feat!(website): Allow customization of data use terms agreement text

[theosanderson]

The purpose of this is to allow linking to for example the "how to cite" page in addition

Description

This PR adds support for customizing the data use terms agreement checkbox label text in the download dialog through configuration. Previously, the text was hardcoded as "I agree to the data use terms" with a link to the terms page.

The changes allow administrators to provide custom HTML for the agreement label via the dataUseTerms.agreementHtml configuration option, enabling more flexible messaging while maintaining backward compatibility with a sensible default.

Changes

• Added optional dataUseTermsAgreementHtml configuration property to website config schema
• Updated DownloadDialog component to use custom HTML when provided, falling back to the default text
• Added configuration getter getDataUseTermsAgreementHtml() to retrieve the custom HTML
• Updated Kubernetes Helm templates to support the new configuration option
• Threaded the new prop through the component hierarchy (SearchFullUI → DownloadDialog)
• Updated test utilities to support the new prop

Configuration

The new configuration option is optional and located under dataUseTerms.agreementHtml. When not provided, the component renders the default agreement text. The configuration accepts HTML strings, allowing for custom links and formatting.

PR Checklist

• All necessary documentation has been adapted (schema, values.yaml, types)
• The implemented feature is covered by appropriate, automated tests (test helper updated)
• Manual testing: Verified component renders with and without custom HTML, and that default fallback works correctly

https://claude.ai/code/session_013oJyL4K1RSVkBKLpEBa3DC

🚀 Preview: Add preview label to enable

[claude]

This PR may be related to: #3674 (Genericise data use terms for other maintainers)

[claude]

Claude finished @theosanderson's task in 1m 13s —— View job

---

Code Review

• Gather context and read changed files
• Review security (XSS concerns with custom HTML)
• Review code quality and implementation
• Review testing coverage
• Post final review

---

Overall the implementation is clean and follows existing patterns in the codebase. There are a few issues to address.

Default text regression (important)

DownloadDialog.tsx:149 — The fallback text 'I agree to the data use terms.' has lost the link to the data use terms page that previously existed. The old code rendered:

I agree to the <a href={routes.datauseTermsPage()}>data use terms</a>.

The new default omits the link entirely. Anyone not supplying a custom agreementHtml will now see unlinked text. The default should either include the link (as inline HTML) or be restored to the original JSX path when dataUseTermsAgreementHtml is undefined.

Fix this →

XSS / dangerouslySetInnerHTML

DownloadDialog.tsx:145-151 — The raw config value is injected directly without sanitization. The Banner.tsx component does the same, so this is consistent with an existing pattern, but it's worth noting: if an attacker can tamper with Helm values (e.g. through a compromised CI or values file), they could inject arbitrary scripts into the download dialog. The project already has sanitize-html installed (used in DataTableEntryValue.tsx). Consider wrapping the value with it, or at minimum documenting in the schema that this is trusted-admin-only HTML and never derived from user input.

Helm template whitespace

_common-metadata.tpl:219 — The opening {{ if ... }} doesn't strip the preceding newline, unlike the {{- end }} below it. This will emit a blank line in the ConfigMap data when agreementHtml is not set (harmless but inconsistent with the style of the rest of the file). Change to {{- if $.Values.dataUseTerms.agreementHtml }}.

Fix this →

Missing test coverage

DownloadDialog.spec.tsx — The test helper was updated to accept dataUseTermsAgreementHtml but no new test cases exercise it. Consider adding:

• A test that confirms custom HTML is rendered when the prop is provided.
• A test that confirms the default text (including the link) is rendered when the prop is absent.

[tombch]

Tested with a custom HTML link and it looks good! My only (tiny) thought was if the agreementHtml should be agreementHTML in the config, in line with the other config variables like welcomeMessageHTML, but not blocking!

[theosanderson]

@theosanderson-agent make the casing change to agreementHTML

[theosanderson-agent]

Renamed agreementHtml → agreementHTML across all 8 files (Helm values schema, template, website config, types, components, and tests). Type checks, tests (31/31), helm lint all pass.

[tombch]

Tested again with agreementHTML and looks good!

[theosanderson]

Thanks for testing again!!

[theosanderson]

I'm just waiting to merge til I have time to prepare a corresponding change to PPX