[policies] Add infrastructure to track user decisions to policies #9818

skarya22 · 2025-05-28T17:17:08Z

Brief summary of changes

Added policies table for projects to implement policies that users must agree to to use certain modules or to request a LORIS account.
Configurable so that you can choose the following:
- Which module it should be for
- Should it be a accessible by a button in the header
- Should the user be forced to accept the policy before being able to access this module?
- How long in between accepting the policy do they have to accept it again?

If there is a policy for the login module

If there is a policy for a non-anonymous module, and HeaderButton = 'Y'

Testing instructions (if applicable)

Two policies have been added to raisinbread, confirm they are present SELECT * FROM POLICIES
Open the Dataquery module, you should be prompted to accept the terms of use
Select Decline, and you should be sent to the LORIS homepage
Confirm the decision was saved for your user select * from user_policy_decision
Open the module again and press Accept, you should be able to access the module now. Confirm your decision was saved.
Exit the module, and re-open it, confirm that it does not prompt you for a policy again.
Modify user_policy_decision and change it to that you accepted the policy 8 days from today
Re-open the module and see that it prompts you to accept the terms of use again
Log out and go to the Request Account page
Enter all the details but do not press Terms of Use
Try to submit and see that it makes you view the terms of use first
View the terms of use and try again
Try to create your own policy for a module and confirm that it behaves how you expect

Link(s) to related issue(s)

No issue, but both CCNA and EEGnet had their own implementations, this will reduce the number of overrides

driusan

I like the idea of this and did a first pass at skimming it. I think the structure should be reworked.

In addition to the changes requested, on a high level I think it would make sense to have a "Policy" class to group the behaviour together rather than everything being ad-hoc strings and Utility functions and htdocs files.

htdocs/PolicyDecision.php

modules/login/jsx/requestAccount.js

php/libraries/Utility.class.inc

driusan · 2025-05-30T13:59:56Z

raisinbread/RB_files/RB_policies.sql

+SET FOREIGN_KEY_CHECKS=0;
+TRUNCATE TABLE `policies`;
+LOCK TABLES `policies` WRITE;
+INSERT INTO `policies` (`PolicyID`, `Name`, `Version`, `ModuleID`, `PolicyRenewalTime`, `PolicyRenewalTimeUnit`, `Content`, `SwalTitle`, `HeaderButton`, `HeaderButtonText`, `Active`, `AcceptButtonText`, `DeclineButtonText`, `CreatedAt`, `UpdatedAt`) VALUES (1,'dataquery_example','v1',49,7,'D','By using this Data Query Tool, you acknowledge that you know it is in beta and may not work as expected. You also agree to use it responsibly and not to misuse the data.','Terms Of Use','Y','Terms Of Use','Y','Yes, I accept','Decline','2025-05-28 10:54:21','2025-05-28 10:54:21');


I'm confused by the fact that the example in the database is for the data query tool but the code being changed is for request account

There are two example policies. The one for the login page is right under this.

The one for dataquery does not require any edits to the module as it is inherited from NDB_Page and will work the same for all pages / modules. So any module just needs to have an entry in policies for it to show up.

I had to make changes to request account to enforce that if there is a policy there it is enforced where you have to view it to request an account

To clarify this a bit further as well, as mentioned there are two example policies in this PR.

A pop-up policy for the DQT that both pop-up when the module is opened, but is also re-openable whenever you press on Terms of Use in the header while the module is open. This behaviour is easily reproducible in any module just through sql.

A policy that is tracked on the login page when a user is requesting an account. It's a different use case than the regular pop-up policies since we need a button in request account rather than having it automatically pop-up or having a button in the header. So for this one we need to manually add the PolicyButton, versus the other implementation where the policy is enforced / added through SQL.

regisoc · 2025-07-07T19:17:44Z

@jeffersoncasimir let me know if you have time for this one, else re-assign it to me.

jeffersoncasimir · 2025-07-10T14:49:18Z

@regisoc I don't think this is ready for review. Not passing tests, no changes since previous review and likely needs rebase

skarya22 · 2025-07-10T15:21:28Z

@jeffersoncasimir sorry about that -- you're right it went off my radar when I went on vacation. I'll fix it up and then request a review! Thanks

…nt_Tracking_Infrastructure

skarya22 · 2025-07-15T00:28:34Z

@jeffersoncasimir thank you for your patience -- it's ready for review now!

There is a test failing, but it seems unrelated to the PR:

…nt_Tracking_Infrastructure

jeffersoncasimir

Works nicely. Likely ready for approval after revision.

Please make sure to add policy_tracker to the modules table in the patch, the -01 schema, and RB.

My interpretation of the testing instructions is that it acts as somewhat of a safeguard to a module, but it doesn't re-prompt when declined, and it can easily be bypassed. I can decline the RB dqt prompt, be sent the home page, but then go back to the dqt and use it normally and unprompted, as if nothing happened. Is it intended do a be a bit more consequential?

jeffersoncasimir · 2025-07-16T14:57:30Z

SQL/0000-00-00-schema.sql

+    PolicyRenewalTime INT DEFAULT 7,
+    PolicyRenewalTimeUnit enum('D','Y','M','H') DEFAULT 'D',
+    Content TEXT NULL,
+    SwalTitle VARCHAR(255) DEFAULT 'Terms Of Use',


Suggested change

SwalTitle VARCHAR(255) DEFAULT 'Terms Of Use',

SwalTitle VARCHAR(255) DEFAULT 'Terms of Use',

jeffersoncasimir · 2025-07-16T14:57:39Z

SQL/0000-00-00-schema.sql

+    Content TEXT NULL,
+    SwalTitle VARCHAR(255) DEFAULT 'Terms Of Use',
+    HeaderButton enum('Y','N') DEFAULT 'Y',
+    HeaderButtonText VARCHAR(255) DEFAULT 'Terms Of Use',


Suggested change

HeaderButtonText VARCHAR(255) DEFAULT 'Terms Of Use',

HeaderButtonText VARCHAR(255) DEFAULT 'Terms of Use',

jeffersoncasimir · 2025-07-16T14:59:13Z

SQL/New_patches/2025-05-22-Introduce-Policy-Decisions.sql

+    PolicyRenewalTime INT DEFAULT 7, -- Number of days before the policy is renewed
+    PolicyRenewalTimeUnit enum('D','Y','M','H') DEFAULT 'D', -- Unit of the renewal time
+    Content TEXT NULL,
+    SwalTitle VARCHAR(255) DEFAULT 'Terms Of Use',


Suggested change

SwalTitle VARCHAR(255) DEFAULT 'Terms Of Use',

SwalTitle VARCHAR(255) DEFAULT 'Terms of Use',

jeffersoncasimir · 2025-07-16T14:59:21Z

SQL/New_patches/2025-05-22-Introduce-Policy-Decisions.sql

+    Content TEXT NULL,
+    SwalTitle VARCHAR(255) DEFAULT 'Terms Of Use',
+    HeaderButton enum('Y','N') DEFAULT 'Y',
+    HeaderButtonText VARCHAR(255) DEFAULT 'Terms Of Use',


Suggested change

HeaderButtonText VARCHAR(255) DEFAULT 'Terms Of Use',

HeaderButtonText VARCHAR(255) DEFAULT 'Terms of Use',

jeffersoncasimir · 2025-07-16T15:06:16Z

SQL/New_patches/2025-05-22-Introduce-Policy-Decisions.sql

+    HeaderButton enum('Y','N') DEFAULT 'Y',
+    HeaderButtonText VARCHAR(255) DEFAULT 'Terms Of Use',
+    Active enum('Y','N') DEFAULT 'Y',
+    AcceptButton enum('Y','N') DEFAULT 'Y',


Suggested change

AcceptButton enum('Y','N') DEFAULT 'Y',

jeffersoncasimir · 2025-07-16T15:24:29Z

raisinbread/RB_files/RB_policies.sql

+SET FOREIGN_KEY_CHECKS=0;
+TRUNCATE TABLE `policies`;
+LOCK TABLES `policies` WRITE;
+INSERT INTO `policies` (`PolicyID`, `Name`, `Version`, `ModuleID`, `PolicyRenewalTime`, `PolicyRenewalTimeUnit`, `Content`, `SwalTitle`, `HeaderButton`, `HeaderButtonText`, `Active`, `AcceptButtonText`, `DeclineButtonText`, `CreatedAt`, `UpdatedAt`) VALUES (1,'dataquery_example','v1',49,7,'D','By using this Data Query Tool, you acknowledge that you know it is in beta and may not work as expected. You also agree to use it responsibly and not to misuse the data.','Terms Of Use','Y','Terms Of Use','Y','Yes, I accept','Decline','2025-05-28 10:54:21','2025-05-28 10:54:21');


Suggested change

INSERT INTO `policies` (`PolicyID`, `Name`, `Version`, `ModuleID`, `PolicyRenewalTime`, `PolicyRenewalTimeUnit`, `Content`, `SwalTitle`, `HeaderButton`, `HeaderButtonText`, `Active`, `AcceptButtonText`, `DeclineButtonText`, `CreatedAt`, `UpdatedAt`) VALUES (1,'dataquery_example','v1',49,7,'D','By using this Data Query Tool, you acknowledge that you know it is in beta and may not work as expected. You also agree to use it responsibly and not to misuse the data.','Terms Of Use','Y','Terms Of Use','Y','Yes, I accept','Decline','2025-05-28 10:54:21','2025-05-28 10:54:21');

INSERT INTO `policies` (`PolicyID`, `Name`, `Version`, `ModuleID`, `PolicyRenewalTime`, `PolicyRenewalTimeUnit`, `Content`, `SwalTitle`, `HeaderButton`, `HeaderButtonText`, `Active`, `AcceptButtonText`, `DeclineButtonText`, `CreatedAt`, `UpdatedAt`) VALUES (1,'dataquery_example','v1',49,7,'D','By using this Data Query Tool, you acknowledge that you know it is in beta and may not work as expected. You also agree to use it responsibly and not to misuse the data.','Terms of Use','Y','Terms of Use','Y','Yes, I accept','Decline','2025-05-28 10:54:21','2025-05-28 10:54:21');

jeffersoncasimir · 2025-07-16T15:24:53Z

raisinbread/RB_files/RB_policies.sql

+TRUNCATE TABLE `policies`;
+LOCK TABLES `policies` WRITE;
+INSERT INTO `policies` (`PolicyID`, `Name`, `Version`, `ModuleID`, `PolicyRenewalTime`, `PolicyRenewalTimeUnit`, `Content`, `SwalTitle`, `HeaderButton`, `HeaderButtonText`, `Active`, `AcceptButtonText`, `DeclineButtonText`, `CreatedAt`, `UpdatedAt`) VALUES (1,'dataquery_example','v1',49,7,'D','By using this Data Query Tool, you acknowledge that you know it is in beta and may not work as expected. You also agree to use it responsibly and not to misuse the data.','Terms Of Use','Y','Terms Of Use','Y','Yes, I accept','Decline','2025-05-28 10:54:21','2025-05-28 10:54:21');
+INSERT INTO `policies` (`PolicyID`, `Name`, `Version`, `ModuleID`, `PolicyRenewalTime`, `PolicyRenewalTimeUnit`, `Content`, `SwalTitle`, `HeaderButton`, `HeaderButtonText`, `Active`, `AcceptButtonText`, `DeclineButtonText`, `CreatedAt`, `UpdatedAt`) VALUES (2,'login_example','v1',28,7,'D','By using this LORIS instance you acknowledge that you know it is filled with test data, and not real user data.','Terms Of Use','Y','Terms Of Use','Y','Accept','','2025-05-28 10:54:23','2025-05-28 10:54:23');


Suggested change

INSERT INTO `policies` (`PolicyID`, `Name`, `Version`, `ModuleID`, `PolicyRenewalTime`, `PolicyRenewalTimeUnit`, `Content`, `SwalTitle`, `HeaderButton`, `HeaderButtonText`, `Active`, `AcceptButtonText`, `DeclineButtonText`, `CreatedAt`, `UpdatedAt`) VALUES (2,'login_example','v1',28,7,'D','By using this LORIS instance you acknowledge that you know it is filled with test data, and not real user data.','Terms Of Use','Y','Terms Of Use','Y','Accept','','2025-05-28 10:54:23','2025-05-28 10:54:23');

INSERT INTO `policies` (`PolicyID`, `Name`, `Version`, `ModuleID`, `PolicyRenewalTime`, `PolicyRenewalTimeUnit`, `Content`, `SwalTitle`, `HeaderButton`, `HeaderButtonText`, `Active`, `AcceptButtonText`, `DeclineButtonText`, `CreatedAt`, `UpdatedAt`) VALUES (2,'login_example','v1',28,7,'D','By using this LORIS instance you acknowledge that you know it is filled with test data, and not real user data.','Terms of Use','Y','Terms of Use','Y','Accept','','2025-05-28 10:54:23','2025-05-28 10:54:23');

jeffersoncasimir · 2025-07-16T15:32:12Z

SQL/0000-00-00-schema.sql

+    Version VARCHAR(50) NOT NULL,
+    ModuleID INT NOT NULL,
+    PolicyRenewalTime INT DEFAULT 7,
+    PolicyRenewalTimeUnit enum('D','Y','M','H') DEFAULT 'D',


It's obvious what these are, but I personally think it's worth the splurge to write out the units

jeffersoncasimir · 2025-07-16T16:06:13Z

php/libraries/NDB_Page.class.inc

+                AND p.Active = 'Y'
+                AND p.HeaderButton IN $headerWhere
+                AND Version = (
+                    SELECT MAX(Version)


I don't think this will always work as expected with Version VARCHAR(50)

Can also likely be shortened with: ORDER BY Version DESC LIMIT 1

jeffersoncasimir · 2025-07-16T16:07:26Z

php/libraries/NDB_Page.class.inc

+                AND DecisionDate = (
+                    SELECT MAX(DecisionDate)
+                    FROM user_policy_decision
+                    WHERE


I think this is equivalent to ORDER BY DecisionDate DESC LIMIT 1

skarya22 added 2 commits May 28, 2025 11:17

[policies] Add infrastructure to track user decisions to policies

d41412d

Add rest of the files

4cf2f1c

skarya22 added 5 commits May 28, 2025 13:31

Fix for lint

8377716

Login test plan

1079cf2

Update unit test

cd193a6

Lint fixes

ef87966

Fix spacing

db25ee7

skarya22 added Project: CCNA Issue or PR related to the CCNA project Project: EEGNet Issue or PR related to the EEGNet project labels May 28, 2025

skarya22 added 3 commits May 28, 2025 14:34

Fix spacing again

2bbb942

Attempt to fix tests

a444d7a

One more time

b69ea56

driusan reviewed May 30, 2025

View reviewed changes

regisoc assigned jeffersoncasimir Jul 7, 2025

skarya22 added the State: Needs work PR awaiting additional work by the author to proceed label Jul 10, 2025

skarya22 assigned skarya22 and unassigned jeffersoncasimir Jul 10, 2025

skarya22 added 5 commits July 10, 2025 14:41

Merge remote-tracking branch 'aces/main' into 2025_08_22_Policy_Conse…

366968b

…nt_Tracking_Infrastructure

Rework to not have htdocs

21a89f0

Forgot to add new policy_tracker module

1c79bd6

Remove leftover code from webpack

daddb8c

Reverse the fix for a lint test to make it work again?

df87735

Fix phan tests

471a605

skarya22 assigned jeffersoncasimir and unassigned skarya22 Jul 15, 2025

skarya22 requested review from jeffersoncasimir and driusan July 15, 2025 00:27

skarya22 removed the State: Needs work PR awaiting additional work by the author to proceed label Jul 15, 2025

Merge remote-tracking branch 'aces/main' into 2025_08_22_Policy_Conse…

3c88a1c

…nt_Tracking_Infrastructure

jeffersoncasimir requested changes Jul 16, 2025

View reviewed changes

	SwalTitle VARCHAR(255) DEFAULT 'Terms Of Use',
	SwalTitle VARCHAR(255) DEFAULT 'Terms of Use',

	HeaderButtonText VARCHAR(255) DEFAULT 'Terms Of Use',
	HeaderButtonText VARCHAR(255) DEFAULT 'Terms of Use',

[policies] Add infrastructure to track user decisions to policies #9818

Are you sure you want to change the base?

[policies] Add infrastructure to track user decisions to policies #9818

Conversation

skarya22 commented May 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Brief summary of changes

If there is a policy for the login module

If there is a policy for a non-anonymous module, and HeaderButton = 'Y'

Testing instructions (if applicable)

Link(s) to related issue(s)

Uh oh!

driusan left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

regisoc commented Jul 7, 2025

Uh oh!

jeffersoncasimir commented Jul 10, 2025

Uh oh!

skarya22 commented Jul 10, 2025

Uh oh!

skarya22 commented Jul 15, 2025

Uh oh!

jeffersoncasimir left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

skarya22 commented May 28, 2025 •

edited

Loading