Direct verification through the municipal census integrated with SMS verification

[carolromero]

Ref: PB01 [BCN]

Is your feature request related to a problem? Please describe.
As a visitor, sometimes the registration form can be a barrier to participation, as the process seems very long if I only want to make a one-time participation. A typical example is the voting phase of a participatory budget, where my interest is to vote my preferred projects and that's it.

Describe the solution you’d like
I want to be able to verify myself without creating an account in order to vote directly by providing the following data:

• Type of document
• Document number
• Date of birth
• Mobile phone
• Terms of Services checkbox acceptance

Once it's verified that these data match with the census, I receive a code on my mobile phone that allows me to complete the authorization and participate in the voting process.

As a visitor who has used this verification system without registration, I should receive an email invitation to create an account on the platform. For sending this invitation, after the voting process I can optionally add my email.

The name and nickname is autogenerated, we will have participants called "Participant 134111 (participant_134111)" with the user ID). The participant could change this nickname after.

Describe alternatives you’ve considered
To also ask name, nickname and email in the same registration form, but having more fields in this same form could bring usability problems (people have fears when having a registration form with 10 fields), so this is discarded.

We also discarded not having the name not nickname and to only have the possibility of voting in this budgets component, meaning that she will not have the possbility of creating a proposal, comment, etc. But this is really difficult to make with the current architecture of Decidim.

Additional context
As usual, for security and privacy reasons if the census data doesn't match then we'll show a generic error and ask for contacting to a support email or contact form.

Also if the census data match with an already verified participant we will show the same generic error. For already verified and very old participants (ie more than 1 year old) what we recommend is to revoke these verifications, as having old verifications brings also a security issues (ie what happens with people that moved out, dead people, etc).

⚠️ branch feature/bcn-budget-v0.24

As this is closely integrated with the city of Barcelona flow then this feature will only be available in this repository. In the future after we have a clearer understanding of this feature we could make a module or send a PR to decidim/decidim repository. Also for time constrains we will make it to v0.24 as v0.25 will have lots of inestability (upgrade to rails 6 and webpacker) and we need this for the Barcelona 2021 Participatory Budgeting process. ⚠️

Does this issue could impact on users private data?
Yes, it's about verifying the participants.

Acceptance criteria

• Given that there's a component with the "Ephemerous Census Data Verification" enabled,
  When a visitor (non logged in) participant click in the "vote" button
  Then she'll see a modal that says: "Login/Register/Participate with the Census Data"
• Given that this visitor clicks in "Participate with the Census Data"
  Then she'll see a form with these fields: Type of document, Document number, Date of birth, Mobile phone and TOS checkbox acceptance.
• Given that the visitor has entered wrong data in this form
  Then she'll see a generic error with a support email or contact form link.
• Given that the visitor has entered data of an already registered participant in this form
  Then she'll see the same generic error with a support email or contact form link.
• Given that the visitor has entered data of a person that exists in the municipal census in this form and that's older than 14 years and that's not already registered
  Then she'll be able to vote in the component
  And
  She'll not be able to vote in other components nor leave a comment.
• Given that this ephemerous participant has already voted
  Then she'll be able to leave her email
  And
  She'll receive an invitation to create an already verified account.