Visible Terms and Privacy links on the auth screens - #317
Conversation
Social-platform app reviews (TikTok explicitly) require both links to be reachable from the public site without logging in or opening a menu.
The links are a compliance artifact an outside reviewer checks, but nothing asserted they exist. A refactor of this layout could drop the footer silently and the next platform submission would fail the same check that prompted the PR. A feature test asserts the shared prop reaches both guest screens and carries whatever the install configured, and a browser test asserts the two links actually render to a logged-out visitor. Declares legal on SharedData, so the props read through the interface rather than its index signature and the inline cast goes away. Adds rel="noopener noreferrer" to both anchors, matching every other target="_blank" in the codebase, and orders the imports the way eslint expects so the file lands clean rather than relying on --fix in CI. Drops the comment explaining why the links are there: that rationale belongs in the commit and the pull request, and the sibling comments in this file describe markup rather than justify decisions.
The register screen has shown "By continuing, you agree to our Terms of Service and Privacy Policy" in production for a long time, translated into all sixteen locales. Only the login screen was missing it, and the two URLs were hardcoded inside the translated string, so a self-hosted install could not point them at its own documents. So this keeps what already worked and changes only those two things. The markup moves into one component, which the login screen now renders as well. The translated sentence keeps its wording and its link labels; only the href becomes an i18n placeholder that the component fills from config. That is one line per locale, and no new translation keys. Reverting the footer out of AuthSplitLayout also stops the links from appearing on the workspace index and create screens, which reach that layout too and are seen after login rather than before it. The sentence no longer hides on a self-hosted install. It was hidden because it named TryPost's own documents; now that the URLs are configuration, an install that sets them wants it shown. A feature test covers the shared prop on both screens and the placeholder in every locale; a browser test covers the rendered sentence, since the links are a compliance artifact an outside reviewer checks and nothing guarded them.
The test hand-rolled a polling loop in injected JavaScript to wait for the element to mount, because the project notes say browser assertions do not wait for SPA paint. They do. visit() returns a PendingAwaitablePage backed by AwaitableWebpage, whose __call wraps every method in Execution::waitForExpectation and retries until the Playwright timeout, which defaults to five seconds. The plugin even deprecates waitForText in favour of assertSee for this reason. The loop was re-implementing the retry that already surrounded each call, less well and with a helper whose name has to be unique across the whole suite because these are global functions. Halves the file and drops the injected script. assertSeeLink also says more than the old check did: it asserts the labels are links, not just text that happens to appear.
|
@gynsus thanks for this — the underlying problem was real and I hadn't noticed it. The TikTok reviewer lands on I pushed some changes to the branch. The short version: it now shows on login and register, and the URLs are fully configurable. A bit more detail on what moved and why: Kept your config idea — that was the key insight. Reused what was already in production instead of adding new copy. The register screen has shown "By continuing, you agree to our Terms of Service and Privacy Policy" for a long time, already translated into all sixteen locales. So the new Took the footer back out of Dropped the Added tests, since the links are a compliance artifact an outside reviewer checks and nothing guarded them: a feature test for the shared prop on both screens plus the placeholder in every locale, and a browser test for the rendered sentence. One thing worth knowing for your next browser test, because our own docs got this wrong and I only found out here: browser assertions do auto-wait. Full suite green. Thanks again for pushing on this one. |
2 participants
Terms of Service and Privacy Policy links in the footer of the auth screens (login / register split layout).
Small, but it unblocks something real: platform app reviews check for this. TikTok's audit rejected a submission specifically because "Privacy Policy and Terms of Service links must be clearly visible on your website" — and the auth screens are the only pages of a self-hosted TryPost a reviewer without an account ever sees. With the links in place the resubmission passed that check.
The links point at
/termsand/privacy, matching the routes the marketing site already uses.