#!/usr/bin/env bash
set -euo pipefail
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
TERMS="$ROOT/status/legal/terms/index.html"
PRIVACY="$ROOT/status/legal/privacy/index.html"
TOS_ALIAS="$ROOT/status/legal/tos/index.html"
require() { grep -Eqi "$2" "$1" || { echo "Missing required content in $1: $2" >&2; exit 1; }; }
test -s "$TERMS" && test -s "$PRIVACY" && test -s "$TOS_ALIAS"
for section in 'License grant' 'Acceptable use' 'best-effort' 'Refund policy' 'Termination' 'Limitation of liability' 'Governing law'; do require "$TERMS" "$section"; done
require "$TERMS" 'within 14 calendar days'
for section in 'GDPR' 'lawful bases' 'Stripe' 'Tailscale' 'data portability|portability' '30 days after cancellation' 'privacy@sami-ahmed.net'; do require "$PRIVACY" "$section"; done
# Reject any SOC 2 / HIPAA compliance claims (the launch explicitly excludes them).
# Negated `! grep` does not trigger errexit under `set -e` (ShellCheck SC2251), so use an
# explicit if/then to make the forbidden-claim guard actually fail the script.
# Regex covers: SOC 2 / SOC-2 / SOC2 + (certified|compliant|compliance|compliant),
# HIPAA + (certified|compliant|compliance|compliant), with optional hyphen.
if grep -Eqi 'SOC[ -]?2[[:space:]-]+(certified|compliant|compliance)|HIPAA[[:space:]-]+(certified|compliant|compliance)' "$TERMS" "$PRIVACY"; then
  echo "Forbidden SOC 2/HIPAA compliance language detected in Terms or Privacy pages." >&2
  exit 1
fi
require "$ROOT/status/index.html" 'href="/legal/terms"'
require "$ROOT/status/index.html" 'href="/legal/privacy"'
require "$TOS_ALIAS" 'url=/legal/terms'
echo 'Legal page sanity checks passed.'