agreements 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6d0c0ec7930db8014c275731beebb35381ce05acc26e7b56ec68e3a6e1d8dcd1
-  data.tar.gz: ec47850af89352033e3ff2f9458073fcc33508b6cfeaddb97687a9f969b3b828
+  metadata.gz: cbb4e3cb21a8e743ea9fab48f117242cad49d78e752258bbb992894498355be4
+  data.tar.gz: f2160a49ff3799851018060c773643c9b829bad4a1d3e22944913cef62dae501
 SHA512:
-  metadata.gz: 48879a71eb8489ee500f01172ba0e25488730aeb263c41478b9f3f910cf6a7c6c12bd7c1ae03e8244b65fe9f733ec9e2949010ac0482ba51d1bcf59313663a65
-  data.tar.gz: a67ad2a4e8282b7b8a1f1fe71842e3797123eb3611d1a36c4dd60b163085a325846797431ff67c92aca9224fba3bd5c2cacaca804dd0255bc24628508f3d4351
+  metadata.gz: 70299f73fe7bc2b6760aae7b1389fa3913298175554ac001963270372c97af651bec611613ae51d367a320dd6d785b154517cccc1c468eece83f7b25e3c0212c
+  data.tar.gz: 7a27e58cf17b1068ecee2705f510f38f6900829eb77c5177b8a77237cb19be6e581b728f8a2eba56f973e8850977fa72e612af28dbdbafd1d787d11d86ad2e60

data/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 0.2.0 - 2026-08-27
+
+- Record the exact localized acceptance statement and locale shown by the host.
+- Publish releases through RubyGems trusted publishing.
+
 ## 0.1.0 - 2026-08-25
 
 - Extract the agreement-version and acceptance primitives proven in EthicsPortal.

data/README.md

@@ -4,8 +4,8 @@ Auditable acceptance of externally hosted legal agreements for Rails.
 
 `agreements` answers one durable question:
 
-> Which agreement version did this subject accept, who performed the
-> acceptance, under what authority, and when?
+> Which agreement version and localized statement did this subject accept,
+> who performed the acceptance, under what authority, and when?
 
 It deliberately does not host legal documents or provide a legal CMS. Your
 legal or marketing site remains authoritative; the gem stores immutable
@@ -29,6 +29,13 @@ view, initializer, JavaScript, CSS, or admin dashboard to integrate.
 
 Ruby >= 3.2 · Rails >= 7.1 and < 9 · PostgreSQL and SQLite
 
+### Upgrading from 0.1
+
+Version 0.2 adds non-null `acceptance_statement` and `locale` columns to
+`agreements_acceptances`. Add them in a host migration before upgrading. For
+existing evidence, copy each version's canonical statement and use an honest
+locale such as `und` when the displayed locale is unknown.
+
 ## Define a version
 
 Agreement versions are deployed data. Create them in a data migration and keep
@@ -79,19 +86,24 @@ application. Submit the exact displayed version as a hidden field:
 Then record only that version while it remains current:
 
 ```ruby
+statement = I18n.t("agreements.user_terms.statement")
+
 acceptance = Agreements.accept!(
   "user_terms",
   version_id: params.dig(:acceptance, :agreement_version_id),
   subject: current_user,
   actor: current_user,
-  authority: "self"
+  authority: "self",
+  acceptance_statement: statement,
+  locale: I18n.locale.to_s
 )
 ```
 
 `Agreements.accept!` resolves the current version server-side, requires the
 submitted ID to match it, derives opaque keys from the server-owned subject and
-actor, and records one acceptance per subject and version. Retries, double
-clicks, and concurrent submissions return the original acceptance.
+actor, and records the exact localized plain-text statement selected by the
+host. Do not accept either value from browser parameters. Retries, double
+clicks, and concurrent submissions return the original acceptance evidence.
 
 A missing, malformed, wrong-agreement, or stale ID raises
 `Agreements::VersionNotCurrent`. Its `current_version` is ready to render:
@@ -112,7 +124,9 @@ Agreements.accept!(
   version_id: params.dig(:acceptance, :agreement_version_id),
   subject: current_organization,
   actor: current_user,
-  authority: "organization_owner"
+  authority: "organization_owner",
+  acceptance_statement: I18n.t("agreements.organization_dpa.statement"),
+  locale: I18n.locale.to_s
 )
 ```
 
@@ -168,6 +182,7 @@ the response contract your application supports.
 - agreement-version foreign key;
 - opaque subject and actor keys;
 - authority;
+- exact localized acceptance statement and locale;
 - server acceptance time;
 - timestamps.
 
@@ -201,7 +216,7 @@ registry alone does not deploy a new version to an existing installation.
 - Draft/publish/activation workflows or an admin dashboard.
 - Electronic signatures or identity proofing.
 - IP addresses, user agents, fingerprints, geolocation, or request provenance.
-- Presentation manifests, snapshots, scroll tracking, or one-time nonces.
+- Presentation manifests, browser snapshots, scroll tracking, or one-time nonces.
 - Consent withdrawal, declarations, attestations, authorizations, retention,
   legal holds, integrity chains, or compliance reporting.
 - Application-specific onboarding, marketing consent, tenancy, ownership,

data/app/models/agreements/acceptance.rb

@@ -6,7 +6,7 @@ module Agreements
                class_name: "Agreements::Version",
                inverse_of: :acceptances
 
-    validates :subject_key, :actor_key, :authority, :accepted_at, presence: true
+    validates :subject_key, :actor_key, :authority, :acceptance_statement, :locale, :accepted_at, presence: true
     validates :authority, format: { with: /\A[a-z0-9_]+\z/ }
 
     def readonly?

data/lib/agreements/recorder.rb

@@ -2,13 +2,15 @@
 
 module Agreements
   class Recorder
-    def self.call(agreement_version:, subject:, actor:, authority:)
+    def self.call(agreement_version:, evidence:)
       Acceptance.create_or_find_by!(
         agreement_version: agreement_version,
-        subject_key: Agreements.identity_key(subject)
+        subject_key: Agreements.identity_key(evidence.fetch(:subject))
       ) do |acceptance|
-        acceptance.actor_key = Agreements.identity_key(actor)
-        acceptance.authority = authority
+        acceptance.actor_key = Agreements.identity_key(evidence.fetch(:actor))
+        acceptance.authority = evidence.fetch(:authority)
+        acceptance.acceptance_statement = evidence.fetch(:acceptance_statement)
+        acceptance.locale = evidence.fetch(:locale)
         acceptance.accepted_at = Time.current
       end
     end

data/lib/agreements/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Agreements
-  VERSION = "0.1.0"
+  VERSION = "0.2.0"
 end

data/lib/agreements.rb

@@ -23,15 +23,21 @@ module Agreements
       end
     end
 
-    def accept!(agreement_key, version_id:, subject:, actor:, authority:)
+    # Explicit keywords keep this evidence boundary distinct from browser params.
+    # rubocop:disable-next Metrics/ParameterLists
+    def accept!(agreement_key, version_id:, subject:, actor:, authority:, acceptance_statement:, locale:)
       version = current_version(agreement_key)
       raise VersionNotCurrent, version unless version&.id.to_s == version_id.to_s
 
       Recorder.call(
         agreement_version: version,
-        subject: subject,
-        actor: actor,
-        authority: authority
+        evidence: {
+          subject: subject,
+          actor: actor,
+          authority: authority,
+          acceptance_statement: acceptance_statement,
+          locale: locale
+        }
       )
     end
 

data/lib/generators/agreements/install/templates/create_agreements_tables.rb.tt

@@ -21,6 +21,8 @@ class CreateAgreementsTables < ActiveRecord::Migration<%= migration_version %>
       t.string :subject_key, null: false
       t.string :actor_key, null: false
       t.string :authority, null: false
+      t.text :acceptance_statement, null: false
+      t.string :locale, null: false
       t.datetime :accepted_at, null: false
       t.timestamps
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: agreements
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - Yaroslav Shmarov
@@ -31,10 +31,10 @@ dependencies:
         version: '9'
 description: |
   A small Rails engine that stores immutable external agreement-version
-  metadata and append-only acceptance evidence. It distinguishes the subject
-  bound by an agreement from the actor accepting under recorded authority,
-  rejects stale rendered versions, and leaves documents, authentication,
-  authorization, routes, and UI in the host application.
+  metadata and append-only localized acceptance evidence. It distinguishes
+  the subject bound by an agreement from the actor accepting under recorded
+  authority, rejects stale rendered versions, and leaves documents,
+  authentication, authorization, routes, and UI in the host application.
 email:
 - yashm@outlook.com
 executables: []
@@ -81,7 +81,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.10
+rubygems_version: 4.0.16
 specification_version: 4
 summary: Auditable acceptance of externally hosted legal agreements for Rails.
 test_files: []