Add versioned legal consent to authentication

microservices/AuthApi/Controllers/SteamAuthController.cs

@@ -19,10 +19,11 @@ public class SteamAuthController : ControllerBase
     private readonly JwtTokenService _tokens;
     private readonly IConfiguration _cfg;
     private readonly ILogger<SteamAuthController> _logger;
+    private readonly LegalPolicy _legal;
 
     public SteamAuthController(UserService users, SteamAuthTransactionService transactions,
         SteamOpenIdService openId, JwtTokenService tokens, IConfiguration cfg,
-        ILogger<SteamAuthController> logger)
+        ILogger<SteamAuthController> logger, LegalPolicy legal)
     {
         _users = users;
         _transactions = transactions;
@@ -30,6 +31,7 @@ public class SteamAuthController : ControllerBase
         _tokens = tokens;
         _cfg = cfg;
         _logger = logger;
+        _legal = legal;
     }
 
     [HttpPost("start")]
@@ -115,7 +117,8 @@ public class SteamAuthController : ControllerBase
             user.Username,
             user.Role,
             jti,
-            exp
+            exp,
+            legal = _legal.Status(user)
         });
     }
 
@@ -133,6 +136,8 @@ public class SteamAuthController : ControllerBase
         var createdUser = false;
         if (request.Action == "create")
         {
+            if (!request.AcceptLegal)
+                return BadRequest(new { message = "You must agree to the Terms of Service and acknowledge the Privacy Policy." });
             var validation = ValidateNewAccount(request);
             if (validation is not null)
                 return BadRequest(new { message = validation });
@@ -149,6 +154,7 @@ public class SteamAuthController : ControllerBase
                 RefreshToken = NewRefreshToken(),
                 RefreshTokenExpiry = DateTime.UtcNow.AddDays(7)
             };
+            _legal.Accept(user, "steam_registration");
             try
             {
                 await _users.CreateAsync(user);