<?php
/**
 * Privacy / GDPR tab — anonymization + retention + transparency.
 *
 * @package Brainwerk Security Suite
 */

if ( ! defined( 'ABSPATH' ) ) {
    exit;
}

$keys = array(
    'privacy_anonymize_ip', 'privacy_pseudonym_users', 'log_retention_days',
);
?>
<form method="post" class="shieldforge-form">
    <?php wp_nonce_field( Shieldforge_Admin::NONCE ); ?>
    <input type="hidden" name="shieldforge_action" value="save_settings">
    <?php foreach ( $keys as $k ) : ?>
        <input type="hidden" name="shieldforge_tab_keys[]" value="<?php echo esc_attr( $k ); ?>">
    <?php endforeach; ?>

    <div class="shieldforge-card">
        <h2><?php esc_html_e( 'Privacy controls (GDPR)', 'brainwerk-security-suite' ); ?></h2>

        <label class="shieldforge-toggle">
            <input type="checkbox" name="shieldforge[privacy_anonymize_ip]" value="1"
                <?php checked( Shieldforge_Settings::get( 'privacy_anonymize_ip' ) ); ?>>
            <span><?php esc_html_e( 'Anonymize IP addresses in stored logs', 'brainwerk-security-suite' ); ?></span>
        </label>
        <p class="description"><?php esc_html_e( 'IPv4: last octet zeroed. IPv6: kept to /64. Original IPs are never written when this is on.', 'brainwerk-security-suite' ); ?></p>

        <label class="shieldforge-toggle">
            <input type="checkbox" name="shieldforge[privacy_pseudonym_users]" value="1"
                <?php checked( Shieldforge_Settings::get( 'privacy_pseudonym_users' ) ); ?>>
            <span><?php esc_html_e( 'Pseudonymize usernames in logs', 'brainwerk-security-suite' ); ?></span>
        </label>
        <p class="description"><?php esc_html_e( 'Stores a salted HMAC instead of the username — useful for shared environments.', 'brainwerk-security-suite' ); ?></p>

        <table class="form-table" role="presentation">
            <tr>
                <th><?php esc_html_e( 'Log retention (days)', 'brainwerk-security-suite' ); ?></th>
                <td>
                    <input type="number" min="1" max="3650" class="small-text"
                           name="shieldforge[log_retention_days]"
                           value="<?php echo esc_attr( Shieldforge_Settings::get( 'log_retention_days', 30 ) ); ?>">
                    <p class="description"><?php esc_html_e( 'Older events are deleted automatically by a daily cron job.', 'brainwerk-security-suite' ); ?></p>
                </td>
            </tr>
        </table>
    </div>

    <div class="shieldforge-card">
        <h2><?php esc_html_e( 'Data map', 'brainwerk-security-suite' ); ?></h2>
        <p><?php esc_html_e( 'Brainwerk Security Suite stores the following data locally — nothing is transmitted to any third-party service in the free version.', 'brainwerk-security-suite' ); ?></p>
        <ul class="shieldforge-datamap">
            <li><strong>shieldforge_log</strong> — <?php esc_html_e( 'Login attempts, hardening blocks, probing 404s, role changes. IPs anonymized when enabled. Auto-deleted after retention period.', 'brainwerk-security-suite' ); ?></li>
            <li><strong>shieldforge_blocks</strong> — <?php esc_html_e( 'Currently blocked IPs (raw IP required to enforce blocking). Auto-removed when block expires.', 'brainwerk-security-suite' ); ?></li>
            <li><strong>shieldforge_baseline</strong> — <?php esc_html_e( 'Per-user statistical baseline for anomaly detection (login times, network ranges).', 'brainwerk-security-suite' ); ?></li>
        </ul>
    </div>

    <p><button type="submit" class="button button-primary"><?php esc_html_e( 'Save changes', 'brainwerk-security-suite' ); ?></button></p>
</form>

<?php
$locale  = isset( $_GET['snippet'] ) && 'en' === $_GET['snippet'] ? 'en' : 'de'; // phpcs:ignore WordPress.Security.NonceVerification
$snippet = Shieldforge_Privacy_Generator::generate( $locale );
$de_url  = add_query_arg( 'snippet', 'de', Shieldforge_Admin::tab_url( 'privacy' ) );
$en_url  = add_query_arg( 'snippet', 'en', Shieldforge_Admin::tab_url( 'privacy' ) );
?>
<div class="shieldforge-card">
    <h2><?php esc_html_e( 'Privacy-policy snippet', 'brainwerk-security-suite' ); ?></h2>
    <p>
        <?php esc_html_e( 'Copy this snippet into your privacy policy. It reflects the current Brainwerk Security Suite settings.', 'brainwerk-security-suite' ); ?>
    </p>
    <p class="sf-snippet-lang">
        <a class="button button-small <?php echo 'de' === $locale ? 'button-primary' : ''; ?>" href="<?php echo esc_url( $de_url ); ?>">Deutsch</a>
        <a class="button button-small <?php echo 'en' === $locale ? 'button-primary' : ''; ?>" href="<?php echo esc_url( $en_url ); ?>">English</a>
        <button type="button" class="button button-small sf-copy-btn" data-target="#sf-privacy-snippet"><?php esc_html_e( 'Copy', 'brainwerk-security-suite' ); ?></button>
    </p>
    <textarea id="sf-privacy-snippet" rows="14" class="large-text code" readonly><?php echo esc_textarea( $snippet ); ?></textarea>

    <h3><?php esc_html_e( 'Rendered preview', 'brainwerk-security-suite' ); ?></h3>
    <div class="sf-snippet-preview"><?php echo wp_kses_post( $snippet ); ?></div>
</div>
