=== Kennedy Auto Legal Compliance ===
Contributors: anthon1
Tags: privacy policy, GDPR, CCPA, cookie consent, legal pages
Requires at least: 6.0
Tested up to: 6.7
Stable tag: 3.1.0
Requires PHP: 7.4
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Generate Privacy Policy, Terms of Service, and CCPA Do Not Sell pages instantly. Includes GDPR/CCPA cookie banner with consent logging and geo-aware Pro detection.

== Description ==

Kennedy Auto Legal Compliance generates your legal pages in one click from your business profile. No lawyers. No shortcodes. No guessing.

**Free features:**
* Privacy Policy generator (GDPR & CCPA ready, 13 sections)
* Terms of Service generator (17 sections, optional clauses)
* CCPA Do Not Sell page with built-in opt-out form
* Sitewide cookie consent banner (Essential / Analytics / Marketing)
* Google Consent Mode v2 integration
* Template update notifications
* Works with Divi, Elementor, and all WordPress themes

**Pro features ($9/mo or $89/yr):**
* Consent log — every banner interaction recorded with timestamp, choices, hashed IP
* CSV export — full audit-ready log download
* Geo-aware banner — auto-detects EU (GDPR) and California (CCPA) visitors
* Full GTM Consent Mode v2 integration
* Monthly compliance email checklist
* Priority support from Kennedy Media Group

Upgrade to Pro from the Pro tab inside the plugin dashboard widget.

== Installation ==

1. Upload the plugin folder to /wp-content/plugins/ or install via Plugins > Add New.
2. Activate the plugin.
3. Go to your WordPress Dashboard and find the Kennedy Auto Legal Compliance widget.
4. Complete the Setup wizard (5 steps).
5. Click Generate on each document in the Generate tab.

== Frequently Asked Questions ==

= Does the free version work for a real site? =
Yes. The free version generates all three legal pages and provides a sitewide cookie banner with Google Consent Mode v2. No time limit.

= How do I upgrade to Pro? =
Install the free plugin, then open the Pro tab in the dashboard widget and follow the link to kennedymedia.com.

= Will it slow down my site? =
No. Frontend assets load only when the banner is enabled. The banner script is under 10KB and loads in the footer.

= Does it block third-party scripts? =
The plugin signals consent state to Google Consent Mode v2 and the GTM dataLayer. Tags configured to respect consent in GTM will only fire with appropriate consent. Native script blocking for non-GTM tools requires GTM configuration.

== Changelog ==

= 3.1.0 =
* NASA-standard code audit applied across all files.
* Security: Added current_user_can('manage_options') check to all admin AJAX handlers.
* Security: Whitelist validation added for document type, cookie position, consent method, and DNS request type parameters.
* Security: All stored fields now truncated to defined maximum lengths.
* Bug fix: kmgalc_get_page_id() now validates type against whitelist before DB access.
* Bug fix: get_permalink() return value checked for false before casting to string (all call sites).
* Bug fix: wp_update_post() now passes true as second arg to return WP_Error on failure (was silently ignoring update failures).
* Bug fix: Export CSV handler now checks current_user_can() before check_ajax_referer() (correct order).
* Bug fix: DB insert result now checked in kmgalc_log_consent — was always returning success.
* Bug fix: Consent log and total count queries now use $wpdb->prepare() with %i placeholder.
* Bug fix: Cookie banner position value validated against whitelist at both save and render time.
* Bug fix: DNS request type validated against whitelist (opt_out_sale, opt_out_targeted, both).
* Bug fix: DNS requests option capped at 10,000 entries to prevent unbounded option growth.
* Bug fix: kmgalc_shortcode_badge() no longer outputs links for un-generated pages.
* Bug fix: DB table creation skipped when schema is already at current version (performance).
* JS fix: Admin JS wizard now reads from correct #wiz_* field IDs (was reading #prof_* which don't exist).
* JS fix: Generate card lookup now uses data-doc-type attribute (was using :first/:last which broke with 3 cards).
* JS fix: All AJAX calls now have .fail() handlers — network errors are surfaced to the user.
* JS fix: Admin JS now includes kmgalcLoadConsentLog() with full table renderer.
* JS fix: 'website' field was missing from profile save AJAX post.
* Cookie JS fix: logConsent() function added — was entirely missing; consent events now reach the DB.
* Cookie JS fix: All three public actions (accept, reject, preferences) now call logConsent().
* Cookie JS fix: enforceDNSIfSet() added — DNS cookie now enforced on every page load.
* Cookie JS fix: XHR HTTP status now checked before JSON.parse in geo-aware path.
* Cookie JS fix: CONSENT_VER bumped to '3' to invalidate stale v2 consent records.
* Cookie JS fix: Geo-auto silent grants correctly excluded from consent log.
* i18n: All user-visible strings wrapped in __() / esc_html_e() / esc_attr_e().

= 3.0.0 =
* Added CCPA Do Not Sell page generator with [kmg_dns_form] shortcode.
* Added Consent Log DB table with 7-column schema.
* Added Consent Log dashboard tab (Pro) with last-50-events view and CSV export.
* Added Pro: Geo-aware banner using ipapi.co (EU/GDPR + California/CCPA detection).
* Added Pro: GTM Consent Mode v2 full integration.
* Added template version feed check (weekly cron, admin notice).
* Added monthly compliance email cron (Pro).
* Added DNS requests stored in kmgalc_dns_requests option.
* Cookie banner now links to Do Not Sell page when generated.

= 2.5.1 =
* Corrected Pro pricing display ($9/mo, $89/yr).
* Updated Pro tab CTA to point to kennedymedia.com/products/.
* Added support email: support@kennedymedia.com.

= 2.5.0 =
* Removed multisite sync and white-label features (deferred to future release).
* Added 5-step wizard UI for business profile setup.
* Improved cookie banner with category toggles and position options.
