=== My Book Showroom ===
Contributors: dmrstech
Tags: books, authors, book catalog, ebook, audiobook
Requires at least: 6.6
Tested up to: 7.0
Requires PHP: 8.2
Stable tag: 1.3.9
License: GPL-2.0-or-later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

The definitive book showcase plugin for WordPress authors, publishers, and retailers. Deluxe Manuscripts Regally Served.

== Description ==

**My Book Showroom (MBS)** is a premium WordPress plugin that gives authors, publishers, and retailers a professional book catalog with rich metadata, retailer buy links, affiliate rewriting, reader reviews, and front-end display layouts.

= FREE Features =

* **Book Catalog CPT** — Create unlimited book entries with full metadata (title, author, ISBN, publisher, publication date, page count, word count, format details).
* **Multiple Formats** — Each book supports multiple editions (Hardcover, Paperback, eBook, Audiobook, Large Print, etc.) with per-format pricing and retailer links.
* **5 FREE Layouts** — Grid, List, Masonry, Hero, and Card layouts for catalog display.
* **9 Retailer Buy Links** — Amazon, Barnes & Noble, Kobo, Audible, BAM, Bookshop.org, Waterstones, Apple Books, Google Play Books.
* **Section Ordering** — Global default ordering of book detail sections.
* **Reader Reviews** — GDPR-aware review form with star ratings and consent checkbox.
* **Taxonomies** — Genre, Author, Series, Tag, Collection, Universe, Theme, Content Warning.
* **Social Share Buttons** — Share individual book pages on major social platforms.
* **Watermark** — FREE tier displays a subtle attribution watermark.
* **Shortcodes** — `[mbs_books]` and `[mbs_book]` for embedding book content anywhere.
* **Gutenberg Blocks** — Book grid, featured book, buy links, and term-list blocks.
* **Star Rating Display** — Manual star rating with half-step precision.
* **Import/Export** — CSV and XLSX import with duplicate detection.
* **Dark Mode** — Full `prefers-color-scheme: dark` support.
* **WCAG 2.1 AA** — Keyboard navigation, focus indicators, ARIA roles.

= PRO Features =

* **Affiliate Rewriting** — Automatic affiliate code insertion at render time (stored URLs unchanged).
* **Custom Stores** — Up to 3 custom retailer entries with `{CODE}` pattern substitution.
* **PRO Layouts** — Slider, Spotlight, and Magazine layouts.
* **CSS Cover Metaphors** — 7 CSS-animated cover styles (Foiled, Matte, Distressed, Noir, etc.).
* **Per-Book Section Order** — Drag-and-drop section ordering per book.
* **Bulk Edit** — Edit Genre, Series, and Visibility across multiple books at once.
* **Recommended Books Flag** — Mark books as Featured/Recommended for front-end highlighting.
* **Audio Sample Player** — Embed MP3 audio samples directly on book pages.
* **Book Trailer** — Embed video trailers (YouTube, Vimeo, direct MP4).
* **Amazon Reviews Import** — Import reader reviews from Amazon via PA-API.
* **Amazon Rating Import** — Import star ratings and review counts from Amazon.
* **Look Inside** — Amazon "Continue Reading" deep link integration.
* **Author Directory Shortcode** — `[mbs_author_directory]` paginated author listing.
* **Series Directory Shortcode** — `[mbs_series_directory]` reading-order series page.
* **Universe / Shared World** — Multi-series shared universe taxonomy.
* **Custom CSS** — Per-installation custom CSS editor.
* **Filter Layout** — AJAX live-filter catalog by genre, series, format, price range.

= Theme Compatibility =

My Book Showroom includes dedicated compatibility files for the following themes, ensuring correct CSS cascade and layout behavior:

* Divi (Elegant Themes)
* Avada (ThemeFusion)
* Astra
* OceanWP
* Flatsome (UX-themes)
* BeTheme (Muffin Group)
* Newspaper (tagDiv)
* Graphene Plus

= License System =

My Book Showroom works immediately after activation — no license key or registration required. Optional free registration at `www.dmrstech.com` unlocks settings import/export and removes the attribution watermark. PRO keys unlock premium features. When registration is used, license keys are AES-256-GCM encrypted in `wp_options`; the server uses Argon2id hashing. See the External Services section below for full disclosure.

== Installation ==

1. Upload the `my-book-showroom` folder to `/wp-content/plugins/`.
2. Activate the plugin through the **Plugins** screen in WordPress.
3. Optional: Navigate to **Books → Settings → License** to register your plugin for free — this unlocks settings import/export and removes the attribution watermark ([Register at dmrstech.com/activate](https://www.dmrstech.com/activate)).
4. Add your first book via **Books → Add New Book**.
5. Place the `[mbs_books]` shortcode or a **Book Grid** block on any page.

= Requirements =

* WordPress 6.6 or higher
* PHP 8.0 or higher
* MySQL 5.7 / MariaDB 10.3 or higher

= Database Tables =

The plugin creates custom tables on activation and via sequential migrations. Core tables:

* `{prefix}mbs_format_rows` — Book format/edition rows (Hardcover, Paperback, eBook, Audiobook, etc.)
* `{prefix}mbs_buy_links` — Per-format retailer buy link URLs
* `{prefix}mbs_section_order` — Per-book section display ordering
* `{prefix}mbs_endorsements` — Endorsements and blurbs
* `{prefix}mbs_book_meta` — Extended book metadata (rating, review count, PA-API cache)
* `{prefix}mbs_reading_order` — Series reading-order positions
* `{prefix}mbs_book_awards` — Book award entries
* `{prefix}mbs_book_contributors` — Per-book contributor assignments
* `{prefix}mbs_affiliate_stores` — Custom retailer store definitions (PRO)
* `{prefix}mbs_buy_link_clicks` — Buy-link click analytics
* `{prefix}mbs_pa_api_cache` — Amazon PA-API response cache
* `{prefix}mbs_activity_log` — Admin activity log (Publisher tier)

Additional tables are created for optional feature modules (ARC reviewer management, ESP queue, Book Club, Brand Monitor cache, POS inventory, classification codes). All table names are prefixed with your WordPress table prefix.

== Frequently Asked Questions ==

= Do I need a license key to use the plugin? =

No. My Book Showroom is fully functional immediately after activation — no license key or registration is required. Front-end book display is active by default on the FREE tier.

Optional free registration at [dmrstech.com/activate](https://www.dmrstech.com/activate) unlocks settings import/export and removes the attribution watermark. A PRO subscription is required for premium features (affiliate rewriting, PRO layouts, Amazon PA-API integration, etc.).

= Are my Amazon PA-API credentials sent to your servers? =

No. Amazon PA-API Access Key and Secret Key are stored encrypted in your `wp_options` database table using AES-256-GCM encryption with your WordPress AUTH_KEY. They are never transmitted to `www.dmrstech.com` or any DMRS Tech server. All PA-API calls go directly from your WordPress installation to Amazon's API endpoint.

= Does affiliate rewriting modify my stored URLs? =

No. Affiliate codes are appended at render time only. The URLs stored in your database are never modified. If you remove your affiliate code from the settings, the clean URL is served immediately — no database cleanup required.

= What happens if I cancel my PRO subscription? =

Your account silently downgrades to FREE tier. All your book data is preserved. PRO-only front-end features (affiliate rewriting, PRO layouts, audio player, etc.) stop rendering, but the content remains in the database. You can re-activate a PRO key at any time to restore full functionality.

= Is the plugin GDPR-compliant? =

The reader review form includes an explicit consent checkbox. No review can be submitted without consent. Review authors' IP addresses are stored only in the standard WordPress comments table (same as any WP comment). No additional personal data is collected. Consult your legal team for your specific compliance obligations.

= Which themes are supported? =

All standard WordPress themes are supported. Dedicated compatibility files are included for Divi, Avada, Astra, OceanWP, Flatsome, BeTheme, Newspaper (tagDiv), and Graphene Plus. The plugin uses a `.mbs-wrapper` CSS scope to prevent bleed from theme stylesheets.

= Can I use the plugin with WooCommerce? =

MBS is designed for authors and publishers showcasing books, not for direct-sell ecommerce. WooCommerce integration (direct cart, per-format pricing in cart) is planned for a future sprint. Currently, buy links point to external retailers.

== Screenshots ==

1. Book catalog in grid layout (FREE tier).
2. Single book page with tab navigation and buy links.
3. Admin book editor with format repeater and metadata fields.
4. Settings panel — Earn More tab with retailer affiliate codes.
5. Bulk edit — selecting genre and visibility for multiple books.

== External Services ==

My Book Showroom communicates with the DMRS Tech API (`www.dmrstech.com`) for the following **optional** operations only. No data is transmitted if you use the plugin without registering.

= Free registration (optional) =

If you choose to register your plugin, the following data is sent to `www.dmrstech.com`:

* Your email address — for license key delivery only
* Your site domain
* A timestamp and request nonce (for HMAC request signing)

= License validation (only when a key is stored) =

* Your license key (HMAC-signed, transmitted over HTTPS)
* Your site domain
* A timestamp and nonce

= Plugin update checks (direct-download edition only) =

The WordPress.org edition of My Book Showroom does not include a self-hosted update checker. Updates are delivered through the standard WordPress.org plugin update system.

If you installed the plugin directly from dmrstech.com, update availability is checked via `www.dmrstech.com` when a license key is stored. Only the plugin slug and current version number are sent -- no personal data.

* Service provider: DMRS Tech
* Service URL: https://www.dmrstech.com
* Terms of Service: https://www.dmrstech.com/terms.php
* Privacy Policy: https://www.dmrstech.com/privacy.php

== Changelog ==

= Unreleased =
* Security: Hardened the licensing server - paid licenses are now provisioned over an authenticated, payment-verified, idempotent path, so a successful payment reliably issues a key (and is retried on transient failures) instead of silently failing.
* Security: Lost-key "resend" now requires confirmation (a token sent to your email, or your current key) before issuing a new key.
* Security: File-integrity (tamper) checks are now enforced on the server and signature-verified by the plugin.

= 1.3.9 =
This release resolves a broad set of issues found in two independent code audits and adds extensive automated test coverage.
* Fix: A false "security violation" notice could appear right after updating; the plugin now re-checks against a freshly downloaded, verified manifest before showing the notice.
* Fix: Three book-classification reference lists (BISAC, Thema, and BIC codes and their mappings) were not created on some sites, which could make classification features appear empty. They are now created and populated correctly.
* Fix: The Repair Tables tool (Settings -> Advanced) now rebuilds and re-populates every database table, re-seeds reference data, verifies the tables exist, and reports any that are still missing.
* Fix: Database setup and upgrades are more reliable - the process now stops and reports a problem instead of silently continuing if a step fails, and rebuilds consistently on a fresh install or repair.
* Fix: Removing or deleting a book from a series now clears its saved reading-order position, so stale positions no longer linger.
* Fix: Imports now record a warning if a book's categories, buy links, endorsements, or contributors could not be saved, instead of failing silently.
* Fix: Custom-store buy links now correctly insert your affiliate code, so custom-store affiliate links are properly credited.
* Fix: The daily Amazon price and rating sync (Professional) now runs reliably; it previously failed to start in some setups.
* Fix: Email / Newsletter settings on the Promote tab (Professional) now save correctly for all supported platforms (Mailchimp, MailerLite, ConvertKit, Brevo, Sendy, ActiveCampaign, GetResponse, Campaign Monitor, Moosend).
* Fix: ARC reviewer records now handle repeat sends to the same reviewer cleanly.
* Note: ISBN lookup import (Google Books and Open Library) remains free, with no registration required.
* Change: Minimum PHP version is now 8.2.
* Security: ONIX import and settings import now use stricter, safer handling of uploaded data.
* Security: Removed a buy-link embed field that could allow a stored script to run on book pages.
* Security: Hardened license validation and payment handling - validation responses are signature-checked before being trusted, and duplicate payment notifications can no longer issue a license twice.
* Fix: Prevented possible data loss during the database upgrade (queue and contributor data is preserved during migration).

= 1.3.8 =
* Fix (critical): Several features did not work correctly on some installations because required database tables were not created during setup. Affected features include book classification codes, awards, ARC campaigns, book statistics, and territorial rights. The most visible symptom was the Books admin list showing "No books found" even after adding books. All affected tables are now created correctly on new and existing installs.
* Fix: Administrator accounts that lost book-management permissions after a database restore or role reset now have those permissions automatically restored without reinstalling the plugin.
* New: Settings > Advanced > Database Tools — a "Repair Tables" button that rebuilds any missing tables and restores your data. Use this if your site was affected by the issue above.

= 1.3.7 =
* Compliance: WP.org Plugin Check remediation — custom update checker excluded from WP.org builds (updates delivered through WordPress.org); dev/tooling files excluded via .distignore; phpcs suppressions added for test infrastructure.
* Fix: Tutorial Data "Install" no longer creates duplicate books when tutorial data is already installed; use "Reinstall" to replace existing data.
* Fix: Imprint "Publisher" field now appears on the Imprint add/edit screen and saves correctly.
* Fix: Author Directory no longer lists authors that have no published books.
* Fix: Built-in demo book installer no longer creates duplicate "The Shadow Architect" copies across reinstall/reset cycles.
* Fix: CSV import and ISBN / Google Books / Open Library lookup no longer require a license -- importing is free for all installs (tier gating applies to display and export, not import).
* Fix: MBS shortcodes ([mbs_books], [mbs_author_directory], [mbs_genre_cloud], and all others) now render correctly when added to a page or post; they previously displayed as literal text.
* Change: US English standardized throughout the plugin (181 spelling corrections in code and 2 docs) per the project language standard; no functional change.
* Fix: Migrating from another book plugin via a WXR (.xml) export no longer rejects valid files on some servers (e.g. XAMPP) that report XML as application/xml.
* Fix: The WXR guided-migration buttons (Upload & Analyze, Import Books) now work reliably; their handlers previously failed to attach.
* Fix: MyBookTable migration now works — the Upload & Migrate button is reliably wired and the standard extensionless MyBookTable JSON export is accepted.

= 1.3.6 =
* Fix: License registration API endpoint URL corrected (trailing .php extension removed from registration endpoint call).
* Compliance: Full WordPress.org Plugin Check remediation — resolved all suppressible errors and warnings (173E+1179W → 1E+4W).
* Security: Added esc_attr() escaping on ISBN and format fields in related-products metabox.
* Security: Replaced wp_redirect() with wp_safe_redirect() in buy-link router.
* Security: Fixed phpcs:ignore comment erroneously embedded inside SQL string literal in endorsement DAO (corrupted query risk).
* Improvement: Self-update hook is a no-op for unregistered installations; added inline documentation clarifying WP.org compliance.
* Improvement: WP_Filesystem used as primary path for temp file writes and directory cleanup; native PHP fallback retained for non-direct filesystem methods.
* i18n: Translator comments added for all printf() calls with placeholders; ordered placeholders (%1$s/%2$s) applied throughout.
* Docs: All developer reference documents moved out of plugin root into project folder; plugin root now contains only WP.org-allowed markdown files.

= 1.3.5 =
* Security: Removed all MBS_DEV_MODE security bypass blocks from production source (tamper gate, ping-age check, HTTPS guards in API and payment adapters now fire unconditionally).
* Security: Upgraded encryption from AES-256-CBC to AES-256-GCM for license keys, API secret, and PA-API credentials.
* Security: Implemented manifest HMAC authentication (SHA-256 HMAC request signing and response verification).
* Security: Applied comprehensive security audit remediations (SQL, XSS, CSRF, SSRF, path traversal, deserialization, auth-check ordering).
* Improvement: All API communication now uses production endpoint (www.dmrstech.com).
* Fix: Resolved multiple URL routing corrections (upgrade, docs, FAQ links).
* l10n: Updated translations for 11 locales.

= 1.0.0 =
* Initial release.
* 12 sprints of feature development and hardening:
  - Full CPT and taxonomy system (Sprints 1–2)
  - Admin settings panel with 7 tabs (Sprint 3)
  - Front-end display — 5 FREE + 3 PRO layouts (Sprint 4)
  - License system with HMAC signing and anti-tamper escalation (Sprint 5)
  - Retailer buy links with 9 retailers and affiliate rewriting (Sprint 6)
  - CSV/XLSX import, settings export (Sprint 7)
  - CSS cover metaphors and audio/video player (Sprint 8)
  - Amazon PA-API integration, reader reviews (Sprint 9)
  - Earn More tab: 5 additional retailers, custom stores, bulk edit (Sprint 10)
  - Theme compat, WCAG 2.1 AA, dark mode, performance hardening (Sprint 12)

== Upgrade Notice ==

= 1.3.9 =
Resolves a broad set of database setup/repair, import, and feature issues found in two code audits, adds extensive test coverage, and raises the minimum PHP to 8.2. If you use Professional email integration, re-save your platform credentials after updating.

= 1.3.8 =
Critical fix: some features (Books list, classification codes, awards, ARC campaigns, and others) may not have worked correctly due to missing database tables. After updating, go to Settings > Advanced > Database Tools and click "Repair Tables" to rebuild any missing tables.

= 1.3.7 =
This release includes significant fixes to shortcode rendering, import tools, and the demo book installer.

= 1.0.0 =
Initial release — no upgrade path.

== Privacy Policy ==

My Book Showroom does not collect or transmit any visitor personal data beyond what WordPress itself stores (comment author data if the reader review form is used).

If you choose to register the plugin (optional), your email address is transmitted to `www.dmrstech.com` solely for license key delivery. It is not used for marketing without your explicit consent.

When a license key is stored, periodic validation transmits your license key (HMAC-signed over HTTPS), your site domain, and a timestamp. No visitor data is ever transmitted.

See the full privacy policy at [dmrstech.com/privacy](https://www.dmrstech.com/privacy.php).
