timescale.info#171 · Accounts for people 13 and older; adults choose; content policy and operator docs
- timeline-app
- pull request
The last part of #115. With it, the plan in [the issue](https://github.com/openchronology/timeline-app/issues/115#issuecomment-6201088679) is complete: - **Reports and the review queue:** #167 - **Sensitive-content labels:** #170 - **Ages, the adults' choice, and policy and operator docs:** this PR Closes #115. ## Ages (decided: 13+, minors always warned) **Year of birth at sign-up.** Only the year is stored (`oc_users.birth_year`). - **Password registration** asks for it. It's kept with the pending registration and copied to the account on confirmation. - **New social accounts** give it at their email step. They can't get a session before that step, so the question comes before the account can be used. - **Counting:** age is counted from the end of the year of birth (`birthYear` in `server/account-security.mjs`), so anyone who may be under 13 is refused. - **Under 13 at the email step:** the just-created social account is deleted (it cannot hold anything yet). If it somehow holds timelines, it's suspended for review instead. - **Accounts made before this:** made under the old 18+ terms, they have no year and count as adults. **Minors and adults.** - **Minors:** accounts that may be under 18 always see sensitive-content warnings and don't browse labelled timelines. The session reports `minor`. - **Adults:** they can turn the warnings off under **Account → Sensitive content** (`show_sensitive`; `showSensitive` in the session). The editor then skips the warning screen and the blur. - **Enforced on the server:** minors' attempts to turn the warnings off are refused (403). ## Policy and operator docs (drafts, pending the operator's legal review) **`legal/TERMS.md`** - Accounts are 13+. - Content rules: labelled educational, historical, medical, artistic and news depictions are allowed; pornography, gore for its own sake and any sexual content involving minors are not. - Anyone may report; decisions come with reasons and one review request. **`legal/PRIVACY.md`** - What's kept: year of birth, the preference, account standing, reports and decisions. - The 13+ policy, replacing the 18+ one. **`legal/LAUNCH.md`:** new checklist items: - review the 13+ policy per region; - keep the content policy, so the site stays outside the pornography age-verification laws and 18 U.S.C. 2257; - register with NCMEC's CyberTipline; - name who staffs the review queue; - complete the UK Online Safety Act assessments; - publish an EU DSA point of contact. **New `legal/RISK-ASSESSMENT.md`:** a template for the Online Safety Act's illegal-content assessment and children's access and risk assessments. It is pre-filled with the service's features and measures. **`docs/moderation.md`** - An **Ages** section. - The operator's procedure for child sexual abuse material: restrict, report, preserve for one year without copying, then delete. **`docs/authentication.md` and `docs/browsing.md`:** updated to match. ## Tests - **New:** `test/ages-postgres.mjs`, which checks: - the year rules (13 and 18 boundaries, invalid input); - password sign-up: missing → 400, under 13 → 403, stored on the registration; - the social email step: missing → 400, under 13 → 403 and the account deleted, a valid year stored; - the session's `minor` and `showSensitive`, and accounts with no year treated as adults; - the preference: refused for minors, validated, reflected in the session and account; - browsing: minors and signed-out readers don't browse labelled timelines; adults do. - **Extended:** `test/labels-live-postgres.mjs` now also checks, in Chromium: - an adult with warnings off opens a labelled timeline with no warning or blur; - a teenager still gets the warning, and their Account page explains why. - **Updated:** the registration calls in existing tests now pass a year. - **Results:** - all 40 database tests pass locally, as do 265 unit tests and the typecheck; - in Chromium (Playwright container), all nine browser suites pass; - a screenshot of the registration form was che…