glatzert
TOS agreement ist never checked
Neither during account creation nor order creation a TOS agreement is checked.
I noticed that when setting the TOS variable to "true," that the payload contains a TOS key and the URL as the value, however that is all that it does.
Is it meant to do more?
Essentially TOS just forces the client to have -agreeToTOS (or whatever a switch is called in your client). It's little more than including the link in the directory metadata.
Also if TOS are updated, clients are forced to re-Agree to TOS by calling update account with the same switch as above. I'd wager most users aren't aware of the TOS and don't care.
Nevertheless - from the server side, that's a oversight with regards to RFC 8555 compliance.