Merge branch 'feature/user-consent' into feature/newCAS-v21.0.0-alpha

Author: cslzchen

src/main/java/io/cos/cas/osf/authentication/credential/OsfPostgresCredential.java

@@ -38,6 +38,8 @@ public class OsfPostgresCredential extends RememberMeUsernamePasswordCredential
 
     public static String AUTHENTICATION_ATTRIBUTE_REMEMBER_ME = "rememberMe";
 
+    public static String AUTHENTICATION_ATTRIBUTE_TOS_CONSENT = "termsOfServiceChecked";
+
     private static String DEFAULT_INSTITUTION_ID = "none";
 
     private static DelegationProtocol DEFAULT_DELEGATION_PROTOCOL = DelegationProtocol.NONE;
@@ -52,6 +54,11 @@ public class OsfPostgresCredential extends RememberMeUsernamePasswordCredential
      */
     private String oneTimePassword;
 
+    /**
+     * The boolean flag that indicates whether the user has checked the terms of service consent agreement
+     */
+    private boolean termsOfServiceChecked;
+
     /**
      * The boolean flag that indicates successful delegated authentication if true.
      */

src/main/java/io/cos/cas/osf/authentication/exception/TermsOfServiceConsentRequiredException.java

@@ -0,0 +1,29 @@
+package io.cos.cas.osf.authentication.exception;
+
+import lombok.NoArgsConstructor;
+
+import javax.security.auth.login.AccountException;
+
+/**
+ * Describes an authentication error condition where a user account needs to agree to OSF's terms of service.
+ *
+ * @author Longze Chen
+ * @since 21.1.0
+ */
+@NoArgsConstructor
+public class TermsOfServiceConsentRequiredException extends AccountException {
+
+    /**
+     * Serialization metadata.
+     */
+    private static final long serialVersionUID = -7702088330316457626L;
+
+    /**
+     * Instantiates a new {@link TermsOfServiceConsentRequiredException}.
+     *
+     * @param msg the msg
+     */
+    public TermsOfServiceConsentRequiredException(final String msg) {
+        super(msg);
+    }
+}

src/main/java/io/cos/cas/osf/authentication/handler/support/OsfPostgresAuthenticationHandler.java

@@ -3,12 +3,12 @@
 import io.cos.cas.osf.authentication.credential.OsfPostgresCredential;
 import io.cos.cas.osf.authentication.exception.AccountNotConfirmedIdpException;
 import io.cos.cas.osf.authentication.exception.AccountNotConfirmedOsfException;
-import io.cos.cas.osf.authentication.exception.InstitutionSsoFailedException;
 import io.cos.cas.osf.authentication.exception.InvalidOneTimePasswordException;
 import io.cos.cas.osf.authentication.exception.InvalidPasswordException;
 import io.cos.cas.osf.authentication.exception.InvalidUserStatusException;
 import io.cos.cas.osf.authentication.exception.OneTimePasswordRequiredException;
 import io.cos.cas.osf.authentication.exception.InvalidVerificationKeyException;
+import io.cos.cas.osf.authentication.exception.TermsOfServiceConsentRequiredException;
 import io.cos.cas.osf.authentication.support.DelegationProtocol;
 import io.cos.cas.osf.authentication.support.OsfUserStatus;
 import io.cos.cas.osf.authentication.support.OsfUserUtils;
@@ -111,6 +111,7 @@ protected final AuthenticationHandlerExecutionResult authenticateOsfPostgresInte
         final String oneTimePassword = credential.getOneTimePassword();
         final String institutionId = credential.getInstitutionId();
         final boolean isRememberMe = credential.isRememberMe();
+        final boolean isTermsOfServiceChecked = credential.isTermsOfServiceChecked();
         final boolean isRemotePrincipal = credential.isRemotePrincipal();
         final DelegationProtocol delegationProtocol = credential.getDelegationProtocol();
 
@@ -169,6 +170,11 @@ protected final AuthenticationHandlerExecutionResult authenticateOsfPostgresInte
             }
         }
 
+        if (!osfUser.isTermsOfServiceAccepted() && !isTermsOfServiceChecked) {
+            LOGGER.info("Terms of service consent is required for [" + username + "]");
+            throw new TermsOfServiceConsentRequiredException("Terms of service consent is required for [" + username + "]");
+        }
+
         if (OsfUserStatus.USER_NOT_CONFIRMED_OSF.equals(userStatus)) {
             throw new AccountNotConfirmedOsfException(
                     "User [" + username + "] is registered via OSF but not confirmed"

src/main/java/io/cos/cas/osf/authentication/metadata/OsfPostgresAuthenticationMetaDataPopulator.java

@@ -27,17 +27,22 @@ public void populateAttributes(final AuthenticationBuilder builder, final Authen
         transaction.getPrimaryCredential().ifPresent(r -> {
             final OsfPostgresCredential credential = (OsfPostgresCredential) r;
             LOGGER.debug(
-                    "Credential is of type [{}], thus adding attributes [{}, {}, {}, {}]",
+                    "Credential is of type [{}], thus adding attributes [{}, {}, {}, {}, {}]",
                     OsfPostgresCredential.class.getSimpleName(),
                     OsfPostgresCredential.AUTHENTICATION_ATTRIBUTE_REMEMBER_ME,
                     OsfPostgresCredential.AUTHENTICATION_ATTRIBUTE_REMOTE_PRINCIPAL,
                     OsfPostgresCredential.AUTHENTICATION_ATTRIBUTE_DELEGATION_PROTOCOL,
-                    OsfPostgresCredential.AUTHENTICATION_ATTRIBUTE_INSTITUTION_ID
+                    OsfPostgresCredential.AUTHENTICATION_ATTRIBUTE_INSTITUTION_ID,
+                    OsfPostgresCredential.AUTHENTICATION_ATTRIBUTE_TOS_CONSENT
             );
             builder.addAttribute(
                     OsfPostgresCredential.AUTHENTICATION_ATTRIBUTE_REMEMBER_ME,
                     credential.isRememberMe()
             );
+            builder.addAttribute(
+                    OsfPostgresCredential.AUTHENTICATION_ATTRIBUTE_TOS_CONSENT,
+                    credential.isTermsOfServiceChecked()
+            );
             builder.addAttribute(
                     OsfPostgresCredential.AUTHENTICATION_ATTRIBUTE_REMOTE_PRINCIPAL,
                     credential.isRemotePrincipal()

src/main/java/io/cos/cas/osf/model/OsfUser.java

@@ -62,6 +62,10 @@ public final class OsfUser extends AbstractOsfModel {
     @Column(name = "date_confirmed")
     private Date dateConfirmed;
 
+    @Temporal(TemporalType.TIMESTAMP)
+    @Column(name = "accepted_terms_of_service")
+    private Date dateTermsOfServiceAccepted;
+
     @Temporal(TemporalType.TIMESTAMP)
     @Column(name = "date_disabled")
     private Date dateDisabled;
@@ -86,6 +90,10 @@ public boolean isConfirmed() {
         return dateConfirmed != null;
     }
 
+    public boolean isTermsOfServiceAccepted() {
+        return dateTermsOfServiceAccepted != null;
+    }
+
     public boolean isDisabled() {
         return dateDisabled != null;
     }

src/main/java/io/cos/cas/osf/web/flow/config/OsfCasCoreWebflowConfiguration.java

@@ -8,6 +8,7 @@
 import io.cos.cas.osf.authentication.exception.InvalidUserStatusException;
 import io.cos.cas.osf.authentication.exception.InvalidVerificationKeyException;
 import io.cos.cas.osf.authentication.exception.OneTimePasswordRequiredException;
+import io.cos.cas.osf.authentication.exception.TermsOfServiceConsentRequiredException;
 
 import org.apereo.cas.configuration.CasConfigurationProperties;
 import org.apereo.cas.web.flow.config.CasCoreWebflowConfiguration;
@@ -47,6 +48,7 @@ public Set<Class<? extends Throwable>> handledAuthenticationExceptions() {
         errors.add(InvalidUserStatusException.class);
         errors.add(InvalidVerificationKeyException.class);
         errors.add(OneTimePasswordRequiredException.class);
+        errors.add(TermsOfServiceConsentRequiredException.class);
 
         // Add built-in exceptions after OSF-specific exceptions since order matters
         errors.addAll(super.handledAuthenticationExceptions());

src/main/java/io/cos/cas/osf/web/flow/configurer/OsfCasLoginWebflowConfigurer.java

@@ -8,6 +8,7 @@
 import io.cos.cas.osf.authentication.exception.InvalidUserStatusException;
 import io.cos.cas.osf.authentication.exception.InvalidVerificationKeyException;
 import io.cos.cas.osf.authentication.exception.OneTimePasswordRequiredException;
+import io.cos.cas.osf.authentication.exception.TermsOfServiceConsentRequiredException;
 import io.cos.cas.osf.web.flow.support.OsfCasWebflowConstants;
 
 import org.apereo.cas.authentication.PrincipalException;
@@ -79,6 +80,7 @@ protected void createDefaultViewStates(final Flow flow) {
         super.createDefaultViewStates(flow);
         // Create OSF customized view states
         createTwoFactorLoginFormView(flow);
+        createTermsOfServiceConsentLoginFormView(flow);
         createInstitutionLoginView(flow);
         createOrcidLoginAutoRedirectView(flow);
         createDefaultServiceLoginAutoRedirectView(flow);
@@ -246,6 +248,11 @@ protected void createHandleAuthenticationFailureAction(final Flow flow) {
                 InvalidOneTimePasswordException.class.getSimpleName(),
                 OsfCasWebflowConstants.VIEW_ID_ONE_TIME_PASSWORD_REQUIRED
         );
+        createTransitionForState(
+                handler,
+                TermsOfServiceConsentRequiredException.class.getSimpleName(),
+                OsfCasWebflowConstants.VIEW_ID_TERMS_OF_SERVICE_CONSENT_REQUIRED
+        );
         createTransitionForState(
                 handler,
                 InstitutionSsoFailedException.class.getSimpleName(),
@@ -427,6 +434,40 @@ private void createTwoFactorLoginFormView(final Flow flow) {
         attributes.put("history", History.INVALIDATE);
     }
 
+    /**
+     * Create the customized terms of service consent form submission view state for OSF CAS.
+     *
+     * @param flow the flow
+     */
+    private void createTermsOfServiceConsentLoginFormView(final Flow flow) {
+        List<String> propertiesToBind = CollectionUtils.wrapList("termsOfServiceChecked", "source");
+        BinderConfiguration binder = createStateBinderConfiguration(propertiesToBind);
+        casProperties.getView().getCustomLoginFormFields()
+                .forEach((field, props) -> {
+                    String fieldName = String.format("customFields[%s]", field);
+                    binder.addBinding(
+                            new BinderConfiguration.Binding(fieldName, props.getConverter(), props.isRequired())
+                    );
+                });
+        ViewState state = createViewState(
+                flow,
+                OsfCasWebflowConstants.VIEW_ID_TERMS_OF_SERVICE_CONSENT_REQUIRED,
+                OsfCasWebflowConstants.VIEW_ID_TERMS_OF_SERVICE_CONSENT_REQUIRED,
+                binder
+        );
+        state.getRenderActionList().add(createEvaluateAction(CasWebflowConstants.ACTION_ID_RENDER_LOGIN_FORM));
+        createStateModelBinding(state, CasWebflowConstants.VAR_ID_CREDENTIAL, OsfPostgresCredential.class);
+        Transition transition = createTransitionForState(
+                state,
+                CasWebflowConstants.TRANSITION_ID_SUBMIT,
+                CasWebflowConstants.STATE_ID_REAL_SUBMIT
+        );
+        MutableAttributeMap<Object> attributes = transition.getAttributes();
+        attributes.put("bind", Boolean.TRUE);
+        attributes.put("validate", Boolean.TRUE);
+        attributes.put("history", History.INVALIDATE);
+    }
+
     /**
      * Create the ORCiD login auto-redirect view to support the OSF feature "sign-up via ORCiD".
      *

src/main/java/io/cos/cas/osf/web/flow/support/OsfCasWebflowConstants.java

@@ -42,6 +42,8 @@ public interface OsfCasWebflowConstants {
 
     String VIEW_ID_ONE_TIME_PASSWORD_REQUIRED = "casTwoFactorLoginView";
 
+    String VIEW_ID_TERMS_OF_SERVICE_CONSENT_REQUIRED = "casTermsOfServiceConsentView";
+
     String VIEW_ID_ACCOUNT_NOT_CONFIRMED_OSF = "casAccountNotConfirmedOsfView";
 
     String VIEW_ID_ACCOUNT_NOT_CONFIRMED_IDP = "casAccountNotConfirmedIdPView";

src/main/resources/messages.properties

@@ -529,6 +529,10 @@ copyright.cos=<span style="white-space: nowrap">Copyright &copy; 2011 &ndash; 20
 #
 screen.welcome.label.loginwith=Sign in through external identity providers
 #
+# Texts and messages that are shared across all pages
+#
+screen.generic.button.wip = One moment please ...
+#
 # Login page and login form submission
 #
 cas.login.pagetitle=Sign in
@@ -547,17 +551,33 @@ screen.delegation.button.institution=Sign in through institution
 screen.delegation.heading.orcidredirect=Redirecting to ORCiD
 screen.flowless.heading.defaultserviceredirect=Redirecting to OSF login
 #
-# Two factor and login form submission
+# Two factor login form submission
 #
-cas.twofactor.pagetitle=Sign in
+screen.twofactor.pagetitle=Sign in
 screen.twofactor.instructions.top=Enter your one-time password to finish login
+screen.twofactor.label.email=OSF account email
 screen.twofactor.label.onetimepassword=<span class="accesskey">O</span>ne-time password (6-digit)
 screen.twofactor.label.onetimepassword.accesskey=o
 screen.twofactor.button.verify=Verify
-screen.twofactor.button.verifywip=One moment please...
 screen.twofactor.button.cancel=Cancel
 screen.twofactor.instructions.bottom=Open the two-factor authentication app on your device to view your authentication code and verify your identity.
 #
+# Terms of service consent check login form submission
+#
+screen.tosconsent.pagetitle=Terms of service
+screen.tosconsent.instructions.top=Terms of use and privacy policy
+screen.tosconsent.message.p1=You must read and agree to our \
+  <a style="white-space: nowrap" href="https://github.com/CenterForOpenScience/centerforopenscience.org/blob/master/TERMS_OF_USE.md>Terms of Use"</a> and \
+  <a style="white-space: nowrap" href="https://github.com/CenterForOpenScience/centerforopenscience.org/blob/master/PRIVACY_POLICY.md>Privacy Policy"</a> \
+  to finish login.
+screen.tosconsent.message.p2=You are seeing this page, either because this is your first-time login to OSF via your \
+  institution, or because we have recently updated the terms.
+screen.tosconsent.message.p3=Please read them carefully and contact \
+  <a style="white-space: nowrap" href="mailto:support@osf.io">OSF Support</a> should you have any questions.
+screen.tosconsent.checkbox.title=I have read and agree to these terms.
+screen.tosconsent.button.agree=Continue
+screen.tosconsent.link.cancel=Cancel and go back to OSF
+#
 # Institution login page
 #
 screen.institutionlogin.pagetitle=Institution SSO
@@ -571,9 +591,6 @@ screen.institutionlogin.select.errormessage=You must select an institution.
 screen.institutionlogin.button.submit=Sign in
 screen.institutionlogin.osf=Sign in with OSF
 screen.institutionlogin.backtoosf=Exit and go back to OSF
-screen.institutionlogin.consent.checkbox=I have read and agree to the <a style="white-space: nowrap" href=https://github.com/CenterForOpenScience/centerforopenscience.org/blob/master/TERMS_OF_USE.md>Terms of Use</a> and <a style="white-space: nowrap" href=https://github.com/CenterForOpenScience/centerforopenscience.org/blob/master/PRIVACY_POLICY.md>Privacy Policy</a>.
-screen.institutionlogin.consent.errormessage=You must read and agree to the <span style="white-space: nowrap">Terms of Use</span> and <span style="white-space: nowrap">Privacy Policy</span>.
-
 #
 # Generic login and logout success page
 #
@@ -594,6 +611,7 @@ screen.generic.button.hidedetails=Hide authentication details
 username.required=Email is required.
 password.required=Password is required.
 oneTimePassword.required=One-time password is required.
+termsOfServiceChecked.required=Terms of service consent is required.
 authenticationFailure.AccountDisabledException=This account has been disabled.
 authenticationFailure.AccountNotFoundException=The email or password you entered is incorrect.
 authenticationFailure.AccountNotConfirmedOsfException=The account you tried to log in to has not been confirmed.
@@ -605,6 +623,7 @@ authenticationFailure.InvalidPasswordException=The email or password you entered
 authenticationFailure.InvalidVerificationKeyException=The verification key you entered is incorrect.
 authenticationFailure.InvalidUserStatusException=The account you tried to log in to is not active.
 authenticationFailure.OneTimePasswordRequiredException=
+authenticationFailure.TermsOfServiceConsentRequiredException=
 #
 # Authentication exception messages in stand-alone exception views
 #

src/main/resources/static/css/cas.css

@@ -593,6 +593,7 @@ button.close {
     --cas-theme-osf-green: #357935;
     --cas-theme-osf-blue: #1b6d85;
     --cas-theme-osf-red: #b52b27;
+    --cas-theme-osf-disabled: #EFEFEF;
     --cas-theme-primary: var(--cas-theme-osf-navbar, #263947);
     --cas-theme-danger: var(--cas-theme-osf-red, #b52b27);
     --mdc-theme-primary: var(--cas-theme-primary, #263947);
@@ -811,6 +812,11 @@ body {
     background-color: var(--cas-theme-osf-red, #b52b27);
 }
 
+.form-button .button-osf-disabled,
+.form-button-inline .button-osf-disabled {
+    background-color: var(--cas-theme-osf-disabled, #EFEFEF);
+}
+
 .login-error-inline {
     margin: 0.25rem 0;
 }