From c40fdb92be73986269a2160ce885dea551edc8a4 Mon Sep 17 00:00:00 2001
From: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Date: Thu, 1 Sep 2022 14:13:55 +0000
Subject: [PATCH] Bug 31503: Make opac-patron-consent more generic
Content-Type: text/plain; charset=utf-8

We now allow multiple consent types as defined under AV
(read: authorised values) category 'PATRON_CONSENT'.
The description is used on the form too.

This is the base patch for multiple consents. We can do some more
polishing on a follow-up or another report even.
Note: the alert for GDPR was moved to the description.

Test plan:
First check the form without any PATRON_CONSENT values in AV. Toggle
the value of pref GDPR_Policy.
Now add GDPR_PROCESSING and another one (e.g. NEWSLETTER).
Refresh the OPAC form. Verify that you can toggle consent/dissent
and that everything is saved correctly. Note only a real change updates
the timestamp.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
---
 .../en/modules/opac-patron-consent.tt         | 72 +++++++++----------
 opac/opac-patron-consent.pl                   | 38 +++++++---
 2 files changed, 61 insertions(+), 49 deletions(-)

diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-patron-consent.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-patron-consent.tt
index d00146e7ff..512a0a8078 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-patron-consent.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-patron-consent.tt
@@ -35,30 +35,30 @@
             </div>
             <div class="col-lg-10 order-first order-md-first order-lg-2">
                 <div id="patronconsents" class="maincontent">
-
-                    [% IF Koha.Preference('GDPR_Policy') %]
-                    <div class="alert alert-warning">
-                            <p>In order to keep you logged in, we need your consent to process personal data as specified in the EU General Data Protection Regulation of May 25, 2018.</p>
-                            <p>Please save your consent below or log out. Thank you!</p>
-                    </div>
-                    [% END %]
-
                     <h1>Your consents</h1>
 
                     <form action="/cgi-bin/koha/opac-patron-consent.pl" method="post">
-                        [% IF Koha.Preference('GDPR_Policy') %]
-                        <legend><h2 id="GDPR_consents">GDPR consents</h2></legend>
-                            <input type="hidden" name="op" value="save"/>
-                            <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]"/>
+                        <input type="hidden" name="op" value="save"/>
+                        <input type="hidden" name="borrowernumber" value="[% patron.borrowernumber | html %]"/>
+                        [% FOREACH consent IN consents %]
+                            <legend><h2>Consent for [% consent.type | html %]</h2></legend>
                             <fieldset>
                                 <ul><li>
-                                    <p>I have read the <a target="_blank" href="[% Koha.Preference('PrivacyPolicyURL') | url %]">privacy policy</a> and agree with your processing of my personal data as outlined therein.</p>
-                                    <p><input type="radio" name="gdpr_processing" value="1"> Yes, I agree.<br>
-                                    <input type="radio" name="gdpr_processing" value="0"> No, I do not agree. Please remove my account within a reasonable time.</p>
-                                    [% IF gdpr_proc_consent.given_on %]
-                                        <p class="consent_info">Your consent was registered on [% gdpr_proc_consent.given_on | html %].</p>
-                                    [% ELSIF gdpr_proc_consent.refused_on %]
-                                        <p class="consent_info">You indicated recently that you do not consent, and we will process your request soon.</p>
+                                    [% IF consent.type == 'GDPR_PROCESSING' %]
+                                        <p>Please read the <a target="_blank" href="[% Koha.Preference('PrivacyPolicyURL') | url %]">privacy policy</a>.</p>
+                                        <p>In order to keep you logged in, we need your consent to process personal data as specified in the EU General Data Protection Regulation of May 25, 2018. If you would not agree, we will need to <strong>remove</strong> your account within a reasonable time.</p>
+                                        <p>Do you agree with our processing of your personal data as outlined in the policy?</p>
+                                    [% ELSE %]
+                                        <p>Description for [% consent.type | html #TODO %]. Do you agree?</p>
+                                    [% END %]
+                                    <p>
+                                        <input type="radio" name="check_[% consent.type | html %]" value="1"> Yes<br>
+                                        <input type="radio" name="check_[% consent.type | html %]" value="0"> No
+                                    </p>
+                                    [% IF consent.given_on %]
+                                        <p class="consent_info">Your consent was registered on [% consent.given_on | html %].</p>
+                                    [% ELSIF consent.refused_on %]
+                                        <p class="dissent_info">We registered that you did not consent on [% consent.refused_on | html %].</p>
                                     [% END %]
                                 </li></ul>
                             </fieldset>
@@ -78,33 +78,29 @@
 [% INCLUDE 'opac-bottom.inc' %]
 [% BLOCK jsinclude %]
     <script>
-        var consent = null;
         $(document).ready(function() {
-            [% IF Koha.Preference('GDPR_Policy') %]
-                [% IF gdpr_proc_consent.given_on %]
-                    consent=1;
-                    $("input[type='radio'][value='1']").prop('checked',true);
-                    $(".alert").hide();
-                [% ELSIF gdpr_proc_consent.refused_on %]
-                    consent=0;
-                    $("input[type='radio'][value='0']").prop('checked',true);
-                [% ELSE %]
+            [% FOREACH consent IN consents %]
+                [% IF consent.given_on %]
+                    $("input[type='radio'][name='check_[% consent.type | html %]'][value='1']").prop('checked',true);
+                [% ELSIF consent.refused_on %]
+                    $("input[type='radio'][name='check_[% consent.type | html %]'][value='0']").prop('checked',true);
                 [% END %]
+
             [% END %]
             // Initially no choice is made or no change, so disable button
             $("#saveconsent").prop('disabled', true);
 
             $("input[type='radio']").click(function() {
-                var radio = $(this).val();
-                if( radio=='1' && (consent==null || consent==0) ) {
-                    $("#saveconsent").prop('disabled', false);
-                    $(".consent_info").hide();
-                } else if( radio=='0' && (consent==null || consent==1) ) {
-                    $("#saveconsent").prop('disabled', false);
-                    $(".consent_info").hide();
+                $("#saveconsent").prop('disabled', false);
+                var v = $(this).val();
+                // If former registration info present, toggle
+                if( v == 1 ) {
+                    $(this).parent().siblings('.consent_info').show();
+                    $(this).parent().siblings('.dissent_info').hide();
+                } else {
+                    $(this).parent().siblings('.consent_info').hide();
+                    $(this).parent().siblings('.dissent_info').show();
                 }
-                if( radio=='1' ) $(".alert").hide();
-                if( radio=='0' ) $(".alert").show();
             });
 
         });
diff --git a/opac/opac-patron-consent.pl b/opac/opac-patron-consent.pl
index 87b57d7c1e..f3e2a51f42 100755
--- a/opac/opac-patron-consent.pl
+++ b/opac/opac-patron-consent.pl
@@ -19,17 +19,20 @@
 
 use Modern::Perl;
 use CGI qw/-utf8/;
+use List::Util qw/none/;
 
 use C4::Auth qw( get_template_and_user );
 use C4::Output qw( output_html_with_http_headers );
+use Koha::AuthorisedValueCategories;
 use Koha::DateUtils qw( dt_from_string );
 use Koha::Patrons;
 
 use constant GDPR_PROCESSING => 'GDPR_PROCESSING';
+use constant AV_CONSENT => 'PATRON_CONSENT';
 
 my $query = CGI->new;
 my $op = $query->param('op') // q{};
-my $gdpr_check = $query->param('gdpr_processing') // q{};
+my $vars = $query->Vars;
 
 my ( $template, $borrowernumber, $cookie ) = get_template_and_user({
     template_name   => "opac-patron-consent.tt",
@@ -37,29 +40,42 @@ my ( $template, $borrowernumber, $cookie ) = get_template_and_user({
     type            => "opac",
 });
 
+my $needs_redirect = 0;
 my $patron = Koha::Patrons->find($borrowernumber);
-my $gdpr_proc_consent;
-if( C4::Context->preference('GDPR_Policy') ) {
-    $gdpr_proc_consent = $patron->consent(GDPR_PROCESSING);
+
+# Get consent types, but always add GDPR when enforced/permissive
+my ( $consents, $types );
+$types = ( $_ = Koha::AuthorisedValueCategories->find(AV_CONSENT) ) ? [ $_->values ] : [];
+if( C4::Context->preference('GDPR_Policy') ) { # Enforced|Permissive
+    push @$types, GDPR_PROCESSING if none { $_ eq GDPR_PROCESSING } @$types;
+}
+
+# Get consent values
+foreach my $t ( @$types ) {
+    push @$consents, $patron->consent($t);
 }
 
 # Handle saves here
 if( $op eq 'save' ) {
-    if( $gdpr_proc_consent ) {
-        $gdpr_proc_consent->set({
-            given_on => $gdpr_check ? dt_from_string() : undef,
-            refused_on => $gdpr_check ? undef : dt_from_string(),
+    foreach my $consent ( @$consents ) {
+        my $check = $vars->{ "check_".$consent->type };
+        next if !defined($check); # no choice made
+        $needs_redirect = 1 if $consent->type eq GDPR_PROCESSING && !$check && C4::Context->preference('GDPR_Policy') eq 'Enforced';
+        next if $consent->given_on && $check || $consent->refused_on && !$check;
+            # No update if no consent change
+        $consent->set({
+            given_on => $check ? dt_from_string() : undef,
+            refused_on => $check ? undef : dt_from_string(),
         })->store;
     }
 }
 
 # If user refused GDPR consent and we enforce GDPR, logout (when saving)
-if( $op =~ /save/ && C4::Context->preference('GDPR_Policy') eq 'Enforced' && $gdpr_proc_consent->refused_on )
-{
+if( $needs_redirect ) {
     print $query->redirect('/cgi-bin/koha/opac-main.pl?logout.x=1');
     exit;
 }
 
-$template->param( patron => $patron, gdpr_proc_consent => $gdpr_proc_consent );
+$template->param( patron => $patron, consents => $consents );
 
 output_html_with_http_headers $query, $cookie, $template->output, undef, { force_no_caching => 1 };
-- 
2.30.2