Add Terms of Service Acceptance Concept

[fm3]

New config keys webKnossos.termsOfService.{enabled, version, content}, new routes
GET /termsOfService, POST termsOfService/accept, GET /termsOfService/acceptanceNeeded

The idea is that after login, the frontend checks acceptanceNeeded and shows a popup asking for new TOS acceptance. If the user is orga owner, they cann call accept and that’s it, if they are not, they are told please contact your orga owner.

Note that if termsOfService is not explicitly enabled in the config, acceptanceNeeded should always return false.

Note that when migrating an existing instance, every orga should get one organization owner.

TODO Frontend

• adapt types (user json now contains isOrganizationOwner)
• use routes, show modals, as described above

URL of deployed dev instance (used for testing):

• https://tos.webknossos.xyz

Steps to test:

• set termsOfService.enabled to true in application.conf
• ensure that you are logged in
• open some page on wk
• a modal should appear and prompt you to accept the ToS
• log in as a second user (which is not an admin)
• a modal should appear and ask you to contact the orga admin
• snoozing
  • the default deadline is currently in 2023, so the modals should be closable
  • reload the page --> the modals shouldn't re-appear
  • wait more than 20 seconds --> the modals should appear again
• with exceeded deadline:
  • change the deadline in application conf to a past date (e.g., 2021)
  • check that the modals cannot be closed without hitting accept
  • after acceptance, the modals shouldn't appear again
• bump the ToS version in the application.conf
  • the modals should appear again

Issues:

• fixes Add owner for organizations and ToS acceptance #6611

---

(Please delete unneeded items, merge only when none are left open)

• Ready for review

[philippotto]

I finished the basic functionality. Looks like this:

@fm3 When I tested this, I stumbled a bit, since I had to set the tos version to 1 (since the lastTOSAcceptanceVersion defaults to 0). maybe it could default to -1? or one checks the last TOS acceptance time against zero..

[daniel-wer]

Frontend LGTM 👍

I think the backend still needs a review?

I'm a little bit worried that this might be fairly disruptive. In case the organization owner is not immediately available, all members need to wait for the ToS acceptance. I think a more user friendly pattern would be to prompt the organization owner for acceptance a couple of weeks before (repeatedly), noting the deadline and that work of the members will be disrupted if the ToS are not accepted by then. I know that this would be more work to implement, but I wanted to note it. Have you thought about or discussed this?

[fm3]

I'm a little bit worried that this might be fairly disruptive. In case the organization owner is not immediately available, all members need to wait for the ToS acceptance. I think a more user friendly pattern would be to prompt the organization owner for acceptance a couple of weeks before (repeatedly), noting the deadline and that work of the members will be disrupted if the ToS are not accepted by then. I know that this would be more work to implement, but I wanted to note it. Have you thought about or discussed this?

Would forward this to @normanrz – I think apart from the implementation effort, there may be legal things to consider?

[philippotto]

I'm a little bit worried that this might be fairly disruptive. In case the organization owner is not immediately available, all members need to wait for the ToS acceptance. I think a more user friendly pattern would be to prompt the organization owner for acceptance a couple of weeks before (repeatedly), noting the deadline and that work of the members will be disrupted if the ToS are not accepted by then. I know that this would be more work to implement, but I wanted to note it. Have you thought about or discussed this?

Would forward this to @normanrz – I think apart from the implementation effort, there may be legal things to consider?

@normanrz and I briefly discussed this and agreed that we should try to find a simple solution to mitigate the described problem. One idea would be the following:

The application.conf gets another ToS parameter which would be a deadlineTimestamp that contains the (ideally, a human-readable?) date on which the new ToS have to be agreed upon. When requesting the ToS state, the result could be {needsAcceptance: boolean, deadlineTimestamp: timestamp}. If the deadline is not reached yet, the modals would be closable.

What do you think about this @fm3 ?

[fm3]

@philippotto I added the two new fields acceptanceDeadline (number) and acceptanceDeadlinePassed Boolean, using current server time, to the /termsOfService/acceptanceNeeded route.

Note that we should set enabled to false again in the config before merging this PR

[jstriebel]

Nice stuff, backend mostly LGTM 👍 Only left some minor comments:

[jstriebel]

Backend is fine from my side, didn't do any testing though. Leaving the approval for the frontend reviewer.

[philippotto]

set to false before merging

[philippotto]

@daniel-wer The front-end part is ready for a second review. I integrated a snooze functionality so that the ToS acceptance can be snoozed if the deadline hasn't passed yet. The modals will re-appear on the next page load if a specific duration has passed in the meantime (currently, 20 seconds for testing; probably will change to 3 days).

[daniel-wer]

LGTM if the remaining ToDos are taken care of. Thank you for making it easy to test on the dev instance 🙏

• The ToS shouldn't include the hamburger menu or website footer. Not sure whether that's something for this PR or needs to be changed in the ToS weblium page.

[philippotto]

[ ] The ToS shouldn't include the hamburger menu or website footer. Not sure whether that's something for this PR or needs to be changed in the ToS weblium page.

I'd assume, it would be the easiest to change this on weblium. @normanrz Is this possible? Currently, it looks like this:

[normanrz]

I'd assume, it would be the easiest to change this on weblium. @normanrz Is this possible?

Yeah. I'll check that.