<?php
/**
 * Hardening+ tab — three new layered defenses (Phase 5e):
 *   1. Custom login URL (rewrite wp-login.php → /[slug]/)
 *   2. Honeypot (login + register + comment forms)
 *   3. Security headers (incl. CSP)
 *
 * @package Brainwerk Security Suite
 */

if ( ! defined( 'ABSPATH' ) ) {
    exit;
}

$lu_enabled    = (bool) Shieldforge_Settings::get( 'login_url_enabled', false );
$lu_slug       = (string) Shieldforge_Settings::get( 'login_url_slug', '' );
$hp_enabled    = (bool) Shieldforge_Settings::get( 'honeypot_enabled', true );
$hp_login      = (bool) Shieldforge_Settings::get( 'honeypot_login', true );
$hp_register   = (bool) Shieldforge_Settings::get( 'honeypot_register', true );
$hp_comment    = (bool) Shieldforge_Settings::get( 'honeypot_comment', true );

$h_xcto        = (bool) Shieldforge_Settings::get( 'hardening_header_xcto', true );
$h_xfo         = (bool) Shieldforge_Settings::get( 'hardening_header_xfo', true );
$h_referrer    = (bool) Shieldforge_Settings::get( 'hardening_header_referrer', true );
$h_permissions = (bool) Shieldforge_Settings::get( 'hardening_header_permissions', true );
$h_hsts        = (bool) Shieldforge_Settings::get( 'hardening_header_hsts', true );
$csp_enabled   = (bool) Shieldforge_Settings::get( 'hardening_csp_enabled', false );
$csp_report    = (bool) Shieldforge_Settings::get( 'hardening_csp_report_only', true );
$csp_value     = (string) Shieldforge_Settings::get( 'hardening_csp_value', '' );

$home          = home_url( '/' );
$lu_preview    = $lu_slug ? trailingslashit( $home ) . $lu_slug . '/' : '';

$badge_enabled = (bool) Shieldforge_Settings::get( 'badge_enabled', false );
?>

<div class="shieldforge-card">
    <h2><?php esc_html_e( '"Secured by" footer badge', 'brainwerk-security-suite' ); ?></h2>
    <p class="muted">
        <?php esc_html_e( 'Shows a small trust badge in your site footer that signals visitors the site is protected. Off by default — turn it on if you want to display it.', 'brainwerk-security-suite' ); ?>
    </p>
    <form method="post" action="">
        <?php wp_nonce_field( Shieldforge_Admin::NONCE ); ?>
        <input type="hidden" name="shieldforge_action" value="save_settings">
        <input type="hidden" name="shieldforge_tab_keys[]" value="badge_enabled">
        <table class="form-table" role="presentation">
            <tr>
                <th scope="row"><?php esc_html_e( 'Show footer badge', 'brainwerk-security-suite' ); ?></th>
                <td>
                    <label class="sf-toggle">
                        <input type="checkbox" name="shieldforge[badge_enabled]" value="1" <?php checked( $badge_enabled ); ?>>
                        <?php esc_html_e( 'Display the badge in the front-end footer', 'brainwerk-security-suite' ); ?>
                    </label>
                    <p class="description" style="margin-top:10px;">
                        <?php esc_html_e( 'Preview:', 'brainwerk-security-suite' ); ?>
                    </p>
                    <div style="display:inline-flex;align-items:center;gap:8px;padding:6px 12px;margin-top:4px;border-radius:8px;background:rgba(31,58,147,.06);border:1px solid rgba(31,58,147,.15);font:600 12px/1.2 -apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Helvetica,Arial,sans-serif;color:#1f3a93;">
                        <img src="<?php echo esc_url( SHIELDFORGE_URL . 'assets/images/secured-badge-96.png' ); ?>" width="24" height="24" alt="" style="width:24px;height:24px;display:block;">
                        <span style="white-space:nowrap;"><?php echo esc_html( sprintf( __( 'Secured by %s', 'brainwerk-security-suite' ), Shieldforge_Badge::brand_label() ) ); ?></span>
                    </div>
                    <p class="description" style="margin-top:10px;">
                        <?php esc_html_e( 'The badge links to brainwerk.at and shows "… Pro" automatically on Pro installs. With Pro whitelabel active, the brand name follows your custom brand.', 'brainwerk-security-suite' ); ?>
                    </p>
                </td>
            </tr>
        </table>
        <p>
            <button type="submit" class="button button-primary"><?php esc_html_e( 'Save', 'brainwerk-security-suite' ); ?></button>
        </p>
    </form>
</div>

<div class="shieldforge-card">
    <h2><?php esc_html_e( 'Custom login URL', 'brainwerk-security-suite' ); ?></h2>
    <p class="muted">
        <?php esc_html_e( 'Rewrite wp-login.php to a custom path. Cuts ~90% of brute-force bot traffic at the door — they all hit /wp-login.php blindly. Direct access to /wp-login.php returns a 404 instead.', 'brainwerk-security-suite' ); ?>
    </p>
    <p class="muted" style="background:#fff8e1; padding:10px 14px; border-left:3px solid #f0a361;">
        <strong><?php esc_html_e( 'Lockout-recovery:', 'brainwerk-security-suite' ); ?></strong>
        <?php esc_html_e( 'If you forget your slug, add this to wp-config.php and visit /wp-login.php?shieldforge_rescue=YOUR_TOKEN to bypass:', 'brainwerk-security-suite' ); ?>
        <br>
        <code style="display:inline-block; margin-top:6px;">define('SHIELDFORGE_LOGIN_RESCUE', 'choose-a-long-random-secret');</code>
    </p>

    <form method="post" action="">
        <?php wp_nonce_field( Shieldforge_Admin::NONCE ); ?>
        <input type="hidden" name="shieldforge_action" value="save_settings">
        <input type="hidden" name="shieldforge_tab_keys[]" value="login_url_enabled">

        <table class="form-table" role="presentation">
            <tr>
                <th scope="row"><?php esc_html_e( 'Enable custom login URL', 'brainwerk-security-suite' ); ?></th>
                <td>
                    <label class="sf-toggle">
                        <input type="checkbox" name="shieldforge[login_url_enabled]" value="1" <?php checked( $lu_enabled ); ?>>
                        <?php esc_html_e( 'Off by default — set the slug below first, then enable.', 'brainwerk-security-suite' ); ?>
                    </label>
                </td>
            </tr>
            <tr>
                <th scope="row"><?php esc_html_e( 'Slug', 'brainwerk-security-suite' ); ?></th>
                <td>
                    <code><?php echo esc_html( $home ); ?></code>
                    <input type="text" name="shieldforge[login_url_slug]" value="<?php echo esc_attr( $lu_slug ); ?>" pattern="[a-zA-Z0-9_-]+" placeholder="mylogin" style="width:200px;">
                    <code>/</code>
                    <p class="description">
                        <?php esc_html_e( 'Letters, numbers, dash, underscore. Avoid common words (admin, login, secure). Example: kogi-portal, schul-zugang.', 'brainwerk-security-suite' ); ?>
                    </p>
                    <?php if ( $lu_preview ) : ?>
                        <p style="margin-top:6px; color:#2d6a2d;"><?php esc_html_e( 'Preview:', 'brainwerk-security-suite' ); ?> <code><?php echo esc_html( $lu_preview ); ?></code></p>
                    <?php endif; ?>
                </td>
            </tr>
        </table>
        <p>
            <button type="submit" class="button button-primary"><?php esc_html_e( 'Save', 'brainwerk-security-suite' ); ?></button>
        </p>
    </form>
</div>

<div class="shieldforge-card">
    <h2><?php esc_html_e( 'Honeypot anti-bot', 'brainwerk-security-suite' ); ?></h2>
    <p class="muted">
        <?php esc_html_e( 'Adds a hidden field to login/register/comment forms. Bots fill every visible field — submissions with the hidden field non-empty are blocked. 100% local, no reCAPTCHA, no Google data transfer.', 'brainwerk-security-suite' ); ?>
    </p>
    <form method="post" action="">
        <?php wp_nonce_field( Shieldforge_Admin::NONCE ); ?>
        <input type="hidden" name="shieldforge_action" value="save_settings">
        <input type="hidden" name="shieldforge_tab_keys[]" value="honeypot_enabled">
        <input type="hidden" name="shieldforge_tab_keys[]" value="honeypot_login">
        <input type="hidden" name="shieldforge_tab_keys[]" value="honeypot_register">
        <input type="hidden" name="shieldforge_tab_keys[]" value="honeypot_comment">

        <table class="form-table" role="presentation">
            <tr>
                <th scope="row"><?php esc_html_e( 'Master toggle', 'brainwerk-security-suite' ); ?></th>
                <td>
                    <label class="sf-toggle">
                        <input type="checkbox" name="shieldforge[honeypot_enabled]" value="1" <?php checked( $hp_enabled ); ?>>
                        <?php esc_html_e( 'Enable honeypot anti-bot.', 'brainwerk-security-suite' ); ?>
                    </label>
                </td>
            </tr>
            <tr>
                <th scope="row"><?php esc_html_e( 'Surfaces', 'brainwerk-security-suite' ); ?></th>
                <td>
                    <label style="display:block; margin-bottom:4px;">
                        <input type="checkbox" name="shieldforge[honeypot_login]" value="1" <?php checked( $hp_login ); ?>>
                        <?php esc_html_e( 'Login + lost-password form', 'brainwerk-security-suite' ); ?>
                    </label>
                    <label style="display:block; margin-bottom:4px;">
                        <input type="checkbox" name="shieldforge[honeypot_register]" value="1" <?php checked( $hp_register ); ?>>
                        <?php esc_html_e( 'Registration form', 'brainwerk-security-suite' ); ?>
                    </label>
                    <label style="display:block;">
                        <input type="checkbox" name="shieldforge[honeypot_comment]" value="1" <?php checked( $hp_comment ); ?>>
                        <?php esc_html_e( 'Comment form', 'brainwerk-security-suite' ); ?>
                    </label>
                </td>
            </tr>
        </table>
        <p>
            <button type="submit" class="button button-primary"><?php esc_html_e( 'Save', 'brainwerk-security-suite' ); ?></button>
        </p>
    </form>
</div>

<div class="shieldforge-card">
    <h2><?php esc_html_e( 'Security HTTP headers', 'brainwerk-security-suite' ); ?></h2>
    <p class="muted">
        <?php esc_html_e( 'Per-header toggles. Each header is set only if your server (nginx/Apache) doesn\'t already send it — we never override a stricter policy.', 'brainwerk-security-suite' ); ?>
    </p>
    <form method="post" action="">
        <?php wp_nonce_field( Shieldforge_Admin::NONCE ); ?>
        <input type="hidden" name="shieldforge_action" value="save_settings">
        <input type="hidden" name="shieldforge_tab_keys[]" value="hardening_header_xcto">
        <input type="hidden" name="shieldforge_tab_keys[]" value="hardening_header_xfo">
        <input type="hidden" name="shieldforge_tab_keys[]" value="hardening_header_referrer">
        <input type="hidden" name="shieldforge_tab_keys[]" value="hardening_header_permissions">
        <input type="hidden" name="shieldforge_tab_keys[]" value="hardening_header_hsts">
        <input type="hidden" name="shieldforge_tab_keys[]" value="hardening_csp_enabled">
        <input type="hidden" name="shieldforge_tab_keys[]" value="hardening_csp_report_only">

        <table class="form-table" role="presentation">
            <tr>
                <th scope="row">X-Content-Type-Options</th>
                <td>
                    <label><input type="checkbox" name="shieldforge[hardening_header_xcto]" value="1" <?php checked( $h_xcto ); ?>>
                        <code>nosniff</code> — <?php esc_html_e( 'block MIME-sniff attacks', 'brainwerk-security-suite' ); ?>
                    </label>
                </td>
            </tr>
            <tr>
                <th scope="row">X-Frame-Options</th>
                <td>
                    <label><input type="checkbox" name="shieldforge[hardening_header_xfo]" value="1" <?php checked( $h_xfo ); ?>>
                        <code>SAMEORIGIN</code> — <?php esc_html_e( 'block clickjacking', 'brainwerk-security-suite' ); ?>
                    </label>
                </td>
            </tr>
            <tr>
                <th scope="row">Referrer-Policy</th>
                <td>
                    <label><input type="checkbox" name="shieldforge[hardening_header_referrer]" value="1" <?php checked( $h_referrer ); ?>>
                        <code>strict-origin-when-cross-origin</code>
                    </label>
                </td>
            </tr>
            <tr>
                <th scope="row">Permissions-Policy</th>
                <td>
                    <label><input type="checkbox" name="shieldforge[hardening_header_permissions]" value="1" <?php checked( $h_permissions ); ?>>
                        <?php esc_html_e( 'disable geolocation, microphone, camera by default', 'brainwerk-security-suite' ); ?>
                    </label>
                </td>
            </tr>
            <tr>
                <th scope="row">Strict-Transport-Security (HSTS)</th>
                <td>
                    <label><input type="checkbox" name="shieldforge[hardening_header_hsts]" value="1" <?php checked( $h_hsts ); ?>>
                        <code>max-age=31536000; includeSubDomains</code> — <?php esc_html_e( 'force HTTPS for 1 year (HTTPS-only)', 'brainwerk-security-suite' ); ?>
                    </label>
                </td>
            </tr>
            <tr>
                <th scope="row">Content-Security-Policy</th>
                <td>
                    <label><input type="checkbox" name="shieldforge[hardening_csp_enabled]" value="1" <?php checked( $csp_enabled ); ?>>
                        <?php esc_html_e( 'Enable CSP (off by default — wrong policy can break a site)', 'brainwerk-security-suite' ); ?>
                    </label>
                    <br>
                    <label style="margin-top:6px; display:inline-block;">
                        <input type="checkbox" name="shieldforge[hardening_csp_report_only]" value="1" <?php checked( $csp_report ); ?>>
                        <?php esc_html_e( 'Report-Only mode (logs violations but does not enforce — recommended for testing)', 'brainwerk-security-suite' ); ?>
                    </label>
                    <br>
                    <textarea name="shieldforge[hardening_csp_value]" rows="4" class="large-text code" style="margin-top:8px; font-family:monospace; font-size:12px;"><?php echo esc_textarea( $csp_value ); ?></textarea>
                    <p class="description">
                        <?php esc_html_e( 'Default policy is permissive enough for most WordPress + page-builder sites. Tighten gradually with Report-Only mode on, watching browser-console violations.', 'brainwerk-security-suite' ); ?>
                    </p>
                </td>
            </tr>
        </table>
        <p>
            <button type="submit" class="button button-primary"><?php esc_html_e( 'Save', 'brainwerk-security-suite' ); ?></button>
        </p>
    </form>
</div>
