<?php
// Prevent direct access.
if (!defined('ABSPATH')) {
    exit;
}

/**
 * HTML template for å vise hovedsiden med status informasjon og innstillnger for firewall.
 * 
 * Forventer at følgende variabler eksisterer.
 * 
 * $msg = Eventuell success/error melding som skal settes inn på toppen av siden.
 * $firewallStatus = HTML/text som angir som firewall er installert eller ikke.
 * $firewallInstall = HTML/text som angir A tag+link tekst for å installere/avinstallere firewall. 
 * $blockMode = Angir block mode
 * $logDays = Antall dager loggen skal lagres.
 * $uninstallBehavior = Angir hva som skal skje ved avinstallering av plugin.
 * $proxyEnabled = Angir om proxy server skal brukes eller ikke.
 * $proxyHeader = Hvilken proxy header som er valgt. 
 * $proxyList = Liste over alle proxy servere bruker har lagt inn.
 */
?>
<div class="wrap wtb-firewall-admin">
    <h1>WTB Firewall</h1>
    <p>
        Manage core settings for the firewall.
    </p>
    <hr class="wp-header-end" />
    <?php echo wp_kses_post($msg); ?>

    <!-- Firewall Status Card -->
    <div class="card">
        <h2>Firewall Status</h2>

        <p>
            Status:
            <?php echo wp_kses_post($firewallStatus); ?>                       
        </p>

        <p>
            Before installing the firewall, we recommend reading the Quick Start Guide.<br>
            It explains the basic setup steps and how to avoid accidental lockouts.
        </p>

        <p>
            <?php echo wp_kses_post($firewallInstall); ?>
        </p>                    
    </div>
    
    <?php do_action('wtb_firewall_registration_form');?>

    <!-- Global Mode Card -->
    <div class="card">
        <h2>Global Mode</h2>

        <p>
            Choose how the firewall handles incoming traffic by default.  
            Rules you add later can override this behavior for specific IPs or ranges.
        </p>

        <form method="post" action="<?php echo esc_url(admin_url('admin-post.php')); ?>">
            <input type="hidden" name="action" value="firewall_mode" />
            <?php wp_nonce_field('wtb_firewall_mode', 'wtb_firewall_nonce'); ?>            

            <fieldset>                            
                <label>
                    <input type="radio" name="block_mode" value="1" <?php checked($blockMode, 1); ?> />
                    <strong>Allow all</strong> – only block requests that match firewall rules.
                </label>
                <br /><br />

                <label>
                    <input type="radio" name="block_mode" value="2" <?php checked($blockMode, 2); ?> />
                    <strong>Deny all</strong> – block everything by default, only allow what matches rules.
                </label>
            </fieldset>

            <p class="description">
                <b>Warning:</b> In DENY ALL mode all incoming traffic will be blocked, except for traffic from IPs in the allow list.
                Before enabling DENY ALL mode ensure your own IP is in the allow list to prevent lockout.
            </p>

            <p>
                <button type="submit" class="button button-primary">
                    Save Mode
                </button>
            </p>
        </form>
    </div>


    <!-- Firewall Log Settings Card -->
    <div class="card">
        <h2>Firewall Log</h2>

        <p>
            Choose how long log entries are kept. Entries older than this gets automatically deleted.
        </p>

        <form method="post" action="<?php echo esc_url(admin_url('admin-post.php')); ?>">
            <input type="hidden" name="action" value="firewall_log" />
            <?php wp_nonce_field('wtb_firewall_log_time', 'wtb_firewall_nonce'); ?>            

            <fieldset>
                <label><input type="radio" name="log_days" value="7" <?php checked($logDays, 7); ?>/><strong>7 days</strong></label><br /><br />
                <label><input type="radio" name="log_days" value="14" <?php checked($logDays, 14); ?>/><strong>14 days</strong></label><br /><br />
                <label><input type="radio" name="log_days" value="30" <?php checked($logDays, 30); ?>/><strong>30 days</strong></label><br /><br />
                <label><input type="radio" name="log_days" value="90" <?php checked($logDays, 90); ?>/><strong>90 days</strong></label><br /><br />
                <label><input type="radio" name="log_days" value="0" <?php checked($logDays, 0); ?>/><strong>Never</strong></label><br /><br />
            </fieldset>

            <p>
                <button type="submit" class="button button-primary">
                    Save Log Setting
                </button>
            </p>
        </form>
    </div>

    <!-- Delete On Uninstall Option Card -->
    <div class="card">
        <h2>Uninstall Behavior</h2>

        <p>
            Choose what should happen to this plugin’s data when it is uninstalled.
            This includes firewall rules, logs, and plugin settings stored in the database.
        </p>

        <form method="post" action="<?php echo esc_url(admin_url('admin-post.php')); ?>">
            <input type="hidden" name="action" value="firewall_uninstall_setting" />
            <?php wp_nonce_field('wtb_firewall_uninstall_behavior', 'wtb_firewall_nonce'); ?>

            <fieldset>
                <label>
                    <input type="radio" name="uninstall_mode" value="1" <?php checked($uninstallBehavior, true); ?> />
                    <strong>Delete all data on uninstall</strong> - Removes all plugin data when the plugin is uninstalled.
                    Use this option if you are permanently removing the plugin and do not need to keep any firewall rules, logs, or settings.
                </label>
                <br /><br />

                <label>
                    <input type="radio" name="uninstall_mode" value="2" <?php checked($uninstallBehavior, false); ?> />
                    <strong>Keep data on uninstall</strong> – Keeps all plugin data in the database when the plugin is uninstalled.
                    Use this option if you plan to reinstall the plugin later or want to preserve existing rules and logs.
                </label>
            </fieldset>

            <p>
                <button type="submit" class="button button-primary">
                    Save Uninstall Behavior
                </button>
            </p>
        </form>
    </div>

    <!-- Write firewall rules files. -->
    <div class="card">
        <h2>Write Firewall Rules To File</h2>

        <p>
            Clicking this button will write all current firewall rules to file.
            This is normally done automatically, but you can use this button to manually trigger the process if needed.
        </p>

        <form method="post" action="<?php echo esc_url(admin_url('admin-post.php')); ?>">
            <input type="hidden" name="action" value="firewall_manually_write_rules" />
            <?php wp_nonce_field('wtb_firewall_write_rules', 'wtb_firewall_nonce'); ?>

            <p>
                <button type="submit" class="button button-primary">
                    Write Firewall Rules
                </button>
            </p>
        </form>
    </div>


    <!-- Proxy support. -->
    <div class="card">
        <h2 class="title">Proxy Support</h2>
        <p>
            If your site is behind a reverse proxy/CDN/load balancer, enable proxy support so the firewall can detect the visitor’s real IP address.
            Only trust headers from proxies you explicitly approve below.
        </p>

        <form method="post" action="<?php echo esc_url(admin_url('admin-post.php')); ?>">
            <input type="hidden" name="action" value="firewall_proxy_settings" />
            <?php wp_nonce_field('wtb_firewall_proxy_support', 'wtb_firewall_nonce'); ?>

            <table class="form-table" role="presentation">
                <tbody>
                    <tr>
                        <th scope="row">
                            Enable proxy support
                        </th>
                        <td>            
                            <input type="checkbox" name="proxy_enabled" value="1" <?php checked($proxyEnabled, true); ?>/>
                            <p class="description">
                                Leave disabled if your server receives connections directly from visitors.
                            </p>
                        </td>
                    </tr>

                    <tr>
                        <th scope="row">
                            Client IP header
                        </th>
                        <td>
                            <select name="proxy_header">
                                <option value="auto" <?php selected($proxyHeader, 'auto'); ?>>Auto Detect</option>
                                <option value="x_forwarded_for" <?php selected($proxyHeader, 'x_forwarded_for'); ?>>X-Forwarded-For</option>
                                <option value="x_real_ip" <?php selected($proxyHeader, 'x_real_ip'); ?>>X-Real-IP</option>
                                <option value="forwarded" <?php selected($proxyHeader, 'forwarded'); ?>>Forwarded</option>
                                <option value="cf_connecting_ip" <?php selected($proxyHeader, 'cf_connecting_ip'); ?>>CF-Connecting-IP (Cloudflare)</option>
                                <option value="true_client_ip" <?php selected($proxyHeader, 'true_client_ip'); ?>>True-Client-IP</option>
                                <option value="x_client_ip" <?php selected($proxyHeader, 'x_client_ip'); ?>>X-Client-IP</option>
                            </select>

                            <p class="description">
                                Choose the header your proxy sets to the original client IP. This header will only be used when the request comes from a trusted proxy IP below.
                            </p>
                        </td>
                    </tr>

                    <tr>
                        <th scope="row">
                            Trusted proxy IPs / CIDRs
                        </th>
                        <td>
                            <textarea name="trusted_proxies" rows="6" class="large-text code" placeholder="One IP/network per line."><?php echo esc_textarea($proxyList); ?></textarea>
                            <p class="description">
                                Add the proxy server IPs (or CIDR ranges) that are allowed to send the selected header.
                            </p>

                            <details style="margin-top: 8px;">
                                <summary>Examples & tips</summary>
                                <ul style="margin: 8px 0 0 18px;">
                                    <li><strong>Single IP:</strong> <code>198.51.100.25</code></li>
                                    <li><strong>IPv4 range:</strong> <code>198.51.100.0/24</code></li>
                                    <li><strong>IPv6 range:</strong> <code>2001:db8:abcd::/48</code></li>                                    
                                </ul>
                            </details>
                        </td>
                    </tr>

                    <tr>
                        <th scope="row">
                            Detected IP
                        </th>
                        <td>
                            You are connecting from IP: <?php echo esc_html(\WtbFirewall\Helpers\IpHelper::getVisitorIP()); ?>                            
                        </td>
                    </tr>
                </tbody>
            </table>

            <p class="submit" style="margin-top: 12px;">
                <button type="submit" class="button button-primary">Save Proxy Settings</button>                
            </p>
        </form>
    </div>



</div>
