Additional Protection (#12461)

* Additional Protection

* fixing

lib/decision_review_v1/service.rb

@@ -20,6 +20,8 @@ class Service < Common::Client::Base
     include DecisionReviewV1::Appeals::SupplementalClaimServices
 
     STATSD_KEY_PREFIX = 'api.decision_review'
+    ZIP_REGEX = /^\d{5}(-\d{4})?$/
+    NO_ZIP_PLACEHOLDER = '00000'
 
     configuration DecisionReviewV1::Configuration
 
@@ -227,10 +229,19 @@ def get_notice_of_disagreement_upload(guid:)
     end
 
     def self.file_upload_metadata(user, backup_zip = nil)
+      original_zip = user.postal_code.to_s
+      backup_zip_from_frontend = backup_zip.to_s
+      zip = if original_zip =~ ZIP_REGEX
+              original_zip
+            elsif backup_zip_from_frontend =~ ZIP_REGEX
+              backup_zip_from_frontend
+            else
+              NO_ZIP_PLACEHOLDER
+            end
       {
         'veteranFirstName' => transliterate_name(user.first_name),
         'veteranLastName' => transliterate_name(user.last_name),
-        'zipCode' => user.postal_code || backup_zip,
+        'zipCode' => zip,
         'fileNumber' => user.ssn.to_s.strip,
         'source' => 'va.gov',
         'businessLine' => 'BVA',

spec/lib/decision_review_v1/service_spec.rb

@@ -99,6 +99,58 @@
     end
   end
 
+  describe '#file_upload_metadata' do
+    let(:backup_zip) { '12345' }
+    let(:zip_replacement_value) { '00000' }
+
+    context 'with all data present' do
+      it 'generates metadata' do
+        md = DecisionReviewV1::Service.file_upload_metadata(user)
+        expect(JSON.parse(md).symbolize_keys).to eq({
+                                                      veteranFirstName: 'abraham',
+                                                      veteranLastName: 'lincoln',
+                                                      zipCode: '20500',
+                                                      fileNumber: '212222112',
+                                                      source: 'va.gov',
+                                                      businessLine: 'BVA',
+                                                      skipDimensionCheck: true
+                                                    })
+      end
+    end
+
+    context 'with a null postal code' do
+      it 'generates metadata, with replaced zip and no errors' do
+        allow_any_instance_of(User).to receive(:postal_code).and_return(nil)
+        md = DecisionReviewV1::Service.file_upload_metadata(user)
+        expect(JSON.parse(md)['zipCode']).to eq(zip_replacement_value)
+      end
+    end
+
+    context 'with invalid postal codes' do
+      ['', '1234', '12345-123', 123, '1' * 100].each do |invalid_zip|
+        it "generates metadata with invalid postal code (#{invalid_zip}) provided" do
+          allow_any_instance_of(User).to receive(:postal_code).and_return(invalid_zip)
+          md = DecisionReviewV1::Service.file_upload_metadata(user)
+          expect(JSON.parse(md)['zipCode']).to eq(zip_replacement_value)
+        end
+      end
+    end
+
+    context 'with backup postal codes' do
+      it 'generates metadata without using backup zip if postal code is valid' do
+        md = DecisionReviewV1::Service.file_upload_metadata(user, backup_zip)
+        expect(JSON.parse(md)['zipCode']).to eq('20500')
+      end
+
+      it 'generates metadata using backup zip if postal code is invalid' do
+        backup_zip = '12345'
+        allow_any_instance_of(User).to receive(:postal_code).and_return('1234')
+        md = DecisionReviewV1::Service.file_upload_metadata(user, backup_zip)
+        expect(JSON.parse(md)['zipCode']).to eq(backup_zip)
+      end
+    end
+  end
+
   describe '#create_higher_level_review' do
     subject { described_class.new.create_higher_level_review(request_body: body.to_json, user:) }