[policies] Add infrastructure to track user decisions to policies #9818

skarya22 · 2025-05-28T17:17:08Z

Brief summary of changes

Added policies table for projects to implement policies that users must agree to to use certain modules or to request a LORIS account.
Configurable so that you can choose the following:
- Which module it should be for
- Should it be a accessible by a button in the header
- Should the user be forced to accept the policy before being able to access this module?
- How long in between accepting the policy do they have to accept it again?

If there is a policy for the login module

If there is a policy for a non-anonymous module, and HeaderButton = 'Y'

Testing instructions (if applicable)

Two policies have been added to raisinbread, confirm they are present SELECT * FROM POLICIES
Open the Dataquery module, you should be prompted to accept the terms of use
Select Decline, and you should be sent to the LORIS homepage
Confirm the decision was saved for your user select * from user_policy_decision
Open the module again and press Accept, you should be able to access the module now. Confirm your decision was saved.
Exit the module, and re-open it, confirm that it does not prompt you for a policy again.
Modify user_policy_decision and change it to that you accepted the policy 8 days from today
Re-open the module and see that it prompts you to accept the terms of use again
Log out and go to the Request Account page
Enter all the details but do not press Terms of Use
Try to submit and see that it makes you view the terms of use first
View the terms of use and try again
Try to create your own policy for a module and confirm that it behaves how you expect

Link(s) to related issue(s)

No issue, but both CCNA and EEGnet had their own implementations, this will reduce the number of overrides

driusan

I like the idea of this and did a first pass at skimming it. I think the structure should be reworked.

In addition to the changes requested, on a high level I think it would make sense to have a "Policy" class to group the behaviour together rather than everything being ad-hoc strings and Utility functions and htdocs files.

htdocs/PolicyDecision.php

modules/login/jsx/requestAccount.js

php/libraries/Utility.class.inc

driusan · 2025-05-30T13:59:56Z

raisinbread/RB_files/RB_policies.sql

+SET FOREIGN_KEY_CHECKS=0;
+TRUNCATE TABLE `policies`;
+LOCK TABLES `policies` WRITE;
+INSERT INTO `policies` (`PolicyID`, `Name`, `Version`, `ModuleID`, `PolicyRenewalTime`, `PolicyRenewalTimeUnit`, `Content`, `SwalTitle`, `HeaderButton`, `HeaderButtonText`, `Active`, `AcceptButtonText`, `DeclineButtonText`, `CreatedAt`, `UpdatedAt`) VALUES (1,'dataquery_example','v1',49,7,'D','By using this Data Query Tool, you acknowledge that you know it is in beta and may not work as expected. You also agree to use it responsibly and not to misuse the data.','Terms Of Use','Y','Terms Of Use','Y','Yes, I accept','Decline','2025-05-28 10:54:21','2025-05-28 10:54:21');


I'm confused by the fact that the example in the database is for the data query tool but the code being changed is for request account

There are two example policies. The one for the login page is right under this.

The one for dataquery does not require any edits to the module as it is inherited from NDB_Page and will work the same for all pages / modules. So any module just needs to have an entry in policies for it to show up.

I had to make changes to request account to enforce that if there is a policy there it is enforced where you have to view it to request an account

To clarify this a bit further as well, as mentioned there are two example policies in this PR.

A pop-up policy for the DQT that both pop-up when the module is opened, but is also re-openable whenever you press on Terms of Use in the header while the module is open. This behaviour is easily reproducible in any module just through sql.

A policy that is tracked on the login page when a user is requesting an account. It's a different use case than the regular pop-up policies since we need a button in request account rather than having it automatically pop-up or having a button in the header. So for this one we need to manually add the PolicyButton, versus the other implementation where the policy is enforced / added through SQL.

regisoc · 2025-07-07T19:17:44Z

@jeffersoncasimir let me know if you have time for this one, else re-assign it to me.

jeffersoncasimir · 2025-07-10T14:49:18Z

@regisoc I don't think this is ready for review. Not passing tests, no changes since previous review and likely needs rebase

skarya22 · 2025-07-10T15:21:28Z

@jeffersoncasimir sorry about that -- you're right it went off my radar when I went on vacation. I'll fix it up and then request a review! Thanks

…nt_Tracking_Infrastructure

skarya22 · 2025-07-15T00:28:34Z

@jeffersoncasimir thank you for your patience -- it's ready for review now!

There is a test failing, but it seems unrelated to the PR:

…nt_Tracking_Infrastructure

jeffersoncasimir

Works nicely. Likely ready for approval after revision.

Please make sure to add policy_tracker to the modules table in the patch, the -01 schema, and RB.

My interpretation of the testing instructions is that it acts as somewhat of a safeguard to a module, but it doesn't re-prompt when declined, and it can easily be bypassed. I can decline the RB dqt prompt, be sent the home page, but then go back to the dqt and use it normally and unprompted, as if nothing happened. Is it intended do a be a bit more consequential?

SQL/0000-00-00-schema.sql

SQL/New_patches/2025-05-22-Introduce-Policy-Decisions.sql

raisinbread/RB_files/RB_policies.sql

SQL/0000-00-00-schema.sql

php/libraries/NDB_Page.class.inc

skarya22 · 2025-07-17T15:29:26Z

@jeffersoncasimir Made all the requested changes except for changing the Date Interval units (see comment).
Also fixed the issue where if you decline you can just go back to the module -- thank you for catching that! It slipped through the cracks after the rewrite

jeffersoncasimir

Works as expected!

jeffersoncasimir · 2025-07-17T16:53:58Z

SQL/sql_for_abstract.sql

I don't think this was meant to be added

jeffersoncasimir · 2025-07-17T16:55:05Z

jsx/PolicyButton.js

+  if (onClickPolicy) {
+    return <a
+      className="hidden-xs hidden-sm"
+      id="onClickPolicyButton"


Suggested change

id="onClickPolicyButton"

id="on-click-policy-button"

jeffersoncasimir · 2025-07-17T16:55:30Z

smarty/templates/main.tpl

@@ -73,6 +73,16 @@
                toggleIcon.classList.add('glyphicon-chevron-down');
              }
            });
+
+            headerPolicyRoot = ReactDOM.createRoot(
+                document.getElementById("headerPolicyButton")


Suggested change

document.getElementById("headerPolicyButton")

document.getElementById("header-policy-button")

jeffersoncasimir · 2025-07-17T16:55:44Z

smarty/templates/main.tpl

@@ -143,6 +153,9 @@
                                </a>
                            </li>
                            {/if}
+                            {if $header_policy}
+                                <li class="hidden-xs hidden-sm" id="headerPolicyButton"></li>


Suggested change

<li class="hidden-xs hidden-sm" id="headerPolicyButton"></li>

<li class="hidden-xs hidden-sm" id="header-policy-button"></li>

SQL/0000-00-00-schema.sql

skarya22 added 2 commits May 28, 2025 11:17

[policies] Add infrastructure to track user decisions to policies

d41412d

Add rest of the files

4cf2f1c

skarya22 added 5 commits May 28, 2025 13:31

Fix for lint

8377716

Login test plan

1079cf2

Update unit test

cd193a6

Lint fixes

ef87966

Fix spacing

db25ee7

skarya22 added Project: CCNA Issue or PR related to the CCNA project Project: EEGNet Issue or PR related to the EEGNet project labels May 28, 2025

skarya22 added 3 commits May 28, 2025 14:34

Fix spacing again

2bbb942

Attempt to fix tests

a444d7a

One more time

b69ea56

driusan reviewed May 30, 2025

View reviewed changes

regisoc assigned jeffersoncasimir Jul 7, 2025

skarya22 added the State: Needs work PR awaiting additional work by the author to proceed label Jul 10, 2025

skarya22 assigned skarya22 and unassigned jeffersoncasimir Jul 10, 2025

skarya22 added 5 commits July 10, 2025 14:41

Merge remote-tracking branch 'aces/main' into 2025_08_22_Policy_Conse…

366968b

…nt_Tracking_Infrastructure

Rework to not have htdocs

21a89f0

Forgot to add new policy_tracker module

1c79bd6

Remove leftover code from webpack

daddb8c

Reverse the fix for a lint test to make it work again?

df87735

Fix phan tests

471a605

skarya22 assigned jeffersoncasimir and unassigned skarya22 Jul 15, 2025

skarya22 requested review from jeffersoncasimir and driusan July 15, 2025 00:27

skarya22 removed the State: Needs work PR awaiting additional work by the author to proceed label Jul 15, 2025

Merge remote-tracking branch 'aces/main' into 2025_08_22_Policy_Conse…

3c88a1c

…nt_Tracking_Infrastructure

jeffersoncasimir requested changes Jul 16, 2025

View reviewed changes

Requested changes and enforce when declined

7add0e0

skarya22 requested a review from jeffersoncasimir July 17, 2025 15:29

skarya22 added 2 commits July 17, 2025 12:22

Fix formatting

2db791c

Fix formatting again

d4589e9

jeffersoncasimir approved these changes Jul 17, 2025

View reviewed changes

	document.getElementById("headerPolicyButton")
	document.getElementById("header-policy-button")

	<li class="hidden-xs hidden-sm" id="headerPolicyButton"></li>
	<li class="hidden-xs hidden-sm" id="header-policy-button"></li>

[policies] Add infrastructure to track user decisions to policies #9818

Are you sure you want to change the base?

[policies] Add infrastructure to track user decisions to policies #9818

Uh oh!

Conversation

skarya22 commented May 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Brief summary of changes

If there is a policy for the login module

If there is a policy for a non-anonymous module, and HeaderButton = 'Y'

Testing instructions (if applicable)

Link(s) to related issue(s)

Uh oh!

driusan left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

driusan May 30, 2025

Choose a reason for hiding this comment

Uh oh!

skarya22 May 30, 2025

Choose a reason for hiding this comment

Uh oh!

skarya22 Jul 10, 2025

Choose a reason for hiding this comment

Uh oh!

regisoc commented Jul 7, 2025

Uh oh!

jeffersoncasimir commented Jul 10, 2025

Uh oh!

skarya22 commented Jul 10, 2025

Uh oh!

skarya22 commented Jul 15, 2025

Uh oh!

jeffersoncasimir left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

skarya22 commented Jul 17, 2025

Uh oh!

jeffersoncasimir left a comment

Choose a reason for hiding this comment

Uh oh!

jeffersoncasimir Jul 17, 2025

Choose a reason for hiding this comment

Uh oh!

jeffersoncasimir Jul 17, 2025

Choose a reason for hiding this comment

Uh oh!

jeffersoncasimir Jul 17, 2025

Choose a reason for hiding this comment

Uh oh!

jeffersoncasimir Jul 17, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

skarya22 commented May 28, 2025 •

edited

Loading