<?php
/**
 * File Path: includes/helpers/class-mbs-disclosure-renderer.php
 *
 * Affiliate Disclosure Renderer — Story 13-12
 *
 * Renders the configurable affiliate-disclosure notice that appears above
 * buy-button sections on book pages. The text and enabled/disabled state
 * are controlled via General Settings.
 *
 * Options consumed:
 *   mbs_setting_general_disclosure_enabled — '1' | '0', default '0'
 *   mbs_setting_general_disclosure_text    — plain text, default ''
 *
 * Usage (called by buy-link templates / section renderers):
 *   $html = MBS_Disclosure_Renderer::render();
 *   if ( $html ) { echo $html; }
 *
 * When disabled or when no text is saved, render() returns an empty string
 * so callers can branch without extra logic.
 *
 * All output is escaped. The disclosure text is rendered as plain text
 * (esc_html) — HTML markup in the disclosure is intentionally not allowed
 * to prevent XSS via the settings page.
 *
 * @package    My_Book_Showroom
 * @subpackage Includes/Helpers
 * @since      1.0.0
 */

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * Class MBS_Disclosure_Renderer
 */
class MBS_Disclosure_Renderer { // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound -- mbs_/MBS_ prefix is correct; scanner not configured with plugin prefix

	/**
	 * Render the affiliate disclosure notice.
	 *
	 * Returns an empty string when:
	 *   - the disclosure is disabled in General Settings, or
	 *   - the disclosure text is empty.
	 *
	 * @return string Escaped HTML string, or '' when not applicable.
	 */
	public static function render(): string {
		$enabled = get_option( 'mbs_setting_general_disclosure_enabled', '0' );
		if ( '1' !== $enabled ) {
			return '';
		}

		$text = trim( (string) get_option( 'mbs_setting_general_disclosure_text', '' ) );
		if ( '' === $text ) {
			return '';
		}

		return '<p class="mbs-affiliate-disclosure">' . esc_html( $text ) . '</p>';
	}

	/**
	 * Echo the affiliate disclosure notice (convenience wrapper).
	 *
	 * Outputs nothing when not applicable. Callers do not need to check
	 * the return value — a no-op echo is silent.
	 */
	public static function output(): void {
		echo self::render(); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- render() returns fully escaped HTML
	}
}
