feat: update some fields in customer agreemnet model

license_manager/apps/api/serializers.py

@@ -355,9 +355,10 @@ class Meta:
             'subscription_for_auto_applied_licenses',
             'available_subscription_catalogs',
             'has_custom_license_expiration_messaging',
+            'modal_header_text',
             'expired_subscription_modal_messaging',
-            'hyper_link_text_for_expired_modal',
-            'url_for_expired_modal',
+            'button_label_in_modal',
+            'url_for_button_in_modal',
             'enable_auto_applied_subscriptions_with_universal_link'
         ]
 

license_manager/apps/subscriptions/admin.py

@@ -418,9 +418,10 @@ class CustomerAgreementAdmin(admin.ModelAdmin):
         'license_duration_before_purge',
         'disable_onboarding_notifications',
         'has_custom_license_expiration_messaging',
+        'modal_header_text',
         'expired_subscription_modal_messaging',
-        'hyper_link_text_for_expired_modal',
-        'url_for_expired_modal',
+        'button_label_in_modal',
+        'url_for_button_in_modal',
         'enable_auto_applied_subscriptions_with_universal_link'
     )
     custom_fields = ('subscription_for_auto_applied_licenses',)

license_manager/apps/subscriptions/migrations/0072_remove_customeragreement_hyper_link_text_for_expired_modal_and_more.py

@@ -0,0 +1,69 @@
+# Generated by Django 4.2.16 on 2024-10-14 10:58
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('subscriptions', '0071_customeragreement_enable_auto_applied_subscriptions_with_universal_link_and_more'),
+    ]
+
+    operations = [
+        migrations.RemoveField(
+            model_name='customeragreement',
+            name='hyper_link_text_for_expired_modal',
+        ),
+        migrations.RemoveField(
+            model_name='customeragreement',
+            name='url_for_expired_modal',
+        ),
+        migrations.RemoveField(
+            model_name='historicalcustomeragreement',
+            name='hyper_link_text_for_expired_modal',
+        ),
+        migrations.RemoveField(
+            model_name='historicalcustomeragreement',
+            name='url_for_expired_modal',
+        ),
+        migrations.AddField(
+            model_name='customeragreement',
+            name='button_label_in_modal',
+            field=models.CharField(blank=True, help_text='The text that will appear as on the button in the expiration modal', max_length=255, null=True),
+        ),
+        migrations.AddField(
+            model_name='customeragreement',
+            name='modal_header_text',
+            field=models.CharField(blank=True, help_text='The bold text that will appear as the header in the expiration modal.', max_length=512, null=True),
+        ),
+        migrations.AddField(
+            model_name='customeragreement',
+            name='url_for_button_in_modal',
+            field=models.CharField(blank=True, help_text='The URL that should underly the sole button in the expiration modal', max_length=512, null=True),
+        ),
+        migrations.AddField(
+            model_name='historicalcustomeragreement',
+            name='button_label_in_modal',
+            field=models.CharField(blank=True, help_text='The text that will appear as on the button in the expiration modal', max_length=255, null=True),
+        ),
+        migrations.AddField(
+            model_name='historicalcustomeragreement',
+            name='modal_header_text',
+            field=models.CharField(blank=True, help_text='The bold text that will appear as the header in the expiration modal.', max_length=512, null=True),
+        ),
+        migrations.AddField(
+            model_name='historicalcustomeragreement',
+            name='url_for_button_in_modal',
+            field=models.CharField(blank=True, help_text='The URL that should underly the sole button in the expiration modal', max_length=512, null=True),
+        ),
+        migrations.AlterField(
+            model_name='customeragreement',
+            name='expired_subscription_modal_messaging',
+            field=models.TextField(blank=True, help_text='The content of a modal that will appear to learners upon subscription expiration. This text can be used for custom guidance per customer.', null=True),
+        ),
+        migrations.AlterField(
+            model_name='historicalcustomeragreement',
+            name='expired_subscription_modal_messaging',
+            field=models.TextField(blank=True, help_text='The content of a modal that will appear to learners upon subscription expiration. This text can be used for custom guidance per customer.', null=True),
+        ),
+    ]

license_manager/apps/subscriptions/models.py

@@ -56,6 +56,7 @@
     provision_licenses,
 )
 
+from license_manager.apps.subscriptions.sanitize import sanitize_html
 from .exceptions import (
     LicenseActivationMissingError,
     LicenseToActivateIsRevokedError,
@@ -150,8 +151,16 @@ class CustomerAgreement(TimeStampedModel):
         )
     )
 
-    expired_subscription_modal_messaging = models.CharField(
+    modal_header_text = models.CharField(
         max_length=512,
+        blank=True,
+        null=True,
+        help_text=_(
+            "The bold text that will appear as the header in the expiration modal."
+        )
+    )
+
+    expired_subscription_modal_messaging = models.TextField(
         blank=True,
         null=True,
         help_text=_(
@@ -160,21 +169,21 @@ class CustomerAgreement(TimeStampedModel):
         )
     )
 
-    hyper_link_text_for_expired_modal = models.CharField(
+    button_label_in_modal = models.CharField(
         max_length=255,
         blank=True,
         null=True,
         help_text=_(
-            "The display text for the link that will be embedded at the end of the custom expiration modal."
+            "The text that will appear as on the button in the expiration modal"
         )
     )
 
-    url_for_expired_modal = models.CharField(
+    url_for_button_in_modal = models.CharField(
         max_length=512,
         blank=True,
         null=True,
         help_text=_(
-            "The underlying url that will be embedded as a hyperlink at the end of the custom expiration modal."
+            "The URL that should underly the sole button in the expiration modal"
         )
     )
 
@@ -237,54 +246,55 @@ class Meta:
         verbose_name_plural = _("Customer Agreements")
 
     def clean(self):
-        # Check if custom messaging is enabled and messaging field is blank
+        """
+        Custom clean method to validate fields based on the 'Has Custom License Expiration Messaging' flag.
+        """
+        errors = {}
+
+        # Sanitize the expired_subscription_modal_messaging field
+        if self.expired_subscription_modal_messaging:
+           self.expired_subscription_modal_messaging = sanitize_html(self.expired_subscription_modal_messaging)
+
+        error_message = "This field cannot be blank if 'Has Custom License Expiration Messaging' is checked."
+        # Validate fields when custom messaging is enabled
         if self.has_custom_license_expiration_messaging:
-            if not self.expired_subscription_modal_messaging:
-                raise ValidationError({
-                    "expired_subscription_modal_messaging": (
-                        "This field cannot be blank if 'Has Custom License Expiration Messaging' is checked."
-                    )
-                })
-
-        # Validate that URL field is not blank if hyperlink text is provided
-        if self.hyper_link_text_for_expired_modal and not self.url_for_expired_modal:
-            raise ValidationError({
-                "url_for_expired_modal": (
-                    "This field cannot be blank if 'Hyper Link Text for Expired Modal' has values."
-                )
-            })
+            required_fields = {
+                "modal_header_text": error_message,
+                "expired_subscription_modal_messaging": error_message,
+                "button_label_in_modal": error_message,
+                "url_for_button_in_modal": error_message,
+            }
 
-        # Validate that hyperlink text is not blank if URL is provided
-        if self.url_for_expired_modal and not self.hyper_link_text_for_expired_modal:
-            raise ValidationError({
-                "hyper_link_text_for_expired_modal": (
-                    "This field cannot be blank if 'URL for Expired Modal' has values."
-                )
-            })
+            # Check if any required fields are missing
+            for field, error_message in required_fields.items():
+                if not getattr(self, field):
+                    errors[field] = error_message
 
         # Ensure all fields are blank if custom messaging is disabled
         if not self.has_custom_license_expiration_messaging:
-            if any([
-                self.expired_subscription_modal_messaging,
-                self.hyper_link_text_for_expired_modal,
-                self.url_for_expired_modal
-            ]):
+            fields_to_check = [
+                "modal_header_text",
+                "expired_subscription_modal_messaging",
+                "button_label_in_modal",
+                "url_for_button_in_modal"
+            ]
+            if any(getattr(self, field) for field in fields_to_check):
                 error_msg = "This field must be blank if 'Has Custom License Expiration Messaging' is unchecked."
-                raise ValidationError({
-                    "expired_subscription_modal_messaging": error_msg,
-                    "hyper_link_text_for_expired_modal": error_msg,
-                    "url_for_expired_modal": error_msg,
-                })
-
-        def __str__(self):
-            """
-            Return human-readable string representation.
-            """
-            return (
-                "<CustomerAgreement: '{}'>".format(
-                    self.enterprise_customer_slug or self.enterprise_customer_name
-                )
+                errors = {field: error_msg for field in fields_to_check}
+
+        # Raise ValidationError if there are any errors
+        if errors:
+            raise ValidationError(errors)
+
+    def __str__(self):
+        """
+        Return human-readable string representation.
+        """
+        return (
+            "<CustomerAgreement: '{}'>".format(
+                self.enterprise_customer_slug or self.enterprise_customer_name
             )
+        )
 
 
 class PlanType(models.Model):

license_manager/apps/subscriptions/sanitize.py

@@ -0,0 +1,30 @@
+import bleach
+
+
+def sanitize_html(html_content):
+    """
+    Sanitize HTML content to allow only safe tags and attributes,
+    while disallowing JavaScript and unsafe protocols.
+    """
+    # Define allowed tags and attributes
+    allowed_tags = bleach.ALLOWED_TAGS  # Allow all standard HTML tags
+    allowed_attrs = {"*": ["className", "class", "style", "id"]}
+
+    # Clean the HTML content
+    sanitized_content = bleach.clean(
+        html_content,
+        tags=allowed_tags,
+        attributes=allowed_attrs,
+        strip=True,  # Strip disallowed tags completely
+        protocols=["http", "https"],  # Only allow http and https URLs
+    )
+
+    # Use bleach.linkify to ensure no javascript: links in <a> tags
+    sanitized_content = bleach.linkify(
+        sanitized_content,
+        callbacks=[
+            bleach.callbacks.nofollow
+        ],  # Apply 'nofollow' to external links for safety
+    )
+
+    return sanitized_content