<?php

/**
 * Guard Dog Login Security Page
 * 
 * Professional admin page for managing login security features including
 * custom login URLs, login attempt limiting, and two-factor authentication.
 *
 * @package GuardDog
 * @since 1.6.0
 */

if (!defined('ABSPATH')) {
    exit; // Exit if accessed directly
}

class Guard_Dog_Login_Security_Page {

    /**
     * Feature instances
     * @var array
     */
    private $features;

    /**
     * Current active tab
     * @var string
     */
    private $current_tab;

    /**
     * Available tabs configuration
     * @var array
     */
    private $tabs;

    /**
     * Constructor
     *
     * @param array $features Feature class instances
     */
    public function __construct(array $features = []) {
        $this->features = $features;
        $this->initialize_tabs();
        $this->determine_current_tab();
    }

    /**
     * Initialize tabs configuration
     */
    private function initialize_tabs(): void {
        $this->tabs = [
            'custom-url' => [
                'label' => __('Custom URL', 'guard-dog'),
                'icon' => 'dashicons-admin-links'
            ],
            'login-attempts' => [
                'label' => __('Login Attempts', 'guard-dog'),
                'icon' => 'dashicons-shield'
            ],
            'two-factor' => [
                'label' => __('Two-Factor Auth', 'guard-dog'),
                'icon' => 'dashicons-smartphone'
            ],
            'passkeys' => [
                'label' => __('Passkeys', 'guard-dog'),
                'icon' => 'dashicons-admin-network'
            ],
            'enumeration' => [
                'label' => __('User Enumeration', 'guard-dog'),
                'icon' => 'dashicons-hidden'
            ],
            'social-login' => [
                'label' => __('Social Login', 'guard-dog'),
                'icon' => 'dashicons-share'
            ],
            'login-form' => [
                'label' => __('Frontend Login Form', 'guard-dog'),
                'icon' => 'dashicons-lock'
            ]
        ];
    }

    /**
     * Determine the current active tab
     */
    private function determine_current_tab(): void {
        // Default tab
        $this->current_tab = 'custom-url';

        // Only process tab parameter if nonce is valid and parameter exists
        if (isset($_GET['tab']) && isset($_GET['_wpnonce']) && wp_verify_nonce(sanitize_text_field(wp_unslash($_GET['_wpnonce'])), 'guard_dog_login_security_tab')) {
            $tab_param = sanitize_text_field(wp_unslash($_GET['tab']));
            if (array_key_exists($tab_param, $this->tabs)) {
                $this->current_tab = $tab_param;
            }
        }
    }

    /**
     * Render the login security page
     */
    public function render(): void {
        // Prepare data for partials
        $this->prepare_page_data();
        
        // Render main page with integrated tabs
        $this->render_page_with_tabs();
    }

    /**
     * Prepare data for page partials
     */
    public function prepare_page_data(): void {
        // Custom URL data
        $current_url = get_option('guard_dog_login_slug', '');
        $custom_url_enabled = !empty($current_url);
        
        // Login attempts data
        $attempts_enabled = get_option('guard_dog_lla_enabled', false);
        $max_retries = get_option('guard_dog_lla_max_retries', 5);
        $lockout_duration = get_option('guard_dog_lla_lockout_duration', 15);
        $current_lockouts = $this->get_current_lockouts();
        
        // 2FA data - new structure
        $tfa_enabled = get_option('guard_dog_two_factor_enabled', false);
        $tfa_enforced = get_option('guard_dog_two_factor_enforced', false);
        $tfa_grace_period = get_option('guard_dog_two_factor_grace_period', 7);
        $tfa_enforcement_date = get_option('guard_dog_two_factor_enforcement_date', '');
        $users_with_2fa = $this->get_users_with_2fa();
        $users_without_2fa = $this->get_users_without_2fa();
        
        // Email 2FA data
        $email_2fa_enabled = get_option('guard_dog_email_2fa_enabled', false);
        
        // Ensure email provider class is available
        $email_provider = null;
        $email_provider_configured = false;
        $current_email_provider = '';
        $available_email_providers = [];
        $configured_providers = [];
        
        if (function_exists('Guard_Dog') && isset(Guard_Dog()->features['email_provider'])) {
            $email_provider = Guard_Dog()->features['email_provider'];
            $email_provider_configured = $email_provider->is_configured();
            $current_email_provider = $email_provider->get_current_provider();
            $all_providers = $email_provider->get_available_providers();
            
            // Show the currently configured provider (settings are stored for one provider at a time)
            $available_email_providers = $this->get_configured_email_providers($all_providers, $current_email_provider);
        } elseif (class_exists('Guard_Dog_Email_Provider')) {
            $email_provider = new Guard_Dog_Email_Provider();
            $email_provider_configured = $email_provider->is_configured();
            $current_email_provider = $email_provider->get_current_provider();
            $all_providers = $email_provider->get_available_providers();

            // Show the currently configured provider (settings are stored for one provider at a time)
            $available_email_providers = $this->get_configured_email_providers($all_providers, $current_email_provider);
        }
        
        // Passkeys data
        $passkeys_enabled = get_option('guard_dog_passkeys_enabled', false);
        $passkeys_bypass_2fa = get_option('guard_dog_passkeys_bypass_2fa', true);
        $passkeys_require_user_verification = get_option('guard_dog_passkeys_require_user_verification', true);
        $users_with_passkeys = $this->get_users_with_passkeys_count();

        // Frontend login form defaults.
        $login_form_style = get_option('guard_dog_login_form_style', 'default');
        $login_form_show_passkey = get_option('guard_dog_login_form_show_passkey', true);
        $login_form_show_social_login = get_option('guard_dog_login_form_show_social_login', true);
        $login_form_show_remember_me = get_option('guard_dog_login_form_show_remember_me', true);
        $login_form_show_lost_password = get_option('guard_dog_login_form_show_lost_password', true);
        $login_form_max_width = get_option('guard_dog_login_form_max_width', '');

        // Pass data to partials via global variables
        $GLOBALS['guard_dog_login_security_data'] = [
            'current_url' => $current_url,
            'custom_url_enabled' => $custom_url_enabled,
            'attempts_enabled' => $attempts_enabled,
            'max_retries' => $max_retries,
            'lockout_duration' => $lockout_duration,
            'current_lockouts' => $current_lockouts,
            'tfa_enabled' => $tfa_enabled,
            'tfa_enforced' => $tfa_enforced,
            'tfa_grace_period' => $tfa_grace_period,
            'tfa_enforcement_date' => $tfa_enforcement_date,
            'users_with_2fa' => $users_with_2fa,
            'users_without_2fa' => $users_without_2fa,
            'email_2fa_enabled' => $email_2fa_enabled,
            'email_provider_configured' => $email_provider_configured,
            'current_email_provider' => $current_email_provider,
            'available_email_providers' => $available_email_providers,
            'passkeys_enabled' => $passkeys_enabled,
            'passkeys_bypass_2fa' => $passkeys_bypass_2fa,
            'passkeys_require_user_verification' => $passkeys_require_user_verification,
            'users_with_passkeys' => $users_with_passkeys,
            'login_form_style' => $login_form_style,
            'login_form_show_passkey' => $login_form_show_passkey,
            'login_form_show_social_login' => $login_form_show_social_login,
            'login_form_show_remember_me' => $login_form_show_remember_me,
            'login_form_show_lost_password' => $login_form_show_lost_password,
            'login_form_max_width' => $login_form_max_width,
        ];
    }

    /**
     * Get current lockouts
     */
    private function get_current_lockouts(): array {
        $limit_login_attempts = $this->get_limit_login_attempts_feature();

        if ($limit_login_attempts && method_exists($limit_login_attempts, 'get_current_lockouts')) {
            return $limit_login_attempts->get_current_lockouts();
        }

        return [];
    }

    /**
     * Get the Limit Login Attempts feature instance.
     *
     * @return Guard_Dog_Limit_Login_Attempts|null
     */
    private function get_limit_login_attempts_feature() {
        if (isset($this->features['limit_login_attempts'])) {
            return $this->features['limit_login_attempts'];
        }

        if (function_exists('Guard_Dog') && method_exists(Guard_Dog(), 'get_feature')) {
            return Guard_Dog()->get_feature('limit_login_attempts');
        }

        if (function_exists('Guard_Dog') && isset(Guard_Dog()->features['limit_login_attempts'])) {
            return Guard_Dog()->features['limit_login_attempts'];
        }

        return null;
    }

    /**
     * Get users with 2FA enabled
     */
    private function get_users_with_2fa(): array {
        global $wpdb;
        
        // phpcs:disable WordPress.DB.SlowDBQuery.slow_db_query_meta_key,WordPress.DB.SlowDBQuery.slow_db_query_meta_value
        // This query is necessary for 2FA user management and only runs in admin context
        $users = get_users([
            'meta_key' => '_guard_dog_2fa_enabled',
            'meta_value' => '1',
            'fields' => ['ID', 'user_login', 'display_name', 'user_email']
        ]);
        // phpcs:enable WordPress.DB.SlowDBQuery.slow_db_query_meta_key,WordPress.DB.SlowDBQuery.slow_db_query_meta_value
        
        $result = [];
        foreach ($users as $user) {
            $user_obj = get_user_by('ID', $user->ID);
            $result[] = [
                'id' => $user->ID,
                'username' => $user->user_login,
                'display_name' => $user->display_name,
                'email' => $user->user_email,
                'role' => implode(', ', $user_obj->roles)
            ];
        }
        
        return $result;
    }

    /**
     * Get users without 2FA enabled
     */
    private function get_users_without_2fa(): array {
        global $wpdb;
        
        // Get all users except those with 2FA enabled
        // phpcs:disable WordPress.DB.SlowDBQuery.slow_db_query_meta_key,WordPress.DB.SlowDBQuery.slow_db_query_meta_value
        // This query is necessary for 2FA user management and only runs in admin context
        $users_with_2fa = get_users([
            'meta_key' => '_guard_dog_2fa_enabled',
            'meta_value' => '1',
            'fields' => 'ID'
        ]);
        // phpcs:enable WordPress.DB.SlowDBQuery.slow_db_query_meta_key,WordPress.DB.SlowDBQuery.slow_db_query_meta_value
        
        $exclude_ids = wp_list_pluck($users_with_2fa, 'ID');
        
        $users = get_users([
            'exclude' => $exclude_ids,
            'fields' => ['ID', 'user_login', 'display_name', 'user_email']
        ]);
        
        $result = [];
        foreach ($users as $user) {
            $user_obj = get_user_by('ID', $user->ID);
            $result[] = [
                'id' => $user->ID,
                'username' => $user->user_login,
                'display_name' => $user->display_name,
                'email' => $user->user_email,
                'role' => implode(', ', $user_obj->roles)
            ];
        }

        return $result;
    }

    /**
     * Get email providers that are fully configured.
     *
     * Checks each provider's required fields against saved settings.
     * Since Guard Dog stores settings for one provider at a time,
     * only the current provider can be configured.
     *
     * @since 1.9.31
     * @param array  $all_providers         All available providers from get_available_providers().
     * @param string $current_email_provider The currently selected provider key.
     * @return array Configured providers (subset of $all_providers).
     */
    private function get_configured_email_providers(array $all_providers, string $current_email_provider): array {
        if (empty($current_email_provider)) {
            return [];
        }

        $provider_settings = get_option('guard_dog_email_provider_settings', []);
        if (empty($provider_settings) || !isset($all_providers[$current_email_provider])) {
            return [];
        }

        $provider_config = $all_providers[$current_email_provider];
        foreach ($provider_config['fields'] as $field_key => $field_def) {
            if (!empty($field_def['required']) && empty($provider_settings[$field_key])) {
                return [];
            }
        }

        return [$current_email_provider => $provider_config];
    }

    /**
     * Get count of users with passkeys registered
     *
     * @return int Number of users with at least one passkey
     */
    private function get_users_with_passkeys_count(): int {
        global $wpdb;

        $table_name = $wpdb->prefix . 'guard_dog_passkeys';

        // Check if table exists first
        // phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching
        // Direct database query is necessary to check for custom table existence.
        // Caching is not appropriate as this is a one-time check per page load.
        $table_exists = $wpdb->get_var(
            $wpdb->prepare(
                'SHOW TABLES LIKE %s',
                $table_name
            )
        );
        // phpcs:enable WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching

        if (!$table_exists) {
            return 0;
        }

        // phpcs:disable WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching
        // Direct database query is necessary for custom passkeys table statistics.
        // Caching is not appropriate for dashboard statistics as they need to reflect current state.
        $escaped_table_name = esc_sql($table_name);
        $count = $wpdb->get_var("SELECT COUNT(DISTINCT user_id) FROM $escaped_table_name");
        // phpcs:enable WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching

        return (int) $count;
    }

    /**
     * Register settings
     */
    public static function register_settings(): void {
        // Register custom login URL settings
        register_setting('guard_dog_login_security', 'guard_dog_login_slug', [
            'type' => 'string',
            'sanitize_callback' => 'sanitize_text_field',
            'default' => '',
        ]);
        
        // Register login attempt limiting settings
        register_setting('guard_dog_login_security', 'guard_dog_lla_enabled', [
            'type' => 'boolean',
            'sanitize_callback' => function($input) {
                return !empty($input);
            },
            'default' => false,
        ]);
        
        register_setting('guard_dog_login_security', 'guard_dog_lla_max_retries', [
            'type' => 'integer',
            'sanitize_callback' => function($input) {
                return max(1, min(20, intval($input))); // Between 1 and 20 attempts
            },
            'default' => 5,
        ]);
        
        register_setting('guard_dog_login_security', 'guard_dog_lla_lockout_duration', [
            'type' => 'integer',
            'sanitize_callback' => function($input) {
                return max(1, min(1440, intval($input))); // Between 1 and 1440 minutes (24 hours)
            },
            'default' => 15,
        ]);

        // Register two-factor authentication settings
        register_setting('guard_dog_login_security', 'guard_dog_two_factor_enabled', [
            'type' => 'boolean',
            'sanitize_callback' => function($input) {
                return !empty($input);
            },
            'default' => false,
        ]);
        
        register_setting('guard_dog_login_security', 'guard_dog_two_factor_enforced', [
            'type' => 'boolean',
            'sanitize_callback' => function($input) {
                $enforcing = !empty($input);

                if (!$enforcing) {
                    update_option('guard_dog_two_factor_enforcement_date', '');
                }

                // If trying to enable enforcement, check that at least one 2FA method is enabled
                if ($enforcing) {
                    $tfa_enabled = get_option('guard_dog_two_factor_enabled', false);
                    $email_2fa_enabled = get_option('guard_dog_email_2fa_enabled', false);
                    
                    // Check if at least one method is enabled (checking POST data first since settings may not be saved yet)
                    // phpcs:disable WordPress.Security.NonceVerification.Missing
                    // Nonce verification is handled by WordPress Settings API
                    if (isset($_POST['guard_dog_two_factor_enabled'])) {
                        $tfa_enabled = !empty($_POST['guard_dog_two_factor_enabled']);
                    }
                    if (isset($_POST['guard_dog_email_2fa_enabled'])) {
                        $email_2fa_enabled = !empty($_POST['guard_dog_email_2fa_enabled']);
                    }
                    // phpcs:enable WordPress.Security.NonceVerification.Missing
                    
                    if (!$tfa_enabled && !$email_2fa_enabled) {
                        // Cannot enforce if no 2FA methods are enabled
                        add_settings_error(
                            'guard_dog_two_factor_enforced',
                            'guard_dog_enforcement_no_methods',
                            __('Cannot enforce 2FA: At least one 2FA method (app-based or email-based) must be enabled before enforcement can be activated.', 'guard-dog'),
                            'error'
                        );
                        return false; // Return current value instead of new value
                    }
                    
                    // Set enforcement date if this is the first time enabling enforcement
                    $current_enforcement_date = get_option('guard_dog_two_factor_enforcement_date', '');
                    if (empty($current_enforcement_date)) {
                        update_option('guard_dog_two_factor_enforcement_date', current_time('timestamp'));
                    }
                }
                
                return $enforcing;
            },
            'default' => false,
        ]);
        
        register_setting('guard_dog_login_security', 'guard_dog_two_factor_grace_period', [
            'type' => 'integer',
            'sanitize_callback' => function($input) {
                return max(0, min(365, intval($input))); // Between 0 and 365 days
            },
            'default' => 7,
        ]);
        
        register_setting('guard_dog_login_security', 'guard_dog_two_factor_enforcement_date', [
            'type' => 'string',
            'sanitize_callback' => 'sanitize_text_field',
            'default' => '',
        ]);

        // Register email 2FA settings
        register_setting('guard_dog_login_security', 'guard_dog_email_2fa_enabled', [
            'type' => 'boolean',
            'sanitize_callback' => function($input) {
                return !empty($input);
            },
            'default' => false,
        ]);
        
        register_setting('guard_dog_login_security', 'guard_dog_email_provider', [
            'type' => 'string',
            'sanitize_callback' => function($input) {
                // If email provider field is not present in the form submission (e.g., saving from Login Security tab),
                // preserve the existing value instead of clearing it
                if (!isset($_POST['guard_dog_email_provider']) && ((string) $input) === '') {
                    return get_option('guard_dog_email_provider', '');
                }
                return sanitize_key((string) $input);
            },
            'default' => '',
        ]);
        
        register_setting('guard_dog_login_security', 'guard_dog_email_provider_settings', [
            'type' => 'array',
            'sanitize_callback' => function($input) {
                $has_submitted_settings = isset($_POST['guard_dog_email_provider_settings']) && is_array($_POST['guard_dog_email_provider_settings']);

                if (!is_array($input)) {
                    return get_option('guard_dog_email_provider_settings', []);
                }

                $form_submitted = isset($input['__submitted']) && (string) $input['__submitted'] === '1';
                if ($form_submitted) {
                    unset($input['__submitted']);
                    $has_submitted_settings = true;
                }

                // If email provider settings are not present in the form submission (e.g., saving from Login Security tab),
                // preserve existing settings. Allow programmatic update_option() calls with array payload.
                if (!$has_submitted_settings && $input === []) {
                    return get_option('guard_dog_email_provider_settings', []);
                }

                $existing_settings = get_option('guard_dog_email_provider_settings', []);
                $provider = isset($_POST['guard_dog_email_provider'])
                    ? sanitize_key((string) wp_unslash($_POST['guard_dog_email_provider']))
                    : sanitize_key((string) get_option('guard_dog_email_provider', ''));

                if ($has_submitted_settings && $input === []) {
                    return [];
                }

                if (class_exists('Guard_Dog_Email_Provider')) {
                    return Guard_Dog_Email_Provider::sanitize_provider_settings($provider, $input, $existing_settings);
                }

                $sanitized = [];
                foreach ($input as $key => $value) {
                    $sanitized[sanitize_text_field((string) $key)] = sanitize_text_field((string) $value);
                }

                return $sanitized;
            },
            'default' => [],
        ]);

        // Register passkeys settings
        register_setting('guard_dog_login_security', 'guard_dog_passkeys_enabled', [
            'type' => 'boolean',
            'sanitize_callback' => function($input) {
                return !empty($input);
            },
            'default' => false,
        ]);

        // These callbacks must NOT consult $_POST. An unchecked checkbox is already
        // handled: wp-admin/options.php passes null for any registered option absent
        // from the submission, and !empty(null) is false. Inspecting $_POST added
        // nothing for the form case while forcing false for every write that is not
        // a settings-form POST - so `wp option update ... 1`, a migration, or any
        // programmatic enable silently stored the opposite of what was asked for.
        register_setting('guard_dog_login_security', 'guard_dog_passkeys_bypass_2fa', [
            'type' => 'boolean',
            'sanitize_callback' => function($input) {
                return !empty($input);
            },
            'default' => true,
        ]);

        register_setting('guard_dog_login_security', 'guard_dog_passkeys_require_user_verification', [
            'type' => 'boolean',
            'sanitize_callback' => function($input) {
                return !empty($input);
            },
            'default' => true,
        ]);

        // User enumeration protection settings
        register_setting('guard_dog_login_security', 'guard_dog_enum_enabled', [
            'type' => 'boolean',
            'sanitize_callback' => function($input) {
                return !empty($input);
            },
            'default' => false,
        ]);

        register_setting('guard_dog_login_security', 'guard_dog_enum_bypass_roles', [
            'type' => 'array',
            'sanitize_callback' => function($input) {
                if (!is_array($input)) {
                    return ['administrator'];
                }
                return array_map('sanitize_text_field', $input);
            },
            'default' => ['administrator'],
        ]);

        register_setting('guard_dog_login_security', 'guard_dog_enum_auto_block_enabled', [
            'type' => 'boolean',
            'sanitize_callback' => function($input) {
                return !empty($input);
            },
            'default' => true,
        ]);

        register_setting('guard_dog_login_security', 'guard_dog_enum_auto_block_threshold', [
            'type' => 'integer',
            'sanitize_callback' => function($input) {
                return max(5, min(100, intval($input)));
            },
            'default' => 20,
        ]);

        register_setting('guard_dog_login_security', 'guard_dog_enum_auto_block_window', [
            'type' => 'integer',
            'sanitize_callback' => function($input) {
                return max(5, min(1440, intval($input)));
            },
            'default' => 60,
        ]);

        register_setting('guard_dog_login_security', 'guard_dog_enum_auto_block_duration', [
            'type' => 'integer',
            'sanitize_callback' => function($input) {
                return max(15, min(10080, intval($input)));
            },
            'default' => 1440,
        ]);

        // Per-vector blocking settings
        $vector_settings = [
            'guard_dog_enum_rest_api_block',
            'guard_dog_enum_author_archives_block',
            'guard_dog_enum_login_errors_block',
            'guard_dog_enum_password_reset_block',
            'guard_dog_enum_xmlrpc_block',
            'guard_dog_enum_oembed_block',
            'guard_dog_enum_registration_block',
        ];

        foreach ($vector_settings as $setting) {
            register_setting('guard_dog_login_security', $setting, [
                'type' => 'boolean',
                'sanitize_callback' => function($input) use ($setting) {
                    // phpcs:ignore WordPress.Security.NonceVerification.Missing
                    if (!isset($_POST[$setting])) {
                        return false;
                    }
                    return !empty($input);
                },
                'default' => true,
            ]);
        }

        // Notification settings
        register_setting('guard_dog_login_security', 'guard_dog_enum_alert_immediate_enabled', [
            'type' => 'boolean',
            'sanitize_callback' => function($input) {
                return !empty($input);
            },
            'default' => false,
        ]);

        register_setting('guard_dog_login_security', 'guard_dog_enum_alert_immediate_threshold', [
            'type' => 'integer',
            'sanitize_callback' => function($input) {
                return max(3, min(100, intval($input)));
            },
            'default' => 10,
        ]);

        register_setting('guard_dog_login_security', 'guard_dog_enum_alert_immediate_window', [
            'type' => 'integer',
            'sanitize_callback' => function($input) {
                return max(1, min(60, intval($input)));
            },
            'default' => 5,
        ]);

        register_setting('guard_dog_login_security', 'guard_dog_enum_alert_immediate_email', [
            'type' => 'string',
            'sanitize_callback' => 'sanitize_email',
            'default' => '',
        ]);

        register_setting('guard_dog_login_security', 'guard_dog_enum_alert_immediate_cooldown', [
            'type' => 'integer',
            'sanitize_callback' => function($input) {
                return max(15, min(1440, intval($input)));
            },
            'default' => 60,
        ]);

        register_setting('guard_dog_login_security', 'guard_dog_enum_alert_digest_enabled', [
            'type' => 'boolean',
            'sanitize_callback' => function($input) {
                return !empty($input);
            },
            'default' => false,
        ]);

        register_setting('guard_dog_login_security', 'guard_dog_enum_alert_digest_frequency', [
            'type' => 'string',
            'sanitize_callback' => function($input) {
                return in_array($input, ['daily', 'weekly'], true) ? $input : 'weekly';
            },
            'default' => 'weekly',
        ]);

        register_setting('guard_dog_login_security', 'guard_dog_enum_alert_digest_threshold', [
            'type' => 'integer',
            'sanitize_callback' => function($input) {
                return max(10, min(1000, intval($input)));
            },
            'default' => 50,
        ]);

        register_setting('guard_dog_login_security', 'guard_dog_enum_alert_digest_email', [
            'type' => 'string',
            'sanitize_callback' => 'sanitize_email',
            'default' => '',
        ]);

        // Social Login settings (same option group as other login security settings)
        register_setting('guard_dog_login_security', 'guard_dog_social_login_enabled', [
            'type' => 'boolean',
            'sanitize_callback' => 'rest_sanitize_boolean',
            'default' => false,
        ]);
        register_setting('guard_dog_login_security', 'guard_dog_social_google_enabled', [
            'type' => 'boolean',
            'sanitize_callback' => 'rest_sanitize_boolean',
            'default' => false,
        ]);
        register_setting('guard_dog_login_security', 'guard_dog_social_google_client_id', [
            'type' => 'string',
            'sanitize_callback' => 'sanitize_text_field',
            'default' => '',
        ]);
        register_setting('guard_dog_login_security', 'guard_dog_social_google_client_secret', [
            'type' => 'string',
            'sanitize_callback' => 'sanitize_text_field',
            'default' => '',
        ]);
        register_setting('guard_dog_login_security', 'guard_dog_social_microsoft_enabled', [
            'type' => 'boolean',
            'sanitize_callback' => 'rest_sanitize_boolean',
            'default' => false,
        ]);
        register_setting('guard_dog_login_security', 'guard_dog_social_microsoft_client_id', [
            'type' => 'string',
            'sanitize_callback' => 'sanitize_text_field',
            'default' => '',
        ]);
        register_setting('guard_dog_login_security', 'guard_dog_social_microsoft_client_secret', [
            'type' => 'string',
            'sanitize_callback' => 'sanitize_text_field',
            'default' => '',
        ]);
        register_setting('guard_dog_login_security', 'guard_dog_social_apple_enabled', [
            'type' => 'boolean',
            'sanitize_callback' => 'rest_sanitize_boolean',
            'default' => false,
        ]);
        register_setting('guard_dog_login_security', 'guard_dog_social_apple_client_id', [
            'type' => 'string',
            'sanitize_callback' => 'sanitize_text_field',
            'default' => '',
        ]);
        register_setting('guard_dog_login_security', 'guard_dog_social_apple_team_id', [
            'type' => 'string',
            'sanitize_callback' => static function ( $value ) {
                $value = sanitize_text_field( $value );
                if ( ! empty( $value ) && ! preg_match( '/^[A-Z0-9]{10}$/', $value ) ) {
                    add_settings_error(
                        'guard_dog_social_apple_team_id',
                        'invalid_team_id',
                        __( 'Apple Team ID must be a 10-character alphanumeric string.', 'guard-dog' )
                    );
                    return get_option( 'guard_dog_social_apple_team_id', '' );
                }
                return $value;
            },
            'default' => '',
        ]);
        register_setting('guard_dog_login_security', 'guard_dog_social_apple_key_id', [
            'type' => 'string',
            'sanitize_callback' => static function ( $value ) {
                $value = sanitize_text_field( $value );
                if ( ! empty( $value ) && ! preg_match( '/^[A-Z0-9]{10}$/', $value ) ) {
                    add_settings_error(
                        'guard_dog_social_apple_key_id',
                        'invalid_key_id',
                        __( 'Apple Key ID must be a 10-character alphanumeric string.', 'guard-dog' )
                    );
                    return get_option( 'guard_dog_social_apple_key_id', '' );
                }
                return $value;
            },
            'default' => '',
        ]);
        register_setting('guard_dog_login_security', 'guard_dog_social_apple_key_file', [
            'type' => 'string',
            'sanitize_callback' => static function ( $value ) {
                $value = Guard_Dog_Apple_Provider::normalize_key_file( sanitize_textarea_field( $value ) );
                // If the placeholder is submitted, keep the existing stored value
                if ( $value === '********' ) {
                    return get_option( 'guard_dog_social_apple_key_file', '' );
                }
                if ( empty( $value ) ) {
                    return '';
                }
                // Validate it looks like a PEM private key
                if ( strpos( $value, '-----BEGIN PRIVATE KEY-----' ) === false ) {
                    add_settings_error(
                        'guard_dog_social_apple_key_file',
                        'invalid_key_file',
                        __( 'Apple private key must be a PEM-formatted .p8 key starting with -----BEGIN PRIVATE KEY-----.', 'guard-dog' )
                    );
                    return get_option( 'guard_dog_social_apple_key_file', '' );
                }
                if ( ! Guard_Dog_Apple_Provider::is_valid_private_key( $value ) ) {
                    add_settings_error(
                        'guard_dog_social_apple_key_file',
                        'invalid_private_key_contents',
                        __( 'Apple private key could not be parsed. Paste the raw contents of the .p8 file, including the BEGIN/END PRIVATE KEY lines.', 'guard-dog' )
                    );
                    return get_option( 'guard_dog_social_apple_key_file', '' );
                }
                return Guard_Dog_Apple_Provider::encrypt_key( $value );
            },
            'default' => '',
        ]);
        register_setting('guard_dog_login_security', 'guard_dog_social_auto_link_email', [
            'type' => 'boolean',
            'sanitize_callback' => 'rest_sanitize_boolean',
            'default' => false,
        ]);
        register_setting('guard_dog_login_security', 'guard_dog_social_auto_create_users', [
            'type' => 'boolean',
            'sanitize_callback' => 'rest_sanitize_boolean',
            'default' => false,
        ]);
        register_setting('guard_dog_login_security', 'guard_dog_social_new_user_role', [
            'type' => 'string',
            'sanitize_callback' => 'sanitize_text_field',
            'default' => 'subscriber',
        ]);
        register_setting('guard_dog_login_security', 'guard_dog_social_bypass_2fa', [
            'type' => 'boolean',
            'sanitize_callback' => 'rest_sanitize_boolean',
            'default' => false,
        ]);

        register_setting('guard_dog_login_security', 'guard_dog_login_form_style', [
            'type' => 'string',
            'sanitize_callback' => static function($input) {
                $style = sanitize_key((string) $input);
                if (!in_array($style, ['default', 'minimal', 'compact'], true)) {
                    return 'default';
                }
                return $style;
            },
            'default' => 'default',
        ]);

        register_setting('guard_dog_login_security', 'guard_dog_login_form_show_passkey', [
            'type' => 'boolean',
            'sanitize_callback' => static function($input) {
                // phpcs:disable WordPress.Security.NonceVerification.Missing
                // Nonce verification is handled by WordPress Settings API.
                return isset($_POST['guard_dog_login_form_show_passkey']) ? !empty($input) : false;
                // phpcs:enable WordPress.Security.NonceVerification.Missing
            },
            'default' => true,
        ]);

        register_setting('guard_dog_login_security', 'guard_dog_login_form_show_social_login', [
            'type' => 'boolean',
            'sanitize_callback' => static function($input) {
                // phpcs:disable WordPress.Security.NonceVerification.Missing
                // Nonce verification is handled by WordPress Settings API.
                return isset($_POST['guard_dog_login_form_show_social_login']) ? !empty($input) : false;
                // phpcs:enable WordPress.Security.NonceVerification.Missing
            },
            'default' => true,
        ]);

        register_setting('guard_dog_login_security', 'guard_dog_login_form_show_remember_me', [
            'type' => 'boolean',
            'sanitize_callback' => static function($input) {
                // phpcs:disable WordPress.Security.NonceVerification.Missing
                // Nonce verification is handled by WordPress Settings API.
                return isset($_POST['guard_dog_login_form_show_remember_me']) ? !empty($input) : false;
                // phpcs:enable WordPress.Security.NonceVerification.Missing
            },
            'default' => true,
        ]);

        register_setting('guard_dog_login_security', 'guard_dog_login_form_show_lost_password', [
            'type' => 'boolean',
            'sanitize_callback' => static function($input) {
                // phpcs:disable WordPress.Security.NonceVerification.Missing
                // Nonce verification is handled by WordPress Settings API.
                return isset($_POST['guard_dog_login_form_show_lost_password']) ? !empty($input) : false;
                // phpcs:enable WordPress.Security.NonceVerification.Missing
            },
            'default' => true,
        ]);

        register_setting('guard_dog_login_security', 'guard_dog_login_form_max_width', [
            'type' => 'string',
            'sanitize_callback' => static function($input) {
                $input = is_string($input) ? trim($input) : '';
                if ($input === '') {
                    return '';
                }

                $width = absint($input);
                if ($width === 0) {
                    return '';
                }

                if ($width < Guard_Dog_Login_Form::MAX_WIDTH_MIN) {
                    return (string) Guard_Dog_Login_Form::MAX_WIDTH_MIN;
                }

                if ($width > Guard_Dog_Login_Form::MAX_WIDTH_MAX) {
                    return (string) Guard_Dog_Login_Form::MAX_WIDTH_MAX;
                }

                return (string) $width;
            },
            'default' => '',
        ]);

        // Add settings sections and fields
        add_action('admin_init', [self::class, 'add_settings_sections']);
    }

    /**
     * Add settings sections and fields
     */
    public static function add_settings_sections(): void {
        // Add custom login URL section
        add_settings_section(
            'guard_dog_login_url_section',
            __('Custom Login URL', 'guard-dog'),
            [self::class, 'render_login_url_section_description'],
            'guard_dog_login_security'
        );

        // Add login URL slug field
        add_settings_field(
            'guard_dog_login_slug',
            __('Login URL Slug', 'guard-dog'),
            [self::class, 'render_login_slug_field'],
            'guard_dog_login_security',
            'guard_dog_login_url_section'
        );

        // Add login attempt limiting section
        add_settings_section(
            'guard_dog_login_attempts_section',
            __('Login Attempt Limiting', 'guard-dog'),
            [self::class, 'render_login_attempts_section_description'],
            'guard_dog_login_security'
        );

        // Add login attempts enabled field
        add_settings_field(
            'guard_dog_lla_enabled',
            __('Enable Login Attempt Limiting', 'guard-dog'),
            [self::class, 'render_login_attempts_enabled_field'],
            'guard_dog_login_security',
            'guard_dog_login_attempts_section'
        );

        // Add max retries field
        add_settings_field(
            'guard_dog_lla_max_retries',
            __('Maximum Retries', 'guard-dog'),
            [self::class, 'render_max_retries_field'],
            'guard_dog_login_security',
            'guard_dog_login_attempts_section'
        );

        // Add lockout duration field
        add_settings_field(
            'guard_dog_lla_lockout_duration',
            __('Lockout Duration (Minutes)', 'guard-dog'),
            [self::class, 'render_lockout_duration_field'],
            'guard_dog_login_security',
            'guard_dog_login_attempts_section'
        );

        // Add two-factor authentication section
        add_settings_section(
            'guard_dog_two_factor_section',
            __('Two-Factor Authentication', 'guard-dog'),
            [self::class, 'render_two_factor_section_description'],
            'guard_dog_login_security'
        );

        // Add 2FA enabled field
        add_settings_field(
            'guard_dog_two_factor_enabled',
            __('Enable Two-Factor Authentication', 'guard-dog'),
            [self::class, 'render_two_factor_enabled_field'],
            'guard_dog_login_security',
            'guard_dog_two_factor_section'
        );

        // Add 2FA enforced field
        add_settings_field(
            'guard_dog_two_factor_enforced',
            __('Enforce Two-Factor Authentication', 'guard-dog'),
            [self::class, 'render_two_factor_enforced_field'],
            'guard_dog_login_security',
            'guard_dog_two_factor_section'
        );

        // Add grace period field
        add_settings_field(
            'guard_dog_two_factor_grace_period',
            __('Grace Period (Days)', 'guard-dog'),
            [self::class, 'render_grace_period_field'],
            'guard_dog_login_security',
            'guard_dog_two_factor_section'
        );

        // Add email 2FA enabled field
        add_settings_field(
            'guard_dog_email_2fa_enabled',
            __('Enable Email Two-Factor Authentication', 'guard-dog'),
            [self::class, 'render_email_2fa_enabled_field'],
            'guard_dog_login_security',
            'guard_dog_two_factor_section'
        );

        // Add email provider field
        add_settings_field(
            'guard_dog_email_provider',
            __('Email Provider', 'guard-dog'),
            [self::class, 'render_email_provider_field'],
            'guard_dog_login_security',
            'guard_dog_two_factor_section'
        );
    }

    /**
     * Render section descriptions
     */
    public static function render_login_url_section_description(): void {
        ?>
        <p><?php esc_html_e('Configure a custom login URL to hide the default WordPress login page.', 'guard-dog'); ?></p>
        <?php
    }

    public static function render_login_attempts_section_description(): void {
        ?>
        <p><?php esc_html_e('Configure login attempt limiting to prevent brute force attacks.', 'guard-dog'); ?></p>
        <?php
    }

    public static function render_two_factor_section_description(): void {
        ?>
        <p><?php esc_html_e('Configure two-factor authentication for enhanced security.', 'guard-dog'); ?></p>
        <?php
    }

    /**
     * Render field methods
     */
    public static function render_login_slug_field(): void {
        $slug = get_option('guard_dog_login_slug', '');
        ?>
        <input type="text" name="guard_dog_login_slug" value="<?php echo esc_attr($slug); ?>" class="regular-text" placeholder="secure-login" />
        <p class="description"><?php esc_html_e('Enter a custom slug for your login URL (e.g., "secure-login" for /secure-login/).', 'guard-dog'); ?></p>
        <?php
    }

    public static function render_login_attempts_enabled_field(): void {
        $enabled = get_option('guard_dog_lla_enabled', false);
        ?>
        <input type="checkbox" name="guard_dog_lla_enabled" value="1" <?php checked($enabled, true); ?> />
        <p class="description"><?php esc_html_e('Enable login attempt limiting.', 'guard-dog'); ?></p>
        <?php
    }

    public static function render_max_retries_field(): void {
        $max_retries = get_option('guard_dog_lla_max_retries', 5);
        ?>
        <input type="number" name="guard_dog_lla_max_retries" value="<?php echo esc_attr($max_retries); ?>" min="1" max="20" class="small-text" />
        <p class="description"><?php esc_html_e('Maximum login attempts before lockout (1-20).', 'guard-dog'); ?></p>
        <?php
    }

    public static function render_lockout_duration_field(): void {
        $duration = get_option('guard_dog_lla_lockout_duration', 15);
        ?>
        <input type="number" name="guard_dog_lla_lockout_duration" value="<?php echo esc_attr($duration); ?>" min="1" max="1440" class="small-text" />
        <p class="description"><?php esc_html_e('Lockout duration in minutes (1-1440).', 'guard-dog'); ?></p>
        <?php
    }

    public static function render_two_factor_enabled_field(): void {
        $enabled = get_option('guard_dog_two_factor_enabled', false);
        ?>
        <input type="checkbox" name="guard_dog_two_factor_enabled" value="1" <?php checked($enabled, true); ?> />
        <p class="description"><?php esc_html_e('Enable two-factor authentication.', 'guard-dog'); ?></p>
        <?php
    }

    public static function render_two_factor_enforced_field(): void {
        $enforced = get_option('guard_dog_two_factor_enforced', false);
        ?>
        <input type="checkbox" name="guard_dog_two_factor_enforced" value="1" <?php checked($enforced, true); ?> />
        <p class="description"><?php esc_html_e('Require two-factor authentication for all users.', 'guard-dog'); ?></p>
        <?php
    }

    public static function render_grace_period_field(): void {
        $grace_period = get_option('guard_dog_two_factor_grace_period', 7);
        ?>
        <input type="number" name="guard_dog_two_factor_grace_period" value="<?php echo esc_attr($grace_period); ?>" min="0" max="365" class="small-text" />
        <p class="description"><?php esc_html_e('Grace period in days before 2FA enforcement (0-365).', 'guard-dog'); ?></p>
        <?php
    }

    public static function render_email_2fa_enabled_field(): void {
        $enabled = get_option('guard_dog_email_2fa_enabled', false);
        ?>
        <input type="checkbox" name="guard_dog_email_2fa_enabled" value="1" <?php checked($enabled, true); ?> />
        <p class="description"><?php esc_html_e('Enable email-based two-factor authentication as an alternative to app-based 2FA.', 'guard-dog'); ?></p>
        <?php
    }

    public static function render_email_provider_field(): void {
        $current_provider = get_option('guard_dog_email_provider', '');
        $email_provider = new Guard_Dog_Email_Provider();
        $available_providers = $email_provider->get_available_providers();
        ?>
        <select name="guard_dog_email_provider" id="guard_dog_email_provider">
            <option value=""><?php esc_html_e('Select Email Provider', 'guard-dog'); ?></option>
            <?php foreach ($available_providers as $provider_key => $provider_config): ?>
                <option value="<?php echo esc_attr($provider_key); ?>" <?php selected($current_provider, $provider_key); ?>>
                    <?php echo esc_html($provider_config['name']); ?>
                </option>
            <?php endforeach; ?>
        </select>
        <p class="description"><?php esc_html_e('Select your email service provider for sending 2FA codes.', 'guard-dog'); ?></p>
        
        <div id="email-provider-config" class="guard-dog-email-provider-config">
            <?php if (!empty($current_provider) && isset($available_providers[$current_provider])): ?>
                <h4><?php echo esc_html($available_providers[$current_provider]['name']); ?> Configuration</h4>
                <table class="form-table">
                    <?php
                    // Email provider form rendering - output is trusted HTML from internal class
                    // Use wp_kses with form-specific allowed tags since this is trusted internal output
                    $allowed_form_tags = [
                        'tr' => [],
                        'th' => ['scope' => []],
                        'td' => [],
                        'label' => ['for' => []],
                        'span' => ['class' => []],
                        'input' => [
                            'type' => [],
                            'id' => [],
                            'name' => [],
                            'value' => [],
                            'class' => [],
                            'required' => []
                        ],
                        'select' => [
                            'id' => [],
                            'name' => [],
                            'required' => []
                        ],
                        'option' => [
                            'value' => [],
                            'selected' => []
                        ],
                        'p' => ['class' => []]
                    ];
                    echo wp_kses($email_provider->render_provider_form($current_provider), $allowed_form_tags);
                    ?>
                </table>
            <?php endif; ?>
        </div>
        <?php
    }

    /**
     * Render the page with integrated tabbed interface
     */
    private function render_page_with_tabs(): void {
        // Get data from global variables
        $login_security_data = $GLOBALS['guard_dog_login_security_data'] ?? [];
        
        ?>
        <div class="wrap guard-dog-admin">
            <h1 class="guard-dog-page-title">
                <span class="dashicons dashicons-admin-users"></span>
                <?php esc_html_e('Login Security', 'guard-dog'); ?>
            </h1>
            
            <p class="guard-dog-page-subtitle">
                <?php esc_html_e('Configure custom login URLs, passkeys, social sign-in, and frontend login defaults to lock down your WordPress auth flow.', 'guard-dog'); ?>
            </p>

            <?php 
            // Display settings messages (success/error notifications)
            settings_errors('guard_dog_login_security');
            ?>

            <div class="guard-dog-admin-grid">
                <div class="guard-dog-main-content">
                    <form method="post" action="options.php" class="guard-dog-settings-form">
                        <?php 
                        // Add WordPress Settings API fields
                        settings_fields('guard_dog_login_security');
                        ?>

                        <!-- Integrated Tabbed Interface -->
                        <div class="guard-dog-tabbed-interface">
                            <nav class="guard-dog-tab-nav">
                                <?php foreach ($this->tabs as $tab_id => $tab_config): ?>
                                    <a href="<?php echo esc_url(add_query_arg(['tab' => $tab_id, '_wpnonce' => wp_create_nonce('guard_dog_login_security_tab')])); ?>" 
                                       class="guard-dog-tab-link<?php echo esc_attr($this->current_tab === $tab_id ? ' active' : ''); ?>" 
                                       data-tab="<?php echo esc_attr($tab_id); ?>"
                                       data-storage-key="guard_dog_login_security_active_tab">
                                        <?php if (isset($tab_config['icon'])): ?>
                                            <span class="dashicons <?php echo esc_attr($tab_config['icon']); ?>"></span>
                                        <?php endif; ?>
                                        <?php echo esc_html($tab_config['label']); ?>
                                    </a>
                                <?php endforeach; ?>
                            </nav>

                            <div class="guard-dog-tab-content">
                                <?php foreach ($this->tabs as $tab_id => $tab_config): ?>
                                    <div id="<?php echo esc_attr($tab_id); ?>" 
                                         class="guard-dog-tab-panel<?php echo esc_attr($this->current_tab === $tab_id ? ' active' : ''); ?>">
                                        <?php $this->render_tab_content($tab_id, $login_security_data); ?>
                                    </div>
                                <?php endforeach; ?>
                            </div>
                        </div>
                        
                        <p class="submit">
                            <input type="submit" name="submit" class="button-primary" value="<?php esc_attr_e('Save Login Security Settings', 'guard-dog'); ?>">
                        </p>
                    </form>
                </div>

                <div class="guard-dog-sidebar">
                    <?php $this->render_security_overview(); ?>
                </div>
            </div>
        </div>
        <?php
    }

    /**
     * Render content for a specific tab
     *
     * @param string $tab_id The tab identifier
     * @param array $data The page data
     */
    private function render_tab_content(string $tab_id, array $data): void {
        switch ($tab_id) {
            case 'custom-url':
                $this->render_custom_url_tab($data);
                break;
            case 'login-attempts':
                $this->render_login_attempts_tab($data);
                break;
            case 'two-factor':
                $this->render_two_factor_tab($data);
                break;
            case 'passkeys':
                $this->render_passkeys_tab($data);
                break;
            case 'enumeration':
                $this->render_enumeration_tab($data);
                break;
            case 'social-login':
                $this->render_social_login_tab($data);
                break;
            case 'login-form':
                $this->render_login_form_tab($data);
                break;
            default:
                ?>
                <p><?php esc_html_e('Invalid tab selected.', 'guard-dog'); ?></p>
                <?php
                break;
        }
    }

    /**
     * Render the custom URL tab content
     *
     * @param array $data The page data
     */
    public function render_custom_url_tab(array $data): void {
        $current_url = $data['current_url'] ?? '';
        $custom_url_enabled = $data['custom_url_enabled'] ?? false;
        
        ?>
        <h3>
            <span class="dashicons dashicons-admin-links"></span>
            <?php esc_html_e('Custom Login URL', 'guard-dog'); ?>
        </h3>

        <p><?php esc_html_e('Hide your WordPress login page by changing the default /wp-login.php URL to something custom.', 'guard-dog'); ?></p>

        <table class="guard-dog-form-table">
            <tr>
                <th><?php esc_html_e('Custom Login URL Slug', 'guard-dog'); ?></th>
                <td>
                    <input type="text" name="guard_dog_login_slug" value="<?php echo esc_attr($current_url); ?>" class="regular-text" />
                    <p class="description">
                        <?php
                        // Translators: %s is the default login slug.
                        printf(esc_html__('Enter the desired slug for your custom login URL (e.g., "secure-login"). Default: %s', 'guard-dog'), '<code>my-login</code>');
                        ?>
                    </p>
                    <?php if ($custom_url_enabled): ?>
                        <p class="guard-dog-current-url">
                            <strong><?php esc_html_e('Current Login URL:', 'guard-dog'); ?></strong>
                            <code><?php echo esc_url(site_url('/' . $current_url . '/')); ?></code>
                        </p>
                    <?php endif; ?>
                </td>
            </tr>
        </table>

        <?php if ($custom_url_enabled): ?>
            <div class="guard-dog-help-section">
                <h4><?php esc_html_e('Help & Tips', 'guard-dog'); ?></h4>
                <ul>
                    <li><?php esc_html_e('Make sure to bookmark your new login URL - you\'ll need it to access your site!', 'guard-dog'); ?></li>
                    <li><?php esc_html_e('The old /wp-login.php URL will redirect to a 404 page for security.', 'guard-dog'); ?></li>
                    <li><?php esc_html_e('If you forget your custom URL, you can always access it via FTP and edit the plugin settings.', 'guard-dog'); ?></li>
                </ul>
            </div>
        <?php endif;
    }

    /**
     * Render the login attempts tab content
     *
     * @param array $data The page data
     */
    public function render_login_attempts_tab(array $data): void {
        $attempts_enabled = $data['attempts_enabled'] ?? false;
        $max_retries = $data['max_retries'] ?? 5;
        $lockout_duration = $data['lockout_duration'] ?? 15;
        $current_lockouts = $data['current_lockouts'] ?? [];
        
        ?>
        <h3>
            <span class="dashicons dashicons-shield"></span>
            <?php esc_html_e('Login Attempt Limiting', 'guard-dog'); ?>
        </h3>

        <p><?php esc_html_e('Protect against brute force attacks by limiting the number of failed login attempts from each IP address.', 'guard-dog'); ?></p>

        <table class="guard-dog-form-table">
            <tr>
                <th><?php esc_html_e('Enable Protection', 'guard-dog'); ?></th>
                <td>
                    <label>
                        <input type="checkbox" name="guard_dog_lla_enabled" value="1" <?php checked($attempts_enabled); ?> />
                        <?php esc_html_e('Enable login attempt limiting', 'guard-dog'); ?>
                    </label>
                    <p class="description"><?php esc_html_e('Recommended for all sites to prevent brute force attacks.', 'guard-dog'); ?></p>
                </td>
            </tr>
            <tr class="guard-dog-dependent-field">
                <th><?php esc_html_e('Max Attempts', 'guard-dog'); ?></th>
                <td>
                    <input type="number" name="guard_dog_lla_max_retries" value="<?php echo esc_attr($max_retries); ?>" min="1" max="20" />
                    <p class="description"><?php esc_html_e('Number of failed attempts before lockout. Default: 5', 'guard-dog'); ?></p>
                </td>
            </tr>
            <tr class="guard-dog-dependent-field">
                <th><?php esc_html_e('Lockout Duration', 'guard-dog'); ?></th>
                <td>
                    <input type="number" name="guard_dog_lla_lockout_duration" value="<?php echo esc_attr($lockout_duration); ?>" min="1" max="1440" />
                    <p class="description"><?php esc_html_e('Minutes to lock out IP after max attempts. Default: 15', 'guard-dog'); ?></p>
                </td>
            </tr>
        </table>

        <?php if ($attempts_enabled && !empty($current_lockouts)): ?>
            <?php $this->render_current_lockouts($current_lockouts); ?>
        <?php endif;
    }

    /**
     * Render the two-factor authentication tab content
     *
     * @param array $data The page data
     */
    public function render_two_factor_tab(array $data): void {
        $tfa_enabled = $data['tfa_enabled'] ?? false;
        $tfa_enforced = $data['tfa_enforced'] ?? false;
        $tfa_grace_period = $data['tfa_grace_period'] ?? 7;
        $tfa_enforcement_date = $data['tfa_enforcement_date'] ?? '';
        $users_with_2fa = $data['users_with_2fa'] ?? [];
        $users_without_2fa = $data['users_without_2fa'] ?? [];
        $email_2fa_enabled = $data['email_2fa_enabled'] ?? false;
        $email_provider_configured = $data['email_provider_configured'] ?? false;
        $current_email_provider = $data['current_email_provider'] ?? '';
        $available_email_providers = $data['available_email_providers'] ?? [];

        // Calculate enforcement status
        $enforcement_active = $tfa_enforced && $tfa_enforcement_date;
        $days_until_enforcement = 0;
        if ($enforcement_active) {
            $enforcement_timestamp = intval($tfa_enforcement_date) + ($tfa_grace_period * DAY_IN_SECONDS);
            $days_until_enforcement = max(0, ceil(($enforcement_timestamp - current_time('timestamp')) / DAY_IN_SECONDS));
        }
        
        ?>
        <h3>
            <span class="dashicons dashicons-smartphone"></span>
            <?php esc_html_e('Two-Factor Authentication', 'guard-dog'); ?>
        </h3>

        <p><?php esc_html_e('Add an extra layer of security by requiring a second authentication factor (TOTP) for user logins.', 'guard-dog'); ?></p>

        <table class="guard-dog-form-table">
            <tr>
                <th><?php esc_html_e('Enable 2FA', 'guard-dog'); ?></th>
                <td>
                    <label>
                        <input type="checkbox" name="guard_dog_two_factor_enabled" value="1" <?php checked($tfa_enabled); ?> />
                        <?php esc_html_e('Enable two-factor authentication (optional for users)', 'guard-dog'); ?>
                    </label>
                    <p class="description"><?php esc_html_e('Users can then optionally set up 2FA on their profile page.', 'guard-dog'); ?></p>
                </td>
            </tr>
            
            <!-- EMAIL 2FA OPTIONS START -->
            <tr>
                <th><?php esc_html_e('Enable Email 2FA', 'guard-dog'); ?></th>
                <td>
                    <label>
                        <input type="checkbox" name="guard_dog_email_2fa_enabled" value="1" <?php checked($email_2fa_enabled); ?> />
                        <?php esc_html_e('Enable email-based two-factor authentication', 'guard-dog'); ?>
                    </label>
                    <p class="description"><?php esc_html_e('Users can choose between app-based and email-based 2FA.', 'guard-dog'); ?></p>
                </td>
            </tr>
            <!-- EMAIL 2FA OPTIONS END -->
            
            <tr class="guard-dog-dependent-field">
                <th><?php esc_html_e('Enforce 2FA', 'guard-dog'); ?></th>
                <td>
                    <label>
                        <input type="checkbox" name="guard_dog_two_factor_enforced" value="1" <?php checked($tfa_enforced); ?> />
                        <?php esc_html_e('Require all users to set up 2FA', 'guard-dog'); ?>
                    </label>
                    <p class="description">
                        <?php 
                        if ($tfa_enabled && $email_2fa_enabled) {
                            esc_html_e('When enabled, all users must set up at least one 2FA method (app-based or email-based) within the grace period. Users can optionally set up both methods for extra security.', 'guard-dog');
                        } elseif ($tfa_enabled) {
                            esc_html_e('When enabled, all users must set up app-based 2FA within the grace period.', 'guard-dog');
                        } elseif ($email_2fa_enabled) {
                            esc_html_e('When enabled, all users must set up email-based 2FA within the grace period.', 'guard-dog');
                        } else {
                            esc_html_e('When enabled, all users must set up 2FA within the grace period. At least one 2FA method (app-based or email-based) must be enabled globally before enforcement can be activated.', 'guard-dog');
                        }
                        ?>
                    </p>
                    
                    <?php if ($tfa_enforced): ?>
                        <div class="guard-dog-notice-info">
                            <p><strong><?php esc_html_e('Enforcement Status:', 'guard-dog'); ?></strong></p>
                            <?php if ($enforcement_active): ?>
                                <p>
                                    <?php if ($days_until_enforcement > 0): ?>
                                        <?php 
                                        // Translators: %d is the number of days remaining for users to set up 2FA.
                                        printf(esc_html__('Users have %d days remaining to set up 2FA.', 'guard-dog'), (int) $days_until_enforcement); 
                                        ?>
                                    <?php else: ?>
                                        <strong><?php esc_html_e('Enforcement is now active. Users without 2FA cannot log in.', 'guard-dog'); ?></strong>
                                    <?php endif; ?>
                                </p>
                            <?php else: ?>
                                <p><?php esc_html_e('Enforcement will begin when you save these settings.', 'guard-dog'); ?></p>
                            <?php endif; ?>
                        </div>
                    <?php endif; ?>
                </td>
            </tr>
            
            <tr class="guard-dog-dependent-field">
                <th><?php esc_html_e('Grace Period', 'guard-dog'); ?></th>
                <td>
                    <input type="number" name="guard_dog_two_factor_grace_period" value="<?php echo esc_attr($tfa_grace_period); ?>" min="1" max="90" />
                    <p class="description"><?php esc_html_e('Number of days users have to set up 2FA before being locked out. (1-90 days)', 'guard-dog'); ?></p>
                </td>
            </tr>
        </table>

        <!-- EMAIL PROVIDER STATUS -->
        <?php if ($email_2fa_enabled): ?>
            <?php if ($email_provider_configured): ?>
                <div class="guard-dog-notice-info">
                    <p><strong><?php esc_html_e('Email Provider Status:', 'guard-dog'); ?></strong> <?php esc_html_e('Email provider is configured and ready to send 2FA codes.', 'guard-dog'); ?></p>
                </div>
            <?php else: ?>
                <div class="guard-dog-notice-warning">
                    <p><strong><?php esc_html_e('Email Provider Status:', 'guard-dog'); ?></strong> 
                    <?php esc_html_e('Email provider is not configured. Please configure your email provider in', 'guard-dog'); ?> 
                    <a href="<?php echo esc_url(admin_url('admin.php?page=guard-dog-settings&tab=email_provider')); ?>"><?php esc_html_e('Settings → Email Provider', 'guard-dog'); ?></a> 
                    <?php esc_html_e('to enable email 2FA.', 'guard-dog'); ?></p>
                </div>
            <?php endif; ?>
        <?php endif; ?>
        <!-- EMAIL PROVIDER STATUS END -->

        <?php if ($tfa_enabled): ?>
            <div class="guard-dog-2fa-status-section">
                <h4><?php esc_html_e('User 2FA Status', 'guard-dog'); ?></h4>
                
                <div class="guard-dog-2fa-stats">
                    <div class="guard-dog-stat-card">
                        <h5><?php esc_html_e('Users with 2FA', 'guard-dog'); ?></h5>
                        <div class="guard-dog-stat-number"><?php echo esc_html(count($users_with_2fa)); ?></div>
                    </div>
                    
                    <div class="guard-dog-stat-card">
                        <h5><?php esc_html_e('Users without 2FA', 'guard-dog'); ?></h5>
                        <div class="guard-dog-stat-number"><?php echo esc_html(count($users_without_2fa)); ?></div>
                    </div>
                </div>
                
                <?php if (!empty($users_with_2fa)): ?>
                    <div class="guard-dog-2fa-users-section">
                        <h5><?php esc_html_e('Users with 2FA Enabled', 'guard-dog'); ?></h5>
                        <table class="guard-dog-2fa-users-table">
                            <thead>
                                <tr>
                                    <th><?php esc_html_e('Username', 'guard-dog'); ?></th>
                                    <th><?php esc_html_e('Display Name', 'guard-dog'); ?></th>
                                    <th><?php esc_html_e('Role', 'guard-dog'); ?></th>
                                    <th><?php esc_html_e('Actions', 'guard-dog'); ?></th>
                                </tr>
                            </thead>
                            <tbody>
                                <?php foreach ($users_with_2fa as $user): ?>
                                    <tr>
                                        <td><?php echo esc_html($user['username']); ?></td>
                                        <td><?php echo esc_html($user['display_name']); ?></td>
                                        <td><?php echo esc_html($user['role']); ?></td>
                                        <td>
                                            <a href="<?php echo esc_url(admin_url('user-edit.php?user_id=' . $user['id'])); ?>" class="button button-small">
                                                <?php esc_html_e('Edit User', 'guard-dog'); ?>
                                            </a>
                                        </td>
                                    </tr>
                                <?php endforeach; ?>
                            </tbody>
                        </table>
                    </div>
                <?php endif; ?>
                
                <?php if (!empty($users_without_2fa) && $tfa_enforced): ?>
                    <div class="guard-dog-2fa-users-section">
                        <h5><?php esc_html_e('Users Without 2FA (Action Required)', 'guard-dog'); ?></h5>
                        <div class="guard-dog-warning-notice">
                            <strong><?php esc_html_e('Warning:', 'guard-dog'); ?></strong> 
                            <?php esc_html_e('These users will be unable to log in once the grace period expires.', 'guard-dog'); ?>
                        </div>
                        <table class="guard-dog-2fa-users-table">
                            <thead>
                                <tr>
                                    <th><?php esc_html_e('Username', 'guard-dog'); ?></th>
                                    <th><?php esc_html_e('Display Name', 'guard-dog'); ?></th>
                                    <th><?php esc_html_e('Role', 'guard-dog'); ?></th>
                                    <th><?php esc_html_e('Actions', 'guard-dog'); ?></th>
                                </tr>
                            </thead>
                            <tbody>
                                <?php foreach ($users_without_2fa as $user): ?>
                                    <tr>
                                        <td><?php echo esc_html($user['username']); ?></td>
                                        <td><?php echo esc_html($user['display_name']); ?></td>
                                        <td><?php echo esc_html($user['role']); ?></td>
                                        <td>
                                            <a href="<?php echo esc_url(admin_url('user-edit.php?user_id=' . $user['id'])); ?>" class="button button-small">
                                                <?php esc_html_e('Edit User', 'guard-dog'); ?>
                                            </a>
                                        </td>
                                    </tr>
                                <?php endforeach; ?>
                            </tbody>
                        </table>
                    </div>
                <?php endif; ?>
            </div>
            
            <div class="guard-dog-2fa-setup-help">
                <h4><?php esc_html_e('How to Set Up 2FA', 'guard-dog'); ?></h4>
                <ol>
                    <li><?php esc_html_e('Go to Users → Your Profile', 'guard-dog'); ?></li>
                    <li><?php esc_html_e('Scroll down to the "Two-Factor Authentication" section', 'guard-dog'); ?></li>
                    <li><?php esc_html_e('Click "Enable Two-Factor Authentication"', 'guard-dog'); ?></li>
                    <li><?php esc_html_e('Scan the QR code with your authenticator app (Google Authenticator, Authy, etc.)', 'guard-dog'); ?></li>
                    <li><?php esc_html_e('Enter the 6-digit code from your app to verify setup', 'guard-dog'); ?></li>
                    <li><?php esc_html_e('Save your recovery codes in a secure location', 'guard-dog'); ?></li>
                </ol>
                
                <?php if ($tfa_enforced): ?>
                    <div class="guard-dog-notice-info">
                        <p><strong><?php esc_html_e('Important for Site Administrators:', 'guard-dog'); ?></strong></p>
                        <p><?php esc_html_e('When 2FA is enforced, all users must set up 2FA within the grace period. Consider:', 'guard-dog'); ?></p>
                        <ul>
                            <li><?php esc_html_e('Communicating the requirement to all users', 'guard-dog'); ?></li>
                            <li><?php esc_html_e('Providing training or documentation', 'guard-dog'); ?></li>
                            <li><?php esc_html_e('Setting up support procedures for users who need help', 'guard-dog'); ?></li>
                            <li><?php esc_html_e('Monitoring user adoption and addressing resistance', 'guard-dog'); ?></li>
                        </ul>
                    </div>
                <?php endif; ?>
            </div>
        <?php endif;
    }

    /**
     * Render the passkeys tab content
     *
     * @param array $data The page data
     */
    public function render_passkeys_tab(array $data): void {
        $passkeys_enabled = $data['passkeys_enabled'] ?? false;
        $passkeys_bypass_2fa = $data['passkeys_bypass_2fa'] ?? true;
        $passkeys_require_user_verification = $data['passkeys_require_user_verification'] ?? true;
        $users_with_passkeys = $data['users_with_passkeys'] ?? 0;

        // Check if WebAuthn library is available
        $webauthn_available = class_exists('GuardDog\Vendor\Webauthn\PublicKeyCredentialSource');

        ?>
        <h3>
            <span class="dashicons dashicons-admin-network"></span>
            <?php esc_html_e('Passkey Authentication', 'guard-dog'); ?>
        </h3>

        <p><?php esc_html_e('Allow users to sign in with passkeys (Touch ID, Face ID, Windows Hello, or security keys) for passwordless authentication.', 'guard-dog'); ?></p>

        <?php if (!$webauthn_available): ?>
            <div class="guard-dog-notice-warning">
                <p><strong><?php esc_html_e('WebAuthn Library Not Available', 'guard-dog'); ?></strong></p>
                <p><?php esc_html_e('The WebAuthn library is required for passkey authentication. Please run "composer install" in the plugin directory to install dependencies.', 'guard-dog'); ?></p>
            </div>
        <?php endif; ?>

        <div class="guard-dog-status-box">
            <p>
                <strong><?php esc_html_e('Status:', 'guard-dog'); ?></strong>
                <?php
                printf(
                    esc_html(
                        /* translators: %d is the number of users with passkeys registered. */
                        _n('%d user has registered passkeys', '%d users have registered passkeys', $users_with_passkeys, 'guard-dog')
                    ),
                    (int) $users_with_passkeys
                );
                ?>
            </p>
        </div>

        <table class="guard-dog-form-table">
            <tr>
                <th><?php esc_html_e('Enable Passkeys', 'guard-dog'); ?></th>
                <td>
                    <label>
                        <input type="checkbox"
                               name="guard_dog_passkeys_enabled"
                               value="1"
                               <?php checked($passkeys_enabled); ?>
                               <?php disabled(!$webauthn_available); ?> />
                        <?php esc_html_e('Enable passkey authentication', 'guard-dog'); ?>
                    </label>
                    <p class="description">
                        <?php esc_html_e('Allow users to register and sign in with passkeys (Touch ID, Face ID, Windows Hello, security keys).', 'guard-dog'); ?>
                    </p>
                </td>
            </tr>

            <tr class="guard-dog-dependent-field">
                <th><?php esc_html_e('Bypass Two-Factor Auth', 'guard-dog'); ?></th>
                <td>
                    <label>
                        <?php
                        // Deliberately NOT rendered with disabled(): a disabled checkbox
                        // is not submitted, and the sanitize callback treats an absent
                        // field as "unchecked". Rendering this checked-but-disabled while
                        // passkeys were off meant the first save after enabling passkeys
                        // silently stored it as off. Dependency is conveyed visually by
                        // the .guard-dog-dependent-field row class, which is how the
                        // login-attempt and 2FA dependent fields on this page behave too.
                        ?>
                        <input type="checkbox"
                               name="guard_dog_passkeys_bypass_2fa"
                               value="1"
                               <?php checked($passkeys_bypass_2fa); ?> />
                        <?php esc_html_e('Users signing in with a passkey skip the 2FA step', 'guard-dog'); ?>
                    </label>
                    <p class="description">
                        <?php esc_html_e('Passkeys already provide strong two-factor authentication (something you have + biometric). Recommended to keep enabled.', 'guard-dog'); ?>
                    </p>
                </td>
            </tr>

            <tr class="guard-dog-dependent-field">
                <th><?php esc_html_e('Require User Verification', 'guard-dog'); ?></th>
                <td>
                    <label>
                        <input type="checkbox"
                               name="guard_dog_passkeys_require_user_verification"
                               value="1"
                               <?php checked($passkeys_require_user_verification); ?> />
                        <?php esc_html_e('Require biometric or PIN when using passkey', 'guard-dog'); ?>
                    </label>
                    <p class="description">
                        <?php esc_html_e('Ensures the user proves their identity with a biometric (fingerprint, face) or PIN. Recommended for maximum security.', 'guard-dog'); ?>
                    </p>
                </td>
            </tr>
        </table>

        <?php if ($passkeys_enabled): ?>
            <div class="guard-dog-help-section">
                <h4><?php esc_html_e('Browser Compatibility', 'guard-dog'); ?></h4>
                <p><?php esc_html_e('Passkeys are supported in modern browsers:', 'guard-dog'); ?></p>
                <ul>
                    <li><?php esc_html_e('Chrome 67+ (desktop and Android)', 'guard-dog'); ?></li>
                    <li><?php esc_html_e('Safari 14+ (macOS and iOS)', 'guard-dog'); ?></li>
                    <li><?php esc_html_e('Firefox 60+', 'guard-dog'); ?></li>
                    <li><?php esc_html_e('Edge 18+', 'guard-dog'); ?></li>
                </ul>
            </div>

            <div class="guard-dog-help-section">
                <h4><?php esc_html_e('How Users Set Up Passkeys', 'guard-dog'); ?></h4>
                <ol>
                    <li><?php esc_html_e('Use Users → Your Profile, or a frontend Guard Dog account-security widget if your site provides one.', 'guard-dog'); ?></li>
                    <li><?php esc_html_e('Open the Passkeys section and click "Register Passkey."', 'guard-dog'); ?></li>
                    <li><?php esc_html_e('Follow the browser prompts on the device or security key you want to register.', 'guard-dog'); ?></li>
                    <li><?php esc_html_e('Use Touch ID, Face ID, Windows Hello, or a security key to complete registration.', 'guard-dog'); ?></li>
                </ol>
            </div>
        <?php endif;
    }

    /**
     * Render the user enumeration tab content
     *
     * @param array $data The page data
     */
    public function render_enumeration_tab(array $data): void {
        $enum_enabled = get_option('guard_dog_enum_enabled', false);
        $bypass_roles = get_option('guard_dog_enum_bypass_roles', ['administrator']);
        $auto_block_enabled = get_option('guard_dog_enum_auto_block_enabled', true);
        $auto_block_threshold = get_option('guard_dog_enum_auto_block_threshold', 20);
        $auto_block_window = get_option('guard_dog_enum_auto_block_window', 60);
        $auto_block_duration = get_option('guard_dog_enum_auto_block_duration', 1440);

        // Per-vector settings
        $rest_api_block = get_option('guard_dog_enum_rest_api_block', true);
        $author_archives_block = get_option('guard_dog_enum_author_archives_block', true);
        $login_errors_block = get_option('guard_dog_enum_login_errors_block', true);
        $password_reset_block = get_option('guard_dog_enum_password_reset_block', true);
        $xmlrpc_block = get_option('guard_dog_enum_xmlrpc_block', true);
        $oembed_block = get_option('guard_dog_enum_oembed_block', true);
        $registration_block = get_option('guard_dog_enum_registration_block', true);

        // Notification settings
        $alert_immediate_enabled = get_option('guard_dog_enum_alert_immediate_enabled', false);
        $alert_immediate_threshold = get_option('guard_dog_enum_alert_immediate_threshold', 10);
        $alert_immediate_window = get_option('guard_dog_enum_alert_immediate_window', 5);
        $alert_immediate_email = get_option('guard_dog_enum_alert_immediate_email', get_option('admin_email'));
        $alert_digest_enabled = get_option('guard_dog_enum_alert_digest_enabled', false);
        $alert_digest_frequency = get_option('guard_dog_enum_alert_digest_frequency', 'weekly');
        $alert_digest_threshold = get_option('guard_dog_enum_alert_digest_threshold', 50);
        $alert_digest_email = get_option('guard_dog_enum_alert_digest_email', get_option('admin_email'));

        // Get all WordPress roles
        $wp_roles = wp_roles();
        $all_roles = $wp_roles->get_names();

        ?>
        <h3>
            <span class="dashicons dashicons-hidden"></span>
            <?php esc_html_e('User Enumeration Protection', 'guard-dog'); ?>
        </h3>

        <p><?php esc_html_e('Protect against attacks that try to discover valid usernames on your site through various WordPress endpoints and features.', 'guard-dog'); ?></p>

        <table class="guard-dog-form-table">
            <tr>
                <th><?php esc_html_e('Enable Protection', 'guard-dog'); ?></th>
                <td>
                    <label>
                        <input type="checkbox" name="guard_dog_enum_enabled" value="1" <?php checked($enum_enabled); ?> />
                        <?php esc_html_e('Enable user enumeration protection', 'guard-dog'); ?>
                    </label>
                    <p class="description"><?php esc_html_e('Block or log attempts to enumerate users through various WordPress endpoints.', 'guard-dog'); ?></p>
                </td>
            </tr>
        </table>

        <h4><?php esc_html_e('Protection Vectors', 'guard-dog'); ?></h4>
        <p class="description"><?php esc_html_e('Checked vectors will be blocked. Unchecked vectors will still be logged but not blocked.', 'guard-dog'); ?></p>

        <table class="guard-dog-form-table">
            <tr>
                <th><?php esc_html_e('REST API Users', 'guard-dog'); ?></th>
                <td>
                    <label>
                        <input type="checkbox" name="guard_dog_enum_rest_api_block" value="1" <?php checked($rest_api_block); ?> />
                        <?php esc_html_e('Block /wp-json/wp/v2/users endpoint', 'guard-dog'); ?>
                    </label>
                    <p class="description"><?php esc_html_e('Prevents anonymous access to the REST API users endpoint.', 'guard-dog'); ?></p>
                </td>
            </tr>
            <tr>
                <th><?php esc_html_e('Author Archives', 'guard-dog'); ?></th>
                <td>
                    <label>
                        <input type="checkbox" name="guard_dog_enum_author_archives_block" value="1" <?php checked($author_archives_block); ?> />
                        <?php esc_html_e('Block ?author=N enumeration', 'guard-dog'); ?>
                    </label>
                    <p class="description"><?php esc_html_e('Prevents sequential ID scanning via author archive URLs.', 'guard-dog'); ?></p>
                </td>
            </tr>
            <tr>
                <th><?php esc_html_e('Login Errors', 'guard-dog'); ?></th>
                <td>
                    <label>
                        <input type="checkbox" name="guard_dog_enum_login_errors_block" value="1" <?php checked($login_errors_block); ?> />
                        <?php esc_html_e('Use generic "Invalid credentials" message', 'guard-dog'); ?>
                    </label>
                    <p class="description"><?php esc_html_e('Replaces revealing error messages like "Unknown username" with generic errors.', 'guard-dog'); ?></p>
                </td>
            </tr>
            <tr>
                <th><?php esc_html_e('Password Reset', 'guard-dog'); ?></th>
                <td>
                    <label>
                        <input type="checkbox" name="guard_dog_enum_password_reset_block" value="1" <?php checked($password_reset_block); ?> />
                        <?php esc_html_e('Use generic "Check your email" message', 'guard-dog'); ?>
                    </label>
                    <p class="description"><?php esc_html_e('Shows the same message whether or not the email exists.', 'guard-dog'); ?></p>
                </td>
            </tr>
            <tr>
                <th><?php esc_html_e('XML-RPC', 'guard-dog'); ?></th>
                <td>
                    <label>
                        <input type="checkbox" name="guard_dog_enum_xmlrpc_block" value="1" <?php checked($xmlrpc_block); ?> />
                        <?php esc_html_e('Remove user enumeration methods', 'guard-dog'); ?>
                    </label>
                    <p class="description"><?php esc_html_e('Removes wp.getAuthors, wp.getUsers, wp.getUsersBlogs methods.', 'guard-dog'); ?></p>
                </td>
            </tr>
            <tr>
                <th><?php esc_html_e('oEmbed', 'guard-dog'); ?></th>
                <td>
                    <label>
                        <input type="checkbox" name="guard_dog_enum_oembed_block" value="1" <?php checked($oembed_block); ?> />
                        <?php esc_html_e('Strip author data from embeds', 'guard-dog'); ?>
                    </label>
                    <p class="description"><?php esc_html_e('Removes author_name and author_url from oEmbed responses.', 'guard-dog'); ?></p>
                </td>
            </tr>
            <tr>
                <th><?php esc_html_e('Registration', 'guard-dog'); ?></th>
                <td>
                    <label>
                        <input type="checkbox" name="guard_dog_enum_registration_block" value="1" <?php checked($registration_block); ?> />
                        <?php esc_html_e('Use generic registration errors', 'guard-dog'); ?>
                    </label>
                    <p class="description"><?php esc_html_e('Hides "username exists" and "email exists" errors.', 'guard-dog'); ?></p>
                </td>
            </tr>
        </table>

        <h4><?php esc_html_e('Bypass Settings', 'guard-dog'); ?></h4>

        <table class="guard-dog-form-table">
            <tr>
                <th><?php esc_html_e('Bypass Roles', 'guard-dog'); ?></th>
                <td>
                    <fieldset>
                        <?php foreach ($all_roles as $role_key => $role_name): ?>
                            <label style="display: inline-block; margin-right: 15px;">
                                <input type="checkbox"
                                       name="guard_dog_enum_bypass_roles[]"
                                       value="<?php echo esc_attr($role_key); ?>"
                                       <?php checked(in_array($role_key, $bypass_roles, true)); ?> />
                                <?php echo esc_html(translate_user_role($role_name)); ?>
                            </label>
                        <?php endforeach; ?>
                    </fieldset>
                    <p class="description"><?php esc_html_e('Users with these roles can access protected endpoints normally.', 'guard-dog'); ?></p>
                </td>
            </tr>
        </table>

        <h4><?php esc_html_e('Auto-Block', 'guard-dog'); ?></h4>

        <table class="guard-dog-form-table">
            <tr>
                <th><?php esc_html_e('Enable Auto-Block', 'guard-dog'); ?></th>
                <td>
                    <label>
                        <input type="checkbox" name="guard_dog_enum_auto_block_enabled" value="1" <?php checked($auto_block_enabled); ?> />
                        <?php esc_html_e('Automatically block IPs after repeated attempts', 'guard-dog'); ?>
                    </label>
                </td>
            </tr>
            <tr class="guard-dog-dependent-field">
                <th><?php esc_html_e('Block Threshold', 'guard-dog'); ?></th>
                <td>
                    <input type="number" name="guard_dog_enum_auto_block_threshold" value="<?php echo esc_attr($auto_block_threshold); ?>" min="5" max="100" class="small-text" />
                    <?php esc_html_e('attempts within', 'guard-dog'); ?>
                    <input type="number" name="guard_dog_enum_auto_block_window" value="<?php echo esc_attr($auto_block_window); ?>" min="5" max="1440" class="small-text" />
                    <?php esc_html_e('minutes', 'guard-dog'); ?>
                </td>
            </tr>
            <tr class="guard-dog-dependent-field">
                <th><?php esc_html_e('Block Duration', 'guard-dog'); ?></th>
                <td>
                    <input type="number" name="guard_dog_enum_auto_block_duration" value="<?php echo esc_attr($auto_block_duration); ?>" min="15" max="10080" class="small-text" />
                    <?php esc_html_e('minutes', 'guard-dog'); ?>
                    <p class="description"><?php esc_html_e('How long to block the IP (1440 = 24 hours).', 'guard-dog'); ?></p>
                </td>
            </tr>
        </table>

        <h4><?php esc_html_e('Notifications', 'guard-dog'); ?></h4>

        <table class="guard-dog-form-table">
            <tr>
                <th><?php esc_html_e('Immediate Alerts', 'guard-dog'); ?></th>
                <td>
                    <label>
                        <input type="checkbox" name="guard_dog_enum_alert_immediate_enabled" value="1" <?php checked($alert_immediate_enabled); ?> />
                        <?php esc_html_e('Send email alert when threshold reached', 'guard-dog'); ?>
                    </label>
                </td>
            </tr>
            <tr class="guard-dog-dependent-field">
                <th><?php esc_html_e('Alert Threshold', 'guard-dog'); ?></th>
                <td>
                    <input type="number" name="guard_dog_enum_alert_immediate_threshold" value="<?php echo esc_attr($alert_immediate_threshold); ?>" min="3" max="100" class="small-text" />
                    <?php esc_html_e('attempts in', 'guard-dog'); ?>
                    <input type="number" name="guard_dog_enum_alert_immediate_window" value="<?php echo esc_attr($alert_immediate_window); ?>" min="1" max="60" class="small-text" />
                    <?php esc_html_e('minutes', 'guard-dog'); ?>
                </td>
            </tr>
            <tr class="guard-dog-dependent-field">
                <th><?php esc_html_e('Alert Email', 'guard-dog'); ?></th>
                <td>
                    <input type="email" name="guard_dog_enum_alert_immediate_email" value="<?php echo esc_attr($alert_immediate_email); ?>" class="regular-text" />
                </td>
            </tr>
            <tr>
                <th><?php esc_html_e('Digest Emails', 'guard-dog'); ?></th>
                <td>
                    <label>
                        <input type="checkbox" name="guard_dog_enum_alert_digest_enabled" value="1" <?php checked($alert_digest_enabled); ?> />
                        <?php esc_html_e('Send periodic digest of enumeration attempts', 'guard-dog'); ?>
                    </label>
                </td>
            </tr>
            <tr class="guard-dog-dependent-field">
                <th><?php esc_html_e('Digest Frequency', 'guard-dog'); ?></th>
                <td>
                    <select name="guard_dog_enum_alert_digest_frequency">
                        <option value="daily" <?php selected($alert_digest_frequency, 'daily'); ?>><?php esc_html_e('Daily', 'guard-dog'); ?></option>
                        <option value="weekly" <?php selected($alert_digest_frequency, 'weekly'); ?>><?php esc_html_e('Weekly', 'guard-dog'); ?></option>
                    </select>
                    <?php esc_html_e('if at least', 'guard-dog'); ?>
                    <input type="number" name="guard_dog_enum_alert_digest_threshold" value="<?php echo esc_attr($alert_digest_threshold); ?>" min="10" max="1000" class="small-text" />
                    <?php esc_html_e('attempts', 'guard-dog'); ?>
                </td>
            </tr>
            <tr class="guard-dog-dependent-field">
                <th><?php esc_html_e('Digest Email', 'guard-dog'); ?></th>
                <td>
                    <input type="email" name="guard_dog_enum_alert_digest_email" value="<?php echo esc_attr($alert_digest_email); ?>" class="regular-text" />
                </td>
            </tr>
        </table>

        <div class="guard-dog-help-section">
            <h4><?php esc_html_e('About User Enumeration', 'guard-dog'); ?></h4>
            <p><?php esc_html_e('User enumeration is a technique attackers use to discover valid usernames on your site. Once they have usernames, they can target those accounts with brute force attacks. This feature blocks or logs the most common enumeration methods:', 'guard-dog'); ?></p>
            <ul>
                <li><strong><?php esc_html_e('REST API:', 'guard-dog'); ?></strong> <?php esc_html_e('The /wp-json/wp/v2/users endpoint returns a list of all users by default.', 'guard-dog'); ?></li>
                <li><strong><?php esc_html_e('Author Archives:', 'guard-dog'); ?></strong> <?php esc_html_e('Visiting ?author=1, ?author=2, etc. reveals usernames through URL redirects.', 'guard-dog'); ?></li>
                <li><strong><?php esc_html_e('Login Errors:', 'guard-dog'); ?></strong> <?php esc_html_e('Different error messages for "unknown username" vs "wrong password" confirm which usernames exist.', 'guard-dog'); ?></li>
                <li><strong><?php esc_html_e('Password Reset:', 'guard-dog'); ?></strong> <?php esc_html_e('The password reset form reveals whether an email is registered.', 'guard-dog'); ?></li>
                <li><strong><?php esc_html_e('XML-RPC:', 'guard-dog'); ?></strong> <?php esc_html_e('Legacy API methods like wp.getAuthors expose user data.', 'guard-dog'); ?></li>
            </ul>
        </div>
        <?php
    }

    /**
     * Render the login form defaults tab content
     *
     * @param array $data The page data
     */
    public function render_login_form_tab(array $data): void {
        $style = $data['login_form_style'] ?? 'default';
        $show_passkey = !empty($data['login_form_show_passkey']);
        $show_social_login = !empty($data['login_form_show_social_login']);
        $show_remember_me = !empty($data['login_form_show_remember_me']);
        $show_lost_password = !empty($data['login_form_show_lost_password']);
        $max_width = $data['login_form_max_width'] ?? '';
        $login_screen_url = admin_url('admin.php?page=guard-dog-login-customizer');

        ?>
        <h3>
            <span class="dashicons dashicons-lock"></span>
            <?php esc_html_e('Frontend Login Form Defaults', 'guard-dog'); ?>
        </h3>

        <p><?php esc_html_e('Set the default behavior for the Guard Dog frontend login form shortcode and block. Individual instances can still override these values.', 'guard-dog'); ?></p>

        <div class="guard-dog-status-box">
            <p>
                <strong><?php esc_html_e('Applies To:', 'guard-dog'); ?></strong>
                <code>[guard_dog_login_form]</code>
                <?php esc_html_e('and the Guard Dog Login Form block.', 'guard-dog'); ?>
            </p>
            <p>
                <?php esc_html_e('Need to customize wp-login.php, your custom login URL, password reset, or login security screens?', 'guard-dog'); ?>
                <a href="<?php echo esc_url($login_screen_url); ?>"><?php esc_html_e('Use Appearance > WordPress Login Screen.', 'guard-dog'); ?></a>
            </p>
        </div>

        <table class="guard-dog-form-table">
            <tr>
                <th><?php esc_html_e('Default Style', 'guard-dog'); ?></th>
                <td>
                    <select name="guard_dog_login_form_style">
                        <option value="default" <?php selected($style, 'default'); ?>><?php esc_html_e('Default', 'guard-dog'); ?></option>
                        <option value="minimal" <?php selected($style, 'minimal'); ?>><?php esc_html_e('Minimal', 'guard-dog'); ?></option>
                        <option value="compact" <?php selected($style, 'compact'); ?>><?php esc_html_e('Compact', 'guard-dog'); ?></option>
                    </select>
                    <p class="description"><?php esc_html_e('Used when a login form instance does not set its own style attribute.', 'guard-dog'); ?></p>
                </td>
            </tr>
            <tr>
                <th><?php esc_html_e('Default Max Width', 'guard-dog'); ?></th>
                <td>
                    <input
                        type="number"
                        name="guard_dog_login_form_max_width"
                        value="<?php echo esc_attr($max_width); ?>"
                        min="<?php echo esc_attr(Guard_Dog_Login_Form::MAX_WIDTH_MIN); ?>"
                        max="<?php echo esc_attr(Guard_Dog_Login_Form::MAX_WIDTH_MAX); ?>"
                        class="small-text"
                    />
                    <span><?php esc_html_e('px', 'guard-dog'); ?></span>
	                    <p class="description">
	                        <?php
	                        printf(
	                            /* translators: 1: minimum width in pixels, 2: maximum width in pixels. */
	                            esc_html__('Optional. Leave blank to use the built-in width for the selected style. Allowed range: %1$d to %2$d pixels.', 'guard-dog'),
	                            Guard_Dog_Login_Form::MAX_WIDTH_MIN,
	                            Guard_Dog_Login_Form::MAX_WIDTH_MAX
                        );
                        ?>
                    </p>
                </td>
            </tr>
            <tr>
                <th><?php esc_html_e('Passkey Sign-In', 'guard-dog'); ?></th>
                <td>
                    <label>
                        <input type="checkbox" name="guard_dog_login_form_show_passkey" value="1" <?php checked($show_passkey); ?> />
                        <?php esc_html_e('Show the passkey button by default', 'guard-dog'); ?>
                    </label>
                    <p class="description"><?php esc_html_e('The button still respects the global Passkeys setting. If passkeys are disabled globally, nothing will be shown.', 'guard-dog'); ?></p>
                </td>
            </tr>
            <tr>
                <th><?php esc_html_e('Social Login', 'guard-dog'); ?></th>
                <td>
                    <label>
                        <input type="checkbox" name="guard_dog_login_form_show_social_login" value="1" <?php checked($show_social_login); ?> />
                        <?php esc_html_e('Show social login buttons by default', 'guard-dog'); ?>
                    </label>
                    <p class="description"><?php esc_html_e('The buttons only appear when Social Login and at least one provider are configured.', 'guard-dog'); ?></p>
                </td>
            </tr>
            <tr>
                <th><?php esc_html_e('Remember Me', 'guard-dog'); ?></th>
                <td>
                    <label>
                        <input type="checkbox" name="guard_dog_login_form_show_remember_me" value="1" <?php checked($show_remember_me); ?> />
                        <?php esc_html_e('Show the remember me checkbox by default', 'guard-dog'); ?>
                    </label>
                </td>
            </tr>
            <tr>
                <th><?php esc_html_e('Lost Password Link', 'guard-dog'); ?></th>
                <td>
                    <label>
                        <input type="checkbox" name="guard_dog_login_form_show_lost_password" value="1" <?php checked($show_lost_password); ?> />
                        <?php esc_html_e('Show the lost password link by default', 'guard-dog'); ?>
                    </label>
                </td>
            </tr>
        </table>

        <div class="guard-dog-help-section">
            <h4><?php esc_html_e('How Overrides Work', 'guard-dog'); ?></h4>
            <p><?php esc_html_e('These defaults are the baseline. A shortcode attribute or block setting on a specific page still wins for that one instance.', 'guard-dog'); ?></p>
            <p><code>[guard_dog_login_form show_passkey="false" max_width="420"]</code></p>
        </div>
        <?php
    }

    /**
     * Render the social login tab content
     *
     * @param array $data The page data
     */
    public function render_social_login_tab(array $data): void {
        ?>

            <h3><?php esc_html_e('Social Login', 'guard-dog'); ?></h3>
            <p class="description"><?php esc_html_e('Allow users to sign in using their social media accounts.', 'guard-dog'); ?></p>

            <table class="form-table" role="presentation">
                <tr>
                    <th scope="row"><?php esc_html_e('Enable Social Login', 'guard-dog'); ?></th>
                    <td>
                        <label>
                            <input type="checkbox" name="guard_dog_social_login_enabled" value="1"
                                <?php checked(get_option('guard_dog_social_login_enabled', false)); ?>>
                            <?php esc_html_e('Show social login buttons on the login form', 'guard-dog'); ?>
                        </label>
                    </td>
                </tr>
            </table>

            <h3><?php esc_html_e('Google', 'guard-dog'); ?></h3>
            <table class="form-table" role="presentation">
                <tr>
                    <th scope="row"><?php esc_html_e('Enable Google', 'guard-dog'); ?></th>
                    <td>
                        <label>
                            <input type="checkbox" name="guard_dog_social_google_enabled" value="1"
                                <?php checked(get_option('guard_dog_social_google_enabled', false)); ?>>
                            <?php esc_html_e('Allow sign in with Google', 'guard-dog'); ?>
                        </label>
                    </td>
                </tr>
                <tr>
                    <th scope="row"><?php esc_html_e('Client ID', 'guard-dog'); ?></th>
                    <td>
                        <input type="text" name="guard_dog_social_google_client_id" value="<?php echo esc_attr(get_option('guard_dog_social_google_client_id', '')); ?>" class="regular-text">
                        <p class="description"><?php esc_html_e('From Google Cloud Console > APIs & Services > Credentials.', 'guard-dog'); ?></p>
                    </td>
                </tr>
                <tr>
                    <th scope="row"><?php esc_html_e('Client Secret', 'guard-dog'); ?></th>
                    <td>
                        <input type="password" name="guard_dog_social_google_client_secret" value="<?php echo esc_attr(get_option('guard_dog_social_google_client_secret', '')); ?>" class="regular-text">
                        <p class="description"><?php esc_html_e('Keep this secret. Never share it publicly.', 'guard-dog'); ?></p>
                    </td>
                </tr>
                <tr>
                    <th scope="row"><?php esc_html_e('Callback URL', 'guard-dog'); ?></th>
                    <td>
                        <code><?php echo esc_html(home_url('/guard-dog/oauth/callback')); ?></code>
                        <p class="description"><?php esc_html_e('Add this URL as an Authorized redirect URI in your Google Cloud Console.', 'guard-dog'); ?></p>
                    </td>
                </tr>
            </table>

            <h3><?php esc_html_e('Microsoft', 'guard-dog'); ?></h3>
            <table class="form-table" role="presentation">
                <tr>
                    <th scope="row"><?php esc_html_e('Enable Microsoft', 'guard-dog'); ?></th>
                    <td>
                        <label>
                            <input type="checkbox" name="guard_dog_social_microsoft_enabled" value="1"
                                <?php checked(get_option('guard_dog_social_microsoft_enabled', false)); ?>>
                            <?php esc_html_e('Allow sign in with Microsoft', 'guard-dog'); ?>
                        </label>
                    </td>
                </tr>
                <tr>
                    <th scope="row"><?php esc_html_e('Application (client) ID', 'guard-dog'); ?></th>
                    <td>
                        <input type="text" name="guard_dog_social_microsoft_client_id" value="<?php echo esc_attr(get_option('guard_dog_social_microsoft_client_id', '')); ?>" class="regular-text">
                        <p class="description"><?php esc_html_e('From Azure Portal > App registrations > Your app > Overview.', 'guard-dog'); ?></p>
                    </td>
                </tr>
                <tr>
                    <th scope="row"><?php esc_html_e('Client Secret', 'guard-dog'); ?></th>
                    <td>
                        <input type="password" name="guard_dog_social_microsoft_client_secret" value="<?php echo esc_attr(get_option('guard_dog_social_microsoft_client_secret', '')); ?>" class="regular-text">
                        <p class="description"><?php esc_html_e('From Azure Portal > Certificates & secrets.', 'guard-dog'); ?></p>
                    </td>
                </tr>
                <tr>
                    <th scope="row"><?php esc_html_e('Callback URL', 'guard-dog'); ?></th>
                    <td>
                        <code><?php echo esc_html(home_url('/guard-dog/oauth/callback')); ?></code>
                        <p class="description"><?php esc_html_e('Add this URL as a Redirect URI in your Azure app registration.', 'guard-dog'); ?></p>
                    </td>
                </tr>
            </table>

            <h3><?php esc_html_e('Apple', 'guard-dog'); ?></h3>
            <table class="form-table" role="presentation">
                <tr>
                    <th scope="row"><?php esc_html_e('Enable Apple', 'guard-dog'); ?></th>
                    <td>
                        <label>
                            <input type="checkbox" name="guard_dog_social_apple_enabled" value="1"
                                <?php checked(get_option('guard_dog_social_apple_enabled', false)); ?>>
                            <?php esc_html_e('Allow sign in with Apple', 'guard-dog'); ?>
                        </label>
                        <p class="description"><?php esc_html_e('Requires an Apple Developer account ($99/year).', 'guard-dog'); ?></p>
                    </td>
                </tr>
                <tr>
                    <th scope="row"><?php esc_html_e('Services ID', 'guard-dog'); ?></th>
                    <td>
                        <input type="text" name="guard_dog_social_apple_client_id" value="<?php echo esc_attr(get_option('guard_dog_social_apple_client_id', '')); ?>" class="regular-text">
                        <p class="description"><?php esc_html_e('From Apple Developer > Certificates, Identifiers & Profiles > Identifiers > Services IDs.', 'guard-dog'); ?></p>
                    </td>
                </tr>
                <tr>
                    <th scope="row"><?php esc_html_e('Team ID', 'guard-dog'); ?></th>
                    <td>
                        <input type="text" name="guard_dog_social_apple_team_id" value="<?php echo esc_attr(get_option('guard_dog_social_apple_team_id', '')); ?>" class="regular-text">
                        <p class="description"><?php esc_html_e('Your 10-character Team ID from Apple Developer > Membership details.', 'guard-dog'); ?></p>
                    </td>
                </tr>
                <tr>
                    <th scope="row"><?php esc_html_e('Key ID', 'guard-dog'); ?></th>
                    <td>
                        <input type="text" name="guard_dog_social_apple_key_id" value="<?php echo esc_attr(get_option('guard_dog_social_apple_key_id', '')); ?>" class="regular-text">
                        <p class="description"><?php esc_html_e('From Apple Developer > Certificates, Identifiers & Profiles > Keys.', 'guard-dog'); ?></p>
                    </td>
                </tr>
                <tr>
                    <th scope="row"><?php esc_html_e('Key File Content', 'guard-dog'); ?></th>
                    <td>
                        <?php
                        $stored_key = get_option('guard_dog_social_apple_key_file', '');
                        $has_key = !empty($stored_key);
                        $key_requires_resave = $has_key
                            && Guard_Dog_Apple_Provider::is_encrypted_key( $stored_key )
                            && '' === Guard_Dog_Apple_Provider::decrypt_key( $stored_key );
                        ?>
                        <textarea name="guard_dog_social_apple_key_file" rows="5" class="large-text code" placeholder="<?php esc_attr_e('Paste .p8 private key contents here...', 'guard-dog'); ?>"><?php echo $has_key ? '********' : ''; ?></textarea>
                        <p class="description">
                            <?php if ($has_key): ?>
                                <?php esc_html_e('A private key is configured and stored encrypted. Paste a new key to replace it, or leave as-is to keep the current key.', 'guard-dog'); ?>
                                <?php if ( $key_requires_resave ): ?>
                                    <br>
                                    <strong style="color: #b32d2e;"><?php esc_html_e('This Apple key can no longer be decrypted on this server. Re-paste the raw .p8 contents and save again after a host migration or WordPress salt change.', 'guard-dog'); ?></strong>
                                <?php endif; ?>
                            <?php else: ?>
                                <?php esc_html_e('Paste the full contents of the .p8 private key file downloaded from Apple. Starts with -----BEGIN PRIVATE KEY-----.', 'guard-dog'); ?>
                            <?php endif; ?>
                    </td>
                </tr>
                <tr>
                    <th scope="row"><?php esc_html_e('Callback URL', 'guard-dog'); ?></th>
                    <td>
                        <code><?php echo esc_html(home_url('/guard-dog/oauth/callback')); ?></code>
                        <p class="description"><?php esc_html_e('Add this URL as a Return URL in your Apple Services ID configuration.', 'guard-dog'); ?></p>
                    </td>
                </tr>
            </table>

            <h3><?php esc_html_e('General Settings', 'guard-dog'); ?></h3>
            <table class="form-table" role="presentation">
                <tr>
                    <th scope="row"><?php esc_html_e('Auto-Link by Email', 'guard-dog'); ?></th>
                    <td>
                        <label>
                            <input type="checkbox" name="guard_dog_social_auto_link_email" value="1"
                                <?php checked(get_option('guard_dog_social_auto_link_email', false)); ?>>
                            <?php esc_html_e('Automatically link social accounts when the email matches an existing user', 'guard-dog'); ?>
                        </label>
                    </td>
                </tr>
                <tr>
                    <th scope="row"><?php esc_html_e('Auto-Create Users', 'guard-dog'); ?></th>
                    <td>
                        <label>
                            <input type="checkbox" name="guard_dog_social_auto_create_users" value="1"
                                <?php checked(get_option('guard_dog_social_auto_create_users', false)); ?>>
                            <?php esc_html_e('Create a new WordPress account when no matching user is found', 'guard-dog'); ?>
                        </label>
                    </td>
                </tr>
                <tr>
                    <th scope="row"><?php esc_html_e('New User Role', 'guard-dog'); ?></th>
                    <td>
                        <select name="guard_dog_social_new_user_role">
                            <?php
                            $current_role = get_option('guard_dog_social_new_user_role', 'subscriber');
                            wp_dropdown_roles($current_role);
                            ?>
                        </select>
                        <p class="description"><?php esc_html_e('Role assigned to users created via social login.', 'guard-dog'); ?></p>
                    </td>
                </tr>
                <tr>
                    <th scope="row"><?php esc_html_e('Bypass 2FA', 'guard-dog'); ?></th>
                    <td>
                        <label>
                            <input type="checkbox" name="guard_dog_social_bypass_2fa" value="1"
                                <?php checked(get_option('guard_dog_social_bypass_2fa', false)); ?>>
                            <?php esc_html_e('Social login bypasses Guard Dog two-factor authentication', 'guard-dog'); ?>
                        </label>
                    </td>
                </tr>
            </table>

        <?php
    }

    /**
     * Render security overview sidebar
     */
    public function render_security_overview(): void {
        // Extract variables for security overview
        $custom_url_enabled = !empty(get_option('guard_dog_login_slug', ''));
        $attempts_enabled = get_option('guard_dog_lla_enabled', false);
        $tfa_enabled = get_option('guard_dog_two_factor_enabled', false);
        $email_2fa_enabled = get_option('guard_dog_email_2fa_enabled', false);
        $passkeys_enabled = get_option('guard_dog_passkeys_enabled', false);
        $enum_enabled = get_option('guard_dog_enum_enabled', false);
        $current_lockouts = [];
        $users_with_2fa = [];

        // Get current lockouts if attempts are enabled
        if ($attempts_enabled) {
            $current_lockouts = $this->get_current_lockouts();
        }

        // Get users with 2FA if enabled
        if ($tfa_enabled && function_exists('Guard_Dog') && isset(Guard_Dog()->features['two_factor'])) {
            $users_with_2fa = Guard_Dog()->features['two_factor']->get_users_with_2fa();
        }

        $enabled_features = 0;
        if ($custom_url_enabled) $enabled_features++;
        if ($attempts_enabled) $enabled_features++;
        if ($tfa_enabled) $enabled_features++;
        if ($email_2fa_enabled) $enabled_features++;
        if ($passkeys_enabled) $enabled_features++;
        if ($enum_enabled) $enabled_features++;

        $status = $enabled_features >= 2 ? 'secure' : ($enabled_features >= 1 ? 'partial' : 'insecure');
        ?>
        <div class="guard-dog-card">
            <h3><?php esc_html_e('Login Security Status', 'guard-dog'); ?></h3>
            
            <div class="guard-dog-security-status-indicator <?php echo esc_attr($status); ?>">
                <?php 
                switch ($status) {
                    case 'secure':
                        esc_html_e('Well Protected', 'guard-dog');
                        break;
                    case 'partial':
                        esc_html_e('Partially Protected', 'guard-dog');
                        break;
                    case 'insecure':
                        esc_html_e('Needs Protection', 'guard-dog');
                        break;
                }
                ?>
            </div>
            
            <div class="guard-dog-security-features">
                <div class="guard-dog-feature-status <?php echo esc_attr($custom_url_enabled ? 'enabled' : 'disabled'); ?>">
                    <span class="dashicons dashicons-admin-links"></span>
                    <?php esc_html_e('Custom Login URL', 'guard-dog'); ?>
                </div>
                
                <div class="guard-dog-feature-status <?php echo esc_attr($attempts_enabled ? 'enabled' : 'disabled'); ?>">
                    <span class="dashicons dashicons-shield"></span>
                    <?php esc_html_e('Login Attempt Limiting', 'guard-dog'); ?>
                </div>
                
                <div class="guard-dog-feature-status <?php echo esc_attr($tfa_enabled ? 'enabled' : 'disabled'); ?>">
                    <span class="dashicons dashicons-smartphone"></span>
                    <?php esc_html_e('Two-Factor Auth', 'guard-dog'); ?>
                </div>
                
                <div class="guard-dog-feature-status <?php echo esc_attr($email_2fa_enabled ? 'enabled' : 'disabled'); ?>">
                    <span class="dashicons dashicons-email-alt"></span>
                    <?php esc_html_e('Email 2FA', 'guard-dog'); ?>
                </div>

                <div class="guard-dog-feature-status <?php echo esc_attr($passkeys_enabled ? 'enabled' : 'disabled'); ?>">
                    <span class="dashicons dashicons-admin-network"></span>
                    <?php esc_html_e('Passkeys', 'guard-dog'); ?>
                </div>

                <div class="guard-dog-feature-status <?php echo esc_attr($enum_enabled ? 'enabled' : 'disabled'); ?>">
                    <span class="dashicons dashicons-hidden"></span>
                    <?php esc_html_e('User Enumeration', 'guard-dog'); ?>
                </div>
            </div>

            <?php if ($attempts_enabled && !empty($current_lockouts)): ?>
                <div class="guard-dog-lockouts-summary">
                    <h4><?php esc_html_e('Active Lockouts', 'guard-dog'); ?></h4>
                    <p><?php 
                    // Translators: %d is the number of IP addresses currently locked out.
                    printf(esc_html__('%d IP addresses are currently locked out.', 'guard-dog'), count($current_lockouts)); 
                    ?></p>
                </div>
            <?php endif; ?>
            
            <?php if ($tfa_enabled && !empty($users_with_2fa)): ?>
                <div class="guard-dog-2fa-summary">
                    <h4><?php esc_html_e('2FA Users', 'guard-dog'); ?></h4>
                    <p><?php 
                    // Translators: %d is the number of users with 2FA enabled.
                    printf(esc_html__('%d users have enabled two-factor authentication.', 'guard-dog'), count($users_with_2fa)); 
                    ?></p>
                </div>
            <?php endif; ?>
        </div>
        <?php
    }

    /**
     * Render current lockouts section
     *
     * @param array $current_lockouts Array of current lockouts
     */
    private function render_current_lockouts(array $current_lockouts): void {
        ?>
        <div class="guard-dog-lockouts-section">
            <h4><?php esc_html_e('Currently Locked Out IPs', 'guard-dog'); ?></h4>
            
            <?php if (!empty($current_lockouts)): ?>
                <table class="guard-dog-lockouts-table">
                    <thead>
                        <tr>
                            <th><?php esc_html_e('IP Address', 'guard-dog'); ?></th>
                            <th><?php esc_html_e('Failed Attempts', 'guard-dog'); ?></th>
                            <th><?php esc_html_e('Locked Until', 'guard-dog'); ?></th>
                            <th><?php esc_html_e('Actions', 'guard-dog'); ?></th>
                        </tr>
                    </thead>
                    <tbody>
                        <?php foreach ($current_lockouts as $lockout): ?>
                            <tr>
                                <td><?php echo esc_html($lockout['ip_address']); ?></td>
                                <td><?php echo esc_html($lockout['attempts']); ?></td>
                                <td><?php echo esc_html($lockout['locked_until']); ?></td>
                                <td>
                                    <form method="post" action="" class="guard-dog-inline-form">
                                        <?php wp_nonce_field('guard_dog_unlock_ip', 'unlock_ip_nonce'); ?>
                                        <input type="hidden" name="unlock_ip" value="<?php echo esc_attr($lockout['ip_address']); ?>" />
                                                                        <button type="submit" class="button button-small guard-dog-unlock-ip-btn">
                                    <?php esc_html_e('Unlock', 'guard-dog'); ?>
                                </button>
                                    </form>
                                </td>
                            </tr>
                        <?php endforeach; ?>
                    </tbody>
                </table>
            <?php else: ?>
                <p class="guard-dog-no-lockouts">
                    <?php esc_html_e('No IP addresses are currently locked out.', 'guard-dog'); ?>
                </p>
            <?php endif; ?>
        </div>
        <?php
    }
} 
