create-ailk 0.21.0 → 0.22.0

package/templates/apps/web/app/[locale]/(authed)/account/agreements-prompt.tsx

@@ -1,181 +1,184 @@
-"use client";
+"use client"; // Accept calls a Server Action then refreshes the router; Sign out is the frame's client hook
 
 /**
- * AgreementsPrompt — the account home's sign-up-agreement re-ask (#8438
- * D13, spec docs/specs/8438-consent-registry-and-ledger-step-spec.md C6).
+ * AgreementsInterstitial — the full-page sign-up-agreement ask (#8765 D7,
+ * spec docs/specs/8765-sign-up-refuses-without-the-spec.md; replaces the
+ * Inbox's `AgreementsPrompt` card, D8).
  *
- * Renders only when `missing` is non-empty — `A/page.tsx` computes that
- * from `GET /v1/member/consents`: a `signUp` agreement with no OWN grant at
- * its current `policyVersion` (D4 — never an any-source row an anonymous
- * form attached, SEC-8438-1).
+ * The account layout renders this IN PLACE of `AccountFrame` and its
+ * children whenever `GET /v1/consent/account` answers `complete: false`, or
+ * fails closed on any read but a 2xx or an older hub's 404 (SEC-8765-C), so no
+ * account page, rail, Inbox or For-you panel loads behind it. The file keeps
+ * its name because `create-ailk`'s `surfaces.ts` syncs it by path.
  *
- * On mount, tries the CARRIED case first: `acceptCarriedAgreementsAction`
- * (this directory's own `agreements-actions.ts`) consumes the sign-up
- * card's signed, email-bound cookie and writes each missing agreement with
- * `via: "sign_up"`, so a member who just ticked the boxes on `/sign-up` is
- * never asked twice. On success the page refreshes and this component is
- * gone from the next render (`missing` becomes empty); on failure — no
- * cookie, expired, wrong account, or it does not cover every missing id —
- * the explicit card below shows instead.
+ * - One `h1`: the "updated" title when any agreement shown has an accepted
+ *   (older) version, else the "new" one — then the lead line.
+ * - Each statement through `ConsentStatement`, its `[Label](key)` tokens
+ *   linked by `consentPoliciesFor(locale)` (D9) — the three destinations
+ *   `/contact` links (#8761).
+ * - Accept posts every id through `acceptAccountAgreementsAction`, then
+ *   refreshes, so the layout's next read loads the account; a failed write
+ *   shows the error line and leaves the page as it is.
+ * - Sign out is always there (D1's "never blocked"): `useAccountSignOut`,
+ *   the frame's own Log out.
  *
- * Dynamically imported, never a static import, mirroring the generated
- * seam's own idiom (`topology.generated.ts`'s `readSession` imports
- * `../auth` dynamically): `./agreements-actions` reads a session and posts
- * through `@working-theory/api-client`, the same database/sign-in-adjacent
- * surface the seam exists to keep lazy. The cookie it consumes is minted by
- * `(auth)/sign-up/sign-up.actions.ts` — a sign-in SEED a sign-in-less spoke
- * drops (`SPOKE_REMOVED_ROOTS`/`spokeExclusions`,
- * `packages/create-ailk/src/topology.ts` D4) — but this file never reaches
- * that module directly; the consume-side logic lives here instead,
- * precisely so this directory carries no cross-boundary import into a seed
- * a spoke prunes. A spoke member signs up on the hub (C6), so on a spoke
- * there is simply no carried cookie to find — the "Otherwise" card below
- * shows instead, exactly as it does for any other failed carried check.
- *
- * "Otherwise" card: the statement (plain text, as `AgreementList` reads it
- * — no markdown-link parsing here either; see that component's own note)
- * plus a link to its policy when the wire carries one, and one Accept
- * button that posts every missing id through `setConsentAction` with no
- * `via` (`account_settings`).
+ * The wrapper carries the account area's `data-ailk-shell` marker, so the
+ * page draws in the same app tokens as the account it stands in for.
  */
 
-import { Button, Heading, Link, Text } from "@working-theory/ui/primitives";
+import { ConsentStatement } from "@working-theory/ui/blocks";
+import {
+  Button,
+  Heading,
+  InlineMessage,
+  Text,
+} from "@working-theory/ui/primitives";
 import { useRouter } from "next/navigation";
-import { useEffect, useRef, useState, type ReactElement } from "react";
+import { useState, type ReactElement } from "react";
+
+import { consentPoliciesFor } from "../../../../lib/consent-policies";
 
-import { setConsentAction } from "./privacy/actions";
+import { useAccountSignOut } from "./account-frame";
+import { acceptAccountAgreementsAction } from "./agreements-actions";
 
-export interface MissingAgreement {
+/** One sign-up agreement the person has not accepted at its current version. */
+export interface AgreementsInterstitialAgreement {
   id: string;
+  /** The resolved statement, `[Label](key)` tokens included. */
   statement: string;
-  policyHref: string | null;
-  version: number;
-  /** True when this purpose has an OWN grant at an older version (D13's "updated" copy). */
-  hadPriorGrant: boolean;
+  /** The version last accepted, or `null` when never accepted. */
+  acceptedVersion: number | null;
 }
 
-export interface AgreementsPromptLabels {
+export interface AgreementsInterstitialLabels {
   titleNew: string;
   titleUpdated: string;
+  lead: string;
   accept: string;
+  signOut: string;
   error: string;
-  /** The policy link's label (the same text Privacy's own policy link uses). */
-  policyLink: string;
+  /** Shown when a hub sign-out is refused or fails (#8465). */
+  signOutFailed: string;
 }
 
-export interface AgreementsPromptProps {
-  missing: MissingAgreement[];
-  labels: AgreementsPromptLabels;
+export interface AgreementsInterstitialProps {
+  locale: string;
+  agreements: AgreementsInterstitialAgreement[];
+  labels: AgreementsInterstitialLabels;
+  /** The seam's `SIGN_OUT_ENDPOINT`, as the frame takes it (#8465). */
+  signOutEndpoint?: string | null;
+  /** Where a hub sign-out lands; defaults to the site home. */
+  signInHref?: string;
 }
 
-type CarriedCheck = "checking" | "hidden" | "show";
-
-export function AgreementsPrompt({ missing, labels }: AgreementsPromptProps): ReactElement | null {
+export function AgreementsInterstitial({
+  locale,
+  agreements,
+  labels,
+  signOutEndpoint,
+  signInHref,
+}: AgreementsInterstitialProps): ReactElement {
   const router = useRouter();
-  const [state, setState] = useState<CarriedCheck>(missing.length === 0 ? "hidden" : "checking");
+  const { onSignOut, signOutFailed } = useAccountSignOut({
+    locale,
+    signOutEndpoint,
+    signInHref,
+  });
   const [pending, setPending] = useState(false);
-  const [error, setError] = useState<string | null>(null);
-  const attempted = useRef(false);
+  const [error, setError] = useState(false);
+  const policies = consentPoliciesFor(locale);
 
-  useEffect(() => {
-    if (missing.length === 0) {
-      setState("hidden");
-      return;
-    }
-    if (attempted.current) return;
-    attempted.current = true;
-    let active = true;
-    void (async () => {
-      try {
-        const { acceptCarriedAgreementsAction } = await import("./agreements-actions");
-        const result = await acceptCarriedAgreementsAction(missing.map((m) => m.id));
-        if (!active) return;
-        if (result.accepted) {
-          setState("hidden");
-          router.refresh();
-        } else {
-          setState("show");
-        }
-      } catch {
-        if (active) setState("show");
-      }
-    })();
-    return () => {
-      active = false;
-    };
-     
-  }, [router]);
+  const title = agreements.some(
+    (agreement) => agreement.acceptedVersion !== null,
+  )
+    ? labels.titleUpdated
+    : labels.titleNew;
 
-  async function acceptAll(): Promise<void> {
+  async function accept(): Promise<void> {
     setPending(true);
-    setError(null);
+    setError(false);
     try {
-      const results = await Promise.all(missing.map((m) => setConsentAction(m.id, true)));
-      if (results.every((r) => r.ok)) {
-        // Mirrors the carried-cookie path: hide now, rather than leaving
-        // `state` at "show" across the refresh below — the mount-time
-        // effect that would otherwise notice `missing` is now empty never
-        // re-runs (its deps are `[router]`, not `missing`), since this is
-        // the SAME component instance, not a fresh mount.
-        setState("hidden");
+      const result = await acceptAccountAgreementsAction(
+        agreements.map((agreement) => agreement.id),
+      );
+      if (result.ok) {
         router.refresh();
-      } else {
-        setError(labels.error);
-        setPending(false);
+        return;
       }
     } catch {
-      setError(labels.error);
-      setPending(false);
+      // Falls through to the error line below.
     }
+    setError(true);
+    setPending(false);
   }
 
-  if (state !== "show") return null;
-
-  const title = missing.some((m) => m.hadPriorGrant) ? labels.titleUpdated : labels.titleNew;
-
   return (
-    <div
-      className="mb-block-loose flex flex-col gap-3 rounded-control border-hairline border-(--color-border) bg-surface-secondary p-4"
-      data-testid="account-agreements-prompt"
-    >
-      <Heading level={2} visual={4}>
-        {title}
-      </Heading>
-      <div className="flex flex-col gap-2">
-        {missing.map((agreement) => (
-          <div key={agreement.id} data-testid={`account-agreements-prompt-${agreement.id}`}>
-            <Text as="p" variant="body-sm">
-              {agreement.statement}
+    <div className="contents" data-ailk-shell="account">
+      <main
+        id="main"
+        className="flex min-h-screen items-center justify-center bg-bg px-4 py-section text-fg"
+        data-testid="account-agreements-interstitial"
+      >
+        <div className="flex w-full max-w-measure flex-col gap-6">
+          <div className="flex flex-col gap-2">
+            <Heading level={1} visual={2}>
+              {title}
+            </Heading>
+            <Text as="p" tone="muted">
+              {labels.lead}
             </Text>
-            {agreement.policyHref ? (
-              <Link
-                href={agreement.policyHref}
-                className="text-body-sm"
-                data-testid={`account-agreements-prompt-${agreement.id}-policy`}
+          </div>
+
+          <div className="flex flex-col gap-3">
+            {agreements.map((agreement) => (
+              <span
+                key={agreement.id}
+                data-testid={`account-agreements-statement-${agreement.id}`}
               >
-                {labels.policyLink}
-              </Link>
-            ) : null}
+                <ConsentStatement
+                  statement={agreement.statement}
+                  policies={policies}
+                />
+              </span>
+            ))}
+          </div>
+
+          {error ? (
+            <InlineMessage
+              variant="error"
+              data-testid="account-agreements-error"
+            >
+              {labels.error}
+            </InlineMessage>
+          ) : null}
+          {signOutFailed ? (
+            <InlineMessage variant="error" data-testid="account-sign-out-error">
+              {labels.signOutFailed}
+            </InlineMessage>
+          ) : null}
+
+          <div className="flex flex-col gap-3 md:flex-row">
+            <Button
+              type="button"
+              size="big"
+              disabled={pending}
+              onClick={() => void accept()}
+              data-testid="account-agreements-accept"
+            >
+              {labels.accept}
+            </Button>
+            <Button
+              type="button"
+              variant="ghost"
+              size="big"
+              onClick={onSignOut}
+              data-testid="account-agreements-sign-out"
+            >
+              {labels.signOut}
+            </Button>
           </div>
-        ))}
-      </div>
-      {error ? (
-        <span role="alert" data-testid="account-agreements-prompt-error">
-          <Text as="span" variant="caption">
-            {error}
-          </Text>
-        </span>
-      ) : null}
-      <div>
-        <Button
-          type="button"
-          disabled={pending}
-          onClick={() => void acceptAll()}
-          data-testid="account-agreements-prompt-accept"
-        >
-          {labels.accept}
-        </Button>
-      </div>
+        </div>
+      </main>
     </div>
   );
 }

package/templates/apps/web/app/[locale]/(authed)/account/layout.tsx

@@ -24,6 +24,16 @@
  * The `(authed)` layout above owns the signed-out gate, so a missing session
  * here is a race (it expired between the two layouts): the page renders
  * unframed and degrades on its own.
+ *
+ * #8765 D7 — after the session check the layout reads the caller's
+ * account-level sign-up agreements (`GET /v1/consent/account`). While any
+ * is not current, it returns `AgreementsInterstitial` IN PLACE of the frame
+ * and its children, so no account page loads behind it. It fails closed
+ * (SEC-8765-C): any answer but a 2xx or a 404 — a thrown read, a 401, 403,
+ * 429 or 5xx — shows the interstitial from the web's own copy of the
+ * registry, with the "new" title, and logs `read_failed`. Only a 404, an
+ * older hub with no such route, renders the account as before. The gate is
+ * on the account area's pages, never the member API (SEC-8765-L).
  */
 
 import { localeHref } from "@working-theory/ui";
@@ -35,6 +45,8 @@ import { SIGN_IN_PATH, SIGN_OUT_ENDPOINT } from "../../../../lib/topology.genera
 
 import { accountSession, loadForYou } from "./account-data";
 import { AccountFrame } from "./account-frame";
+import { outstandingAgreements } from "./agreements-gate";
+import { AgreementsInterstitial } from "./agreements-prompt";
 import { forYouLabels } from "./for-you-labels";
 
 /** The value when it parses as an https URL, else undefined: operator config is rendered as an href. */
@@ -61,6 +73,33 @@ export default async function AccountLayout({
   if (!session) return <>{children}</>;
 
   const t = await getTranslations({ locale, namespace: "account" });
+  const signOutProps = SIGN_OUT_ENDPOINT
+    ? {
+        signOutEndpoint: SIGN_OUT_ENDPOINT,
+        signInHref: localeHref(locale, SIGN_IN_PATH ?? "/"),
+      }
+    : {};
+
+  const outstanding = await outstandingAgreements(session.ctx);
+  if (outstanding.length > 0) {
+    return (
+      <AgreementsInterstitial
+        locale={locale}
+        agreements={outstanding}
+        {...signOutProps}
+        labels={{
+          titleNew: t("agreements.titleNew"),
+          titleUpdated: t("agreements.titleUpdated"),
+          lead: t("agreements.lead"),
+          accept: t("agreements.accept"),
+          signOut: t("agreements.signOut"),
+          error: t("agreements.error"),
+          signOutFailed: t("frame.signOutFailed"),
+        }}
+      />
+    );
+  }
+
   const forYou = await loadForYou(locale);
   const { name, email } = session.ctx.user;
   const helpCenterUrl = httpsUrl(process.env.AILK_HELP_CENTER_URL);
@@ -81,12 +120,7 @@ export default async function AccountLayout({
           : []),
       ]}
       forYou={{ items: forYou.items, now: forYou.now, labels: forYouLabels(session.ctx.t) }}
-      {...(SIGN_OUT_ENDPOINT
-        ? {
-            signOutEndpoint: SIGN_OUT_ENDPOINT,
-            signInHref: localeHref(locale, SIGN_IN_PATH ?? "/"),
-          }
-        : {})}
+      {...signOutProps}
       labels={{
         home: t("frame.home"),
         inbox: t("frame.inbox"),

package/templates/apps/web/app/[locale]/(authed)/account/page.tsx

@@ -39,9 +39,12 @@
  * whose `available` read resolved `true`, each opening its popup over the
  * Inbox. None offered (a Free build) → no New at all. A read that rejected
  * drops its row and shows the error row too — a failed read is never silent.
+ *
+ * #8765 D8 — the Inbox renders nothing about agreements: an outstanding
+ * sign-up agreement is asked by the layout's full-page interstitial, before
+ * this page loads at all.
  */
 
-import { member } from "@working-theory/api-client";
 import {
   ForYouPanel,
   InboxList,
@@ -50,9 +53,17 @@ import {
   type InboxListRow,
 } from "@working-theory/templates/account";
 import { Heading, Text } from "@working-theory/ui/primitives";
-import { CalendarClock, ClipboardList, Receipt, type LucideProps } from "lucide-react";
+import {
+  CalendarClock,
+  ClipboardList,
+  Receipt,
+  type LucideProps,
+} from "lucide-react";
 import type { Metadata } from "next";
+import { headers } from "next/headers";
 import { getTranslations } from "next-intl/server";
+import { SITE_NAME } from "../../../../lib/site-brand";
+import { readSession } from "../../../../lib/topology.generated";
 import type { ComponentType, ReactElement } from "react";
 
 import {
@@ -63,7 +74,7 @@ import {
   logReadFailure,
   type LoadedInboxItem,
 } from "./account-data";
-import { AgreementsPrompt, type MissingAgreement } from "./agreements-prompt";
+import { outstandingAgreements } from "./agreements-gate";
 import { ErrorRow } from "./error-row";
 import { ACCOUNT_PERSIST_KEY, forYouLabels } from "./for-you-labels";
 import { NewMenu, type NewMenuAction } from "./new-menu";
@@ -76,6 +87,18 @@ interface Props {
 export async function generateMetadata({ params }: Props): Promise<Metadata> {
   const { locale } = await params;
   const t = await getTranslations({ locale, namespace: "account" });
+  // Signed out, the `(authed)` layout renders the sign-in gate in this page's
+  // place, so the title names THAT state — "Sign in · <site>" — not the Inbox
+  // the visitor cannot see yet (#8790 AC-1). The session read is the layout's
+  // own (`topology.generated`'s `readSession`); any failure keeps the Inbox
+  // title, exactly as before.
+  const session = await readSession(await headers()).catch(() => null);
+  if (!session) {
+    return {
+      title: `${t("gate.title")} · ${SITE_NAME}`,
+      description: t("description"),
+    };
+  }
   return { title: t("inbox.title"), description: t("description") };
 }
 
@@ -97,69 +120,57 @@ function soonestFirst(a: LoadedInboxItem, b: LoadedInboxItem): number {
 async function loadNewActions(
   ctx: AccountContext,
 ): Promise<{ actions: NewMenuAction[]; failed: boolean }> {
-  const settled = await Promise.allSettled(newActions.map((action) => action.available(ctx)));
+  const settled = await Promise.allSettled(
+    newActions.map((action) => action.available(ctx)),
+  );
   const actions: NewMenuAction[] = [];
   settled.forEach((result, i) => {
     const action = newActions[i]!;
-    if (result.status === "rejected") logReadFailure(`new:${action.id}`, result.reason);
+    if (result.status === "rejected")
+      logReadFailure(`new:${action.id}`, result.reason);
     else if (result.value)
-      actions.push({ id: action.id, label: ctx.t(action.label), popup: action.renderPopup(ctx) });
+      actions.push({
+        id: action.id,
+        label: ctx.t(action.label),
+        popup: action.renderPopup(ctx),
+      });
   });
-  return { actions, failed: settled.some((result) => result.status === "rejected") };
+  return {
+    actions,
+    failed: settled.some((result) => result.status === "rejected"),
+  };
 }
 
 /** Upcoming items first, soonest first; then the rest, as loaded (newest first). */
 function scheduledOrder(rows: readonly LoadedInboxItem[]): LoadedInboxItem[] {
-  const upcoming = rows.filter(({ item }) => item.upcoming === true).sort(soonestFirst);
+  const upcoming = rows
+    .filter(({ item }) => item.upcoming === true)
+    .sort(soonestFirst);
   return [...upcoming, ...rows.filter(({ item }) => item.upcoming !== true)];
 }
 
-/**
- * #8438 D13 — the `signUp` agreements this caller's OWN state does not
- * cover at their CURRENT registry version. A failed or absent read answers
- * none: the prompt is a convenience, never a page-breaking requirement.
- */
-async function loadMissingAgreements(ctx: AccountContext, locale: string): Promise<MissingAgreement[]> {
-  try {
-    const res = await member.consents(ctx.init, { locale });
-    if (!res.ok) return [];
-    return res.body.purposes
-      .filter((purpose) => purpose.signUp)
-      .filter(
-        (purpose) =>
-          !purpose.state || !purpose.state.granted || purpose.state.policyVersion !== purpose.policyVersion,
-      )
-      .map((purpose) => ({
-        id: purpose.id,
-        statement: purpose.statement,
-        policyHref: purpose.policyHref,
-        version: purpose.policyVersion,
-        hadPriorGrant: purpose.state !== null,
-      }));
-  } catch {
-    return [];
-  }
-}
-
-export default async function AccountInboxPage({ params }: Props): Promise<ReactElement> {
+export default async function AccountInboxPage({ params }: Props): Promise<ReactElement | null> {
   const { locale } = await params;
   const t = await getTranslations({ locale, namespace: "account" });
   const session = await accountSession(locale);
 
+  // The layout shows the interstitial in place of this page while an
+  // agreement is outstanding, but the App Router still renders the page: no
+  // Inbox loader may run meanwhile (`member.messages` stamps `readAt`, #8765 D7).
+  if (session && (await outstandingAgreements(session.ctx)).length > 0) return null;
+
   // The contract's translator, for keys that are data (a kind's `label`).
   const translate = session?.ctx.t ?? ((key: string): string => key);
-  const [inbox, forYou, newMenu, missingAgreements] = session
+  const [inbox, forYou, newMenu] = session
     ? await Promise.all([
         loadInboxItems(session.ctx),
         loadForYou(locale),
         loadNewActions(session.ctx),
-        loadMissingAgreements(session.ctx, locale),
       ])
     : [
         { items: [], failed: false },
         { items: [], failed: false, now: "" },
         { actions: [], failed: false },
-        [],
       ];
 
   const dateFormat = new Intl.DateTimeFormat(locale, {
@@ -173,14 +184,18 @@ export default async function AccountInboxPage({ params }: Props): Promise<React
     return {
       id: `${kind.kind}:${item.id}`,
       ...(icon ? { icon } : {}),
-      caption: item.at ? `${label} · ${dateFormat.format(new Date(item.at))}` : label,
+      caption: item.at
+        ? `${label} · ${dateFormat.format(new Date(item.at))}`
+        : label,
       title: item.title,
       href: inboxItemHref(locale, kind.kind, item.id),
     };
   };
 
   const all = inbox.items.map(toRow);
-  const purchases = inbox.items.filter(({ kind }) => kind.section === "purchases").map(toRow);
+  const purchases = inbox.items
+    .filter(({ kind }) => kind.section === "purchases")
+    .map(toRow);
   const scheduled = scheduledOrder(
     inbox.items.filter(({ kind }) => kind.section === "upcoming"),
   ).map(toRow);
@@ -189,17 +204,6 @@ export default async function AccountInboxPage({ params }: Props): Promise<React
   return (
     // The phone's top bar already clears the canvas — no top inset there.
     <div className="max-w-3xl py-8 max-md:pt-0" data-testid="account-inbox">
-      {/* #8438 D13 — the sign-up agreement re-ask, above both phone tabs. */}
-      <AgreementsPrompt
-        missing={missingAgreements}
-        labels={{
-          titleNew: t("agreements.titleNew"),
-          titleUpdated: t("agreements.titleUpdated"),
-          accept: t("agreements.accept"),
-          error: t("agreements.error"),
-          policyLink: t("settings.privacy.policyLink"),
-        }}
-      />
       {/* The page's one h1, on both phone tabs; visually hidden on the phone,
           which has no large title (§5.15). New sits beside it (#8233 D4). */}
       <div className="flex items-center justify-between gap-2">
@@ -212,7 +216,12 @@ export default async function AccountInboxPage({ params }: Props): Promise<React
         />
       </div>
       <PhoneTabPanel tabs={["inbox"]} desktop data-testid="inbox-panel-inbox">
-        <Text as="p" variant="body-sm" tone="muted" className="mt-block-tight hidden md:block">
+        <Text
+          as="p"
+          variant="body-sm"
+          tone="muted"
+          className="mt-block-tight hidden md:block"
+        >
           {t("inbox.lead")}
         </Text>
 
@@ -226,7 +235,12 @@ export default async function AccountInboxPage({ params }: Props): Promise<React
 
         <InboxList
           tabs={[
-            { id: "all", label: t("inbox.tabs.all"), count: all.length, rows: all },
+            {
+              id: "all",
+              label: t("inbox.tabs.all"),
+              count: all.length,
+              rows: all,
+            },
             {
               id: "purchases",
               label: t("inbox.tabs.purchases"),

package/templates/apps/web/app/[locale]/(authed)/account/privacy/page.tsx

@@ -14,7 +14,9 @@
  *   3. account-privacy-consents — one `ConsentSwitchList` row per
  *      `area: "data"` purpose, or the "no other data-use consents" line.
  *   4. account-privacy-agreements — a read-only `AgreementList` of every
- *      agreement (`service_terms`, `account_terms`, …), or "None yet".
+ *      agreement (`service_terms`, `account_terms`, …), or "None yet"; each
+ *      statement's links resolve through `consentPoliciesFor(locale)`
+ *      (#8765 D11).
  *   5. account-deletion — moved unchanged from General (#8438 D16).
  *
  * Sections 3 and 4 read `GET /v1/member/consents`; a failed read shows one
@@ -35,6 +37,7 @@ import { cookies } from "next/headers";
 import { getTranslations } from "next-intl/server";
 import type { ReactElement } from "react";
 
+import { consentPoliciesFor } from "../../../../../lib/consent-policies";
 import { accountSession } from "../account-data";
 import { DeletionRequest } from "../general/deletion-request";
 import { loadProfileSource } from "../general/profile-source";
@@ -188,6 +191,7 @@ export default async function AccountPrivacyPage({ params }: Props): Promise<Rea
                 notAcceptedLine={t("settings.privacy.agreementsEmpty")}
                 emptyLine={t("settings.privacy.agreementsEmpty")}
                 testIdPrefix="account-privacy-agreement"
+                policies={consentPoliciesFor(locale)}
               />
             </div>
           </>