add TermsAcceptance pseudo-resource, app/views/contacts/_form.html.haml

app/controllers/application_controller.rb

@@ -4,7 +4,7 @@
 
 class ApplicationController < ActionController::Base
   include Pagy::Backend
-  #before_action :authenticate_user!
+  before_action :force_terms_acceptance
   impersonates :user
 
   def authorize_admin!
@@ -15,4 +15,19 @@ def authorize_admin!
       redirect_to root_path
     end
   end
+
+  def authorize_user!
+    if !user_signed_in?
+      flash[:error] = t('you need to log in')
+      redirect_to root_path
+    end
+  end
+
+  def force_terms_acceptance
+    if user_signed_in? && current_user == true_user
+      if !current_user.admin? && !current_user.terms_accepted_at
+        redirect_to terms_acceptance_path
+      end
+    end
+  end
 end

app/controllers/terms_acceptances_controller.rb

@@ -0,0 +1,33 @@
+# SPDX-FileCopyrightText: 2020 Felix Wolfsteller
+#
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+class TermsAcceptancesController < ApplicationController
+  before_action :authorize_user!
+  before_action :force_terms_acceptance
+
+  def show
+    if !current_user.terms_accepted_at.present?
+      flash[:warning] = t('.have_to_agree')
+    end
+  end
+
+  def create
+    if params[:accept_terms] && params[:read_privacy_terms]
+      flash[:message] = t('.welcome')
+      current_user.update(terms_accepted_at: DateTime.current)
+      redirect_to root_path
+    else
+      flash[:warning] = t('terms_acceptances.show.have_to_agree')
+      render :show
+    end
+  end
+
+  private
+
+  def force_terms_acceptance
+    # no show (overriding ApplicationController#force_terms_acceptance,
+    # otherwise redirect loop)
+  end
+end
+

app/views/terms_acceptances/show.html.haml

@@ -0,0 +1,26 @@
+-# SPDX-FileCopyrightText: 2020 Felix Wolfsteller
+-#
+-# SPDX-License-Identifier: AGPL-3.0-or-later
+
+%h1.title
+  = t('privacy_statement')
+.container.mb-5
+  .content.is-medium.has-text-justified
+    != SiteSetting['privacy_statement']
+
+%h1.title
+  = t('terms')
+.container.mb-5
+  .content.is-medium.has-text-justified
+    != SiteSetting['terms']
+
+= form_with url: terms_acceptance_path, builder: BulmaFormBuilder::FormBuilder do |f|
+  .field
+    = label_tag :accept_terms, t('activerecord.attributes.user.tos_agreement')
+    = f.check_box :accept_terms
+  .field
+    = label_tag :read_privacy_terms, t('activerecord.attributes.user.read_privacy_terms')
+    = f.check_box :read_privacy_terms
+  .actions
+    = f.submit t('Save'), class: 'button is-primary'
+

config/locales/de.yml

@@ -464,6 +464,11 @@ de:
     your-are-subscriped: Du hast ein Abonnement
     your-subscription-ended: Dein Abonnement ist abgelaufen
     your-trial-ended: Deine Schnupperwoche ist abgelaufen
+  terms_acceptances:
+    create:
+      welcome: Super! Willkommen und viel Spaß!
+    show:
+      have_to_agree: Du musst den AGB zustimmen und die Datenschutzerklärung als gelesen markieren.
   the_website: yogamitveronique.de
   till: bis
   time:

config/routes.rb

@@ -31,6 +31,8 @@
 
   resources :styles, only: [:index, :show]
 
+  resource :terms_acceptance, only: [:show, :create]
+
   namespace :admin do
     resources :appointments
 

test/system/tos_test.rb

@@ -60,11 +60,26 @@ class TosTest < ApplicationSystemTestCase
   end
 
   test "when logging in and no consent was given, user is forced to agree or delete account" do
-    skip "tbi"
+    visit new_user_session_path
+
+    user = users(:user_without_tos_acceptance)
+
+    fill_in "E-Mail", with: user.email
+    fill_in "Passwort", with: 'userpwd'
+
+    click_on "Anmelden"
+
+    assert_selector '.notification', text: /Du musst/
+    assert_selector 'button', text: 'gelesen'
+    assert_selector 'button', text: 'löschen'
   end
 
   test "admins can update date of tos changes and user has to re-agree or delete account" do
     skip "tbi"
   end
+
+  test "admins do not need to accept the terms" do
+    skip "tbi"
+  end
 end