This is an EPIC to improve the signature process of an initiative

Summary

The process to sign an initiative need to be enhanced by adding new steps in the signature process in order to improve the system, improve its abstraction and providing more security.

EPIC motivation

To enhance the security process and adapting the requirements coming from the city of Barcelona we propose a set of developments in the process of signing an initiative.

User story

As a User

When I am in a full-page initiative:

• If I have no authorization to sign I should see the button to sign an initiative in grey colour. (Sign initiative user flow in front. #4657)
• I want to see the reference code of the initiative in the same way as proposals (example: BCN-INIT-2018-11-13554). (Add a reference code to initiatives #4647)
  When I want to sign an initiative:
• After clicking on sign button I should see a new (emergent) window and I should be able to fill the following fields (Add setting to initiative types with list of extra user fields to be collected in signature #4652):
  • Name and surname,
  • DNI / NIE / Passport
  • Date of birth
  • Postal code.
  • Customizable text box to add legal information
• In this step the system should check if the Hash of DNI provided here (applying the same hash that we have in the verification process) is the same that the Hash od DNI on verification process.
  The design of this step would look like this (Document number verifications in initiatives signature #4656):
  
• Then I should add the code received on my mobile phone. (Add an initiative type setting to enable SMS verification step #4654)
  
• After this step the initiative could be signed and I should receive a message confirming that the initiative has been signed (Sign initiative user flow in front. #4657).
  

As an administrator I want to:

• Identify any Initiative with one unique identifier Add a reference code to initiatives #4647
• For each type of initiative I want to decide if digital signatures are enabled or not. Add setting to enable digital signatures in initiative type #4650
• Add support for requiring several verification systems for a component/resource Support requiring multiple authorizations for voting/endorsing items #4677
• For each type of initiative I have to be able to define what type of verification (authorization) is needed to be able to sign. Add type of authorization required to sign an initiative setting to initiative types #4649
• For each type of initiative, I have to be able to configure the minimum number of people that the committee promoting an initiative should have. Add minimum committee members setting to initiatives #4648
• For each type of initiative the extra fields to fill in when the user sign, have to be enabled or disabled from the administration panel. Add setting to initiative types with list of extra user fields to be collected in signature #4652
• For each type of initiative the option to use SMS have to be enabled or disabled from the administration panel. (Add an initiative type setting to enable SMS verification step #4654)
• Download a file with all logs of the signatures (Generate downloadable data of signatures #4655)
• Download the list of all signatures in PDF format including the following information (Generate downloadable data of signatures #4655):
  • Identifier of the initiative
  • Title of the Initiative
  • Date of start and date of the end
  • Number of Initiatives
  • List of signatures
    • Identifier of the initiative and title
    • DNI/NIF/Passport
    • Name and surname
    • Postal Code
    • Date of birth
    • Time an date
    • Timestamp
    • Hash (Hash of the last signature + this signature)

Security of the initiative:

• In the first step after to add my personal information, the DNI provided should be hashed and compared with the hash of the DNI that we keep on the database in the authorization process. (Document number verifications in initiatives signature #4656)
• We should guarantee that no one sign more than one time an initiative. (Document number verifications in initiatives signature #4656)
• The personal data collected in each initiative should be saved in a new database with an extra-security layer, having a key in the system to access this data. (Implement signature data storage #4653)
• To check the list of signatures after the period to gather signatures the data to be saved in the database should be (Generate downloadable data of signatures #4655):
  • Identifier of the initiative and title
  • DNI/NIF/Passport
  • Name and surname
  • Postal Code
  • Date of birth
  • Each signature should have a TimeStamp provided by a third.
• Every time that anyone signs an initiative the system generates a log (Generate downloadable data of signatures #4655).

Other related issues:

#4555

Other information

Initiative engine: https://github.com/decidim/decidim/tree/master/decidim-initiatives