Prompt to accept identity server policies before inviting them to a room

[lampholder]

Prompt for accepting IS terms before inviting a user by email address (if you haven't already agreed to that IS's policies)

There's another beat on which we need to capture accepting the IS's policies - before associating a new email address with your account _and choosing to publish that association on the IS - but that's tracked in #10159 (comment)

[lampholder]

This will require a change to sydent and presumably the spec to expose policy documents

[turt2live]

we should try and reuse matrix-org/matrix-spec-proposals#1692 if possible

[lampholder]

Talking this through with Dave yesterday, we identified that it might not be desirable or appropriate for the IS to track users' acceptance of policy terms itself, since it would then need to support Open ID.

It might be preferable for the IS to mandate that calls to its APIs are provided with a 'policy-accepted' header representing the URI(s) of the latest policy documents the user has indicated their acceptance of - if this doesn't match the latest docs the IS has published, it can respond with an error (and the URI(s) of the new docs).

This approach could work for the IM, too.

This approach allows us to state with confidence that either the user accepted the terms, or (worst case scenario) the client they were using made a false attestation on the user's behalf.

[lampholder]

Basically this looks something like this (if the user hasn't yet agreed to the active is'es t's and c's:

[ara4n]

Is there a reason to do this here rather than at registration or when changing IS? I'm worried that we may have other places where we need to talk to ISes (e.g. for displaying bound 3PIDs in settings), and having each UI control prompt for GDPR flows will be cumbersome versus doing them up front.