<?php
/**
 * Plugin settings: the sanitized `adpriva_settings` option plus typed accessors.
 *
 * This is separate from `adpriva_connection` (which holds OAuth tokens). The option
 * is registered with the WordPress Settings API; sanitize() is a pure function so it
 * is unit-testable without a database. The endpoint accessors implement
 * "a wp-config constant always wins over a Settings override".
 *
 * @package AdPriva
 */

declare( strict_types=1 );

defined( 'ABSPATH' ) || exit;

/**
 * Owns the adpriva_settings option, its Settings API registration, and accessors.
 */
class Adpriva_Config {

	const OPTION       = 'adpriva_settings';
	const OPTION_GROUP = 'adpriva_settings_group';
	const PAGE         = 'adpriva-settings';

	/**
	 * Canonical defaults. Bool fields default to the "fresh install" state; on save,
	 * an absent checkbox is stored as false (see sanitize()). sanitize() rebuilds the
	 * option from these keys only, so a key a newer version dropped (1.0.x's
	 * consent_mode) is ignored on read and removed by the next Settings save. The
	 * tag's consent mode (tag#138) is a NEW key, tag_consent_mode, so a leftover
	 * 1.0.x consent_mode value (always|respect_filter) can never be read as one.
	 * The consent default is `manual` (wordpress-plugin#42): nothing is collected
	 * until the site grants consent. Only an upgrade from 1.3.x is pinned to an
	 * explicit `off` (see migrate_consent_default()).
	 *
	 * @var array<string, mixed>
	 */
	const DEFAULTS = array(
		'tag_post_types'         => 'all',
		'tag_exclude_logged_in'  => false,
		'tag_exclude_admins'     => false,
		'tag_exclude_urls'       => '',
		'tag_consent_mode'       => 'manual',
		'tag_didomi_vendor'      => '',
		'tag_didomi_purposes'    => '',
		'tag_consent_legacy_off' => false,
		'show_dashboard_widget'  => true,
		'default_date_range'     => '30d',
		'api_base'               => '',
		'console_url'            => '',
		'tag_url'                => '',
	);

	/**
	 * The tag's consent modes (AdPriva/tag#138, Didomi in tag#165), rendered as
	 * data-consent-mode, in the order the console offers them.
	 *
	 * @var array<int, string>
	 */
	const CONSENT_MODES = array( 'manual', 'didomi', 'tcf', 'off' );

	/**
	 * Mode used for a missing, unknown or unusable value. Never `off`.
	 */
	const DEFAULT_CONSENT_MODE = 'manual';

	/**
	 * The tag rejects this placeholder from its README, so the console and the
	 * plugin do too (console tag-snippet.ts DIDOMI_PURPOSE_PLACEHOLDER).
	 */
	const DIDOMI_PURPOSE_PLACEHOLDER = 'YOUR_ADPRIVA_PURPOSE_ID';

	/**
	 * Set once the 1.3.2 consent-default migration has run.
	 */
	const MIGRATED_OPTION = 'adpriva_consent_default_migrated';

	const CONSENT_DOCS_URL = 'https://docs.adpriva.com/developer-docs/tag-installation/#consent-modes';

	/**
	 * Built-in tag script URL (AdPriva/infrastructure#27). Loaded from this host, the
	 * tag sends to ingest.adpriva.com. The legacy cdn.adpriva-ads.com/tag.js (which
	 * sends to server.adpriva-ads.com) stays live for a Tag script URL override or an
	 * ADPRIVA_TAG_URL constant.
	 *
	 * @var string
	 */
	const DEFAULT_TAG_URL = 'https://cdn.adpriva.com/tag.js';

	/**
	 * Map of override key => the wp-config constant that pins (and overrides) it.
	 *
	 * @var array<string, string>
	 */
	const ENDPOINT_CONSTANTS = array(
		'api_base'    => 'ADPRIVA_API_BASE',
		'console_url' => 'ADPRIVA_CONSOLE_URL',
		'tag_url'     => 'ADPRIVA_TAG_URL',
	);

	/**
	 * Register hooks (Settings API registration runs on admin_init).
	 *
	 * @return void
	 */
	public function hooks() {
		add_action( 'admin_init', array( __CLASS__, 'register' ) );
		add_action( 'admin_notices', array( __CLASS__, 'notice_legacy_off' ) );
	}

	/**
	 * One-time upgrade step for the 1.3.2 consent default (wordpress-plugin#42).
	 *
	 * Before 1.3.2 a site that never saved the setting ran on `off`. The default is
	 * now `manual`, which would silently stop that site's data. So the first time this
	 * runs, a CONNECTED site with no stored mode is pinned to an explicit `off` and
	 * flagged for the admin notice. A fresh install, or a site that connects later,
	 * is not touched and resolves to `manual`.
	 *
	 * @return void
	 */
	public static function migrate_consent_default() {
		if ( get_option( self::MIGRATED_OPTION, false ) ) {
			return;
		}
		$stored = get_option( self::OPTION, array() );
		$stored = is_array( $stored ) ? $stored : array();
		if ( Adpriva_Tokens::is_connected() && ! array_key_exists( 'tag_consent_mode', $stored ) ) {
			$stored['tag_consent_mode']       = 'off';
			$stored['tag_consent_legacy_off'] = true;
			update_option( self::OPTION, $stored );
		}
		update_option( self::MIGRATED_OPTION, '1' );
	}

	/**
	 * Admin notice for a site upgraded onto an implicit `off`. It ends when the owner
	 * saves the Settings page (sanitize() resets the flag).
	 *
	 * @return void
	 */
	public static function notice_legacy_off() {
		if ( ! current_user_can( 'manage_options' ) || ! self::get( 'tag_consent_legacy_off' ) || 'off' !== self::tag_consent_mode() ) {
			return;
		}
		$url = admin_url( 'admin.php?page=' . self::PAGE );
		printf(
			'<div class="notice notice-warning"><p>%1$s <a href="%2$s">%3$s</a></p></div>',
			esc_html__( 'AdPriva is collecting before visitor consent: this site was set to Off when the plugin was updated. Choose Manual, TCF or Didomi so nothing is collected until consent is given.', 'adpriva' ),
			esc_url( $url ),
			esc_html__( 'Choose a consent mode', 'adpriva' )
		);
	}

	/**
	 * What is wrong with the Didomi inputs, keyed vendor|purposes. Empty when both
	 * are usable. Same rules as the console (tag-snippet.ts validateDidomi()).
	 *
	 * @param string $vendor   Custom vendor id, starts with c:.
	 * @param string $purposes Comma-separated purpose ids.
	 * @return array<string, string>
	 */
	public static function validate_didomi( $vendor, $purposes ) {
		$errors = array();
		$v      = trim( (string) $vendor );
		if ( 0 !== strpos( $v, 'c:' ) || ! preg_match( '/^[A-Za-z0-9._-]+$/', substr( $v, 2 ) ) ) {
			$errors['vendor'] = __( 'Enter the custom vendor ID from the Didomi Console. It starts with c:', 'adpriva' );
		}
		$list = self::purpose_list( (string) $purposes );
		if ( empty( $list ) ) {
			$errors['purposes'] = __( 'Enter at least one purpose ID from the Didomi Console.', 'adpriva' );
		} elseif ( in_array( strtolower( self::DIDOMI_PURPOSE_PLACEHOLDER ), array_map( 'strtolower', $list ), true ) ) {
			$errors['purposes'] = __( 'Replace the placeholder with the purpose ID you created in Didomi.', 'adpriva' );
		} else {
			foreach ( $list as $id ) {
				if ( ! preg_match( '/^[A-Za-z0-9._-]+$/', $id ) ) {
					$errors['purposes'] = __( 'Purpose IDs use letters, digits, dots, hyphens and underscores only.', 'adpriva' );
					break;
				}
			}
		}
		return $errors;
	}

	/**
	 * Comma-separated ids, trimmed, empties dropped.
	 *
	 * @param string $purposes Raw list.
	 * @return array<int, string>
	 */
	private static function purpose_list( $purposes ) {
		$out = array();
		foreach ( explode( ',', $purposes ) as $id ) {
			$id = trim( $id );
			if ( '' !== $id ) {
				$out[] = $id;
			}
		}
		return $out;
	}

	/**
	 * The attributes the tag's <script> carries for the active consent mode, in the
	 * order the console prints them (console tag-snippet.ts), minus `async`, `src`
	 * and the id, which WordPress owns.
	 *
	 * @return array<string, string>
	 */
	public static function consent_attributes() {
		$mode = self::tag_consent_mode();
		if ( 'didomi' !== $mode ) {
			return array( 'data-consent-mode' => $mode );
		}
		$vendor = trim( (string) self::get( 'tag_didomi_vendor' ) );
		return array(
			'type'                 => 'didomi/javascript',
			'data-vendor'          => $vendor,
			'data-consent-mode'    => 'didomi',
			'data-didomi-vendor'   => $vendor,
			'data-didomi-purposes' => implode( ',', self::purpose_list( (string) self::get( 'tag_didomi_purposes' ) ) ),
		);
	}

	/**
	 * Register the setting, its sections, and its fields with the Settings API.
	 *
	 * @return void
	 */
	public static function register() {
		register_setting(
			self::OPTION_GROUP,
			self::OPTION,
			array(
				'type'              => 'array',
				'sanitize_callback' => array( __CLASS__, 'sanitize' ),
				'default'           => self::DEFAULTS,
			)
		);

		add_settings_section( 'adpriva_tag', __( 'Tag targeting', 'adpriva' ), array( __CLASS__, 'section_tag' ), self::PAGE );
		add_settings_field( 'tag_post_types', __( 'Load on post types', 'adpriva' ), array( __CLASS__, 'field_post_types' ), self::PAGE, 'adpriva_tag' );
		add_settings_field( 'tag_exclude_logged_in', __( 'Exclude logged-in users', 'adpriva' ), array( __CLASS__, 'field_exclude_logged_in' ), self::PAGE, 'adpriva_tag' );
		add_settings_field( 'tag_exclude_admins', __( 'Exclude administrators', 'adpriva' ), array( __CLASS__, 'field_exclude_admins' ), self::PAGE, 'adpriva_tag' );
		add_settings_field( 'tag_exclude_urls', __( 'Exclude URLs', 'adpriva' ), array( __CLASS__, 'field_exclude_urls' ), self::PAGE, 'adpriva_tag' );

		add_settings_section( 'adpriva_tag_consent', __( 'Visitor consent', 'adpriva' ), array( __CLASS__, 'section_tag_consent' ), self::PAGE );
		add_settings_field( 'tag_consent_mode', __( 'Consent mode', 'adpriva' ), array( __CLASS__, 'field_tag_consent_mode' ), self::PAGE, 'adpriva_tag_consent' );

		add_settings_section( 'adpriva_dashboard', __( 'Dashboard', 'adpriva' ), array( __CLASS__, 'section_dashboard' ), self::PAGE );
		add_settings_field( 'show_dashboard_widget', __( 'Show dashboard widget', 'adpriva' ), array( __CLASS__, 'field_show_widget' ), self::PAGE, 'adpriva_dashboard' );
		add_settings_field( 'default_date_range', __( 'Default date range', 'adpriva' ), array( __CLASS__, 'field_default_range' ), self::PAGE, 'adpriva_dashboard' );

		add_settings_section( 'adpriva_advanced', __( 'Advanced (endpoints)', 'adpriva' ), array( __CLASS__, 'section_advanced' ), self::PAGE );
		add_settings_field( 'api_base', __( 'API base URL', 'adpriva' ), array( __CLASS__, 'field_api_base' ), self::PAGE, 'adpriva_advanced' );
		add_settings_field( 'console_url', __( 'Console URL', 'adpriva' ), array( __CLASS__, 'field_console_url' ), self::PAGE, 'adpriva_advanced' );
		add_settings_field( 'tag_url', __( 'Tag script URL', 'adpriva' ), array( __CLASS__, 'field_tag_url' ), self::PAGE, 'adpriva_advanced' );
	}

	/**
	 * Sanitize+normalize the submitted settings into the canonical option shape.
	 * Pure: defaults are applied here, so a partial or empty input is always valid.
	 *
	 * @param mixed $input Raw submitted values (expected to be an array).
	 * @return array<string, mixed>
	 */
	public static function sanitize( $input ): array {
		$input = is_array( $input ) ? $input : array();
		$out   = self::DEFAULTS;

		// tag_post_types: the string 'all' or a list of post-type slugs.
		if ( isset( $input['tag_post_types'] ) && is_array( $input['tag_post_types'] ) ) {
			$types = array();
			foreach ( $input['tag_post_types'] as $slug ) {
				$slug = sanitize_key( (string) $slug );
				if ( '' !== $slug ) {
					$types[] = $slug;
				}
			}
			$out['tag_post_types'] = ! empty( $types ) ? $types : 'all';
		} else {
			$out['tag_post_types'] = 'all';
		}

		// Checkboxes: present+truthy in POST => true; absent (unchecked) => false.
		$out['tag_exclude_logged_in'] = ! empty( $input['tag_exclude_logged_in'] );
		$out['tag_exclude_admins']    = ! empty( $input['tag_exclude_admins'] );
		$out['show_dashboard_widget'] = ! empty( $input['show_dashboard_widget'] );

		// Exclude-URL list: one path per line, trimmed, blanks dropped.
		$raw   = isset( $input['tag_exclude_urls'] ) ? (string) $input['tag_exclude_urls'] : '';
		$lines = array();
		foreach ( preg_split( '/\r\n|\r|\n/', $raw ) as $line ) {
			$line = trim( $line );
			if ( '' !== $line ) {
				$lines[] = sanitize_text_field( $line );
			}
		}
		$out['tag_exclude_urls'] = implode( "\n", $lines );

		// Consent mode: an unknown value falls back to manual, never to off. Off needs
		// the confirm checkbox and Didomi needs valid ids; a rejected choice keeps the
		// mode the site had and says why.
		$mode                       = isset( $input['tag_consent_mode'] ) ? (string) $input['tag_consent_mode'] : '';
		$vendor                     = isset( $input['tag_didomi_vendor'] ) ? sanitize_text_field( (string) $input['tag_didomi_vendor'] ) : '';
		$purposes                   = isset( $input['tag_didomi_purposes'] ) ? implode( ',', self::purpose_list( sanitize_text_field( (string) $input['tag_didomi_purposes'] ) ) ) : '';
		$out['tag_didomi_vendor']   = $vendor;
		$out['tag_didomi_purposes'] = $purposes;
		$out['tag_consent_mode']    = in_array( $mode, self::CONSENT_MODES, true ) ? $mode : self::DEFAULT_CONSENT_MODE;
		if ( 'off' === $mode && empty( $input['tag_consent_off_confirm'] ) ) {
			$out['tag_consent_mode'] = self::tag_consent_mode();
			add_settings_error(
				self::OPTION,
				'adpriva_off_unconfirmed',
				__( 'The consent mode was not changed. Off needs the "I understand this collects before consent." checkbox to be ticked.', 'adpriva' )
			);
		} elseif ( 'didomi' === $mode ) {
			$errors = self::validate_didomi( $vendor, $purposes );
			if ( ! empty( $errors ) ) {
				$out['tag_consent_mode'] = self::tag_consent_mode();
				foreach ( $errors as $field => $message ) {
					add_settings_error( self::OPTION, 'adpriva_didomi_' . $field, $message );
				}
			}
		}

		$range                     = isset( $input['default_date_range'] ) ? (string) $input['default_date_range'] : '';
		$out['default_date_range'] = in_array( $range, array( '7d', '30d', '90d' ), true ) ? $range : '30d';

		// Advanced endpoint overrides: a pinned wp-config constant wins, so any
		// override for an endpoint whose constant is defined is dropped.
		foreach ( array_keys( self::ENDPOINT_CONSTANTS ) as $key ) {
			if ( self::endpoint_locked( $key ) ) {
				$out[ $key ] = '';
				continue;
			}
			$val         = isset( $input[ $key ] ) ? trim( (string) $input[ $key ] ) : '';
			$out[ $key ] = '' !== $val ? esc_url_raw( $val ) : '';
		}

		return $out;
	}

	/**
	 * The full option merged over defaults.
	 *
	 * @return array<string, mixed>
	 */
	public static function all() {
		$stored = get_option( self::OPTION, array() );
		if ( ! is_array( $stored ) ) {
			$stored = array();
		}
		return array_merge( self::DEFAULTS, $stored );
	}

	/**
	 * Single setting value (defaults applied).
	 *
	 * @param string $key Setting key.
	 * @return mixed
	 */
	public static function get( $key ) {
		$all = self::all();
		return array_key_exists( $key, $all ) ? $all[ $key ] : null;
	}

	/**
	 * 'all' or an array of post-type slugs the tag may load on.
	 *
	 * @return string|array<int, string>
	 */
	public static function tag_post_types() {
		return self::get( 'tag_post_types' );
	}

	/**
	 * Whether to suppress the tag for logged-in users.
	 *
	 * @return bool
	 */
	public static function exclude_logged_in() {
		return (bool) self::get( 'tag_exclude_logged_in' );
	}

	/**
	 * Whether to suppress the tag for administrators.
	 *
	 * @return bool
	 */
	public static function exclude_admins() {
		return (bool) self::get( 'tag_exclude_admins' );
	}

	/**
	 * Excluded URL fragments as a trimmed, non-empty list.
	 *
	 * @return array<int, string>
	 */
	public static function exclude_urls() {
		$raw = (string) self::get( 'tag_exclude_urls' );
		if ( '' === trim( $raw ) ) {
			return array();
		}
		$out = array();
		foreach ( preg_split( '/\r\n|\r|\n/', $raw ) as $line ) {
			$line = trim( $line );
			if ( '' !== $line ) {
				$out[] = $line;
			}
		}
		return $out;
	}

	/**
	 * The tag's consent mode: 'manual' (default: wait for AdPriva.grantConsent()),
	 * 'didomi' (wait for Didomi consent to the AdPriva custom vendor and purpose),
	 * 'tcf' (wait for purpose 1 in the page's IAB TCF v2 CMP) or 'off' (start at page
	 * load; only ever an explicit, confirmed choice or the 1.3.x upgrade pin). A
	 * missing or unknown value, and a Didomi config that fails validation, resolve to
	 * 'manual', never to 'off'.
	 *
	 * @return string
	 */
	public static function tag_consent_mode() {
		$mode = (string) self::get( 'tag_consent_mode' );
		if ( ! in_array( $mode, self::CONSENT_MODES, true ) ) {
			return self::DEFAULT_CONSENT_MODE;
		}
		if ( 'didomi' === $mode && ! empty( self::validate_didomi( (string) self::get( 'tag_didomi_vendor' ), (string) self::get( 'tag_didomi_purposes' ) ) ) ) {
			return self::DEFAULT_CONSENT_MODE;
		}
		return $mode;
	}

	/**
	 * Whether the WP-dashboard summary widget is enabled.
	 *
	 * @return bool
	 */
	public static function show_widget() {
		return (bool) self::get( 'show_dashboard_widget' );
	}

	/**
	 * The default dashboard date range ('7d' | '30d' | '90d').
	 *
	 * @return string
	 */
	public static function default_range() {
		return (string) self::get( 'default_date_range' );
	}

	/**
	 * Resolved API base URL: wp-config constant wins, then a saved override, then the default.
	 *
	 * @return string
	 */
	public static function api_base() {
		return self::endpoint( 'api_base', 'https://api.adpriva.com' );
	}

	/**
	 * Resolved console URL (same precedence as api_base()).
	 *
	 * @return string
	 */
	public static function console_url() {
		return self::endpoint( 'console_url', 'https://console.adpriva.com' );
	}

	/**
	 * Resolved tag script URL (same precedence as api_base()).
	 *
	 * @return string
	 */
	public static function tag_url() {
		return self::endpoint( 'tag_url', self::DEFAULT_TAG_URL );
	}

	/**
	 * Whether an endpoint is pinned by a wp-config constant (so its override is locked).
	 *
	 * @param string $key One of api_base|console_url|tag_url.
	 * @return bool
	 */
	public static function endpoint_locked( $key ) {
		return isset( self::ENDPOINT_CONSTANTS[ $key ] ) && defined( self::ENDPOINT_CONSTANTS[ $key ] );
	}

	/**
	 * Resolve an endpoint by the constant-wins precedence.
	 *
	 * @param string $key      Endpoint key.
	 * @param string $fallback Value when neither a constant nor an override is set.
	 * @return string
	 */
	private static function endpoint( $key, $fallback ) {
		$const = isset( self::ENDPOINT_CONSTANTS[ $key ] ) ? self::ENDPOINT_CONSTANTS[ $key ] : '';
		if ( '' !== $const && defined( $const ) ) {
			return (string) constant( $const );
		}
		$override = (string) self::get( $key );
		return '' !== $override ? $override : $fallback;
	}

	// ── Settings API section + field renderers ─────────────────────────────────

	/**
	 * Render a section intro.
	 *
	 * @return void
	 */
	public static function section_tag() {
		echo '<p>' . esc_html__( 'Control where the AdPriva verification tag loads on your site.', 'adpriva' ) . '</p>';
	}

	/**
	 * Render a section intro.
	 *
	 * @return void
	 */
	public static function section_tag_consent() {
		echo '<p>' . esc_html__( 'Choose when the AdPriva tag may observe the page and send data. With TCF or Manual, it sends nothing until the visitor consents and stops when consent is withdrawn.', 'adpriva' ) . '</p>';
	}

	/**
	 * Render a section intro.
	 *
	 * @return void
	 */
	public static function section_dashboard() {
		echo '<p>' . esc_html__( 'Preferences for the in-admin AdPriva dashboard.', 'adpriva' ) . '</p>';
	}

	/**
	 * Render a section intro.
	 *
	 * @return void
	 */
	public static function section_advanced() {
		echo '<p>' . esc_html__( 'Override the AdPriva service endpoints. Leave blank to use the defaults. An endpoint pinned in wp-config.php cannot be changed here.', 'adpriva' ) . '</p>';
	}

	/**
	 * Render the post-types selector.
	 *
	 * @return void
	 */
	public static function field_post_types() {
		$current = self::tag_post_types();
		$all     = ( 'all' === $current || ! is_array( $current ) );
		$types   = function_exists( 'get_post_types' ) ? get_post_types( array( 'public' => true ), 'objects' ) : array();

		echo '<fieldset>';
		echo '<p class="description">' . esc_html__( 'Leave all unchecked to load on every public post type.', 'adpriva' ) . '</p>';
		foreach ( $types as $type ) {
			$slug    = isset( $type->name ) ? $type->name : '';
			$label   = isset( $type->label ) ? $type->label : $slug;
			$checked = ( ! $all && is_array( $current ) && in_array( $slug, $current, true ) );
			printf(
				'<label style="display:block"><input type="checkbox" name="%1$s[tag_post_types][]" value="%2$s" %3$s /> %4$s</label>',
				esc_attr( self::OPTION ),
				esc_attr( $slug ),
				checked( $checked, true, false ),
				esc_html( $label )
			);
		}
		echo '</fieldset>';
	}

	/**
	 * Render the "exclude logged-in" checkbox.
	 *
	 * @return void
	 */
	public static function field_exclude_logged_in() {
		self::render_checkbox( 'tag_exclude_logged_in', __( 'Do not load the tag for logged-in users.', 'adpriva' ) );
	}

	/**
	 * Render the "exclude admins" checkbox.
	 *
	 * @return void
	 */
	public static function field_exclude_admins() {
		self::render_checkbox( 'tag_exclude_admins', __( 'Do not load the tag for administrators.', 'adpriva' ) );
	}

	/**
	 * Render the exclude-URLs textarea.
	 *
	 * @return void
	 */
	public static function field_exclude_urls() {
		printf(
			'<textarea name="%1$s[tag_exclude_urls]" rows="4" cols="50" class="large-text code">%2$s</textarea>',
			esc_attr( self::OPTION ),
			esc_textarea( (string) self::get( 'tag_exclude_urls' ) )
		);
		echo '<p class="description">' . esc_html__( 'One path fragment per line. The tag is skipped on any URL containing a listed fragment.', 'adpriva' ) . '</p>';
	}

	/**
	 * Render the consent-mode selector (AdPriva/tag#138). Wording matches the console
	 * install flow (console domain-wizard.tsx), so both surfaces say the same thing.
	 *
	 * @return void
	 */
	public static function field_tag_consent_mode() {
		self::render_select(
			'tag_consent_mode',
			array(
				'manual' => __( 'Manual: wait until my site calls AdPriva.grantConsent()', 'adpriva' ),
				'didomi' => __( 'Didomi: wait for consent to an AdPriva custom vendor and purpose', 'adpriva' ),
				'tcf'    => __( 'TCF: wait for purpose 1 in my IAB TCF v2 consent banner', 'adpriva' ),
				'off'    => __( 'Off: start on page load (only where consent is not required)', 'adpriva' ),
			)
		);
		echo '<p class="description">' . esc_html__( 'Manual: nothing is collected until your site calls AdPriva.grantConsent().', 'adpriva' ) . '</p>';
		echo '<p class="description">' . esc_html__( "TCF mode checks your banner's purpose 1 (store/access on a device). It is not AdPriva vendor consent, because AdPriva is not on the IAB vendor list yet. If your CMP lists AdPriva as a custom vendor, choose Didomi or Manual.", 'adpriva' ) . '</p>';

		echo '<fieldset><legend><strong>' . esc_html__( 'Didomi', 'adpriva' ) . '</strong></legend>';
		printf(
			'<p><label>%1$s<br /><input type="text" class="regular-text" name="%2$s[tag_didomi_vendor]" value="%3$s" placeholder="c:adpriva-xxxx" /></label></p>',
			esc_html__( 'Custom vendor ID', 'adpriva' ),
			esc_attr( self::OPTION ),
			esc_attr( (string) self::get( 'tag_didomi_vendor' ) )
		);
		printf(
			'<p><label>%1$s<br /><input type="text" class="regular-text" name="%2$s[tag_didomi_purposes]" value="%3$s" placeholder="your-purpose-id" /></label></p>',
			esc_html__( 'Purpose IDs, comma separated', 'adpriva' ),
			esc_attr( self::OPTION ),
			esc_attr( (string) self::get( 'tag_didomi_purposes' ) )
		);
		echo '<p class="description">' . esc_html(
			sprintf(
				/* translators: %s: placeholder purpose id. */
				__( 'In the Didomi Console, create AdPriva as a custom vendor and a custom purpose for traffic verification, attach the purpose to the vendor, then paste both IDs here. Replace %s with the real purpose ID.', 'adpriva' ),
				self::DIDOMI_PURPOSE_PLACEHOLDER
			)
		) . '</p>';
		echo '<p class="description">' . esc_html__( 'Do not deploy this script through Google Tag Manager: it strips the data-* attributes the tag needs.', 'adpriva' ) . '</p>';
		echo '</fieldset>';

		echo '<fieldset><legend><strong>' . esc_html__( 'Off', 'adpriva' ) . '</strong></legend>';
		echo '<p class="description"><strong>' . esc_html__( 'Collects before consent. Only use it where consent is not required.', 'adpriva' ) . '</strong></p>';
		printf(
			'<label><input type="checkbox" name="%1$s[tag_consent_off_confirm]" value="1" %2$s /> %3$s</label>',
			esc_attr( self::OPTION ),
			checked( 'off' === self::tag_consent_mode(), true, false ),
			esc_html__( 'I understand this collects before consent.', 'adpriva' )
		);
		echo '</fieldset>';

		printf(
			'<p class="description"><a href="%1$s" target="_blank" rel="noopener noreferrer">%2$s</a></p>',
			esc_url( self::CONSENT_DOCS_URL ),
			esc_html__( 'How consent modes work', 'adpriva' )
		);
	}

	/**
	 * Render the "show widget" checkbox.
	 *
	 * @return void
	 */
	public static function field_show_widget() {
		self::render_checkbox( 'show_dashboard_widget', __( 'Show the AdPriva summary widget on the WordPress dashboard.', 'adpriva' ) );
	}

	/**
	 * Render the default-range selector.
	 *
	 * @return void
	 */
	public static function field_default_range() {
		self::render_select(
			'default_date_range',
			array(
				'7d'  => __( 'Last 7 days', 'adpriva' ),
				'30d' => __( 'Last 30 days', 'adpriva' ),
				'90d' => __( 'Last 90 days', 'adpriva' ),
			)
		);
	}

	/**
	 * Render the API-base override field.
	 *
	 * @return void
	 */
	public static function field_api_base() {
		self::render_endpoint_field( 'api_base' );
	}

	/**
	 * Render the console-URL override field.
	 *
	 * @return void
	 */
	public static function field_console_url() {
		self::render_endpoint_field( 'console_url' );
	}

	/**
	 * Render the tag-URL override field.
	 *
	 * @return void
	 */
	public static function field_tag_url() {
		self::render_endpoint_field( 'tag_url' );
	}

	/**
	 * Shared checkbox renderer.
	 *
	 * @param string $key   Setting key.
	 * @param string $label Inline label.
	 * @return void
	 */
	private static function render_checkbox( $key, $label ) {
		printf(
			'<label><input type="checkbox" name="%1$s[%2$s]" value="1" %3$s /> %4$s</label>',
			esc_attr( self::OPTION ),
			esc_attr( $key ),
			checked( (bool) self::get( $key ), true, false ),
			esc_html( $label )
		);
	}

	/**
	 * Shared single-select renderer.
	 *
	 * @param string                $key     Setting key.
	 * @param array<string, string> $options value => label.
	 * @return void
	 */
	private static function render_select( $key, array $options ) {
		$current = (string) self::get( $key );
		printf( '<select name="%1$s[%2$s]">', esc_attr( self::OPTION ), esc_attr( $key ) );
		foreach ( $options as $value => $label ) {
			printf(
				'<option value="%1$s" %2$s>%3$s</option>',
				esc_attr( $value ),
				selected( $current, $value, false ),
				esc_html( $label )
			);
		}
		echo '</select>';
	}

	/**
	 * Shared endpoint-override renderer (locked + showing the pinned value when defined).
	 *
	 * @param string $key Endpoint key.
	 * @return void
	 */
	private static function render_endpoint_field( $key ) {
		if ( self::endpoint_locked( $key ) ) {
			$const = self::ENDPOINT_CONSTANTS[ $key ];
			printf(
				'<input type="text" class="regular-text" value="%1$s" disabled /> <span class="description">%2$s</span>',
				esc_attr( (string) constant( $const ) ),
				esc_html( sprintf( /* translators: %s: PHP constant name. */ __( 'Pinned by %s in wp-config.php.', 'adpriva' ), $const ) )
			);
			return;
		}
		printf(
			'<input type="url" class="regular-text" name="%1$s[%2$s]" value="%3$s" placeholder="%4$s" />',
			esc_attr( self::OPTION ),
			esc_attr( $key ),
			esc_attr( (string) self::get( $key ) ),
			esc_attr( self::endpoint( $key, '' ) )
		);
	}
}