Add upload agreement to project submission workflow. Ref #1324

physionet-django/console/test_views.py

@@ -19,6 +19,7 @@
     PublishedProject,
     StorageRequest,
     SubmissionStatus,
+    UploadAgreement
 )
 from user.models import User
 from physionet.models import FrontPageButton, StaticPage
@@ -390,7 +391,6 @@ def get_project():
         project.refresh_from_db()
         self.assertTrue(project.is_publishable())
 
-
     def test_publish(self):
         """
         Test publishing project
@@ -502,6 +502,17 @@ def test_publish_with_versions(self):
             response = self.client.post(
                 reverse('new_project_version', args=(self.PROJECT_SLUG,)),
                 data={'version': version})
+
+            # Create upload agreement for the new project version
+            new_project = ActiveProject.objects.get(title=self.PROJECT_TITLE, version=version)
+            submitting_author = new_project.authors.get(is_submitting=True)
+            UploadAgreement.objects.create(
+                project=new_project,
+                accepted_by=submitting_author.user,
+                accepted=True,
+                no_human_subjects=True
+            )
+
             self.test_publish()
 
         # Sort the list of version numbers

physionet-django/notification/models.py

@@ -2,7 +2,7 @@
 
 from django.db import models
 
-from project.models import SafeHTMLField
+from project.modelcomponents.fields import SafeHTMLField
 
 
 class News(models.Model):

physionet-django/physionet/models.py

@@ -1,6 +1,6 @@
 from django.db import models
 from django.db import transaction
-from project.models import SafeHTMLField
+from project.modelcomponents.fields import SafeHTMLField
 from storages.backends.gcloud import GoogleCloudStorage
 
 

physionet-django/project/admin.py

@@ -81,6 +81,30 @@ def get_queryset(self, request):
         return super().get_queryset(request).select_related('user').prefetch_related('project')
 
 
+class UploadAgreementAdmin(admin.ModelAdmin):
+    list_display = ('project', 'accepted', 'accepted_datetime', 'created_datetime')
+    list_filter = ('accepted', 'no_human_subjects', 'derived_data', 'human_subjects_deidentified')
+    search_fields = ('project__title', 'project__slug')
+    readonly_fields = ('created_datetime', 'updated_datetime')
+
+    fieldsets = (
+        ('Project Information', {
+            'fields': ('project',)
+        }),
+        ('Agreement Status', {
+            'fields': ('accepted', 'accepted_datetime')
+        }),
+        ('Data Type Options', {
+            'fields': ('no_human_subjects', 'derived_data', 'human_subjects_deidentified'),
+            'description': 'At least one option must be selected.'
+        }),
+        ('Timestamps', {
+            'fields': ('created_datetime', 'updated_datetime'),
+            'classes': ('collapse',)
+        }),
+    )
+
+
 # Unregister the tasks to add the custom tasks to the amdin page
 admin.site.unregister(Task)
 admin.site.unregister(CompletedTask)
@@ -115,3 +139,4 @@ def get_queryset(self, request):
 # Add the custom tasks to the admin page
 admin.site.register(Task, TaskAdmin)
 admin.site.register(CompletedTask, CompletedTaskAdmin)
+admin.site.register(models.UploadAgreement, UploadAgreementAdmin)

physionet-django/project/fixtures/demo-project.json

@@ -2293,5 +2293,110 @@
     "object_id": 1,
     "document": "ethics/Ethics_Approval_567b029d-9ea6-41b8-b738-bf45675b24ce.txt"
   }
+},
+{
+  "model": "project.uploadagreement",
+  "pk": 1,
+  "fields": {
+    "project": 1,
+    "accepted_by": 2,
+    "accepted": true,
+    "accepted_datetime": "2018-09-04T17:26:24.820Z",
+    "no_human_subjects": true,
+    "derived_data": false,
+    "human_subjects_deidentified": false,
+    "created_datetime": "2018-09-04T17:26:24.820Z",
+    "updated_datetime": "2018-09-04T17:26:24.820Z"
+  }
+},
+{
+  "model": "project.uploadagreement",
+  "pk": 2,
+  "fields": {
+    "project": 2,
+    "accepted_by": 2,
+    "accepted": true,
+    "accepted_datetime": "2018-09-04T17:26:24.820Z",
+    "no_human_subjects": true,
+    "derived_data": false,
+    "human_subjects_deidentified": false,
+    "created_datetime": "2018-09-04T17:26:24.820Z",
+    "updated_datetime": "2018-09-04T17:26:24.820Z"
+  }
+},
+{
+  "model": "project.uploadagreement",
+  "pk": 3,
+  "fields": {
+    "project": 4,
+    "accepted_by": 4,
+    "accepted": true,
+    "accepted_datetime": "2018-09-04T17:26:24.820Z",
+    "no_human_subjects": true,
+    "derived_data": false,
+    "human_subjects_deidentified": false,
+    "created_datetime": "2018-09-04T17:26:24.820Z",
+    "updated_datetime": "2018-09-04T17:26:24.820Z"
+  }
+},
+{
+  "model": "project.uploadagreement",
+  "pk": 4,
+  "fields": {
+    "project": 5,
+    "accepted_by": 4,
+    "accepted": true,
+    "accepted_datetime": "2018-09-04T17:26:24.820Z",
+    "no_human_subjects": true,
+    "derived_data": false,
+    "human_subjects_deidentified": false,
+    "created_datetime": "2018-09-04T17:26:24.820Z",
+    "updated_datetime": "2018-09-04T17:26:24.820Z"
+  }
+},
+{
+  "model": "project.uploadagreement",
+  "pk": 5,
+  "fields": {
+    "project": 7,
+    "accepted_by": 4,
+    "accepted": true,
+    "accepted_datetime": "2018-09-04T17:26:24.820Z",
+    "no_human_subjects": true,
+    "derived_data": false,
+    "human_subjects_deidentified": false,
+    "created_datetime": "2018-09-04T17:26:24.820Z",
+    "updated_datetime": "2018-09-04T17:26:24.820Z"
+  }
+},
+{
+  "model": "project.uploadagreement",
+  "pk": 6,
+  "fields": {
+    "project": 8,
+    "accepted_by": 1,
+    "accepted": true,
+    "accepted_datetime": "2018-09-04T17:26:24.820Z",
+    "no_human_subjects": true,
+    "derived_data": false,
+    "human_subjects_deidentified": false,
+    "created_datetime": "2018-09-04T17:26:24.820Z",
+    "updated_datetime": "2018-09-04T17:26:24.820Z"
+  }
+},
+{
+  "model": "project.uploadagreement",
+  "pk": 7,
+  "fields": {
+    "project": 9,
+    "accepted_by": 1,
+    "accepted": true,
+    "accepted_datetime": "2018-09-04T17:26:24.820Z",
+    "no_human_subjects": true,
+    "derived_data": false,
+    "human_subjects_deidentified": false,
+    "created_datetime": "2018-09-04T17:26:24.820Z",
+    "updated_datetime": "2018-09-04T17:26:24.820Z"
+  }
 }
 ]

physionet-django/project/forms.py

@@ -39,6 +39,7 @@
     Topic,
     exists_project_slug,
     UploadedDocument,
+    UploadAgreement,
 )
 from user.models import User, TrainingType
 from user.validators import validate_affiliation
@@ -98,6 +99,10 @@ def transfer(self):
         new_author.is_submitting = True
         new_author.save()
 
+        # Invalidate any existing upload agreements since the submitting author changed
+        # The new submitting author will need to accept a new agreement
+        self.project.upload_agreements.filter(accepted=True).update(accepted=False)
+
 
 class ActiveProjectFilesForm(forms.Form):
     """
@@ -1163,7 +1168,6 @@ class Meta:
             'responder_comments': forms.Textarea(attrs={'rows': 3}),
             'status': forms.Select(choices=DataAccessRequest.REJECT_ACCEPT)
         }
-
         labels = {
             'status': 'Decision',
             'responder_comments': 'Comment or Justification'
@@ -1196,6 +1200,69 @@ def __init__(self, responder, *args, **kwargs):
         self.responder = responder
 
 
+class UploadAgreementForm(forms.ModelForm):
+    """
+    Form for accepting the upload agreement
+    """
+    class Meta:
+        model = UploadAgreement
+        fields = (
+            'no_human_subjects',
+            'derived_data',
+            'human_subjects_deidentified',
+        )
+        labels = {
+            'no_human_subjects': (
+                'This project does not contain any data derived from human subjects.'
+            ),
+            'derived_data': (
+                'This project contains data derived from other de-identified datasets '
+                f'published on {settings.SITE_NAME} or elsewhere.'
+            ),
+            'human_subjects_deidentified': (
+                'This project contains data obtained from human subjects, and all '
+                'personally identifiable information has been removed.'
+            ),
+        }
+        help_texts = {
+            'derived_data': (
+                'You will need to cite these datasets in your project description, '
+                'and explain how you created the derived data. Even if you are using '
+                'data previously published elsewhere, we expect you to take all '
+                'reasonable steps to ensure the files you are uploading are free of '
+                'personally identifiable information.'
+            ),
+        }
+
+    def __init__(self, project, user=None, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.project = project
+        self.user = user
+
+    def clean(self):
+        cleaned_data = super().clean()
+
+        # At least one checkbox must be selected
+        if not any([
+            cleaned_data.get('no_human_subjects'),
+            cleaned_data.get('derived_data'),
+            cleaned_data.get('human_subjects_deidentified'),
+        ]):
+            raise forms.ValidationError(
+                'Please select at least one option that applies to your project.'
+            )
+
+        return cleaned_data
+
+    def save(self):
+        agreement = super().save(commit=False)
+        agreement.project = self.project
+        agreement.accepted = True
+        agreement.accepted_by = self.user
+        agreement.save()
+        return agreement
+
+
 class InviteDataAccessReviewerForm(forms.ModelForm):
     reviewer = forms.CharField(widget=forms.TextInput(
         attrs={'class': 'form-control'}),

physionet-django/project/migrations/0086_uploadagreement_and_more.py

@@ -0,0 +1,71 @@
+# Generated by Django 4.2.22 on 2025-08-29 01:59
+
+from django.db import migrations, models
+import django.db.models.deletion
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('project', '0085_activeproject_georestricted_and_more'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='UploadAgreement',
+            fields=[
+                ('id', models.AutoField(
+                    auto_created=True, primary_key=True, serialize=False,
+                    verbose_name='ID'
+                )),
+                ('accepted', models.BooleanField(
+                    default=False,
+                    help_text='Whether the upload agreement has been accepted'
+                )),
+                ('accepted_datetime', models.DateTimeField(
+                    blank=True,
+                    help_text='When the upload agreement was accepted',
+                    null=True
+                )),
+                ('no_human_subjects', models.BooleanField(
+                    default=False,
+                    help_text='This project does not contain any data derived from human subjects'
+                )),
+                ('derived_data', models.BooleanField(
+                    default=False,
+                    help_text='This project contains data derived from other de-identified datasets'
+                )),
+                ('human_subjects_deidentified', models.BooleanField(
+                    default=False,
+                    help_text=(
+                        'This project contains data obtained from human subjects, and all '
+                        'personally identifiable information has been removed'
+                    )
+                )),
+                ('created_datetime', models.DateTimeField(auto_now_add=True)),
+                ('updated_datetime', models.DateTimeField(auto_now=True)),
+                ('project', models.ForeignKey(
+                    on_delete=django.db.models.deletion.CASCADE,
+                    related_name='upload_agreements',
+                    to='project.activeproject'
+                )),
+            ],
+            options={
+                'verbose_name': 'Upload Agreement',
+                'verbose_name_plural': 'Upload Agreements',
+                'db_table': 'project_uploadagreement',
+            },
+        ),
+        migrations.AddConstraint(
+            model_name='uploadagreement',
+            constraint=models.CheckConstraint(
+                check=models.Q(
+                    ('no_human_subjects', True),
+                    ('derived_data', True),
+                    ('human_subjects_deidentified', True),
+                    _connector='OR'
+                ),
+                name='at_least_one_data_type_selected'
+            ),
+        ),
+    ]

physionet-django/project/migrations/0087_add_accepted_by_to_uploadagreement.py

@@ -0,0 +1,25 @@
+# Generated by Django 4.2.22 on 2025-09-02 18:06
+
+from django.conf import settings
+from django.db import migrations, models
+import django.db.models.deletion
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+        ('project', '0086_uploadagreement_and_more'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='uploadagreement',
+            name='accepted_by',
+            field=models.ForeignKey(blank=True,
+                                    help_text='The user who accepted this upload agreement',
+                                    null=True,
+                                    on_delete=django.db.models.deletion.CASCADE,
+                                    to=settings.AUTH_USER_MODEL),
+        ),
+    ]