
|[TC_IDA_SendOTP_07|]|Send otp to locked phone and email with valid UIN| |
|[TC_IDA_SendOTP_09|]|Send otp to blocked UIN| |
|[TC_IDA_SendOTP_05|]|Send otp to locked email with valid UIN| |
|[TC_IDA_SendOTP_06|]|Send otp to locked phone with valid UIN| |

Expected Output: OTP should not be sent on blocked, deactivated or on locked channels , should get valid error message.

📎 Attachments

• mosip-api-internal.qa1-java21-auth-2025-08-05_11-27-full-report_T-612_P-591_S-0_F-6_I-5_KI-10.html

• mosip-api-internal.qa-base-auth-2025-08-05_15-08-full-report_T-612_P-572_S-8_F-17_I-5_KI-10.html

• mosip-api-internal.qaga-auth-2025-12-05_08-30-full-report_T-612_P-598_S-0_F-1_I-5_KI-8.html

• mosip-api-internal.qa-java21-auth-2025-03-20_09-30-full-report_T-603_P-576_S-0_F-22_I-5_KI-0.html

• mosip-api-internal.released-auth-2025-03-25_05-26-full-report_T-603_P-577_S-1_F-20_I-5_KI-0 (1).html

[Ivanmeneges]

Md Tarique Azeez commented: To help debug this issue, I created a UIN in the ACTIVATED state. After creating the UIN, we observed that the logs were correctly generated in the IDA repo, and the UIN records were stored in the IDENTITY_CACHE table. However, after deactivating the same UIN, we did not see any corresponding logs in the IDA repo. It appears that the event is not reaching the IDA repo after the UIN is deactivated.

[Ivanmeneges]

Md Tarique Azeez commented: The issue we faced last time, where the record wasn't being saved in the database after deactivation, is now resolved. The event is now being received from the ID-repo, and we now need confirmation regarding the business logic and modifications to proceed further.
CC : [~accountid:5c18fe9f16ac1e4f7cbb5d3a] [~accountid:712020:54328ce0-79e5-427f-bafd-4f6048ff584f]

[Ivanmeneges]

Varaniya commented: [~accountid:712020:42f70298-8075-48e2-8304-bf89d3fd5fa5] you can work on below scenarios which are valid ones:
[+TC_IDA_SendOTP_10+|https://mosip.atlassian.net/browse/MOSIP-41021]

[TC_IDA_SendOTP_07|https://mosip.atlassian.net/browse/MOSIP-41021]

[TC_IDA_SendOTP_05|https://mosip.atlassian.net/browse/MOSIP-41021]

[TC_IDA_SendOTP_06|https://mosip.atlassian.net/browse/MOSIP-41021]

In Addition to the above please check on the authentication behavior for the expired VID

[~accountid:63295ec9f568615bdc7ad1a4] regarding the blocking if UIN can you explain more as per the script what is the expected behavior of the system. We are not deactivating UIN so need to have a discussion on this before fixing this

[Ivanmeneges]

Md Tarique Azeez commented: [~accountid:712020:54328ce0-79e5-427f-bafd-4f6048ff584f]
I’m unable to find the lock and unlock API. API’s in resident for lock and unlock are deprecated so how taking care this scenario.

[Ivanmeneges]

varaniya commented: [~accountid:712020:42f70298-8075-48e2-8304-bf89d3fd5fa5] old API have been deprecated and created new one. the feature is still present. i am sharing the new api details please have a look: [https://mosip.stoplight.io/docs/resident/ced90acc1a872-create-a-req-auth-lock|https://mosip.stoplight.io/docs/resident/ced90acc1a872-create-a-req-auth-lock|smart-link]

[Ivanmeneges]

varaniya commented: [~accountid:712020:aadfe03f-47db-45df-83f0-889d2229ac9e] this is to be marked as known issue only for the release 1.2.1.0-beta.1 (Part 4), since this needed more effort to debug

[~accountid:5a507d8482ad5d29a77684d7] this needed to be fixed before the next release

Cc: [~accountid:5c18fe9f16ac1e4f7cbb5d3a]