Daccess 630 tou link fix

[JeremyDuncan]

Jira Ticket: https://culibrary.atlassian.net/browse/DACCESS-630?atlOrigin=eyJpIjoiZjI1MjA4OWIyNGQwNDk0ZTliZThiNmZkNGEzZDY4ZjEiLCJwIjoiaiJ9

Changes

• Centralized all Terms of Use (TOU) logic into a new TouLookupService, including FOLIO and Solr calls, and updated cached token management.
• Refactored CatalogController#tou/new_tou and DatabasesController#tou/new_tou to use the service instead of inline Solr/FOLIO/ERM logic (and cleaning that helper logic out of the controller).
• Added a new FOLIO-backed /databases/new_tou/:title_id/:id flow and updated database TOU links to prefer it when a titleid is available.
• Extracted shared database/TOU view partials (db_title, db_data, erm_db_result, default_rights_text, table_new_tou_result) to DRY up templates.
• Updated Cucumber TOU feature scenarios to cover both legacy /databases/tou/:id and new /databases/new_tou/:title_id/:id pages.

---

Example Comparison of old TOU and New TOU

New database TOU:
https://catalog-container-int.library.cornell.edu/databases/new_tou/2929539/4478166

Old Generic database TOU:
https://catalog.library.cornell.edu/databases/tou/4478166

[Baroquem]

Really nice refactoring job! Just needs a little more work on the token caching, I think.

[Baroquem]

There's a bit of a problem here. FOLIO actually provides two tokens upon successful authentication: an access token with a fairly short TTL (10 minutes is the default, though I'm not sure if that's what we have) and a refresh token that can be used to fetch a new pair of tokens without sending username and password again (details). So caching it for 45 minutes won't work. (This is the complexity I alluded to in the code comments from the first implementation -- the new expiring token mechanism.)

The CUL::FOLIO::Edge authenticate method provides the access token and the access token expiration time (as :token_exp in the response). It doesn't bother with the refresh token because we figured that all of our FOLIO API interactions in Blacklight and subcomponents are brief and discrete enough to not need an extended session. But that's a choice we could revisit if it seems advisable. For now, the expedient thing to do might be to use the :token_exp value to determine TTL.

[JeremyDuncan]

Thank you for the valuable feedback! 🙏 I'll dive deeper into this and see what I can come up with based on these details.