Terms of Service

[fubuloubu]

It would be nice to be able to configure some sort of external link or template for a pop-up to display TOS to new users, and additionally have a checkbox that must be checked in order to sign up for a new account.

The benefit of an external link is that it can be easily configurable via Env Variable (with unset meaning don't use this feature). The benefit of the template could be that there could be a direct page in Fief that displays the current terms, and has some method of distributing updates in terms to users when those terms change.

[frankie567]

Interesting!

Instead of an globally set environment variable, what do you think of supporting formatting options (including links) in the label/description of custom User Fields?

[fubuloubu]

Yes that would work. Making it a user field was something I was considering, this way when you update terms you can actually unset the acceptance of those terms and have the user recheck them manually. I am currently doing it this way using a required to set boolean.

Problem with that is I'm not sure how one would redirect a user to their profile specifically to ensure they check it again if the TOS is updated. Terms of Service being a relatively standard thing, this is why I think a dedicated function for it might be the best way to go about it, so 1) you don't have the user info carrying around an unused boolean field bloating the token, and 2) as an end user of Fief you don't have to worry about people using your downstream service without accepting your service terms first (in some locales it's not enough to just be made aware of the terms of service, but to actually accept them through some user action, and for every time they are updated).

[fubuloubu]

Would it make sense to include this as a Stronghold "premium" feature? seems to fit the purpose, as only really a "production" use case for this auth system would need this type of feature (if implemented as a customizable add-on and not as User Field formatting thing)

reading: https://polar.sh/fief-dev/posts/a-new-step-in-fief-s-journey

[frankie567]

My take on this would be to first support formatting options in the user field label. IMO, this would cover 95% of the use cases.

Having a more powerful feature able to handle updated terms and block access looks interesting, but slightly out of scope. I don't think to put this as a high priority.

---

Idea: you may use permissions to workaround that. Let's say you have a permission tos_accepted that's required everywhere in your app. Whenever you change our TOS, remove the permission from everyone using the Admin API. You can then implement a page with a simple form that'll in the background re-add the permission when submitted.