Migrate privacy acceptance from FormAction to RequiredAction SPI

[felixevers]

Summary

Refactors the privacy policy acceptance mechanism from a registration-time FormAction to a reusable RequiredAction SPI. This enables versioned policy consents that re-prompt users on login when the policy version changes, without requiring flow modifications.

Key Changes

• Backend (Keycloak SPI)

  • Replaced PrivacyAcceptanceFormAction + PrivacyAcceptanceFormActionFactory with a new PolicyAcceptanceRequiredAction framework
  • Introduced PolicyDefinition immutable configuration class to describe policies (id, provider id, URLs, i18n keys, attribute names)
  • Created AbstractPolicyAcceptanceRequiredActionFactory base class for easy addition of new policies
  • Implemented PrivacyPolicyRequiredActionFactory as the first concrete policy using the new framework
  • Module renamed from privacy/ to policy-acceptance/ to reflect broader scope
  • Version bumped to 0.3.0

• Frontend (React Login Theme)

  • Updated Terms.tsx to detect policy-acceptance mode via policyId context attribute
  • Added PolicyBody component to render policy-specific UI (label + optional URL link)
  • Added PolicyCheckboxLabel component for inline policy acceptance checkbox with link
  • Conditional rendering: shows policy UI when policyId is present, otherwise shows traditional terms text
  • Added error display and hidden form field (policy-accepted) for policy variant
  • Removed privacy checkbox from Register.tsx (now handled by RequiredAction on login)
  • Updated KcContext.ts type definitions to include policy-acceptance attributes
  • Updated branding animation to delay start by 3 seconds for better UX
  • Version bumped to 0.6.0

• Documentation

  • Updated deployment docs to reflect RequiredAction vs FormAction distinction
  • Clarified that policy version bumps trigger re-prompts on next login without migration
  • Updated example NixOS configuration with new module names and versions

Implementation Details

• Versioning Strategy: User attributes store the accepted policy version. On each login, evaluateTriggers() compares stored version against realm-configured version; mismatch triggers re-prompt.
• Realm Configuration: Policy URL and version are overridable via realm attributes (helpwave.policy.<id>.url and helpwave.policy.<id>.version), allowing runtime changes without code deployment.
• Extensibility: New policies can be added by creating a PolicyDefinition constant and a factory class extending AbstractPolicyAcceptanceRequiredActionFactory, then registering in SPI manifest.
• User Attributes: Acceptance metadata stored as <id>_policy_accepted, <id>_policy_accepted_at, and <id>_policy_version.

https://claude.ai/code/session_0195crFD3B3cfn6TQW4n9ACr