Mr/legal (#439)

* Update application_wizard.py

* Newer, slimmer version of legal content

* Update form section labels

* Updated text for request for info from tribal govs

* Added text to clarify that managing elections should be primary purpose of office

* Added question about audience to align with new requirements

* Fix link in error message, tests and linting

---------

Co-authored-by: Neil Martinsen-Burrell <neil.martinsen-burrell@gsa.gov>

src/registrar/forms/application_wizard.py

@@ -6,6 +6,8 @@ from phonenumber_field.formfields import PhoneNumberField  # type: ignore
 
 from django import forms
 from django.core.validators import RegexValidator
+from django.urls import reverse
+from django.utils.safestring import mark_safe
 
 from api.views import DOMAIN_API_MESSAGES
 
@@ -179,11 +181,19 @@ class TribalGovernmentForm(RegistrarForm):
             self.cleaned_data["federally_recognized_tribe"]
             or self.cleaned_data["state_recognized_tribe"]
         ):
+            todo_url = reverse("todo")
             raise forms.ValidationError(
-                "Only tribes recognized by the U.S. federal government or by a U.S."
+                # no sec because we are using it to include an internal URL
-                " state government are eligible for .gov domains. Please email"
+                # into a link. There should be no user-facing input in the
-                " registrar@dotgov.gov to tell us more about your tribe and why you"
+                # HTML indicated here.
-                " want a .gov domain.",
+                mark_safe(  # nosec
+                    "Only tribes recognized by the U.S. federal government "
+                    "or by a U.S. state government are eligible for .gov "
+                    'domains. Please <a href="{}">tell us more '
+                    "about your tribe and why you want a .gov domain</a>.".format(
+                        todo_url
+                    )
+                ),
                 code="invalid",
             )
 
@@ -682,14 +692,11 @@ class AnythingElseForm(RegistrarForm):
 
 class RequirementsForm(RegistrarForm):
     is_policy_acknowledged = forms.BooleanField(
-        label=(
+        label=("I read and agree to the requirements for operating .gov domains."),
-            "I read and agree to the requirements for registering "
-            "and operating .gov domains."
-        ),
         error_messages={
             "required": (
                 "Check the box if you read and agree to the requirements for"
-                " registering and operating .gov domains."
+                " operating .gov domains."
             )
         },
     )

src/registrar/templates/application_org_election.html

@@ -5,6 +5,7 @@
   <h2 class="margin-bottom-05">
     Is your organization an election office?
   </h2>
+<p>Answer “yes” if the primary purpose of your organization is to manage elections.</p>
 {% endblock %}
 
 
@@ -12,4 +13,4 @@
   {% with add_class="usa-radio__input--tile" %}
     {% input_with_errors forms.0.is_election_board %}
   {% endwith %}
-{% endblock %}
+{% endblock %}

src/registrar/templates/application_purpose.html

@@ -2,14 +2,13 @@
 {% load field_helpers %}
 
 {% block form_instructions %}
-  <p>.Gov domain names are intended for use on the internet. They should be registered
+  <p>.Gov domain names are for use on the internet. Don’t register a .gov to simply reserve a 
-  with an intent to deploy services, not simply to reserve a name. .Gov domains should
+domain name or for mainly internal use.</p>
-  not be registered for primarily internal use.</p>
 
-  <p>Describe the reason for your domain request. Explain how you plan to use this
+  <p>Describe the reason for your domain request. Explain how you plan to use this domain. 
-  domain. Will you use it for a website and/or email? Are you moving your website from
+Who is your intended audience? Will you use it for a website and/or email? Are you moving 
-  another top-level domain (like .com or .org)? Read about <a href="{% url 'todo' %}">activities that
+your website from another top-level domain (like .com or .org)? 
-  are prohibited on .gov domains.</a></p>
+Read about <a href="{% url 'todo' %}">activities that are prohibited on .gov domains.</a></p>
 {% endblock %}
 
 
@@ -17,4 +16,4 @@
     {% with attr_maxlength=500 %}
       {% input_with_errors forms.0.purpose %}
     {% endwith %}
-{% endblock %}
+{% endblock %}

src/registrar/templates/application_requirements.html

@@ -2,55 +2,44 @@
 {% load field_helpers %}
 
 {% block form_instructions %}
-  <p>The .gov domain exists to support a broad diversity of government missions and
+  <p>Please read this page. Check the box at the bottom to show that you agree to the requirements for operating .gov domains.</p>
-  public initiatives. Generally, the .gov registry does not review or audit how
+<p>The .gov domain space exists to support a broad diversity of government missions. Generally, we don’t examine how government organizations use their domains. However, misuse of a .gov domain can reflect upon the integrity of the entire .gov space. There are categories of misuse that are statutorily prohibited or abusive in nature.</p>
-  government organizations use their domains. However, misuse of an individual .gov
-  domain can reflect upon the integrity of the entire .gov space. There are categories
-  of misuse that are statutorily prohibited or abusive in nature.</p>
 
-  <h2>Prohibited activities for .gov domains</h2>
 
-  <h3>Commercial purposes </h3>
+  <h2>What you can’t do with .gov domains</h2>
 
-  <p>A .gov domain must not be used for commercial purposes, such as advertising
+  <h3>Commercial purposes</h3>
-  benefitting private individuals or entities.</p>
+
+  <p>.Gov domains must not be used for commercial purposes, such as advertising that benefits private individuals or entities.</p>
 
   <h3>Political campaigns</h3>
 
-  <p>A .gov domain must not be used for political campaigns.</p>
+  <p>.Gov domains must not be used for political campaigns.</p>
 
   <h3>Illegal content</h3>
 
-  <p>A .gov domain must not be used to distribute or promote material whose distribution
+  <p>.Gov domains must not be used to distribute or promote material whose distribution violates applicable law.</p>
-  violates applicable law.</p>
 
   <h3>Malicious cyber activity </h3>
 
   <p>.Gov is a trusted and safe space. .Gov domains must not distribute malware, host
   open redirects, or otherwise engage in malicious cyber activity.</p>
 
-  <h2>Required activities for .gov domain registrants </h2>
+  <h2>What .gov domain registrants must do</h2>
 
   <h3>Keep your contact information updated</h3>
 
-  <p>As a .gov domain registrant, maintain current and accurate contact information in the
+  <p>.Gov domain registrants must maintain accurate contact information in the .gov registrar.</p>
-  .gov registrar. We strongly recommend that you create and use a security contact.</p>
 
   <h3>Be responsive if we contact you</h3>
 
-  <p>Registrants should respond in a timely manner to communications about required and
+  <p>Registrants should respond promptly to communications about potential violations to these requirements.</p>
-  prohibited activities.</p>
 
-  <h2>Domains can be suspended or terminated for violations</h2>
+  <h2>Failure to comply with these requirements could result in domain suspension or termination</h2>
 
-  <p>The .gov program may need to suspend or terminate a domain registration for
+  <p>We may need to suspend or terminate a domain registration for violations. When we discover a violation, we’ll make reasonable efforts to contact a registrant, including:
-  violations. Registrants should respond in a timely manner to communications about
-  prohibited activities.</p>
-
-  <p>When we discover a violation, we will make reasonable efforts to contact a
-  registrant, including:
     <ul class="usa-list"> 
-      <li>Emails to domain contacts </li>
+      <li>Emails to domain contacts</li>
       <li>Phone calls to domain contacts</li>
       <li>Email or phone call to the authorizing official</li>
       <li>Emails or phone calls to the government organization, a parent organization,
@@ -58,130 +47,9 @@
     </ul>
   </p>
 
-  <p>We understand the critical importance of the availability of .gov domains.
+  <p>We understand the critical importance of the availability of .gov domains. Suspending or terminating a .gov domain is reserved for prolonged, unresolved, serious violations where the registrant is non-responsive. We'll make extensive efforts to contact registrants and to identify potential solutions. We'll make reasonable accommodations for remediation timelines based on the severity of the issue.</p>
-  Suspending or terminating a .gov domain is reserved only for prolonged, unresolved
-  serious violations where the registrant is non-responsive. We will make extensive
-  efforts to contact registrants and to identify potential solutions, and will make
-  reasonable accommodations for remediation timelines proportional to the severity of
-  the issue.</p>
-
-  <h2>Requirements for authorizing officials</h2>
-
-  <p>Your authorizing official is the person within your organization who can authorize
-  your domain request. This is generally the highest ranking or highest elected official
-  in your organization.</p>
-
-  <h3>Executive branch federal agencies</h3>
-
-  <p>Domain requests from executive branch agencies must be authorized by CIOs or agency
-  heads.</p> 
-
-  <p>Domain requests from executive branch agencies are subject to guidance issued by
-  the U.S. Office of Management and Budget.</p>
-
-  <h3>Judicial branch federal agencies</h3>
-
-  <p>Domain requests for judicial branch agencies, except the U.S. Supreme Court, must
-  be authorized by the director or CIO of the Administrative Office (AO) of the United
-  States Courts.</p>
-
-  <p>Domain requests from the U.S. Supreme Court must be authorized by the director of
-  information technology for the U.S. Supreme Court.</p>
-
-  <h3>Legislative branch federal agencies</h3>
-
-  <h4>U.S. Senate</h4>
-
-  <p>Domain requests from the U.S. Senate must come from the Senate Sergeant at Arms.</p>
-
-  <h4>U.S. House of Representatives</h4>
-
-  <p>Domain requests from the U.S. House of Representatives must come from the House
-  Chief Administrative Officer.</p>
-
-  <h4>Other legislative branch agencies</h4>
-
-  <p>Domain requests from legislative branch agencies must come from the agency’s head
-  or CIO.</p>
-
-  <p>Domain requests from legislative commissions must come from the head of the
-  commission, or the head or CIO of the parent agency, if there is one.</p>
-
-  <h3>Interstate</h3>
-
-  <p>Domain requests from interstate organizations must be authorized by the
-  highest-ranking executive (president, director, chair, or equivalent) or one of the
-  state’s governors or CIOs.</p>
-
-  <h3>U.S. states and territories</h3>
-
-  <h4>States and territories: executive branch</h4>
-
-  <p>Domain requests from states and territories must be authorized by the governor or
-  the state CIO.</p>
-
-  <h4>States and territories: judicial and legislative branches</h4>
-
-  <p>Domain requests from state legislatures and courts must be authorized by an
-  agency’s CIO or highest-ranking executive.</p>
-
-  <h3>Tribal governments</h3>
-
-  <p>Domain requests from federally-recognized tribal governments must be authorized by
-  tribal chiefs as noted by the
-  <a href="https://www.bia.gov/service/tribal-leaders-directory">Bureau of Indian
-  Affairs</a>.</p>
-
-  <h3>Counties</h3>
-
-  <p>Domain requests from counties must be authorized by the chair of the county
-  commission or the equivalent highest elected official.</p>
-
-  <h3>Cities</h3>
-
-  <p>Domain requests from cities must be authorized by the mayor or the equivalent
-  highest elected official.</p>
-
-  <h3>Special districts</h3>
-
-  <p>Domain requests from special districts must be authorized by the highest-ranking
-  executive (president, director, chair, or equivalent) or state CIOs for state-based
-  organizations.</p>
-
-  <h3>School districts</h3>
-
-  <p>Domain requests from school district governments must be authorized by the highest-ranking
-  executive (the chair of a school district’s board or a superintendent).</p>
-
-  <h2>Requirements for .gov domain names</h2>
-
-  <p>.Gov domains must:
-    <ul class="usa-list"> 
-      <li>Be available</li>
-      <li>Be unique</li>
-      <li>Relate to your organization’s name, location, and/or services</li>
-      <li>Be clear to the general public. Your domain name must not be easily confused
-        with other organizations.</li>
-    </ul>
-  </p>
-
-  <h2>HSTS preloading</h2>
-
-  <p>The .gov program will preload all newly registered .gov domains for HTTP Strict
-  Transport Security (HSTS).</p> 
-
-  <p>HSTS is a simple and widely-supported standard that protects visitors by ensuring
-  that their browsers always connect to a website over HTTPS. HSTS removes the need to
-  redirect users from http:// to https:// URLs. (This redirection is a security risk
-  that HSTS eliminates.)</p>
-
-  <p>HSTS preloading impacts web traffic only. Once a domain is on the HSTS preload
-  list, modern web browsers will enforce HTTPS connections for all websites hosted on
-  the .gov domain. Users will not be able to click through warnings to reach a site.
-  Non-web uses of .gov (email, VPN, APIs, etc.) are not affected.</p>
 {% endblock %}
 
-
 {% block form_fields %}
     <fieldset class="usa-fieldset">
       <legend>
@@ -191,4 +59,4 @@
       {% input_with_errors forms.0.is_policy_acknowledged %}
 
     </fieldset>
-{% endblock %}
+{% endblock %}

src/registrar/templates/includes/form_errors.html

@@ -1,23 +1,14 @@
 {% comment %}
-Commenting the code below to turn off the error because 
+This only shows non-field errors at the top of form pages.
-we are showing the caution dialog instead. But saving in 
+The individual field errors are not shown at the top of the
-case we want to revert this. 
+page, they are shown on each individual field.
+{% endcomment %}
 {% if form.errors %}
-{% for error in form.non_field_errors %}
+  {% for error in form.non_field_errors %}
     <div class="usa-alert usa-alert--error usa-alert--slim margin-bottom-2">
     <div class="usa-alert__body">
     {{ error|escape }}
     </div>
     </div>
   {% endfor %}
-  {% for field in form %}
-    {% for error in field.errors %}
-      <div class="usa-alert usa-alert--error usa-alert--slim margin-bottom-2">
-        <div class="usa-alert__body">
-          {{ error|escape }}
-        </div>
-      </div>
-    {% endfor %}
-  {% endfor %}
 {% endif %}
-{% endcomment %}

src/registrar/tests/test_forms.py

@@ -123,7 +123,7 @@ class TestFormValidation(TestCase):
             form.errors["is_policy_acknowledged"],
             [
                 "Check the box if you read and agree to the requirements for"
-                " registering and operating .gov domains."
+                " operating .gov domains."
             ],
         )
 
@@ -134,7 +134,7 @@ class TestFormValidation(TestCase):
             form.errors["is_policy_acknowledged"],
             [
                 "Check the box if you read and agree to the requirements for"
-                " registering and operating .gov domains."
+                " operating .gov domains."
             ],
         )
 
@@ -145,7 +145,7 @@ class TestFormValidation(TestCase):
         )
         self.assertTrue(
             any(
-                "Please email registrar@dotgov.gov" in error
+                "tell us more about your tribe" in error
                 for error in form.non_field_errors()
             )
         )

src/registrar/views/application.py

@@ -77,16 +77,14 @@ class ApplicationWizard(LoginRequiredMixin, TemplateView):
         Step.ORGANIZATION_CONTACT: _("Organization name and mailing address"),
         Step.TYPE_OF_WORK: _("Type of work"),
         Step.AUTHORIZING_OFFICIAL: _("Authorizing official"),
-        Step.CURRENT_SITES: _("Organization website"),
+        Step.CURRENT_SITES: _("Current website for your organization"),
         Step.DOTGOV_DOMAIN: _(".gov domain"),
         Step.PURPOSE: _("Purpose of your domain"),
         Step.YOUR_CONTACT: _("Your contact information"),
         Step.OTHER_CONTACTS: _("Other employees from your organization"),
         Step.NO_OTHER_CONTACTS: _("No other employees from your organization?"),
         Step.ANYTHING_ELSE: _("Anything else we should know?"),
-        Step.REQUIREMENTS: _(
+        Step.REQUIREMENTS: _("Requirements for operating .gov domains"),
-            "Requirements for registration and operation of .gov domains"
-        ),
         Step.REVIEW: _("Review and submit your domain request"),
     }