feat: legal clause CRUD with ordering in sponsor management UI

Full CRUD for legal clauses under More > Legal Clauses. List view shows
clause text preview, benefit count, and up/down move buttons for ordering.
Edit page shows how many benefits reference the clause. Delete confirms
with impact warning.

Removes legal clause CRUD from the "admin-only" list in the guide.
Includes 10 tests.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: JacobCoffee

apps/sponsors/manage/forms.py

@@ -8,6 +8,7 @@
 from apps.sponsors.models import (
     SPONSOR_TEMPLATE_HELP_TEXT,
     EmailTargetableConfiguration,
+    LegalClause,
     LogoPlacementConfiguration,
     ProvidedFileAssetConfiguration,
     ProvidedTextAssetConfiguration,
@@ -699,6 +700,23 @@ def clean(self):
         return cleaned
 
 
+class LegalClauseForm(forms.ModelForm):
+    """Form for creating and editing legal clauses."""
+
+    class Meta:
+        """Meta options."""
+
+        model = LegalClause
+        fields = ["internal_name", "clause", "notes"]
+        widgets = {
+            "internal_name": forms.TextInput(attrs={"style": INPUT_STYLE}),
+            "clause": forms.Textarea(attrs={"rows": 6, "style": INPUT_STYLE + "resize:vertical;"}),
+            "notes": forms.Textarea(
+                attrs={"rows": 3, "style": INPUT_STYLE + "resize:vertical;", "placeholder": "Internal notes..."}
+            ),
+        }
+
+
 # Dispatcher mapping config type slugs to (model, form) tuples
 CONFIG_TYPES = {
     "logo_placement": (LogoPlacementConfiguration, LogoPlacementConfigForm, "Logo Placement"),

apps/sponsors/manage/tests.py

@@ -14,6 +14,7 @@
 
 from apps.sponsors.models import (
     Contract,
+    LegalClause,
     Sponsor,
     SponsorBenefit,
     SponsorContact,
@@ -2367,3 +2368,81 @@ def test_sync_button_shown_on_benefit_edit(self):
         """Benefit edit page shows Sync button when sponsorships exist."""
         response = self.client.get(reverse("manage_benefit_edit", args=[self.benefit.pk]))
         self.assertContains(response, "Sync to Sponsorships")
+
+
+class LegalClauseViewTests(SponsorManageTestBase):
+    """Test legal clause CRUD views."""
+
+    def setUp(self):
+        super().setUp()
+        self.client.login(username="staff", password="pass")
+        self.clause = LegalClause.objects.create(
+            internal_name="Trademark Usage",
+            clause="Sponsor may use the Python trademark per PSF guidelines.",
+            notes="Standard clause",
+        )
+
+    def test_list_loads(self):
+        response = self.client.get(reverse("manage_legal_clauses"))
+        self.assertEqual(response.status_code, 200)
+        self.assertContains(response, "Trademark Usage")
+
+    def test_create_get(self):
+        response = self.client.get(reverse("manage_legal_clause_create"))
+        self.assertEqual(response.status_code, 200)
+
+    def test_create_post(self):
+        response = self.client.post(
+            reverse("manage_legal_clause_create"),
+            {"internal_name": "New Clause", "clause": "Some legal text.", "notes": ""},
+        )
+        self.assertEqual(response.status_code, 302)
+        self.assertTrue(LegalClause.objects.filter(internal_name="New Clause").exists())
+
+    def test_edit_get(self):
+        response = self.client.get(reverse("manage_legal_clause_edit", args=[self.clause.pk]))
+        self.assertEqual(response.status_code, 200)
+        self.assertContains(response, "Trademark Usage")
+
+    def test_edit_post(self):
+        response = self.client.post(
+            reverse("manage_legal_clause_edit", args=[self.clause.pk]),
+            {"internal_name": "Updated Name", "clause": "Updated text.", "notes": ""},
+        )
+        self.assertEqual(response.status_code, 302)
+        self.clause.refresh_from_db()
+        self.assertEqual(self.clause.internal_name, "Updated Name")
+
+    def test_delete_get(self):
+        response = self.client.get(reverse("manage_legal_clause_delete", args=[self.clause.pk]))
+        self.assertEqual(response.status_code, 200)
+        self.assertContains(response, "Trademark Usage")
+
+    def test_delete_post(self):
+        response = self.client.post(reverse("manage_legal_clause_delete", args=[self.clause.pk]))
+        self.assertEqual(response.status_code, 302)
+        self.assertFalse(LegalClause.objects.filter(pk=self.clause.pk).exists())
+
+    def test_move_up(self):
+        clause2 = LegalClause.objects.create(internal_name="Second Clause", clause="Text.")
+        self.client.post(
+            reverse("manage_legal_clause_move", args=[clause2.pk]),
+            {"direction": "up"},
+        )
+        clause2.refresh_from_db()
+        self.clause.refresh_from_db()
+        self.assertLess(clause2.order, self.clause.order)
+
+    def test_move_down(self):
+        clause2 = LegalClause.objects.create(internal_name="Second Clause", clause="Text.")
+        self.client.post(
+            reverse("manage_legal_clause_move", args=[self.clause.pk]),
+            {"direction": "down"},
+        )
+        self.clause.refresh_from_db()
+        clause2.refresh_from_db()
+        self.assertGreater(self.clause.order, clause2.order)
+
+    def test_nav_has_legal_clauses_link(self):
+        response = self.client.get(reverse("manage_dashboard"))
+        self.assertContains(response, "Legal Clauses")

apps/sponsors/manage/urls.py

@@ -23,6 +23,12 @@
     path(
         "benefit-configs/<int:pk>/delete/", views.BenefitConfigDeleteView.as_view(), name="manage_benefit_config_delete"
     ),
+    # Legal clauses
+    path("legal-clauses/", views.LegalClauseListView.as_view(), name="manage_legal_clauses"),
+    path("legal-clauses/new/", views.LegalClauseCreateView.as_view(), name="manage_legal_clause_create"),
+    path("legal-clauses/<int:pk>/edit/", views.LegalClauseUpdateView.as_view(), name="manage_legal_clause_edit"),
+    path("legal-clauses/<int:pk>/delete/", views.LegalClauseDeleteView.as_view(), name="manage_legal_clause_delete"),
+    path("legal-clauses/<int:pk>/move/", views.LegalClauseMoveView.as_view(), name="manage_legal_clause_move"),
     # Packages
     path("packages/", views.PackageListView.as_view(), name="manage_packages"),
     path("packages/new/", views.PackageCreateView.as_view(), name="manage_package_create"),

apps/sponsors/manage/views.py

@@ -32,6 +32,7 @@
     ComposerTermsForm,
     CurrentYearForm,
     ExecuteContractForm,
+    LegalClauseForm,
     NotificationTemplateForm,
     SendSponsorshipNotificationManageForm,
     SponsorContactForm,
@@ -47,6 +48,7 @@
     BenefitFeature,
     BenefitFeatureConfiguration,
     Contract,
+    LegalClause,
     Sponsor,
     SponsorBenefit,
     SponsorContact,
@@ -366,6 +368,86 @@ def post(self, request, pk):
         return redirect(reverse("manage_benefit_edit", args=[pk]))
 
 
+# ── Legal Clause Views ────────────────────────────────────────────────
+
+
+class LegalClauseListView(SponsorshipAdminRequiredMixin, ListView):
+    """List legal clauses with ordering controls."""
+
+    model = LegalClause
+    template_name = "sponsors/manage/legal_clause_list.html"
+    context_object_name = "clauses"
+
+    def get_queryset(self):
+        """Return clauses ordered by position."""
+        return LegalClause.objects.all().order_by("order")
+
+
+class LegalClauseCreateView(SponsorshipAdminRequiredMixin, CreateView):
+    """Create a new legal clause."""
+
+    model = LegalClause
+    form_class = LegalClauseForm
+    template_name = "sponsors/manage/legal_clause_form.html"
+
+    def get_success_url(self):
+        """Return URL to clause list."""
+        messages.success(self.request, f'Legal clause "{self.object.internal_name}" created.')
+        return reverse("manage_legal_clauses")
+
+    def get_context_data(self, **kwargs):
+        """Return context with create flag."""
+        context = super().get_context_data(**kwargs)
+        context["is_create"] = True
+        return context
+
+
+class LegalClauseUpdateView(SponsorshipAdminRequiredMixin, UpdateView):
+    """Edit an existing legal clause."""
+
+    model = LegalClause
+    form_class = LegalClauseForm
+    template_name = "sponsors/manage/legal_clause_form.html"
+
+    def get_success_url(self):
+        """Return URL to clause list."""
+        messages.success(self.request, f'Legal clause "{self.object.internal_name}" updated.')
+        return reverse("manage_legal_clauses")
+
+    def get_context_data(self, **kwargs):
+        """Return context with benefit count."""
+        context = super().get_context_data(**kwargs)
+        context["is_create"] = False
+        context["benefit_count"] = self.object.benefits.count()
+        return context
+
+
+class LegalClauseDeleteView(SponsorshipAdminRequiredMixin, DeleteView):
+    """Delete a legal clause."""
+
+    model = LegalClause
+    template_name = "sponsors/manage/legal_clause_confirm_delete.html"
+
+    def get_success_url(self):
+        """Return URL to clause list."""
+        messages.success(self.request, f'Legal clause "{self.object.internal_name}" deleted.')
+        return reverse("manage_legal_clauses")
+
+
+class LegalClauseMoveView(SponsorshipAdminRequiredMixin, View):
+    """Move a legal clause up or down in order."""
+
+    def post(self, request, pk):
+        """Move clause up or down based on direction parameter."""
+        clause = get_object_or_404(LegalClause, pk=pk)
+        direction = request.POST.get("direction")
+        if direction == "up":
+            clause.up()
+        elif direction == "down":
+            clause.down()
+        return redirect(reverse("manage_legal_clauses"))
+
+
 class PackageListView(SponsorshipAdminRequiredMixin, ListView):
     """List sponsorship packages grouped by year."""
 

apps/sponsors/templates/sponsors/manage/_base.html

@@ -679,6 +679,7 @@
             <div class="manage-nav-more" style="position:relative;">
                 <a href="#" class="{% if active_tab == 'clone' or active_tab == 'guide' %}active{% endif %}" onclick="event.preventDefault();this.parentElement.classList.toggle('open');">More &#9662;</a>
                 <div class="manage-nav-dropdown">
+                    <a href="{% url 'manage_legal_clauses' %}">Legal Clauses</a>
                     <a href="{% url 'manage_clone_year' %}">Clone Year</a>
                     <a href="{% url 'manage_guide' %}">Guide</a>
                 </div>

apps/sponsors/templates/sponsors/manage/guide.html

@@ -337,7 +337,7 @@ <h3 style="font-size:16px;font-weight:700;color:#e74c3c;border-bottom:2px solid
 <ul style="font-size:13px;line-height:2;color:#444;padding-left:20px;">
 <li><strong>Benefit ordering</strong> &mdash; drag-to-reorder benefits within a program. The manage UI shows them in order but doesn't let you rearrange</li>
 <li><strong>Benefit conflicts</strong> &mdash; configuring which benefits are mutually exclusive (M2M relationship in the admin)</li>
-<li><strong>Legal clause CRUD</strong> &mdash; creating and editing the legal clauses that get pulled into contracts</li>
+<li><s>Legal clause CRUD</s> &mdash; now available under More &rarr; <a href="{% url 'manage_legal_clauses' %}" style="color:#3776ab;">Legal Clauses</a></li>
 <li><strong>Sponsorship program management</strong> &mdash; adding or editing programs (Foundation, PyCon, PyPI, etc.)</li>
 <li><strong>Advanced import/export</strong> &mdash; django-import-export for bulk data operations</li>
 <li><strong>Detailed asset filtering</strong> &mdash; filtering and administering individual uploaded assets across all sponsors</li>

apps/sponsors/templates/sponsors/manage/legal_clause_confirm_delete.html

@@ -0,0 +1,44 @@
+{% extends "sponsors/manage/_base.html" %}
+
+{% block page_title %}Delete {{ object.internal_name }} | Sponsor Management{% endblock %}
+
+{% with active_tab="more" %}
+
+{% block manage_breadcrumbs %}
+<div class="manage-crumbs">
+    <a href="{% url 'manage_dashboard' %}">Dashboard</a>
+    <span class="sep">/</span>
+    <a href="{% url 'manage_legal_clauses' %}">Legal Clauses</a>
+    <span class="sep">/</span>
+    <span class="current">Delete</span>
+</div>
+{% endblock %}
+
+{% block manage_content %}
+    <div class="manage-form">
+        <h2 style="font-size:18px;font-weight:700;color:#e74c3c;margin:0 0 20px;">
+            Delete Legal Clause
+        </h2>
+
+        <div class="manage-alert manage-alert-warning" style="margin-bottom:20px;">
+            Are you sure you want to delete <strong>"{{ object.internal_name }}"</strong>?
+            {% with bc=object.benefits.count %}
+            {% if bc %}This clause is used by {{ bc }} benefit{{ bc|pluralize }}. Deleting it will remove it from those benefits' contracts.{% endif %}
+            {% endwith %}
+        </div>
+
+        <div style="background:#f7f8fa;padding:12px 16px;border-radius:4px;margin-bottom:20px;font-size:13px;color:#555;">
+            {{ object.clause|truncatechars:300 }}
+        </div>
+
+        <form method="post">
+            {% csrf_token %}
+            <div style="display:flex;gap:10px;">
+                <button type="submit" class="btn btn-danger">Delete Clause</button>
+                <a href="{% url 'manage_legal_clauses' %}" class="btn btn-secondary">Cancel</a>
+            </div>
+        </form>
+    </div>
+{% endblock %}
+
+{% endwith %}

apps/sponsors/templates/sponsors/manage/legal_clause_form.html

@@ -0,0 +1,85 @@
+{% extends "sponsors/manage/_base.html" %}
+
+{% block page_title %}{% if is_create %}New Legal Clause{% else %}Edit {{ object.internal_name }}{% endif %} | Sponsor Management{% endblock %}
+
+{% with active_tab="more" %}
+
+{% block manage_breadcrumbs %}
+<div class="manage-crumbs">
+    <a href="{% url 'manage_dashboard' %}">Dashboard</a>
+    <span class="sep">/</span>
+    <a href="{% url 'manage_legal_clauses' %}">Legal Clauses</a>
+    <span class="sep">/</span>
+    <span class="current">{% if is_create %}New{% else %}{{ object.internal_name }}{% endif %}</span>
+</div>
+{% endblock %}
+
+{% block manage_content %}
+    <div class="manage-form">
+        <h2 style="font-size:18px;font-weight:700;color:#1a1a2e;margin:0 0 4px;">
+            {% if is_create %}Create Legal Clause{% else %}Edit Legal Clause{% endif %}
+        </h2>
+        {% if not is_create and benefit_count %}
+        <p style="font-size:13px;color:#777;margin:0 0 20px;">
+            Used by <span style="color:#e74c3c;">{{ benefit_count }} benefit{{ benefit_count|pluralize }}</span>
+        </p>
+        {% else %}
+        <p style="font-size:13px;color:#777;margin:0 0 20px;">
+            {% if is_create %}Legal clause text that gets pulled into contracts via benefit associations.{% endif %}
+        </p>
+        {% endif %}
+
+        {% if form.errors %}
+        <div class="form-errors">
+            <strong>Please correct the errors below:</strong>
+            <ul>
+            {% for field, errors in form.errors.items %}
+                {% for error in errors %}
+                <li>{{ field }}: {{ error }}</li>
+                {% endfor %}
+            {% endfor %}
+            </ul>
+        </div>
+        {% endif %}
+
+        <form method="post">
+            {% csrf_token %}
+
+            <fieldset class="manage-fieldset">
+                <legend>Clause Details</legend>
+
+                <div class="form-group">
+                    <label for="id_internal_name">Internal Name</label>
+                    {{ form.internal_name }}
+                    <span class="helptext">Friendly name for PSF staff reference (not shown in contracts).</span>
+                    {% if form.internal_name.errors %}<div class="field-errors">{{ form.internal_name.errors.0 }}</div>{% endif %}
+                </div>
+
+                <div class="form-group">
+                    <label for="id_clause">Clause Text</label>
+                    {{ form.clause }}
+                    <span class="helptext">The legal text that appears in contracts. Rendered as markdown.</span>
+                    {% if form.clause.errors %}<div class="field-errors">{{ form.clause.errors.0 }}</div>{% endif %}
+                </div>
+
+                <div class="form-group">
+                    <label for="id_notes">Notes</label>
+                    {{ form.notes }}
+                    {% if form.notes.errors %}<div class="field-errors">{{ form.notes.errors.0 }}</div>{% endif %}
+                </div>
+            </fieldset>
+
+            <div style="display:flex;gap:10px;align-items:center;padding-top:8px;">
+                <button type="submit" class="btn btn-primary">
+                    {% if is_create %}Create Clause{% else %}Save Changes{% endif %}
+                </button>
+                <a href="{% url 'manage_legal_clauses' %}" class="btn btn-secondary">Cancel</a>
+                {% if not is_create %}
+                <a href="{% url 'manage_legal_clause_delete' object.pk %}" class="btn btn-danger" style="margin-left:auto;">Delete</a>
+                {% endif %}
+            </div>
+        </form>
+    </div>
+{% endblock %}
+
+{% endwith %}