<?php
/**
 * Security page view — IP management and access controls.
 *
 * @package PrivexPasswordProtect
 */

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

$ppmstr_s     = PPMSTR_Settings::get_all();
$ppmstr_is_pro = function_exists( 'ppp_fs' ) && ppp_fs()->can_use_premium_code__premium_only();
$ppmstr_saved = isset( $_GET['ppmstr_saved'] ) && '1' === $_GET['ppmstr_saved']; // phpcs:ignore WordPress.Security.NonceVerification.Recommended

// Get visitor's current IP for reference.
$ppmstr_visitor_ip = '—';
$ppmstr_ip_headers = array( 'HTTP_CF_CONNECTING_IP', 'HTTP_X_FORWARDED_FOR', 'HTTP_X_REAL_IP', 'REMOTE_ADDR' );
foreach ( $ppmstr_ip_headers as $ppmstr_hdr ) {
	if ( ! empty( $_SERVER[ $ppmstr_hdr ] ) ) {
		$ppmstr_raw_ip = sanitize_text_field( wp_unslash( $_SERVER[ $ppmstr_hdr ] ) );
		if ( strpos( $ppmstr_raw_ip, ',' ) !== false ) {
			$ppmstr_raw_ip = trim( explode( ',', $ppmstr_raw_ip )[0] );
		}
		if ( filter_var( $ppmstr_raw_ip, FILTER_VALIDATE_IP ) ) {
			$ppmstr_visitor_ip = $ppmstr_raw_ip;
			break;
		}
	}
}

// Get all WP roles for bypass roles.
$ppmstr_all_roles = wp_roles()->get_names();
unset( $ppmstr_all_roles['administrator'] );
?>

<div class="ppmstr-page-header">
	<h2><?php esc_html_e( 'Security & Access Controls', 'privex-password-protect' ); ?></h2>
	<p class="ppmstr-page-desc"><?php esc_html_e( 'Manage IP restrictions, role-based bypass, and advanced access policies.', 'privex-password-protect' ); ?></p>
</div>

<?php if ( $ppmstr_saved ) : ?>
	<div class="ppmstr-notice ppmstr-notice--success">
		<?php esc_html_e( 'Settings saved successfully.', 'privex-password-protect' ); ?>
	</div>
<?php endif; ?>

<form method="post" action="" class="ppmstr-settings-form">
	<?php wp_nonce_field( 'ppmstr_save_settings', 'ppmstr_settings_nonce' ); ?>
	<input type="hidden" name="ppmstr_redirect_to" value="ppmstr-security" />

	<!-- IP Info -->
	<div class="ppmstr-card">
		<div class="ppmstr-card-header"><h3><?php esc_html_e( 'IP Information', 'privex-password-protect' ); ?></h3></div>
		<div class="ppmstr-card-body">
			<div class="ppmstr-field-row">
				<div class="ppmstr-field-label">
					<label><?php esc_html_e( 'Your Current IP', 'privex-password-protect' ); ?></label>
					<p class="ppmstr-field-hint"><?php esc_html_e( 'This is the IP address your admin session is using. Be careful not to block yourself.', 'privex-password-protect' ); ?></p>
				</div>
				<div class="ppmstr-field-input">
					<code class="ppmstr-shortcode-example" style="display:inline; padding:6px 14px; font-size:14px;"><?php echo esc_html( $ppmstr_visitor_ip ); ?></code>
				</div>
			</div>
		</div>
	</div>

	<!-- IP Whitelist -->
	<div class="ppmstr-card">
		<div class="ppmstr-card-header"><h3><?php esc_html_e( 'IP Whitelist', 'privex-password-protect' ); ?> <span class="ppmstr-pro-badge">PRO</span></h3></div>
		<div class="ppmstr-card-body <?php echo ! $ppmstr_is_pro ? 'ppmstr-pro-locked-wrap' : ''; ?>">
			<div class="ppmstr-field-row" style="flex-direction:column; gap:10px;">
				<div class="ppmstr-field-label">
					<label for="ppmstr-ip-whitelist"><?php esc_html_e( 'Whitelisted IPs', 'privex-password-protect' ); ?></label>
					<p class="ppmstr-field-hint"><?php esc_html_e( 'One IP or CIDR per line. These visitors bypass all password protection entirely.', 'privex-password-protect' ); ?></p>
				</div>
				<textarea name="ppmstr_ip_whitelist" id="ppmstr-ip-whitelist" class="ppmstr-textarea" rows="5" disabled
					placeholder="<?php esc_attr_e( "192.168.1.100\n10.0.0.0/8\n203.0.113.50", 'privex-password-protect' ); ?>"
				></textarea>
			</div>
		</div>
	</div>

	<!-- IP Blacklist -->
	<div class="ppmstr-card">
		<div class="ppmstr-card-header"><h3><?php esc_html_e( 'IP Blacklist', 'privex-password-protect' ); ?> <span class="ppmstr-pro-badge">PRO</span></h3></div>
		<div class="ppmstr-card-body <?php echo ! $ppmstr_is_pro ? 'ppmstr-pro-locked-wrap' : ''; ?>">
			<div class="ppmstr-field-row" style="flex-direction:column; gap:10px;">
				<div class="ppmstr-field-label">
					<label for="ppmstr-ip-blacklist"><?php esc_html_e( 'Blocked IPs', 'privex-password-protect' ); ?></label>
					<p class="ppmstr-field-hint"><?php esc_html_e( 'One IP or CIDR per line. These visitors are always blocked, even if they know the password.', 'privex-password-protect' ); ?></p>
				</div>
				<textarea name="ppmstr_ip_blacklist" id="ppmstr-ip-blacklist" class="ppmstr-textarea ppmstr-textarea--danger" rows="5" disabled
					placeholder="<?php esc_attr_e( "192.168.1.200\n198.51.100.0/24", 'privex-password-protect' ); ?>"
				></textarea>
			</div>
		</div>
	</div>

	<!-- Bypass Roles -->
	<div class="ppmstr-card">
		<div class="ppmstr-card-header"><h3><?php esc_html_e( 'Role-Based Bypass', 'privex-password-protect' ); ?> <span class="ppmstr-pro-badge">PRO</span></h3></div>
		<div class="ppmstr-card-body <?php echo ! $ppmstr_is_pro ? 'ppmstr-pro-locked-wrap' : ''; ?>">
			<div class="ppmstr-field-row">
				<div class="ppmstr-field-label">
					<label><?php esc_html_e( 'Bypass Roles', 'privex-password-protect' ); ?></label>
					<p class="ppmstr-field-hint"><?php esc_html_e( 'Users with these roles bypass all protection. Administrators always bypass.', 'privex-password-protect' ); ?></p>
				</div>
				<div class="ppmstr-field-input">
					<div class="ppmstr-checkbox-group">
						<?php foreach ( $ppmstr_all_roles as $ppmstr_role_slug => $ppmstr_role_name ) : ?>
							<label class="ppmstr-checkbox-label">
								<input type="checkbox" disabled value="<?php echo esc_attr( $ppmstr_role_slug ); ?>" />
								<?php echo esc_html( translate_user_role( $ppmstr_role_name ) ); ?>
							</label>
						<?php endforeach; ?>
					</div>
				</div>
			</div>
		</div>
	</div>

	<!-- CAPTCHA Integration -->
	<div class="ppmstr-card">
		<div class="ppmstr-card-header"><h3><?php esc_html_e( 'CAPTCHA Integration', 'privex-password-protect' ); ?> <span class="ppmstr-pro-badge">PRO</span></h3></div>
		<div class="ppmstr-card-body <?php echo ! $ppmstr_is_pro ? 'ppmstr-pro-locked-wrap' : ''; ?>">
			<div class="ppmstr-field-row" style="flex-direction:column; gap:10px;">
				<div class="ppmstr-field-label">
					<label for="ppmstr-captcha-provider"><?php esc_html_e( 'CAPTCHA Provider', 'privex-password-protect' ); ?></label>
					<p class="ppmstr-field-hint"><?php esc_html_e( 'Protect password forms from automated bot attacks.', 'privex-password-protect' ); ?></p>
				</div>
				<select name="ppmstr_captcha_provider" id="ppmstr-captcha-provider" class="ppmstr-select" style="max-width:300px;" disabled>
					<option value="none"><?php esc_html_e( 'None (Disabled)', 'privex-password-protect' ); ?></option>
					<option value="recaptcha_v2"><?php esc_html_e( 'Google reCAPTCHA v2 (Checkbox)', 'privex-password-protect' ); ?></option>
					<option value="recaptcha_v3"><?php esc_html_e( 'Google reCAPTCHA v3 (Invisible)', 'privex-password-protect' ); ?></option>
					<option value="hcaptcha"><?php esc_html_e( 'hCaptcha', 'privex-password-protect' ); ?></option>
					<option value="turnstile"><?php esc_html_e( 'Cloudflare Turnstile', 'privex-password-protect' ); ?></option>
				</select>
			</div>

			<div class="ppmstr-captcha-keys" style="margin-top:20px;">
				<div class="ppmstr-field-row">
					<div class="ppmstr-field-label">
						<label for="ppmstr-captcha-site-key"><?php esc_html_e( 'Site Key', 'privex-password-protect' ); ?></label>
					</div>
					<div class="ppmstr-field-input">
						<input type="text" name="ppmstr_captcha_site_key" id="ppmstr-captcha-site-key" class="ppmstr-input" value="" disabled />
					</div>
				</div>
				<div class="ppmstr-field-row" style="margin-top:15px;">
					<div class="ppmstr-field-label">
						<label for="ppmstr-captcha-secret-key"><?php esc_html_e( 'Secret Key', 'privex-password-protect' ); ?></label>
					</div>
					<div class="ppmstr-field-input">
						<input type="password" name="ppmstr_captcha_secret_key" id="ppmstr-captcha-secret-key" class="ppmstr-input" value="" disabled />
					</div>
				</div>
			</div>
		</div>
	</div>

	<!-- Limit Login Attempts -->
	<div class="ppmstr-card">
		<div class="ppmstr-card-header">
			<div style="display:flex; justify-content:space-between; align-items:center;">
				<h3><?php esc_html_e( 'Limit Form Attempts (Brute Force Protection)', 'privex-password-protect' ); ?></h3>
				<label class="ppmstr-toggle">
					<input type="checkbox" name="ppmstr_limit_login_enabled" value="1" <?php checked( $ppmstr_s['limit_login_enabled'] ); ?> />
					<span class="ppmstr-toggle-slider"></span>
				</label>
			</div>
		</div>
		<div class="ppmstr-card-body" style="<?php echo empty( $ppmstr_s['limit_login_enabled'] ) ? 'opacity:0.5;pointer-events:none;' : ''; ?>" id="ppmstr-limit-login-settings">
			<div class="ppmstr-field-row">
				<div class="ppmstr-field-label">
					<label for="ppmstr-limit-login-max"><?php esc_html_e( 'Max Failed Attempts', 'privex-password-protect' ); ?></label>
					<p class="ppmstr-field-hint"><?php esc_html_e( 'Number of failed attempts allowed before blocking the IP.', 'privex-password-protect' ); ?></p>
				</div>
				<div class="ppmstr-field-input" style="display:flex;align-items:center;gap:10px;">
					<input type="number" name="ppmstr_limit_login_max" id="ppmstr-limit-login-max" class="ppmstr-input" style="width:100px;" value="<?php echo esc_attr( $ppmstr_s['limit_login_max'] ); ?>" min="1" max="100" />
					<span><?php esc_html_e( 'attempts', 'privex-password-protect' ); ?></span>
				</div>
			</div>
			<div class="ppmstr-field-row" style="margin-top:15px;">
				<div class="ppmstr-field-label">
					<label for="ppmstr-limit-login-lockout"><?php esc_html_e( 'Lockout Duration', 'privex-password-protect' ); ?></label>
					<p class="ppmstr-field-hint"><?php esc_html_e( 'How long the IP should be blocked after exceeding max attempts.', 'privex-password-protect' ); ?></p>
				</div>
				<div class="ppmstr-field-input" style="display:flex;align-items:center;gap:10px;">
					<input type="number" name="ppmstr_limit_login_lockout" id="ppmstr-limit-login-lockout" class="ppmstr-input" style="width:100px;" value="<?php echo esc_attr( $ppmstr_s['limit_login_lockout'] ); ?>" min="1" />
					<span><?php esc_html_e( 'minutes', 'privex-password-protect' ); ?></span>
				</div>
			</div>
		</div>
	</div>

	<!-- Concurrent Logins -->
	<div class="ppmstr-card">
		<div class="ppmstr-card-header">
			<div style="display:flex; justify-content:space-between; align-items:center;">
				<h3><?php esc_html_e( 'Concurrent Session Limits', 'privex-password-protect' ); ?> <span class="ppmstr-pro-badge">PRO</span></h3>
			</div>
		</div>
		<div class="ppmstr-card-body <?php echo ! $ppmstr_is_pro ? 'ppmstr-pro-locked-wrap' : ''; ?>">
			<div class="ppmstr-field-row">
				<div class="ppmstr-field-label">
					<label for="ppmstr-concurrent-logins-max"><?php esc_html_e( 'Max Concurrent Sessions', 'privex-password-protect' ); ?></label>
					<p class="ppmstr-field-hint"><?php esc_html_e( 'Limit how many different devices/browsers can use the same password at once. The oldest session will be disconnected.', 'privex-password-protect' ); ?></p>
				</div>
				<div class="ppmstr-field-input" style="display:flex;align-items:center;gap:10px;">
					<input type="number" name="ppmstr_concurrent_logins_max" id="ppmstr-concurrent-logins-max" class="ppmstr-input" style="width:100px;" value="3" min="1" max="100" disabled />
					<span><?php esc_html_e( 'sessions', 'privex-password-protect' ); ?></span>
				</div>
			</div>
		</div>
	</div>




	<!-- Per-Post Access Info -->
	<div class="ppmstr-card">
		<div class="ppmstr-card-header"><h3><?php esc_html_e( 'Per-Content Access Rules', 'privex-password-protect' ); ?></h3></div>
		<div class="ppmstr-card-body">
			<div class="ppmstr-steps">
				<div class="ppmstr-step">
					<span class="ppmstr-step-number">
						<svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5"><path d="M17 21v-2a4 4 0 0 0-4-4H5a4 4 0 0 0-4 4v2"/><circle cx="9" cy="7" r="4"/><path d="M23 21v-2a4 4 0 0 0-3-3.87"/><path d="M16 3.13a4 4 0 0 1 0 7.75"/></svg>
					</span>
					<div class="ppmstr-step-text">
						<strong><?php esc_html_e( 'Per-Post Roles & Users', 'privex-password-protect' ); ?></strong>
						<p><?php esc_html_e( 'Edit any protected page/post and use the "Access Rules" section in the metabox to assign specific roles or users who can access without a password.', 'privex-password-protect' ); ?></p>
					</div>
				</div>
				<div class="ppmstr-step">
					<span class="ppmstr-step-number">
						<svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5"><circle cx="12" cy="12" r="10"/><polyline points="12 6 12 12 16 14"/></svg>
					</span>
					<div class="ppmstr-step-text">
						<strong><?php esc_html_e( 'Protection Schedule', 'privex-password-protect' ); ?></strong>
						<p><?php esc_html_e( 'Set start/end dates in the metabox "Protection Schedule" section. Outside the scheduled window, content is freely accessible.', 'privex-password-protect' ); ?></p>
					</div>
				</div>
			</div>
		</div>
	</div>

	<div class="ppmstr-form-actions">
		<button type="submit" class="ppmstr-btn ppmstr-btn--primary">
			<?php esc_html_e( 'Save Security Settings', 'privex-password-protect' ); ?>
		</button>
	</div>
</form>
