<?php
/**
 * Hardening tab — one-line toggles, each with a short explanation.
 *
 * @package Brainwerk Security Suite
 */

if ( ! defined( 'ABSPATH' ) ) {
    exit;
}

$toggles = array(
    'hardening_disable_xmlrpc' => array(
        __( 'Disable XML-RPC', 'brainwerk-security-suite' ),
        __( 'Closes a common attack surface used by amplification and brute-force bots. Disable only if Jetpack/legacy app login is required.', 'brainwerk-security-suite' ),
    ),
    'hardening_disable_editor' => array(
        __( 'Disable file editor in admin', 'brainwerk-security-suite' ),
        __( 'Sets DISALLOW_FILE_EDIT — prevents attackers with a stolen admin account from injecting code via the theme/plugin editor.', 'brainwerk-security-suite' ),
    ),
    'hardening_hide_version' => array(
        __( 'Hide WordPress version', 'brainwerk-security-suite' ),
        __( 'Removes the generator meta tag and version from RSS to make automated CVE scans harder.', 'brainwerk-security-suite' ),
    ),
    'hardening_block_authors' => array(
        __( 'Block author enumeration', 'brainwerk-security-suite' ),
        __( 'Stops "?author=1" tricks and removes /wp-json/wp/v2/users for anonymous users — both leak usernames.', 'brainwerk-security-suite' ),
    ),
    'hardening_security_headers' => array(
        __( 'Send security headers', 'brainwerk-security-suite' ),
        __( 'Adds X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, and HSTS (when on HTTPS).', 'brainwerk-security-suite' ),
    ),
    'hardening_rest_restrict' => array(
        __( 'Restrict REST API for anonymous users', 'brainwerk-security-suite' ),
        __( 'Blocks anonymous access to /wp-json/wp/v2/users, which often leaks usernames.', 'brainwerk-security-suite' ),
    ),
);
?>
<form method="post" class="shieldforge-form">
    <?php wp_nonce_field( Shieldforge_Admin::NONCE ); ?>
    <input type="hidden" name="shieldforge_action" value="save_settings">
    <?php foreach ( array_keys( $toggles ) as $k ) : ?>
        <input type="hidden" name="shieldforge_tab_keys[]" value="<?php echo esc_attr( $k ); ?>">
    <?php endforeach; ?>

    <div class="shieldforge-card">
        <h2><?php esc_html_e( 'Hardening Toggles', 'brainwerk-security-suite' ); ?></h2>
        <ul class="shieldforge-toggle-list">
            <?php foreach ( $toggles as $key => $info ) : list( $title, $desc ) = $info; ?>
                <li>
                    <label class="shieldforge-toggle">
                        <input type="checkbox" name="shieldforge[<?php echo esc_attr( $key ); ?>]" value="1"
                            <?php checked( Shieldforge_Settings::get( $key ) ); ?>>
                        <span class="title"><?php echo esc_html( $title ); ?></span>
                    </label>
                    <p class="description"><?php echo esc_html( $desc ); ?></p>
                </li>
            <?php endforeach; ?>
        </ul>
    </div>

    <p><button type="submit" class="button button-primary"><?php esc_html_e( 'Save changes', 'brainwerk-security-suite' ); ?></button></p>
</form>
