Enforce the 13+ age requirement with Apple's Declared Age Range API - #25979
Draft
crazytonyli wants to merge 3 commits into
Draft
Enforce the 13+ age requirement with Apple's Declared Age Range API#25979crazytonyli wants to merge 3 commits into
crazytonyli wants to merge 3 commits into
Conversation
Add the `age_requirement_compliance` remote feature flag (defaults off) and the `com.apple.developer.declared-age-range` entitlement to every WordPress and Jetpack build variant, so the app can query Apple's Declared Age Range API once the feature ships.
Run a one-shot age requirement check from the root view transition after the initial UI appears. When the Declared Age Range API reports an age under 13, enforce the restriction: sign out of the WordPress.com account, remove self-hosted sites and their local drafts, present the sign-in UI, and show an explanatory alert. Checks fail open, skip unsupported OS versions, and run at most once. Track every outcome.
Gate both the WordPress.com and self-hosted sign-in paths on the age restriction. Refuse at entry, and re-check right before persisting the account, since the restriction can arrive while a sign-in flow is in progress. A refused sign-in shows the restriction alert and returns without persisting or posting the sign-in completion notification.
Collaborator
Generated by 🚫 Danger |
Contributor
🤖 Build Failure AnalysisThis build has failures. Claude has analyzed them - check the build annotations for details. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR is blocked by
Description
Fixes https://linear.app/a8c/issue/CMM-2393
Apple's Declared Age Range API tells apps which age range the App Store account belongs to, in the regions where age assurance laws apply. Our terms require users to be 13 or older, so the app now asks the API once after launch and refuses under-13 accounts. The feature is behind the
age_requirement_complianceremote flag, which defaults to off.The main changes:
AgeRequirementCoordinatorruns one check per process afterWindowManagerinstalls the signed-in or signed-out root. Only an affirmative under-13 range restricts. Declined sharing, ineligible regions, unsupported OS versions, and API errors all fail open, so this cannot lock out people the law does not cover.AgeRequirementEnforcershows the sign-in UI, removes the sites that have no WordPress.com account, signs out, and presents an alert. The sign-in UI goes first on purpose: the logout notification handler only shows it when it is not already showing, so this order gives one root transition instead of two.Every check outcome is tracked as
age_requirement_check, without the age range itself.Testing instructions
The Simulator cannot exercise the Declared Age Range service, so the check is a no-op there. To test the restriction, use a physical device on iOS 26.2 or later with a sandbox Apple Account whose age assurance is set to under 13 (Settings > Developer > Sandbox Apple Account > Manage > Age Assurance), and enable the remote flag.
Regression tests on both sign-in flows are worth doing, since the persistence points in
WordPressDotComAuthenticatorandSelfHostedSiteAuthenticatorchanged.