<?php
/**
 * Login & Auth tab — toggles for login log, brute-force, lockout settings.
 *
 * @package Brainwerk Security Suite
 */

if ( ! defined( 'ABSPATH' ) ) {
    exit;
}
$keys = array(
    'login_log_enabled', 'bruteforce_enabled', 'bruteforce_threshold',
    'bruteforce_window_min', 'bruteforce_lockout_min', 'bruteforce_whitelist',
    'bf_user_lockout_enabled', 'bf_user_lockout_threshold',
    'bf_user_lockout_window_min', 'bf_user_lockout_minutes',
);
?>
<form method="post" class="shieldforge-form">
    <?php wp_nonce_field( Shieldforge_Admin::NONCE ); ?>
    <input type="hidden" name="shieldforge_action" value="save_settings">
    <?php foreach ( $keys as $k ) : ?>
        <input type="hidden" name="shieldforge_tab_keys[]" value="<?php echo esc_attr( $k ); ?>">
    <?php endforeach; ?>

    <div class="shieldforge-card">
        <h2><?php esc_html_e( 'Login Activity Logging', 'brainwerk-security-suite' ); ?></h2>
        <label class="shieldforge-toggle">
            <input type="checkbox" name="shieldforge[login_log_enabled]" value="1"
                <?php checked( Shieldforge_Settings::get( 'login_log_enabled' ) ); ?>>
            <span><?php esc_html_e( 'Log every login attempt (success and failure)', 'brainwerk-security-suite' ); ?></span>
        </label>
        <p class="description"><?php esc_html_e( 'Stored in the database, respects the IP-anonymization setting under Privacy.', 'brainwerk-security-suite' ); ?></p>
    </div>

    <div class="shieldforge-card">
        <h2><?php esc_html_e( 'Brute-Force Protection', 'brainwerk-security-suite' ); ?></h2>
        <label class="shieldforge-toggle">
            <input type="checkbox" name="shieldforge[bruteforce_enabled]" value="1"
                <?php checked( Shieldforge_Settings::get( 'bruteforce_enabled' ) ); ?>>
            <span><?php esc_html_e( 'Block IPs after too many failed logins', 'brainwerk-security-suite' ); ?></span>
        </label>

        <table class="form-table" role="presentation">
            <tr>
                <th scope="row"><?php esc_html_e( 'Failure threshold', 'brainwerk-security-suite' ); ?></th>
                <td>
                    <input type="number" min="1" max="50" class="small-text"
                           name="shieldforge[bruteforce_threshold]"
                           value="<?php echo esc_attr( Shieldforge_Settings::get( 'bruteforce_threshold', 5 ) ); ?>">
                    <p class="description"><?php esc_html_e( 'Number of failed logins from the same IP that triggers a block.', 'brainwerk-security-suite' ); ?></p>
                </td>
            </tr>
            <tr>
                <th scope="row"><?php esc_html_e( 'Window (minutes)', 'brainwerk-security-suite' ); ?></th>
                <td>
                    <input type="number" min="1" max="120" class="small-text"
                           name="shieldforge[bruteforce_window_min]"
                           value="<?php echo esc_attr( Shieldforge_Settings::get( 'bruteforce_window_min', 5 ) ); ?>">
                </td>
            </tr>
            <tr>
                <th scope="row"><?php esc_html_e( 'Lockout duration (minutes)', 'brainwerk-security-suite' ); ?></th>
                <td>
                    <input type="number" min="1" max="1440" class="small-text"
                           name="shieldforge[bruteforce_lockout_min]"
                           value="<?php echo esc_attr( Shieldforge_Settings::get( 'bruteforce_lockout_min', 30 ) ); ?>">
                </td>
            </tr>
            <tr>
                <th scope="row"><?php esc_html_e( 'IP whitelist', 'brainwerk-security-suite' ); ?></th>
                <td>
                    <textarea name="shieldforge[bruteforce_whitelist]" rows="4" cols="40" class="large-text code"><?php
                        echo esc_textarea( implode( "\n", (array) Shieldforge_Settings::get( 'bruteforce_whitelist', array() ) ) );
                    ?></textarea>
                    <p class="description"><?php esc_html_e( 'One IP or CIDR per line. These addresses are never blocked.', 'brainwerk-security-suite' ); ?></p>
                </td>
            </tr>
        </table>
    </div>

    <div class="shieldforge-card">
        <h2><?php esc_html_e( 'Account-based Lockout', 'brainwerk-security-suite' ); ?></h2>
        <p class="description"><?php esc_html_e( 'IP-based protection above blocks one source. This rule blocks one ACCOUNT regardless of source IP — defense against credential-stuffing botnets that rotate addresses.', 'brainwerk-security-suite' ); ?></p>
        <label class="shieldforge-toggle">
            <input type="checkbox" name="shieldforge[bf_user_lockout_enabled]" value="1"
                <?php checked( Shieldforge_Settings::get( 'bf_user_lockout_enabled', true ) ); ?>>
            <span><?php esc_html_e( 'Lock individual accounts after too many failed logins', 'brainwerk-security-suite' ); ?></span>
        </label>

        <table class="form-table" role="presentation">
            <tr>
                <th scope="row"><?php esc_html_e( 'Failure threshold (per account)', 'brainwerk-security-suite' ); ?></th>
                <td>
                    <input type="number" min="1" max="100" class="small-text"
                           name="shieldforge[bf_user_lockout_threshold]"
                           value="<?php echo esc_attr( Shieldforge_Settings::get( 'bf_user_lockout_threshold', 8 ) ); ?>">
                    <p class="description"><?php esc_html_e( 'Total failed attempts on the same username (across all IPs) before the account is locked.', 'brainwerk-security-suite' ); ?></p>
                </td>
            </tr>
            <tr>
                <th scope="row"><?php esc_html_e( 'Window (minutes)', 'brainwerk-security-suite' ); ?></th>
                <td>
                    <input type="number" min="1" max="1440" class="small-text"
                           name="shieldforge[bf_user_lockout_window_min]"
                           value="<?php echo esc_attr( Shieldforge_Settings::get( 'bf_user_lockout_window_min', 15 ) ); ?>">
                </td>
            </tr>
            <tr>
                <th scope="row"><?php esc_html_e( 'Lockout duration (minutes)', 'brainwerk-security-suite' ); ?></th>
                <td>
                    <input type="number" min="1" max="1440" class="small-text"
                           name="shieldforge[bf_user_lockout_minutes]"
                           value="<?php echo esc_attr( Shieldforge_Settings::get( 'bf_user_lockout_minutes', 15 ) ); ?>">
                </td>
            </tr>
        </table>
    </div>

    <p><button type="submit" class="button button-primary"><?php esc_html_e( 'Save changes', 'brainwerk-security-suite' ); ?></button></p>
</form>
