1210191 - Convert TOS signature into a 2-step process

Status: RESOLVED FIXED

(Marketplace Graveyard :: Developer Pages, defect, P1)

Description

[Chuck Harmston [:chuck]]

Currently, there is a single field on the UserProfile model that indicates that
the user has signed the developer agreement: read_dev_agreement. If NULL, it
indicates a non-signature. If not NULL, it is a DateTimeField indicating the
date and time that the signature occurred. You can change that field from null
to the date/time with an authenticated POST to /api/v2/account/tos/.

In order to ensure that users of that API have actually been given those terms
of service, we need to make this a two step process.

--

Step 1: receive terms of service URL

POST /api/v2/dev_agreement/get/

Response body:
{
  "developer_agreement_url": "<hostname>/developers/terms/standalone"
}

This request will set UserProfile.shown_dev_agreement, which, if not NULL,
indicates the date and time that the authenticating user was given a URL to the
terms of service.

--

Step 2: agree to terms of service

POST /api/v2/dev_agreement/agree/

This request will set UserProfile.shown_dev_agreement, which, if not NULL,
indicates the date and time that the authenticating user has agreed to the
developer agreement.

If the UserProfile.shown_dev_agreement for the authenticating user is NULL,
this request will fail 409 with an error message indicating that the user must
complete /api/v2/dev_agreement/get/ before completing this request. This
enforces that the user has been given the URL of the developer agreement.

--

The UI of the content tools will need to be updated to reflect this flow. The
step 1 request should be completed before showing the user the terms of
service, and the URL returned in that step should be used as the src of the
<iframe> in that handler.

Comment 1

[Chuck Harmston [:chuck]]

For QA, please check for regressions and interaction with the devhub TOS signature flow as well.