feat: require compliance confirmation for paid features

Gate payment, redemption, subscription, and invitation reward flows behind an audited compliance acknowledgement.

web/default/src/features/system-settings/integrations/payment-settings-section.tsx

@@ -20,8 +20,17 @@ import * as React from 'react'
 import * as z from 'zod'
 import { useForm } from 'react-hook-form'
 import { zodResolver } from '@hookform/resolvers/zod'
-import { Code2, Eye } from 'lucide-react'
+import { useMutation, useQueryClient } from '@tanstack/react-query'
+import { Code2, Eye, ShieldAlert } from 'lucide-react'
 import { useTranslation } from 'react-i18next'
+import { toast } from 'sonner'
+import { cn } from '@/lib/utils'
+import {
+  Alert,
+  AlertAction,
+  AlertDescription,
+  AlertTitle,
+} from '@/components/ui/alert'
 import { Button } from '@/components/ui/button'
 import {
   Form,
@@ -36,6 +45,8 @@ import { Input } from '@/components/ui/input'
 import { Separator } from '@/components/ui/separator'
 import { Switch } from '@/components/ui/switch'
 import { Textarea } from '@/components/ui/textarea'
+import { RiskAcknowledgementDialog } from '@/components/risk-acknowledgement-dialog'
+import { confirmPaymentCompliance } from '../api'
 import { SettingsSection } from '../components/settings-section'
 import { useUpdateOption } from '../hooks/use-update-option'
 import { AmountDiscountVisualEditor } from './amount-discount-visual-editor'
@@ -125,18 +136,30 @@ const paymentSchema = z.object({
 
 type PaymentFormValues = z.infer<typeof paymentSchema>
 
+const CURRENT_COMPLIANCE_TERMS_VERSION = 'v1'
+
+type PaymentComplianceDefaults = {
+  confirmed: boolean
+  termsVersion: string
+  confirmedAt: number
+  confirmedBy: number
+}
+
 type PaymentSettingsSectionProps = {
   defaultValues: PaymentFormValues
   waffoDefaultValues: WaffoSettingsValues
   waffoPancakeDefaultValues: WaffoPancakeSettingsValues
+  complianceDefaults: PaymentComplianceDefaults
 }
 
 export function PaymentSettingsSection({
   defaultValues,
   waffoDefaultValues,
   waffoPancakeDefaultValues,
+  complianceDefaults,
 }: PaymentSettingsSectionProps) {
   const { t } = useTranslation()
+  const queryClient = useQueryClient()
   const updateOption = useUpdateOption()
   const initialRef = React.useRef(defaultValues)
   const defaultsSignature = React.useMemo(
@@ -151,6 +174,81 @@ export function PaymentSettingsSection({
     React.useState(true)
   const [creemProductsVisualMode, setCreemProductsVisualMode] =
     React.useState(true)
+  const [showComplianceDialog, setShowComplianceDialog] = React.useState(false)
+
+  const complianceStatements = React.useMemo(
+    () => [
+      t(
+        'You have legally obtained authorization for the connected model APIs, accounts, keys, and quotas.'
+      ),
+      t(
+        'You commit to using upstream APIs, accounts, keys, quotas, and service capabilities only within the scope of lawful authorization obtained from upstream service providers, model service providers, or relevant rights holders, and will not conduct unauthorized resale, trafficking, distribution, or other non-compliant commercialization.'
+      ),
+      t(
+        'If you provide generative AI services to the public in mainland China, you will fulfill legal obligations including filing, security assessment, content safety, complaint handling, generated content labeling, log retention, and personal information protection.'
+      ),
+      t(
+        'You commit not to use this system to implement, assist with, or indirectly implement acts that violate applicable laws and regulations, regulatory requirements, platform rules, public interests, or the lawful rights and interests of third parties.'
+      ),
+      t(
+        'You understand and independently bear legal responsibility arising from deployment, operation, and charging behavior.'
+      ),
+      t(
+        'You understand this compliance reminder is only for risk notice and does not constitute legal advice, a compliance review conclusion, or a guarantee of the legality of your use of this system; you should consult professional legal or compliance advisors based on your actual business scenario.'
+      ),
+    ],
+    [t]
+  )
+
+  const complianceRequiredText = t(
+    'I have read and understood the above compliance reminder, acknowledge the related legal risks, and confirm that I bear legal responsibility arising from deployment, operation, and charging behavior.'
+  )
+  const complianceRequiredTextParts = React.useMemo(
+    () => [
+      {
+        type: 'input' as const,
+        text: t('I have read and understood the above compliance reminder'),
+      },
+      { type: 'static' as const, text: t('，') },
+      {
+        type: 'input' as const,
+        text: t('acknowledge the related legal risks'),
+      },
+      { type: 'static' as const, text: t('，and ') },
+      {
+        type: 'input' as const,
+        text: t(
+          'confirm that I bear legal responsibility arising from deployment'
+        ),
+      },
+      { type: 'static' as const, text: t('、') },
+      {
+        type: 'input' as const,
+        text: t('operation and charging behavior'),
+      },
+    ],
+    [t]
+  )
+
+  const complianceConfirmed =
+    complianceDefaults.confirmed &&
+    complianceDefaults.termsVersion === CURRENT_COMPLIANCE_TERMS_VERSION
+
+  const confirmComplianceMutation = useMutation({
+    mutationFn: confirmPaymentCompliance,
+    onSuccess: (data) => {
+      if (data.success) {
+        toast.success(t('Compliance confirmed successfully'))
+        setShowComplianceDialog(false)
+        queryClient.invalidateQueries({ queryKey: ['system-options'] })
+      } else {
+        toast.error(data.message || t('Failed to confirm compliance'))
+      }
+    },
+    onError: (error: Error) => {
+      toast.error(error.message || t('Failed to confirm compliance'))
+    },
+  })
 
   const form = useForm({
     resolver: zodResolver(paymentSchema),
@@ -562,11 +660,77 @@ export function PaymentSettingsSection({
         'Configure recharge pricing and payment gateway integrations'
       )}
     >
+      {!complianceConfirmed ? (
+        <Alert variant='destructive' className='mb-6'>
+          <ShieldAlert className='h-4 w-4' />
+          <AlertTitle>{t('Compliance confirmation required')}</AlertTitle>
+          <AlertDescription>
+            <div className='space-y-3'>
+              <p>
+                {t(
+                  'Payment, redemption codes, subscription plans, and invitation rewards are locked until the root administrator confirms the compliance terms.'
+                )}
+              </p>
+              <ol className='list-decimal space-y-1 pl-5'>
+                {complianceStatements.map((statement) => (
+                  <li key={statement}>{statement}</li>
+                ))}
+              </ol>
+            </div>
+          </AlertDescription>
+          <AlertAction>
+            <Button
+              type='button'
+              size='sm'
+              variant='destructive'
+              onClick={() => setShowComplianceDialog(true)}
+            >
+              {t('Confirm compliance')}
+            </Button>
+          </AlertAction>
+        </Alert>
+      ) : (
+        <Alert className='mb-6'>
+          <AlertTitle>{t('Compliance confirmed')}</AlertTitle>
+          <AlertDescription>
+            {t('Confirmed at {{time}} by user #{{userId}}', {
+              time: complianceDefaults.confirmedAt
+                ? new Date(
+                    complianceDefaults.confirmedAt * 1000
+                  ).toLocaleString()
+                : '-',
+              userId: complianceDefaults.confirmedBy || '-',
+            })}
+          </AlertDescription>
+        </Alert>
+      )}
+
+      <RiskAcknowledgementDialog
+        open={showComplianceDialog}
+        onOpenChange={setShowComplianceDialog}
+        title={t('Confirm compliance terms')}
+        description={t(
+          'This confirmation unlocks payment, redemption code, subscription plan, and invitation reward features. Please read the statements carefully.'
+        )}
+        items={complianceStatements}
+        requiredText={complianceRequiredText}
+        requiredTextParts={complianceRequiredTextParts}
+        inputPrompt={t('Please type the following text to confirm:')}
+        inputPlaceholder={t('Type the confirmation text here')}
+        mismatchHint={t('The entered text does not match the required text.')}
+        confirmText={t('Confirm and enable')}
+        isLoading={confirmComplianceMutation.isPending}
+        onConfirm={() => confirmComplianceMutation.mutate()}
+      />
+
       {/* eslint-disable react-hooks/refs */}
       <Form {...form}>
         <form
           onSubmit={form.handleSubmit(onSubmit)}
-          className='space-y-8'
+          className={cn(
+            'space-y-8',
+            !complianceConfirmed && 'pointer-events-none opacity-40'
+          )}
           data-no-autosubmit='true'
         >
           <div className='space-y-4'>