<?php

namespace VulnTitan\Admin\Pages;

use VulnTitan\Services\FirewallService;

class Firewall extends TemplateParts
{
    public static function render()
    {
        $contactForm7Installed = class_exists('\WPCF7_Submission') && class_exists('\WPCF7_ContactForm');
        $fluentFormsInstalled = defined('FLUENTFORM') && class_exists('\FluentForm\App\Modules\SubmissionHandler\SubmissionHandler');
        ?>
        <div class="wrap vulntitan-wrapper vulntitan-wrapper--firewall">
            <div class="vulntitan-layout">
                <div class="vulntitan-main">
                    <?php self::header(); ?>

                    <div class="vulntitan-dashboard-section-wrapper vulntitan-firewall-page" id="vulntitan-firewall-page">
                        <section class="vulntitan-firewall-hero">
                            <div class="vulntitan-firewall-hero-content">
                                <span class="vulntitan-elite-kicker"><?php esc_html_e('Firewall Command Center', 'vulntitan'); ?></span>
                                <h2 class="vulntitan-firewall-title"><?php esc_html_e('Adaptive WAF and Login Shield', 'vulntitan'); ?></h2>
                                <p class="vulntitan-firewall-subtitle"><?php esc_html_e('Harden access with intelligent lockout policies, payload inspection, and real-time traffic telemetry. Firewall runtime is deployed as an MU loader.', 'vulntitan'); ?></p>
                                <div class="vulntitan-firewall-hero-metrics">
                                    <span class="vulntitan-metric-pill"><?php esc_html_e('Threat Containment', 'vulntitan'); ?></span>
                                    <span class="vulntitan-metric-pill"><?php esc_html_e('WAF Payload Guard', 'vulntitan'); ?></span>
                                    <span class="vulntitan-metric-pill"><?php esc_html_e('Identity Lockouts', 'vulntitan'); ?></span>
                                </div>
                            </div>
                            <div class="vulntitan-firewall-hero-panel">
                                <div class="vulntitan-panel-title"><?php esc_html_e('Live Overview', 'vulntitan'); ?></div>
                                <div id="vulntitan-firewall-overview" class="vulntitan-firewall-overview"></div>
                            </div>
                        </section>

                        <div id="vulntitan-firewall-feedback" class="vulntitan-firewall-feedback" style="display:none;"></div>

                        <div class="vulntitan-firewall-grid">
                            <section class="vulntitan-firewall-panel vulntitan-firewall-panel--settings">
                                <div class="vulntitan-firewall-panel-head">
                                    <h3 class="vulntitan-firewall-panel-title"><?php esc_html_e('Firewall Settings', 'vulntitan'); ?></h3>
                                    <span class="vulntitan-firewall-panel-meta"><?php esc_html_e('Policy and runtime controls', 'vulntitan'); ?></span>
                                </div>

                                <div class="vulntitan-firewall-form">
                                    <div class="vulntitan-firewall-workspace">
                                        <div class="vulntitan-firewall-settings-layout">
                                            <aside class="vulntitan-firewall-settings-nav" aria-label="<?php esc_attr_e('Firewall settings navigation', 'vulntitan'); ?>">
                                                <div class="vulntitan-firewall-settings-nav-title"><?php esc_html_e('Settings sections', 'vulntitan'); ?></div>
                                                <div class="vulntitan-firewall-tabs" role="tablist" aria-label="<?php esc_attr_e('Firewall setting groups', 'vulntitan'); ?>">
                                                    <button
                                                        type="button"
                                                        class="vulntitan-firewall-tab is-active"
                                                        id="vulntitan-firewall-tab-access"
                                                        data-firewall-tab="access"
                                                        role="tab"
                                                        aria-selected="true"
                                                        aria-controls="vulntitan-firewall-panel-access"
                                                    >
                                                        <span class="vulntitan-firewall-tab-copy">
                                                            <span class="vulntitan-firewall-tab-title"><?php esc_html_e('Access & Proxy', 'vulntitan'); ?></span>
                                                            <span class="vulntitan-firewall-tab-desc"><?php esc_html_e('Firewall runtime, login URL, proxy trust.', 'vulntitan'); ?></span>
                                                        </span>
                                                        <span class="vulntitan-firewall-tab-chevron" aria-hidden="true"></span>
                                                    </button>
                                                    <button
                                                        type="button"
                                                        class="vulntitan-firewall-tab"
                                                        id="vulntitan-firewall-tab-identity"
                                                        data-firewall-tab="identity"
                                                        role="tab"
                                                        aria-selected="false"
                                                        aria-controls="vulntitan-firewall-panel-identity"
                                                        tabindex="-1"
                                                    >
                                                        <span class="vulntitan-firewall-tab-copy">
                                                            <span class="vulntitan-firewall-tab-title"><?php esc_html_e('Login & Identity', 'vulntitan'); ?></span>
                                                            <span class="vulntitan-firewall-tab-desc"><?php esc_html_e('2FA, CAPTCHA, XML-RPC, passwords.', 'vulntitan'); ?></span>
                                                        </span>
                                                        <span class="vulntitan-firewall-tab-chevron" aria-hidden="true"></span>
                                                    </button>
                                                    <button
                                                        type="button"
                                                        class="vulntitan-firewall-tab"
                                                        id="vulntitan-firewall-tab-waf"
                                                        data-firewall-tab="waf"
                                                        role="tab"
                                                        aria-selected="false"
                                                        aria-controls="vulntitan-firewall-panel-waf"
                                                        tabindex="-1"
                                                    >
                                                        <span class="vulntitan-firewall-tab-copy">
                                                            <span class="vulntitan-firewall-tab-title"><?php esc_html_e('Request Firewall', 'vulntitan'); ?></span>
                                                            <span class="vulntitan-firewall-tab-desc"><?php esc_html_e('Payload rules and safe path exceptions.', 'vulntitan'); ?></span>
                                                        </span>
                                                        <span class="vulntitan-firewall-tab-chevron" aria-hidden="true"></span>
                                                    </button>
                                                    <button
                                                        type="button"
                                                        class="vulntitan-firewall-tab"
                                                        id="vulntitan-firewall-tab-approvals"
                                                        data-firewall-tab="approvals"
                                                        role="tab"
                                                        aria-selected="false"
                                                        aria-controls="vulntitan-firewall-panel-approvals"
                                                        tabindex="-1"
                                                    >
                                                        <span class="vulntitan-firewall-tab-copy">
                                                            <span class="vulntitan-firewall-tab-title"><?php esc_html_e('Approvals', 'vulntitan'); ?></span>
                                                            <span class="vulntitan-firewall-tab-desc"><?php esc_html_e('Review blocked requests before allowing them.', 'vulntitan'); ?></span>
                                                        </span>
                                                        <span class="vulntitan-firewall-tab-count" id="vulntitan-firewall-approvals-count" aria-hidden="true"></span>
                                                        <span class="vulntitan-firewall-tab-chevron" aria-hidden="true"></span>
                                                    </button>
                                                    <button
                                                        type="button"
                                                        class="vulntitan-firewall-tab"
                                                        id="vulntitan-firewall-tab-lockouts"
                                                        data-firewall-tab="lockouts"
                                                        role="tab"
                                                        aria-selected="false"
                                                        aria-controls="vulntitan-firewall-panel-lockouts"
                                                        tabindex="-1"
                                                    >
                                                        <span class="vulntitan-firewall-tab-copy">
                                                            <span class="vulntitan-firewall-tab-title"><?php esc_html_e('Lockouts & Reports', 'vulntitan'); ?></span>
                                                            <span class="vulntitan-firewall-tab-desc"><?php esc_html_e('Failed login limits, retention, weekly digest.', 'vulntitan'); ?></span>
                                                        </span>
                                                        <span class="vulntitan-firewall-tab-chevron" aria-hidden="true"></span>
                                                    </button>
                                                    <button
                                                        type="button"
                                                        class="vulntitan-firewall-tab"
                                                        id="vulntitan-firewall-tab-spam"
                                                        data-firewall-tab="spam"
                                                        role="tab"
                                                        aria-selected="false"
                                                        aria-controls="vulntitan-firewall-panel-spam"
                                                        tabindex="-1"
                                                    >
                                                        <span class="vulntitan-firewall-tab-copy">
                                                            <span class="vulntitan-firewall-tab-title"><?php esc_html_e('Spam Protection', 'vulntitan'); ?></span>
                                                            <span class="vulntitan-firewall-tab-desc"><?php esc_html_e('Comments, forms, providers, shared heuristics.', 'vulntitan'); ?></span>
                                                        </span>
                                                        <span class="vulntitan-firewall-tab-chevron" aria-hidden="true"></span>
                                                    </button>
                                                </div>
                                            </aside>

                                            <div class="vulntitan-firewall-tab-panels">
                                            <section
                                                class="vulntitan-firewall-tab-panel is-active"
                                                id="vulntitan-firewall-panel-access"
                                                data-firewall-tab-panel="access"
                                                role="tabpanel"
                                                aria-labelledby="vulntitan-firewall-tab-access"
                                            >
                                                <div class="vulntitan-firewall-tab-panel-head">
                                                    <div class="vulntitan-firewall-section-title"><?php esc_html_e('Access Shield', 'vulntitan'); ?></div>
                                                    <div class="vulntitan-firewall-section-desc"><?php esc_html_e('Control the live firewall runtime and hide the default WordPress login endpoints behind a custom entry path.', 'vulntitan'); ?></div>
                                                </div>

                                                <?php
                                                $proxyStatus = FirewallService::getProxyStatus();
                                                $showProxyAlert = !empty($proxyStatus['has_forwarded_headers']) && empty($proxyStatus['trust_forwarded']);
                                                $showProxyDisabledNotice = empty($proxyStatus['has_forwarded_headers'])
                                                    && (!empty($proxyStatus['trust_cloudflare']) || !empty($proxyStatus['trusted_proxy_count']));
                                                $proxyAlertStyle = $showProxyAlert ? '' : 'style="display:none;"';
                                                $proxyDisabledStyle = $showProxyDisabledNotice ? '' : 'style="display:none;"';
                                                ?>

                                                <div class="vulntitan-firewall-section">
                                                    <div class="vulntitan-firewall-section-title"><?php esc_html_e('Core Protection', 'vulntitan'); ?></div>
                                                    <div class="vulntitan-firewall-section-desc"><?php esc_html_e('Master switches for the firewall runtime and login shield.', 'vulntitan'); ?></div>

                                                    <label class="vulntitan-firewall-toggle">
                                                        <input type="checkbox" id="vulntitan-firewall-enabled" class="vulntitan-firewall-checkbox" checked>
                                                        <span><?php esc_html_e('Enable Firewall', 'vulntitan'); ?></span>
                                                    </label>

                                                    <label class="vulntitan-firewall-toggle">
                                                        <input type="checkbox" id="vulntitan-firewall-login-protection" class="vulntitan-firewall-checkbox" checked>
                                                        <span><?php esc_html_e('Enable Login Protection', 'vulntitan'); ?></span>
                                                    </label>
                                                </div>

                                                <div class="vulntitan-firewall-section">
                                                    <div class="vulntitan-firewall-section-title"><?php esc_html_e('Hidden Login Route', 'vulntitan'); ?></div>
                                                    <div class="vulntitan-firewall-section-desc"><?php esc_html_e('Replace the public login path with a private slug known only to administrators.', 'vulntitan'); ?></div>

                                                    <label class="vulntitan-firewall-field">
                                                        <span class="vulntitan-firewall-field-label"><?php esc_html_e('Custom Login Slug', 'vulntitan'); ?></span>
                                                        <input type="text" id="vulntitan-firewall-custom-login-slug" class="vulntitan-firewall-input" placeholder="secure-portal" autocomplete="off" spellcheck="false">
                                                        <small class="vulntitan-firewall-field-help"><?php esc_html_e('Leave blank to keep the default WordPress login URLs. When set, logged-out visitors hitting wp-login.php or wp-admin will receive a 404 instead of the login screen.', 'vulntitan'); ?></small>
                                                        <small class="vulntitan-firewall-field-help"><?php esc_html_e('Use a unique slug that is not already used by an existing page.', 'vulntitan'); ?></small>
                                                        <small class="vulntitan-firewall-field-help">
                                                            <?php esc_html_e('Active login URL:', 'vulntitan'); ?>
                                                            <code id="vulntitan-firewall-custom-login-url" class="vulntitan-firewall-runtime-path"><?php esc_html_e('Disabled', 'vulntitan'); ?></code>
                                                        </small>
                                                    </label>
                                                </div>

                                                <div class="vulntitan-firewall-section">
                                                    <div class="vulntitan-firewall-section-title"><?php esc_html_e('Cloudflare or proxy', 'vulntitan'); ?></div>
                                                    <div class="vulntitan-firewall-section-desc"><?php esc_html_e('Use this only if your site runs through Cloudflare or another proxy. It helps VulnTitan block the real visitor, not the server in front of your site.', 'vulntitan'); ?></div>

                                                    <label class="vulntitan-firewall-toggle">
                                                        <input type="checkbox" id="vulntitan-firewall-trust-cloudflare" class="vulntitan-firewall-checkbox">
                                                        <span><?php esc_html_e('My site uses Cloudflare', 'vulntitan'); ?></span>
                                                    </label>

                                                    <div id="vulntitan-firewall-proxy-alert" class="vulntitan-firewall-proxy-note" role="note" <?php echo $proxyAlertStyle; ?>>
                                                        <div class="vulntitan-firewall-proxy-note-title"><?php esc_html_e('Proxy traffic detected', 'vulntitan'); ?></div>
                                                        <div class="vulntitan-firewall-proxy-note-text"><?php esc_html_e('VulnTitan sees that this request came through a proxy. If this is Cloudflare, keep "My site uses Cloudflare" turned on. If it is another service, add its proxy IP below.', 'vulntitan'); ?></div>
                                                        <?php if (!empty($proxyStatus['remote_addr'])) : ?>
                                                            <small class="vulntitan-firewall-field-help">
                                                                <?php esc_html_e('Detected proxy address:', 'vulntitan'); ?>
                                                                <code><?php echo esc_html($proxyStatus['remote_addr']); ?></code>
                                                            </small>
                                                        <?php endif; ?>
                                                    </div>

                                                    <div id="vulntitan-firewall-proxy-missing" class="vulntitan-firewall-proxy-note" role="note" <?php echo $proxyDisabledStyle; ?>>
                                                        <div class="vulntitan-firewall-proxy-note-title"><?php esc_html_e('Cloudflare not visible on this request', 'vulntitan'); ?></div>
                                                        <div class="vulntitan-firewall-proxy-note-text"><?php esc_html_e('This admin page is not showing Cloudflare information right now. If public visitors really go through Cloudflare, you can keep this on. If not, turn it off.', 'vulntitan'); ?></div>
                                                    </div>

                                                    <label class="vulntitan-firewall-field">
                                                        <span class="vulntitan-firewall-field-label"><?php esc_html_e('Other proxy IPs', 'vulntitan'); ?></span>
                                                        <textarea id="vulntitan-firewall-trusted-proxies" class="vulntitan-firewall-textarea" rows="4" placeholder="203.0.113.10"></textarea>
                                                        <small class="vulntitan-firewall-field-help"><?php esc_html_e('Leave this empty unless your host or CDN gave you proxy IP addresses to trust.', 'vulntitan'); ?></small>
                                                        <small class="vulntitan-firewall-field-help"><?php esc_html_e('If you only use Cloudflare, turn on the Cloudflare option above and leave this field empty.', 'vulntitan'); ?></small>
                                                    </label>
                                                </div>
                                            </section>

                                            <section
                                                class="vulntitan-firewall-tab-panel"
                                                id="vulntitan-firewall-panel-identity"
                                                data-firewall-tab-panel="identity"
                                                role="tabpanel"
                                                aria-labelledby="vulntitan-firewall-tab-identity"
                                                hidden
                                            >
                                                <div class="vulntitan-firewall-tab-panel-head">
                                                    <div class="vulntitan-firewall-section-title"><?php esc_html_e('Identity Security', 'vulntitan'); ?></div>
                                                    <div class="vulntitan-firewall-section-desc"><?php esc_html_e('Add multi-step login verification, challenge-based bot resistance, XML-RPC controls, and stronger credential hygiene.', 'vulntitan'); ?></div>
                                                </div>

                                                <div class="vulntitan-firewall-section">
                                                    <div class="vulntitan-firewall-section-title"><?php esc_html_e('Two-Factor Authentication', 'vulntitan'); ?></div>
                                                    <div class="vulntitan-firewall-section-desc"><?php esc_html_e('Require a TOTP authenticator code for users in selected roles. Enrollment is completed from each user profile.', 'vulntitan'); ?></div>

                                                    <details class="vulntitan-firewall-guidance-note">
                                                        <summary class="vulntitan-firewall-guidance-summary">
                                                            <span class="vulntitan-firewall-guidance-kicker"><?php esc_html_e('2FA Rollout', 'vulntitan'); ?></span>
                                                            <span class="vulntitan-firewall-guidance-title"><?php esc_html_e('Recommended administrator rollout', 'vulntitan'); ?></span>
                                                        </summary>
                                                        <ol class="vulntitan-firewall-guidance-list">
                                                            <li><?php esc_html_e('Enable global 2FA enforcement here first.', 'vulntitan'); ?></li>
                                                            <li><?php esc_html_e('Select the roles that must use 2FA, then have each of those users enroll from their WordPress profile.', 'vulntitan'); ?></li>
                                                            <li><?php esc_html_e('Confirm recovery codes are stored offline before enforcing sign-in changes team-wide.', 'vulntitan'); ?></li>
                                                            <li><?php esc_html_e('Use trusted devices only on managed machines.', 'vulntitan'); ?></li>
                                                        </ol>
                                                    </details>

                                                    <?php
                                                    $roleOptions = function_exists('wp_roles') ? wp_roles()->get_names() : [];
                                                    if (!is_array($roleOptions)) {
                                                        $roleOptions = [];
                                                    }
                                                    $roleCount = count($roleOptions);
                                                    $roleSize = min(8, max(3, $roleCount));
                                                    ?>

                                                    <label class="vulntitan-firewall-toggle">
                                                        <input type="checkbox" id="vulntitan-firewall-two-factor-enabled" class="vulntitan-firewall-checkbox">
                                                        <span><?php esc_html_e('Enable TOTP 2FA enforcement', 'vulntitan'); ?></span>
                                                    </label>
                                                    <small class="vulntitan-firewall-field-help"><?php esc_html_e('Users in the selected roles must complete setup before using the admin dashboard.', 'vulntitan'); ?></small>

                                                    <div class="vulntitan-firewall-field-grid">
                                                        <label class="vulntitan-firewall-field">
                                                            <span class="vulntitan-firewall-field-label"><?php esc_html_e('Roles that must enable 2FA', 'vulntitan'); ?></span>
                                                            <select id="vulntitan-firewall-two-factor-roles" class="vulntitan-firewall-input" multiple size="<?php echo (int) $roleSize; ?>">
                                                                <?php foreach ($roleOptions as $roleKey => $roleLabel) : ?>
                                                                    <?php
                                                                    $label = function_exists('translate_user_role') ? translate_user_role($roleLabel) : $roleLabel;
                                                                    ?>
                                                                    <option value="<?php echo esc_attr($roleKey); ?>"><?php echo esc_html($label); ?></option>
                                                                <?php endforeach; ?>
                                                            </select>
                                                            <small class="vulntitan-firewall-field-help"><?php esc_html_e('Select one or more roles that must enroll in 2FA. Hold Command/Ctrl to select multiple roles.', 'vulntitan'); ?></small>
                                                        </label>
                                                    </div>

                                                    <div class="vulntitan-firewall-field-grid">
                                                        <label class="vulntitan-firewall-field">
                                                            <span class="vulntitan-firewall-field-label"><?php esc_html_e('Trusted device duration (days)', 'vulntitan'); ?></span>
                                                            <input type="number" id="vulntitan-firewall-trusted-device-days" class="vulntitan-firewall-input" min="0" max="90" value="30">
                                                            <small class="vulntitan-firewall-field-help"><?php esc_html_e('Set to 0 to require 2FA on every sign-in. Administrators and editors can enroll from their WordPress profile page.', 'vulntitan'); ?></small>
                                                        </label>
                                                    </div>
                                                </div>

                                                <div class="vulntitan-firewall-section">
                                                    <div class="vulntitan-firewall-section-title"><?php esc_html_e('CAPTCHA Challenge Layer', 'vulntitan'); ?></div>
                                                    <div class="vulntitan-firewall-section-desc"><?php esc_html_e('Deploy Cloudflare Turnstile or hCaptcha to login, register, lost-password, and optional comment submission screens.', 'vulntitan'); ?></div>

                                                    <details class="vulntitan-firewall-guidance-note">
                                                        <summary class="vulntitan-firewall-guidance-summary">
                                                            <span class="vulntitan-firewall-guidance-kicker"><?php esc_html_e('CAPTCHA Setup', 'vulntitan'); ?></span>
                                                            <span class="vulntitan-firewall-guidance-title"><?php esc_html_e('Recommended challenge rollout', 'vulntitan'); ?></span>
                                                        </summary>
                                                        <ol class="vulntitan-firewall-guidance-list">
                                                            <li><?php esc_html_e('Choose Cloudflare Turnstile or hCaptcha and save both the site key and secret key.', 'vulntitan'); ?></li>
                                                            <li><?php esc_html_e('Start with login and lost-password protection, then expand to registration or comments if your site uses them.', 'vulntitan'); ?></li>
                                                            <li><?php esc_html_e('Test every protected form once before considering the rollout complete.', 'vulntitan'); ?></li>
                                                        </ol>
                                                    </details>

                                                    <div class="vulntitan-firewall-field-grid">
                                                        <label class="vulntitan-firewall-field">
                                                            <span class="vulntitan-firewall-field-label"><?php esc_html_e('Provider', 'vulntitan'); ?></span>
                                                            <select id="vulntitan-firewall-captcha-provider" class="vulntitan-firewall-input">
                                                                <option value="none"><?php esc_html_e('Disabled', 'vulntitan'); ?></option>
                                                                <option value="turnstile"><?php esc_html_e('Cloudflare Turnstile', 'vulntitan'); ?></option>
                                                                <option value="hcaptcha"><?php esc_html_e('hCaptcha', 'vulntitan'); ?></option>
                                                            </select>
                                                            <small class="vulntitan-firewall-field-help"><?php esc_html_e('Challenge forms only activate when a provider and both API keys are saved.', 'vulntitan'); ?></small>
                                                        </label>

                                                        <label class="vulntitan-firewall-field">
                                                            <span class="vulntitan-firewall-field-label"><?php esc_html_e('Site Key', 'vulntitan'); ?></span>
                                                            <input type="text" id="vulntitan-firewall-captcha-site-key" class="vulntitan-firewall-input" autocomplete="off" spellcheck="false">
                                                            <small class="vulntitan-firewall-field-help"><?php esc_html_e('Public key rendered in the widget shown to visitors.', 'vulntitan'); ?></small>
                                                        </label>

                                                        <label class="vulntitan-firewall-field">
                                                            <span class="vulntitan-firewall-field-label"><?php esc_html_e('Secret Key', 'vulntitan'); ?></span>
                                                            <input type="text" id="vulntitan-firewall-captcha-secret-key" class="vulntitan-firewall-input" autocomplete="off" spellcheck="false">
                                                            <small class="vulntitan-firewall-field-help"><?php esc_html_e('Private server-side credential used to verify challenge responses.', 'vulntitan'); ?></small>
                                                        </label>
                                                    </div>

                                                    <div class="vulntitan-firewall-field-grid">
                                                        <label class="vulntitan-firewall-toggle">
                                                            <input type="checkbox" id="vulntitan-firewall-captcha-login-enabled" class="vulntitan-firewall-checkbox">
                                                            <span><?php esc_html_e('Protect login form', 'vulntitan'); ?></span>
                                                        </label>

                                                        <label class="vulntitan-firewall-toggle">
                                                            <input type="checkbox" id="vulntitan-firewall-captcha-register-enabled" class="vulntitan-firewall-checkbox">
                                                            <span><?php esc_html_e('Protect registration form', 'vulntitan'); ?></span>
                                                        </label>

                                                        <label class="vulntitan-firewall-toggle">
                                                            <input type="checkbox" id="vulntitan-firewall-captcha-lostpassword-enabled" class="vulntitan-firewall-checkbox">
                                                            <span><?php esc_html_e('Protect lost password form', 'vulntitan'); ?></span>
                                                        </label>

                                                        <label class="vulntitan-firewall-toggle">
                                                            <input type="checkbox" id="vulntitan-firewall-captcha-comment-enabled" class="vulntitan-firewall-checkbox">
                                                            <span><?php esc_html_e('Protect comment form', 'vulntitan'); ?></span>
                                                        </label>
                                                    </div>
                                                </div>

                                                <div class="vulntitan-firewall-section">
                                                    <div class="vulntitan-firewall-section-title"><?php esc_html_e('XML-RPC Policy', 'vulntitan'); ?></div>
                                                    <div class="vulntitan-firewall-section-desc"><?php esc_html_e('Allow, disable, or rate-limit XML-RPC traffic, with optional IP allowlisting for trusted integrations.', 'vulntitan'); ?></div>

                                                    <div class="vulntitan-firewall-field-grid">
                                                        <label class="vulntitan-firewall-field">
                                                            <span class="vulntitan-firewall-field-label"><?php esc_html_e('Policy', 'vulntitan'); ?></span>
                                                            <select id="vulntitan-firewall-xmlrpc-policy" class="vulntitan-firewall-input">
                                                                <option value="allow"><?php esc_html_e('Allow XML-RPC', 'vulntitan'); ?></option>
                                                                <option value="disable"><?php esc_html_e('Disable XML-RPC', 'vulntitan'); ?></option>
                                                                <option value="rate_limit"><?php esc_html_e('Rate-limit XML-RPC', 'vulntitan'); ?></option>
                                                            </select>
                                                            <small class="vulntitan-firewall-field-help"><?php esc_html_e('Disable XML-RPC unless you actively rely on the WordPress mobile app, Jetpack, or another remote publishing integration.', 'vulntitan'); ?></small>
                                                        </label>

                                                        <label class="vulntitan-firewall-field">
                                                            <span class="vulntitan-firewall-field-label"><?php esc_html_e('Rate limit attempts', 'vulntitan'); ?></span>
                                                            <input type="number" id="vulntitan-firewall-xmlrpc-rate-limit-attempts" class="vulntitan-firewall-input" min="1" max="500" value="20">
                                                        </label>

                                                        <label class="vulntitan-firewall-field">
                                                            <span class="vulntitan-firewall-field-label"><?php esc_html_e('Rate limit window (minutes)', 'vulntitan'); ?></span>
                                                            <input type="number" id="vulntitan-firewall-xmlrpc-rate-limit-window-minutes" class="vulntitan-firewall-input" min="1" max="240" value="10">
                                                        </label>
                                                    </div>

                                                    <label class="vulntitan-firewall-field">
                                                        <span class="vulntitan-firewall-field-label"><?php esc_html_e('XML-RPC IP Allowlist', 'vulntitan'); ?></span>
                                                        <textarea id="vulntitan-firewall-xmlrpc-allowlist" class="vulntitan-firewall-input vulntitan-firewall-textarea" rows="4" placeholder="203.0.113.10&#10;198.51.100.42"></textarea>
                                                        <small class="vulntitan-firewall-field-help"><?php esc_html_e('One IPv4 or IPv6 address per line. Allowlisted IPs bypass XML-RPC disable and rate-limit rules.', 'vulntitan'); ?></small>
                                                    </label>
                                                </div>

                                                <div class="vulntitan-firewall-section">
                                                    <div class="vulntitan-firewall-section-title"><?php esc_html_e('Password Policy', 'vulntitan'); ?></div>
                                                    <div class="vulntitan-firewall-section-desc"><?php esc_html_e('Reject weak passwords during profile updates, password resets, and compatible registration flows.', 'vulntitan'); ?></div>

                                                    <label class="vulntitan-firewall-toggle">
                                                        <input type="checkbox" id="vulntitan-firewall-weak-password-blocking-enabled" class="vulntitan-firewall-checkbox">
                                                        <span><?php esc_html_e('Block weak passwords', 'vulntitan'); ?></span>
                                                    </label>
                                                </div>
                                            </section>

                                            <section
                                                class="vulntitan-firewall-tab-panel"
                                                id="vulntitan-firewall-panel-waf"
                                                data-firewall-tab-panel="waf"
                                                role="tabpanel"
                                                aria-labelledby="vulntitan-firewall-tab-waf"
                                                hidden
                                            >
                                                <div class="vulntitan-firewall-tab-panel-head">
                                                    <div class="vulntitan-firewall-section-title"><?php esc_html_e('WAF Rules', 'vulntitan'); ?></div>
                                                    <div class="vulntitan-firewall-section-desc"><?php esc_html_e('Tune payload inspection so risky requests are blocked early while known-safe paths stay operational.', 'vulntitan'); ?></div>
                                                </div>

                                                <div class="vulntitan-firewall-section">
                                                    <div class="vulntitan-firewall-section-title"><?php esc_html_e('Payload Protection', 'vulntitan'); ?></div>
                                                    <div class="vulntitan-firewall-section-desc"><?php esc_html_e('Inspect request parameters for common SQL injection and command injection payloads.', 'vulntitan'); ?></div>

                                                    <label class="vulntitan-firewall-toggle">
                                                        <input type="checkbox" id="vulntitan-firewall-waf-sqli-enabled" class="vulntitan-firewall-checkbox" checked>
                                                        <span><?php esc_html_e('Enable SQL Injection Rule Set', 'vulntitan'); ?></span>
                                                    </label>

                                                    <label class="vulntitan-firewall-toggle">
                                                        <input type="checkbox" id="vulntitan-firewall-waf-command-enabled" class="vulntitan-firewall-checkbox" checked>
                                                        <span><?php esc_html_e('Enable Command Injection Rule Set', 'vulntitan'); ?></span>
                                                    </label>
                                                </div>

                                                <div class="vulntitan-firewall-section">
                                                    <div class="vulntitan-firewall-section-title"><?php esc_html_e('Trusted Exceptions', 'vulntitan'); ?></div>
                                                    <div class="vulntitan-firewall-section-desc"><?php esc_html_e('Whitelist routes that should bypass payload rules, without weakening traversal or sensitive-file protection.', 'vulntitan'); ?></div>

                                                    <label class="vulntitan-firewall-field">
                                                        <span class="vulntitan-firewall-field-label"><?php esc_html_e('WAF Whitelist (Path patterns)', 'vulntitan'); ?></span>
                                                        <textarea id="vulntitan-firewall-waf-whitelist-paths" class="vulntitan-firewall-input vulntitan-firewall-textarea" rows="5" placeholder="/wp-json/my-plugin/*&#10;/custom-safe-endpoint"></textarea>
                                                        <small class="vulntitan-firewall-field-help"><?php esc_html_e('One pattern per line. Use * wildcard only when needed. Whitelist applies to SQLi/Command rules, not traversal/sensitive-file blocks.', 'vulntitan'); ?></small>
                                                    </label>
                                                </div>

                                                <div class="vulntitan-firewall-section">
                                                    <div class="vulntitan-firewall-section-title"><?php esc_html_e('Learning Mode', 'vulntitan'); ?></div>
                                                    <div class="vulntitan-firewall-section-desc"><?php esc_html_e('Generate smart allowlist suggestions from repeated admin-triggered WAF blocks. This never auto-whitelists—everything requires approval.', 'vulntitan'); ?></div>

                                                    <label class="vulntitan-firewall-toggle">
                                                        <input type="checkbox" id="vulntitan-firewall-learning-enabled" class="vulntitan-firewall-checkbox">
                                                        <span><?php esc_html_e('Enable learning suggestions', 'vulntitan'); ?></span>
                                                    </label>

                                                    <div class="vulntitan-firewall-field-grid">
                                                        <label class="vulntitan-firewall-field">
                                                            <span class="vulntitan-firewall-field-label"><?php esc_html_e('Minimum hits to suggest', 'vulntitan'); ?></span>
                                                            <input type="number" id="vulntitan-firewall-learning-threshold" class="vulntitan-firewall-input" min="2" max="20" value="3">
                                                        </label>

                                                        <label class="vulntitan-firewall-field">
                                                            <span class="vulntitan-firewall-field-label"><?php esc_html_e('Lookback window (days)', 'vulntitan'); ?></span>
                                                            <input type="number" id="vulntitan-firewall-learning-window" class="vulntitan-firewall-input" min="1" max="30" value="7">
                                                        </label>

                                                        <div class="vulntitan-firewall-field">
                                                            <span class="vulntitan-firewall-field-label"><?php esc_html_e('Suggestions', 'vulntitan'); ?></span>
                                                            <button type="button" class="vulntitan-fw-btn vulntitan-fw-btn-secondary" id="vulntitan-firewall-learning-refresh"><?php esc_html_e('Refresh suggestions', 'vulntitan'); ?></button>
                                                            <small class="vulntitan-firewall-field-help"><?php esc_html_e('Learning only analyzes WAF blocks triggered by logged-in administrators.', 'vulntitan'); ?></small>
                                                        </div>
                                                    </div>
                                                </div>

                                                <div class="vulntitan-firewall-section">
                                                    <div class="vulntitan-firewall-section-title"><?php esc_html_e('Learning Suggestions', 'vulntitan'); ?></div>
                                                    <div class="vulntitan-firewall-section-desc"><?php esc_html_e('Review suggested whitelist patterns derived from repeated WAF blocks. Approving adds a pattern to the WAF whitelist.', 'vulntitan'); ?></div>
                                                    <div id="vulntitan-firewall-learning-empty" class="vulntitan-firewall-approvals-empty">
                                                        <?php esc_html_e('Learning suggestions are disabled.', 'vulntitan'); ?>
                                                    </div>
                                                    <div id="vulntitan-firewall-learning-list" class="vulntitan-firewall-log-list"></div>
                                                </div>
                                            </section>

                                            <section
                                                class="vulntitan-firewall-tab-panel"
                                                id="vulntitan-firewall-panel-approvals"
                                                data-firewall-tab-panel="approvals"
                                                role="tabpanel"
                                                aria-labelledby="vulntitan-firewall-tab-approvals"
                                                hidden
                                            >
                                                <div class="vulntitan-firewall-tab-panel-head">
                                                    <div class="vulntitan-firewall-section-title"><?php esc_html_e('Approval Queue', 'vulntitan'); ?></div>
                                                    <div class="vulntitan-firewall-section-desc"><?php esc_html_e('Review blocked WAF events that may belong to trusted plugins. Approving adds a targeted WAF whitelist pattern.', 'vulntitan'); ?></div>
                                                </div>

                                                <div class="vulntitan-firewall-section">
                                                    <div id="vulntitan-firewall-approvals-empty" class="vulntitan-firewall-approvals-empty">
                                                        <?php esc_html_e('No pending approvals right now.', 'vulntitan'); ?>
                                                    </div>
                                                    <div id="vulntitan-firewall-approvals-list" class="vulntitan-firewall-log-list"></div>
                                                </div>
                                            </section>

                                            <section
                                                class="vulntitan-firewall-tab-panel"
                                                id="vulntitan-firewall-panel-lockouts"
                                                data-firewall-tab-panel="lockouts"
                                                role="tabpanel"
                                                aria-labelledby="vulntitan-firewall-tab-lockouts"
                                                hidden
                                            >
                                                <div class="vulntitan-firewall-tab-panel-head">
                                                    <div class="vulntitan-firewall-section-title"><?php esc_html_e('Lockouts & Logs', 'vulntitan'); ?></div>
                                                    <div class="vulntitan-firewall-section-desc"><?php esc_html_e('Set aggressive but safe thresholds for failed logins and determine how long firewall intelligence stays available in the log store.', 'vulntitan'); ?></div>
                                                </div>

                                                <div class="vulntitan-firewall-section">
                                                    <div class="vulntitan-firewall-section-title"><?php esc_html_e('Login Lockout Policy', 'vulntitan'); ?></div>
                                                    <div class="vulntitan-firewall-section-desc"><?php esc_html_e('Tighten brute force resilience with adaptive limits and retention.', 'vulntitan'); ?></div>

                                                    <div class="vulntitan-firewall-field-grid">
                                                        <label class="vulntitan-firewall-field">
                                                            <span class="vulntitan-firewall-field-label"><?php esc_html_e('Max failed attempts', 'vulntitan'); ?></span>
                                                            <input type="number" id="vulntitan-firewall-max-attempts" class="vulntitan-firewall-input" min="2" max="20" value="5">
                                                        </label>

                                                        <label class="vulntitan-firewall-field">
                                                            <span class="vulntitan-firewall-field-label"><?php esc_html_e('Lockout duration (minutes)', 'vulntitan'); ?></span>
                                                            <input type="number" id="vulntitan-firewall-lockout-minutes" class="vulntitan-firewall-input" min="5" max="240" value="15">
                                                        </label>

                                                        <label class="vulntitan-firewall-field">
                                                            <span class="vulntitan-firewall-field-label"><?php esc_html_e('Log retention (days)', 'vulntitan'); ?></span>
                                                            <input type="number" id="vulntitan-firewall-log-retention" class="vulntitan-firewall-input" min="1" max="365" value="30">
                                                        </label>
                                                    </div>

                                                    <div class="vulntitan-firewall-field-grid">
                                                        <label class="vulntitan-firewall-field">
                                                            <span class="vulntitan-firewall-field-label"><?php esc_html_e('Login Lockout IP Allowlist', 'vulntitan'); ?></span>
                                                            <textarea id="vulntitan-firewall-lockout-allowlist" class="vulntitan-firewall-input vulntitan-firewall-textarea" rows="4" placeholder="203.0.113.10&#10;198.51.100.42"></textarea>
                                                            <small class="vulntitan-firewall-field-help"><?php esc_html_e('Allowlisted IPs bypass login lockouts only. One IPv4 or IPv6 address per line.', 'vulntitan'); ?></small>
                                                        </label>
                                                    </div>
                                                </div>

                                                <div class="vulntitan-firewall-section">
                                                    <div class="vulntitan-firewall-section-title"><?php esc_html_e('Executive Weekly Digest', 'vulntitan'); ?></div>
                                                    <div class="vulntitan-firewall-section-desc"><?php esc_html_e('Send a polished HTML security summary to the main administrator with the previous 7 complete days of blocked events, login abuse, and WAF detections.', 'vulntitan'); ?></div>

                                                    <label class="vulntitan-firewall-toggle">
                                                        <input type="checkbox" id="vulntitan-firewall-weekly-summary-email-enabled" class="vulntitan-firewall-checkbox" checked>
                                                        <span><?php esc_html_e('Enable Weekly Security Email', 'vulntitan'); ?></span>
                                                    </label>

                                                    <div class="vulntitan-firewall-field-grid">
                                                        <label class="vulntitan-firewall-field">
                                                            <span class="vulntitan-firewall-field-label"><?php esc_html_e('Recipient Email', 'vulntitan'); ?></span>
                                                            <input type="email" id="vulntitan-firewall-weekly-summary-email-recipient" class="vulntitan-firewall-input" placeholder="admin@example.com" autocomplete="email" spellcheck="false">
                                                            <small class="vulntitan-firewall-field-help"><?php esc_html_e('Defaults to the primary WordPress administrator email when left blank or invalid.', 'vulntitan'); ?></small>
                                                            <small class="vulntitan-firewall-field-help"><?php esc_html_e('Digest is scheduled weekly and reports on the previous 7 complete days.', 'vulntitan'); ?></small>
                                                        </label>
                                                    </div>
                                                </div>
                                            </section>

                                            <section
                                                class="vulntitan-firewall-tab-panel"
                                                id="vulntitan-firewall-panel-spam"
                                                data-firewall-tab-panel="spam"
                                                role="tabpanel"
                                                aria-labelledby="vulntitan-firewall-tab-spam"
                                                hidden
                                            >
                                                <div class="vulntitan-firewall-tab-panel-head">
                                                    <div class="vulntitan-firewall-section-title"><?php esc_html_e('Spam Protection', 'vulntitan'); ?></div>
                                                    <div class="vulntitan-firewall-section-desc"><?php esc_html_e('Manage anti-spam coverage across comments and form providers without coupling every new integration to a comment-only feature set.', 'vulntitan'); ?></div>
                                                </div>

                                                <div class="vulntitan-firewall-section">
                                                    <div class="vulntitan-firewall-section-title"><?php esc_html_e('Comments', 'vulntitan'); ?></div>
                                                    <div class="vulntitan-firewall-section-desc"><?php esc_html_e('Protect native WordPress comments with anti-spam heuristics and decide whether suspicious submissions should be held or blocked.', 'vulntitan'); ?></div>

                                                    <label class="vulntitan-firewall-toggle">
                                                        <input type="checkbox" id="vulntitan-firewall-comment-shield-enabled" class="vulntitan-firewall-checkbox">
                                                        <span><?php esc_html_e('Enable Comment Shield', 'vulntitan'); ?></span>
                                                    </label>

                                                    <label class="vulntitan-firewall-field">
                                                        <span class="vulntitan-firewall-field-label"><?php esc_html_e('Suspicious Comment Action', 'vulntitan'); ?></span>
                                                        <select id="vulntitan-firewall-comment-suspicious-action" class="vulntitan-firewall-input">
                                                            <option value="hold"><?php esc_html_e('Hold for moderation', 'vulntitan'); ?></option>
                                                            <option value="block"><?php esc_html_e('Block immediately', 'vulntitan'); ?></option>
                                                        </select>
                                                        <small class="vulntitan-firewall-field-help"><?php esc_html_e('Objective bot signals like honeypot fills and repeated rate-limit abuse are always blocked. This setting controls how softer heuristics behave for comments; Contact Form 7 matches are blocked and logged in WAF because there is no moderation queue.', 'vulntitan'); ?></small>
                                                    </label>
                                                </div>

                                                <div class="vulntitan-firewall-section">
                                                    <div class="vulntitan-firewall-section-title"><?php esc_html_e('Forms', 'vulntitan'); ?></div>
                                                    <div class="vulntitan-firewall-section-desc"><?php esc_html_e('Turn on shared form protection once, then enable supported providers individually as you add integrations over time.', 'vulntitan'); ?></div>

                                                    <label class="vulntitan-firewall-toggle">
                                                        <input type="checkbox" id="vulntitan-firewall-form-shield-enabled" class="vulntitan-firewall-checkbox">
                                                        <span><?php esc_html_e('Enable Form Shield', 'vulntitan'); ?></span>
                                                    </label>

                                                    <div class="vulntitan-firewall-field-grid">
                                                        <div class="vulntitan-firewall-field">
                                                            <label class="vulntitan-firewall-toggle">
                                                                <input
                                                                    type="checkbox"
                                                                    id="vulntitan-firewall-form-provider-cf7-enabled"
                                                                    class="vulntitan-firewall-checkbox"
                                                                    data-provider-installed="<?php echo $contactForm7Installed ? '1' : '0'; ?>"
                                                                    <?php disabled(!$contactForm7Installed); ?>
                                                                >
                                                                <span><?php esc_html_e('Protect Contact Form 7', 'vulntitan'); ?></span>
                                                            </label>
                                                            <?php if (!$contactForm7Installed) : ?>
                                                                <small class="vulntitan-firewall-field-help"><?php esc_html_e('Not installed. Install and activate Contact Form 7 to enable this provider.', 'vulntitan'); ?></small>
                                                            <?php endif; ?>
                                                        </div>

                                                        <div class="vulntitan-firewall-field">
                                                            <label class="vulntitan-firewall-toggle">
                                                                <input
                                                                    type="checkbox"
                                                                    id="vulntitan-firewall-form-provider-fluentforms-enabled"
                                                                    class="vulntitan-firewall-checkbox"
                                                                    data-provider-installed="<?php echo $fluentFormsInstalled ? '1' : '0'; ?>"
                                                                    <?php disabled(!$fluentFormsInstalled); ?>
                                                                >
                                                                <span><?php esc_html_e('Protect Fluent Forms', 'vulntitan'); ?></span>
                                                            </label>
                                                            <?php if (!$fluentFormsInstalled) : ?>
                                                                <small class="vulntitan-firewall-field-help"><?php esc_html_e('Not installed. Install and activate Fluent Forms to enable this provider.', 'vulntitan'); ?></small>
                                                            <?php endif; ?>
                                                        </div>
                                                    </div>

                                                    <small class="vulntitan-firewall-field-help"><?php esc_html_e('Enabled form providers are blocked and logged in WAF because form flows do not have a moderation queue.', 'vulntitan'); ?></small>
                                                </div>

                                                <div class="vulntitan-firewall-section">
                                                    <div class="vulntitan-firewall-section-title"><?php esc_html_e('Shared Heuristics', 'vulntitan'); ?></div>
                                                    <div class="vulntitan-firewall-section-desc"><?php esc_html_e('Tune the shared heuristics used by comments and enabled form providers, so future integrations can reuse the same core anti-spam engine.', 'vulntitan'); ?></div>

                                                    <div class="vulntitan-firewall-field-grid">
                                                        <label class="vulntitan-firewall-field">
                                                            <span class="vulntitan-firewall-field-label"><?php esc_html_e('Minimum submit time (seconds)', 'vulntitan'); ?></span>
                                                            <input type="number" id="vulntitan-firewall-submission-min-submit-seconds" class="vulntitan-firewall-input" min="1" max="30" value="3">
                                                        </label>

                                                        <label class="vulntitan-firewall-field">
                                                            <span class="vulntitan-firewall-field-label"><?php esc_html_e('Link limit', 'vulntitan'); ?></span>
                                                            <input type="number" id="vulntitan-firewall-submission-max-links" class="vulntitan-firewall-input" min="0" max="20" value="2">
                                                        </label>

                                                        <label class="vulntitan-firewall-field">
                                                            <span class="vulntitan-firewall-field-label"><?php esc_html_e('Rate limit attempts', 'vulntitan'); ?></span>
                                                            <input type="number" id="vulntitan-firewall-submission-rate-limit-attempts" class="vulntitan-firewall-input" min="1" max="20" value="3">
                                                        </label>
                                                    </div>

                                                    <div class="vulntitan-firewall-field-grid">
                                                        <label class="vulntitan-firewall-field">
                                                            <span class="vulntitan-firewall-field-label"><?php esc_html_e('Rate limit window (minutes)', 'vulntitan'); ?></span>
                                                            <input type="number" id="vulntitan-firewall-submission-rate-limit-window-minutes" class="vulntitan-firewall-input" min="1" max="120" value="10">
                                                            <small class="vulntitan-firewall-field-help"><?php esc_html_e('The same time window is also used for duplicate-content detection from the same visitor fingerprint.', 'vulntitan'); ?></small>
                                                        </label>
                                                    </div>
                                                </div>
                                            </section>
                                            </div>
                                        </div>
                                    </div>
                                </div>

                                <div class="vulntitan-firewall-actions">
                                    <button type="button" class="vulntitan-fw-btn vulntitan-fw-btn-primary" id="vulntitan-firewall-save-settings"><?php esc_html_e('Save Settings', 'vulntitan'); ?></button>
                                    <button type="button" class="vulntitan-fw-btn vulntitan-fw-btn-secondary" id="vulntitan-firewall-refresh"><?php esc_html_e('Refresh', 'vulntitan'); ?></button>
                                </div>
                            </section>
                        </div>
                    </div>
                </div>
            </div>
            <?php self::footer(); ?>
        </div>
    <?php
    }
}
