Feat: Recording Legal Acceptance

src/Auth/Listeners/RecordLegalAcceptanceForNewUser.php

@@ -0,0 +1,28 @@
+<?php
+
+namespace Modules\Core\Auth\Listeners;
+
+use Modules\Core\Auth\Events\UserCreated;
+
+/**
+ * The storefront login page shows a terms/privacy notice ("By continuing,
+ * you accept the Terms of Use and have read the Privacy Policy") that
+ * requesting an OTP code implicitly accepts — recorded once, right here,
+ * for a genuinely new signup only (UserCreated fires exactly once per
+ * user, from Auth\Services\UserOtpService::generateAndSend()'s own
+ * wasRecentlyCreated check). An existing user's original acceptance
+ * (whatever version was live when THEY signed up) must never be
+ * overwritten by whatever config('legal.*') says today, which is exactly
+ * why this only ever runs from UserCreated and nowhere else.
+ */
+class RecordLegalAcceptanceForNewUser
+{
+    public function handle(UserCreated $event): void
+    {
+        $event->user->forceFill([
+            'terms_accepted_at' => now(),
+            'terms_version' => config('legal.terms_version'),
+            'privacy_policy_version' => config('legal.privacy_policy_version'),
+        ])->save();
+    }
+}

src/Customer/Privacy/CustomerDataProvider.php

@@ -66,6 +66,9 @@ class CustomerDataProvider implements PersonalDataProvider
             'id' => $user->id,
             'name' => $user->name,
             'email' => $user->email,
+            'terms_accepted_at' => $user->terms_accepted_at,
+            'terms_version' => $user->terms_version,
+            'privacy_policy_version' => $user->privacy_policy_version,
             'customers' => $user->customers->map(fn (Customer $customer) => [
                 'id' => $customer->id,
                 'company_name' => $customer->company_name,

src/Providers/AuthServiceProvider.php

@@ -2,13 +2,18 @@
 
 namespace Modules\Core\Providers;
 
+use Illuminate\Support\Facades\Event;
 use Illuminate\Support\ServiceProvider;
+use Modules\Core\Auth\Events\UserCreated;
+use Modules\Core\Auth\Listeners\RecordLegalAcceptanceForNewUser;
 use Modules\Core\Command\CreateAdminCommand;
 
 class AuthServiceProvider extends ServiceProvider
 {
     public function boot(): void
     {
+        Event::listen(UserCreated::class, RecordLegalAcceptanceForNewUser::class);
+
         if ($this->app->runningInConsole()) {
             $this->app->booted(fn () => $this->commands([CreateAdminCommand::class]));
         }