<?php
if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

use WP_PowerSuite\Core\OptionStoreModuleSettingsRepository;

if ( ! isset( $module_id ) || empty( $module_id ) ) {
	$module_id = 'cloudflare-turnstile';
}

$settings     = OptionStoreModuleSettingsRepository::forModule( $module_id )->all( [] );
if ( ! is_array( $settings ) ) {
	$settings = [];
}

$site_key   = trim( $settings['site_key'] ?? '' );
// Never render the stored secret in HTML (even as a password field — browser "reveal" exposes it, and it may be encrypted).
// Show a mask when a secret is saved; the save handler preserves the existing value if the mask is submitted unchanged.
$secret_mask       = class_exists( 'CloudflareTurnstile\\Module' ) && method_exists( 'CloudflareTurnstile\\Module', 'getSecretMask' )
	? \CloudflareTurnstile\Module::getSecretMask()
	: '••••••••••••';
$has_secret_stored = isset( $settings['secret_key'] ) && trim( (string) $settings['secret_key'] ) !== '';
$secret_key        = $has_secret_stored ? $secret_mask : '';
$theme             = $settings['theme'] ?? 'auto';
$widget_full_width = ! isset( $settings['widget_full_width'] ) || ! empty( $settings['widget_full_width'] );
$protect_login          = ! empty( $settings['protect_login'] );
$protect_registration   = ! empty( $settings['protect_registration'] );
$protect_password_reset = ! empty( $settings['protect_password_reset'] );
$protect_comments       = ! empty( $settings['protect_comments'] );

$woo_login          = ! empty( $settings['woo_login'] );
$woo_registration   = ! empty( $settings['woo_registration'] );
$woo_lost_password  = ! empty( $settings['woo_lost_password'] );
$woo_checkout       = ! empty( $settings['woo_checkout'] );
$woo_reviews        = ! empty( $settings['woo_reviews'] );

$basic_forms     = ! empty( $settings['basic_forms'] );
$cf7             = ! empty( $settings['cf7'] );
$wpforms         = ! empty( $settings['wpforms'] );
$formidable      = ! empty( $settings['formidable'] );
$fluent_forms    = ! empty( $settings['fluent_forms'] );
$elementor_forms = ! empty( $settings['elementor_forms'] );

$elementor_pro_active = defined( 'ELEMENTOR_PRO_VERSION' );

$skip_rules        = isset( $settings['skip_rules'] ) && is_array( $settings['skip_rules'] ) ? $settings['skip_rules'] : [];
$skip_enabled      = ! empty( $skip_rules['enabled'] );
$skip_roles_saved  = isset( $skip_rules['roles'] ) && is_array( $skip_rules['roles'] ) ? $skip_rules['roles'] : [];
$skip_ips_saved    = isset( $skip_rules['ips'] ) && is_array( $skip_rules['ips'] ) ? $skip_rules['ips'] : [];
$skip_ips_textarea = implode( "\n", array_map( 'strval', $skip_ips_saved ) );
$skip_uas_saved    = isset( $skip_rules['user_agents'] ) && is_array( $skip_rules['user_agents'] ) ? $skip_rules['user_agents'] : [];
$skip_uas_textarea = implode( "\n", array_map( 'strval', $skip_uas_saved ) );
$all_roles         = function_exists( 'wp_roles' ) ? wp_roles()->roles : [];

$widget_language            = isset( $settings['widget_language'] ) ? trim( (string) $settings['widget_language'] ) : '';
$widget_visible_appearance  = isset( $settings['widget_visible_appearance'] ) ? sanitize_key( (string) $settings['widget_visible_appearance'] ) : 'interaction-only';
if ( ! in_array( $widget_visible_appearance, [ 'always', 'interaction-only' ], true ) ) {
	$widget_visible_appearance = 'interaction-only';
}
$refresh_timeout            = isset( $settings['refresh_timeout'] ) ? trim( (string) $settings['refresh_timeout'] ) : 'auto';

$disable_submit             = ! empty( $settings['disable_submit'] );
$ajax_comment_reset         = ! empty( $settings['ajax_comment_reset'] );
$login_canonical_only       = ! empty( $settings['login_canonical_only'] );
$register_canonical_only    = ! empty( $settings['register_canonical_only'] );
$woo_checkout_guest_only    = ! empty( $settings['woo_checkout_guest_only'] );

$failsafe_mode = isset( $settings['failsafe_mode'] ) ? sanitize_key( (string) $settings['failsafe_mode'] ) : 'off';
if ( ! in_array( $failsafe_mode, [ 'off', 'allow', 'recaptcha' ], true ) ) {
	$failsafe_mode = 'off';
}
$failsafe_recaptcha_site_key = trim( (string) ( $settings['failsafe_recaptcha_site_key'] ?? '' ) );
$has_failsafe_recaptcha_secret = isset( $settings['failsafe_recaptcha_secret_key'] ) && trim( (string) $settings['failsafe_recaptcha_secret_key'] ) !== '';
$failsafe_recaptcha_secret_display = $has_failsafe_recaptcha_secret ? $secret_mask : '';

$perf_compat      = ! empty( $settings['perf_compat'] );
$resource_hints   = ! empty( $settings['resource_hints'] );
$blocksy_compat   = ! empty( $settings['blocksy_compat'] );
$integration_gravity    = ! empty( $settings['integration_gravity'] );
$integration_jetpack    = ! empty( $settings['integration_jetpack'] );
$integration_bbpress    = ! empty( $settings['integration_bbpress'] );
$integration_buddypress = ! empty( $settings['integration_buddypress'] );
$integration_ultimate_member = ! empty( $settings['integration_ultimate_member'] );
$integration_memberpress = ! empty( $settings['integration_memberpress'] );
$integration_edd        = ! empty( $settings['integration_edd'] );
$integration_pmp        = ! empty( $settings['integration_pmp'] );
$integration_mc4wp      = ! empty( $settings['integration_mc4wp'] );

$premium_unlocked = function_exists( 'wp_powersuite_is_license_valid' ) && wp_powersuite_is_license_valid();
$license_page_url   = admin_url( 'admin.php?page=powersuite-license' );

$premium_integrations_on = $basic_forms || $cf7 || $wpforms || $formidable || $fluent_forms || $elementor_forms
	|| $integration_gravity || $integration_jetpack || $integration_bbpress || $integration_buddypress
	|| $integration_ultimate_member || $integration_memberpress || $integration_edd || $integration_pmp
	|| $integration_mc4wp;

$protection_on = $protect_login || $protect_registration || $protect_password_reset || $protect_comments
	|| $woo_login || $woo_registration || $woo_lost_password || $woo_checkout || $woo_reviews
	|| ( $premium_unlocked && $premium_integrations_on );
$keys_missing  = ( $site_key === '' || ! $has_secret_stored );

$woo_active = class_exists( 'WooCommerce', false );

$wpps_cf_ts_integrations = [
	[ 'key' => 'cf7', 'label' => __( 'Contact Form 7', 'wp-powersuite' ), 'available' => class_exists( 'WPCF7' ) ],
	[ 'key' => 'wpforms', 'label' => __( 'WPForms', 'wp-powersuite' ), 'available' => function_exists( 'wpforms' ) ],
	[ 'key' => 'formidable', 'label' => __( 'Formidable Forms', 'wp-powersuite' ), 'available' => class_exists( 'FrmFormsController' ) ],
	[ 'key' => 'fluent_forms', 'label' => __( 'Fluent Forms', 'wp-powersuite' ), 'available' => defined( 'FLUENTFORM' ) ],
	[ 'key' => 'elementor_forms', 'label' => __( 'Elementor Pro Forms', 'wp-powersuite' ), 'available' => $elementor_pro_active ],
	[ 'key' => 'integration_gravity', 'label' => __( 'Gravity Forms', 'wp-powersuite' ), 'available' => class_exists( 'GFForms' ) ],
	[ 'key' => 'integration_jetpack', 'label' => __( 'Jetpack forms', 'wp-powersuite' ), 'available' => defined( 'JETPACK__VERSION' ) ],
	[ 'key' => 'integration_bbpress', 'label' => __( 'bbPress', 'wp-powersuite' ), 'available' => function_exists( 'bbpress' ) ],
	[ 'key' => 'integration_buddypress', 'label' => __( 'BuddyPress', 'wp-powersuite' ), 'available' => class_exists( 'BuddyPress' ) ],
	[ 'key' => 'integration_ultimate_member', 'label' => __( 'Ultimate Member', 'wp-powersuite' ), 'available' => class_exists( 'UM' ) ],
	[ 'key' => 'integration_memberpress', 'label' => __( 'MemberPress', 'wp-powersuite' ), 'available' => class_exists( 'MeprAppCtrl' ) ],
	[ 'key' => 'integration_edd', 'label' => __( 'Easy Digital Downloads', 'wp-powersuite' ), 'available' => function_exists( 'EDD' ) ],
	[ 'key' => 'integration_pmp', 'label' => __( 'Paid Memberships Pro', 'wp-powersuite' ), 'available' => defined( 'PMPRO_VERSION' ) ],
	[ 'key' => 'integration_mc4wp', 'label' => __( 'MC4WP (Mailchimp)', 'wp-powersuite' ), 'available' => defined( 'MC4WP_VERSION' ) || function_exists( 'mc4wp_show_form' ) || class_exists( 'MC4WP_Form', false ) ],
];

$cf_dashboard_url = 'https://dash.cloudflare.com/?to=/:account/turnstile';

$uid = preg_replace( '/[^a-z0-9_-]/i', '', $module_id );

$wpps_cf_ts_render_premium_notice = static function () use ( $premium_unlocked, $license_page_url ): void {
	if ( $premium_unlocked ) {
		return;
	}
	?>
	<div class="notice notice-info inline" style="margin:0 0 12px; padding:8px 12px;">
		<p style="margin:0;">
			<?php
			echo wp_kses_post(
				sprintf(
					/* translators: %s: URL to license page */
					__( 'This section is a Premium feature. <a href="%s">Activate your license</a> to configure form integrations, advanced options, and skip rules.', 'wp-powersuite' ),
					esc_url( $license_page_url )
				)
			);
			?>
		</p>
	</div>
	<?php
};
?>

<?php if ( $protection_on && $keys_missing ) : ?>
	<div class="wpps-settings-alert wpps-settings-alert--warning" role="alert">
		<p>
			<strong><?php esc_html_e( 'Keys required', 'wp-powersuite' ); ?></strong>
			<?php esc_html_e( 'Turn protection is on but Site Key or Secret Key is missing — verification will fail.', 'wp-powersuite' ); ?>
			<?php
			wpps_render_modal_settings_tip(
				__( 'Help: API keys', 'wp-powersuite' ),
				__( 'Create a Turnstile widget in Cloudflare, then paste the site key and secret key here. Save before running the connection test.', 'wp-powersuite' )
			);
			?>
		</p>
	</div>
<?php endif; ?>

<?php if ( is_multisite() && ( $site_key === '' || ! $has_secret_stored ) ) : ?>
	<div class="wpps-settings-alert wpps-settings-alert--info">
		<p>
			<?php esc_html_e( 'Multisite: empty keys can fall back to network defaults set by the super admin.', 'wp-powersuite' ); ?>
			<?php
			wpps_render_modal_settings_tip(
				__( 'Help: multisite keys', 'wp-powersuite' ),
				__( 'Network option keys: wpps_network_cloudflare-turnstile_site_key and wpps_network_cloudflare-turnstile_secret_key. Store the network secret with ENC2 encryption (same as site-level saves) when possible.', 'wp-powersuite' )
			);
			?>
		</p>
	</div>
<?php endif; ?>

<?php wpps_render_captcha_overlap_notices( $module_id ); ?>

<div class="wp-powersuite-module-settings wpps-settings-panel wpps-settings-panel--accordion-stack" data-module-id="<?php echo esc_attr( $module_id ); ?>">
	<form class="wp-powersuite-module-settings-form" data-module-id="<?php echo esc_attr( $module_id ); ?>">
		<?php wp_nonce_field( 'wp_powersuite_save_module_settings_' . $module_id, 'wp_powersuite_nonce' ); ?>

		<div class="wpps-ts-accordions">
			<div class="wpps-ts-accordion is-open">
				<button type="button" class="wpps-ts-accordion-header" id="<?php echo esc_attr( $uid ); ?>_acc_head_api" aria-expanded="true" aria-controls="<?php echo esc_attr( $uid ); ?>_acc_body_api">
					<span class="wpps-ts-accordion-title"><?php esc_html_e( 'API & appearance', 'wp-powersuite' ); ?></span>
					<span class="dashicons dashicons-arrow-down-alt2 wpps-ts-accordion-chevron" aria-hidden="true"></span>
				</button>
				<div class="wpps-ts-accordion-body" id="<?php echo esc_attr( $uid ); ?>_acc_body_api" role="region" aria-labelledby="<?php echo esc_attr( $uid ); ?>_acc_head_api">
					<div class="wpps-ts-field wpps-ts-field--keys">
						<div class="wpps-ts-inline-keys">
							<div class="wpps-ts-inline-keys__cell">
								<div class="wpps-ts-field__label-row">
									<label for="<?php echo esc_attr( $module_id ); ?>_site_key"><?php esc_html_e( 'Site Key', 'wp-powersuite' ); ?></label>
									<?php
									wpps_render_modal_settings_tip(
										__( 'Help: Site Key', 'wp-powersuite' ),
										__( 'Public key from the Cloudflare Turnstile dashboard. Pair it with the secret key below.', 'wp-powersuite' )
									);
									?>
								</div>
								<input
									type="text"
									id="<?php echo esc_attr( $module_id ); ?>_site_key"
									name="<?php echo esc_attr( $module_id ); ?>[site_key]"
									value="<?php echo esc_attr( $site_key ); ?>"
									class="wp-powersuite-advanced-setting"
									data-setting-key="site_key"
									placeholder="0x4AAAAAAA..."
									autocomplete="off"
									spellcheck="false"
								/>
							</div>
							<div class="wpps-ts-inline-keys__cell">
								<div class="wpps-ts-field__label-row">
									<label for="<?php echo esc_attr( $module_id ); ?>_secret_key"><?php esc_html_e( 'Secret Key', 'wp-powersuite' ); ?></label>
									<?php
									wpps_render_modal_settings_tip(
										__( 'Help: Secret Key', 'wp-powersuite' ),
										$has_secret_stored
											? __( 'A secret is already stored. Leave the dots unchanged to keep it, or replace with a new secret from Cloudflare.', 'wp-powersuite' )
											: __( 'Private key for server-side verification. Never expose it in the browser or logs.', 'wp-powersuite' )
									);
									?>
								</div>
								<input
									type="password"
									id="<?php echo esc_attr( $module_id ); ?>_secret_key"
									name="<?php echo esc_attr( $module_id ); ?>[secret_key]"
									value="<?php echo esc_attr( $secret_key ); ?>"
									class="wp-powersuite-advanced-setting"
									data-setting-key="secret_key"
									placeholder="0x4AAAAAAA..."
									autocomplete="new-password"
									spellcheck="false"
								/>
							</div>
						</div>
						<p class="wpps-settings-subtle-link wpps-ts-dashboard-link">
							<a href="<?php echo esc_url( $cf_dashboard_url ); ?>" target="_blank" rel="noopener noreferrer"><?php esc_html_e( 'Open Turnstile dashboard', 'wp-powersuite' ); ?></a>
						</p>
					</div>

					<div class="wpps-ts-field">
						<div class="wpps-ts-field__control">
							<div class="wpps-ts-controls-row wpps-ts-controls-row--502525">
								<div class="wpps-ts-controls-row__cell">
									<div class="wpps-ts-field__label-row">
										<span><?php esc_html_e( 'Test connection', 'wp-powersuite' ); ?></span>
										<?php
										wpps_render_modal_settings_tip(
											__( 'Help: connection test', 'wp-powersuite' ),
											__( 'Save your keys first. Run test loads Turnstile in the background, obtains a token, and verifies it with Cloudflare — no manual copying.', 'wp-powersuite' )
										);
										?>
									</div>
									<div class="wpps-captcha-test-row">
										<div
											class="wpps-captcha-test-widget"
											data-provider="turnstile"
											data-module-id="<?php echo esc_attr( $module_id ); ?>"
											data-nonce="<?php echo esc_attr( wp_create_nonce( 'wpps_captcha_test_' . $module_id ) ); ?>"
											data-sitekey-field="<?php echo esc_attr( $module_id ); ?>_site_key"
											data-theme-field="<?php echo esc_attr( $module_id ); ?>_theme"
											data-appearance-field="<?php echo esc_attr( $module_id ); ?>_widget_visible_appearance"
											data-full-width-field="<?php echo esc_attr( $module_id ); ?>_widget_full_width"
										></div>
										<button
											type="button"
											class="button button-secondary wpps-captcha-test-connection"
											data-module-id="<?php echo esc_attr( $module_id ); ?>"
											data-provider="turnstile"
											data-nonce="<?php echo esc_attr( wp_create_nonce( 'wpps_captcha_test_' . $module_id ) ); ?>"
										>
											<?php esc_html_e( 'Run test', 'wp-powersuite' ); ?>
										</button>
									</div>
								</div>
								<div class="wpps-ts-controls-row__cell">
									<div class="wpps-ts-field__label-row">
										<label for="<?php echo esc_attr( $module_id ); ?>_theme"><?php esc_html_e( 'Theme', 'wp-powersuite' ); ?></label>
										<?php
										wpps_render_modal_settings_tip(
											__( 'Help: widget theme', 'wp-powersuite' ),
											__( 'Maps to Turnstile data-theme: light, dark, or auto (follow the visitor system). Applies to visible widgets and invisible challenge styling.', 'wp-powersuite' )
										);
										?>
									</div>
									<select
										id="<?php echo esc_attr( $module_id ); ?>_theme"
										name="<?php echo esc_attr( $module_id ); ?>[theme]"
										class="wp-powersuite-advanced-setting"
										data-setting-key="theme"
									>
										<option value="auto" <?php selected( $theme, 'auto' ); ?>><?php esc_html_e( 'Auto (follow system)', 'wp-powersuite' ); ?></option>
										<option value="light" <?php selected( $theme, 'light' ); ?>><?php esc_html_e( 'Light', 'wp-powersuite' ); ?></option>
										<option value="dark" <?php selected( $theme, 'dark' ); ?>><?php esc_html_e( 'Dark', 'wp-powersuite' ); ?></option>
									</select>
								</div>
								<div class="wpps-ts-controls-row__cell">
									<div class="wpps-ts-field__label-row">
										<label for="<?php echo esc_attr( $module_id ); ?>_widget_full_width"><?php esc_html_e( 'Full width widget', 'wp-powersuite' ); ?></label>
										<?php
										wpps_render_modal_settings_tip(
											__( 'Help: full width widget', 'wp-powersuite' ),
											__( 'Uses Turnstile flexible size so the widget stretches to the form field width (recommended for wp-login and narrow forms).', 'wp-powersuite' )
										);
										?>
									</div>
									<label class="wpps-ts-checkbox-label">
										<input
											type="checkbox"
											id="<?php echo esc_attr( $module_id ); ?>_widget_full_width"
											name="<?php echo esc_attr( $module_id ); ?>[widget_full_width]"
											value="1"
											<?php checked( $widget_full_width ); ?>
											class="wp-powersuite-advanced-setting"
											data-setting-key="widget_full_width"
										/>
										<?php esc_html_e( 'Match form field width', 'wp-powersuite' ); ?>
									</label>
								</div>
							</div>
							<p class="description wpps-captcha-test-status" role="status" aria-live="polite" id="<?php echo esc_attr( $module_id ); ?>_test_status"></p>
						</div>
					</div>

					<div class="wpps-ts-field">
						<div class="wpps-ts-field__label-row">
							<label for="<?php echo esc_attr( $module_id ); ?>_widget_visible_appearance"><?php esc_html_e( 'Appearance mode', 'wp-powersuite' ); ?></label>
							<?php
							wpps_render_modal_settings_tip(
								__( 'Help: appearance mode', 'wp-powersuite' ),
								__( 'Maps to Turnstile data-appearance. Interaction-only keeps the widget hidden until a challenge is needed (minimal friction for most visitors). Always shows the widget whenever the script runs.', 'wp-powersuite' )
							);
							?>
						</div>
						<div class="wpps-ts-field__control">
							<select
								id="<?php echo esc_attr( $module_id ); ?>_widget_visible_appearance"
								name="<?php echo esc_attr( $module_id ); ?>[widget_visible_appearance]"
								class="wp-powersuite-advanced-setting"
								data-setting-key="widget_visible_appearance"
							>
								<option value="interaction-only" <?php selected( $widget_visible_appearance, 'interaction-only' ); ?>><?php esc_html_e( 'Interaction-only (recommended)', 'wp-powersuite' ); ?></option>
								<option value="always" <?php selected( $widget_visible_appearance, 'always' ); ?>><?php esc_html_e( 'Always', 'wp-powersuite' ); ?></option>
							</select>
						</div>
					</div>
				</div>
			</div>

			<div class="wpps-ts-accordion">
				<button type="button" class="wpps-ts-accordion-header" id="<?php echo esc_attr( $uid ); ?>_acc_head_wp" aria-expanded="false" aria-controls="<?php echo esc_attr( $uid ); ?>_acc_body_wp">
					<span class="wpps-ts-accordion-title"><?php esc_html_e( 'WordPress core', 'wp-powersuite' ); ?></span>
					<span class="dashicons dashicons-arrow-down-alt2 wpps-ts-accordion-chevron" aria-hidden="true"></span>
				</button>
				<div class="wpps-ts-accordion-body" id="<?php echo esc_attr( $uid ); ?>_acc_body_wp" role="region" aria-labelledby="<?php echo esc_attr( $uid ); ?>_acc_head_wp">
					<div class="wpps-ts-field">
						<div class="wpps-ts-field__label-row">
							<span><?php esc_html_e( 'Protected forms', 'wp-powersuite' ); ?></span>
							<?php
							wpps_render_modal_settings_tip(
								__( 'Help: WordPress forms', 'wp-powersuite' ),
								__( 'Adds Turnstile to core WordPress flows. Enable only what you use — each adds a verification step for visitors.', 'wp-powersuite' )
							);
							?>
						</div>
						<div class="wpps-ts-field__control">
							<div class="wpps-check-grid">
								<label>
									<input type="checkbox" name="<?php echo esc_attr( $module_id ); ?>[protect_login]" value="1" <?php checked( $protect_login ); ?> class="wp-powersuite-advanced-setting" data-setting-key="protect_login" />
									<?php esc_html_e( 'Login', 'wp-powersuite' ); ?>
								</label>
								<label>
									<input type="checkbox" name="<?php echo esc_attr( $module_id ); ?>[protect_registration]" value="1" <?php checked( $protect_registration ); ?> class="wp-powersuite-advanced-setting" data-setting-key="protect_registration" />
									<?php esc_html_e( 'Registration', 'wp-powersuite' ); ?>
								</label>
								<label>
									<input type="checkbox" name="<?php echo esc_attr( $module_id ); ?>[protect_password_reset]" value="1" <?php checked( $protect_password_reset ); ?> class="wp-powersuite-advanced-setting" data-setting-key="protect_password_reset" />
									<?php esc_html_e( 'Password reset', 'wp-powersuite' ); ?>
								</label>
								<label>
									<input type="checkbox" name="<?php echo esc_attr( $module_id ); ?>[protect_comments]" value="1" <?php checked( $protect_comments ); ?> class="wp-powersuite-advanced-setting" data-setting-key="protect_comments" />
									<?php esc_html_e( 'Comments', 'wp-powersuite' ); ?>
								</label>
							</div>
						</div>
					</div>
				</div>
			</div>

			<div class="wpps-ts-accordion">
				<button type="button" class="wpps-ts-accordion-header" id="<?php echo esc_attr( $uid ); ?>_acc_head_woo" aria-expanded="false" aria-controls="<?php echo esc_attr( $uid ); ?>_acc_body_woo">
					<span class="wpps-ts-accordion-title"><?php esc_html_e( 'WooCommerce', 'wp-powersuite' ); ?></span>
					<span class="dashicons dashicons-arrow-down-alt2 wpps-ts-accordion-chevron" aria-hidden="true"></span>
				</button>
				<div class="wpps-ts-accordion-body" id="<?php echo esc_attr( $uid ); ?>_acc_body_woo" role="region" aria-labelledby="<?php echo esc_attr( $uid ); ?>_acc_head_woo">
					<?php if ( ! $woo_active ) : ?>
						<p class="description"><?php esc_html_e( 'WooCommerce is not active. These options stay disabled until you install and activate WooCommerce.', 'wp-powersuite' ); ?></p>
					<?php endif; ?>
					<div class="wpps-ts-field">
						<div class="wpps-ts-field__label-row">
							<span><?php esc_html_e( 'Protected forms', 'wp-powersuite' ); ?></span>
							<?php
							wpps_render_modal_settings_tip(
								__( 'Help: WooCommerce', 'wp-powersuite' ),
								__( 'Adds Turnstile to storefront forms. Product reviews only applies when Comments protection above is off.', 'wp-powersuite' )
							);
							?>
						</div>
						<div class="wpps-ts-field__control">
							<div class="wpps-check-grid">
								<label<?php echo $woo_active ? '' : ' class="wpps-ts-integration--unavailable"'; ?>>
									<input type="checkbox" name="<?php echo esc_attr( $module_id ); ?>[woo_login]" value="1" <?php checked( $woo_login ); ?> class="wp-powersuite-advanced-setting" data-setting-key="woo_login" <?php disabled( ! $woo_active ); ?> />
									<?php esc_html_e( 'Login', 'wp-powersuite' ); ?>
								</label>
								<label<?php echo $woo_active ? '' : ' class="wpps-ts-integration--unavailable"'; ?>>
									<input type="checkbox" name="<?php echo esc_attr( $module_id ); ?>[woo_registration]" value="1" <?php checked( $woo_registration ); ?> class="wp-powersuite-advanced-setting" data-setting-key="woo_registration" <?php disabled( ! $woo_active ); ?> />
									<?php esc_html_e( 'Registration', 'wp-powersuite' ); ?>
								</label>
								<label<?php echo $woo_active ? '' : ' class="wpps-ts-integration--unavailable"'; ?>>
									<input type="checkbox" name="<?php echo esc_attr( $module_id ); ?>[woo_lost_password]" value="1" <?php checked( $woo_lost_password ); ?> class="wp-powersuite-advanced-setting" data-setting-key="woo_lost_password" <?php disabled( ! $woo_active ); ?> />
									<?php esc_html_e( 'Lost password', 'wp-powersuite' ); ?>
								</label>
								<label<?php echo $woo_active ? '' : ' class="wpps-ts-integration--unavailable"'; ?>>
									<input type="checkbox" name="<?php echo esc_attr( $module_id ); ?>[woo_checkout]" value="1" <?php checked( $woo_checkout ); ?> class="wp-powersuite-advanced-setting" data-setting-key="woo_checkout" <?php disabled( ! $woo_active ); ?> />
									<?php esc_html_e( 'Checkout', 'wp-powersuite' ); ?>
								</label>
								<label class="wpps-check-grid__label-with-tip<?php echo $woo_active ? '' : ' wpps-ts-integration--unavailable'; ?>">
									<input type="checkbox" name="<?php echo esc_attr( $module_id ); ?>[woo_reviews]" value="1" <?php checked( $woo_reviews ); ?> class="wp-powersuite-advanced-setting" data-setting-key="woo_reviews" <?php disabled( ! $woo_active ); ?> />
									<span><?php esc_html_e( 'Product reviews', 'wp-powersuite' ); ?></span>
									<?php
									wpps_render_modal_settings_tip(
										__( 'Help: product reviews', 'wp-powersuite' ),
										__( 'Use when Comments protection is disabled but you still want Turnstile on WooCommerce product reviews only.', 'wp-powersuite' )
									);
									?>
								</label>
							</div>
						</div>
					</div>
				</div>
			</div>

			<div class="wpps-ts-accordion">
				<button type="button" class="wpps-ts-accordion-header" id="<?php echo esc_attr( $uid ); ?>_acc_head_forms" aria-expanded="false" aria-controls="<?php echo esc_attr( $uid ); ?>_acc_body_forms">
					<span class="wpps-ts-accordion-title"><?php esc_html_e( 'Forms & integrations', 'wp-powersuite' ); ?><?php if ( ! $premium_unlocked ) : ?> <span class="wpps-pro-badge"><?php esc_html_e( 'Premium', 'wp-powersuite' ); ?></span><?php endif; ?></span>
					<span class="dashicons dashicons-arrow-down-alt2 wpps-ts-accordion-chevron" aria-hidden="true"></span>
				</button>
				<div class="wpps-ts-accordion-body" id="<?php echo esc_attr( $uid ); ?>_acc_body_forms" role="region" aria-labelledby="<?php echo esc_attr( $uid ); ?>_acc_head_forms">
					<?php $wpps_cf_ts_render_premium_notice(); ?>
					<div class="wpps-ts-field">
						<div class="wpps-ts-field__label-row">
							<span><?php esc_html_e( 'Integrations', 'wp-powersuite' ); ?></span>
							<?php
							wpps_render_modal_settings_tip(
								__( 'Help: form plugins', 'wp-powersuite' ),
								__( 'All supported integrations are listed below. Install and activate a plugin to enable its checkbox. Basic Forms is built into WP PowerSuite.', 'wp-powersuite' )
							);
							?>
						</div>
						<div class="wpps-ts-field__control">
							<div class="wpps-check-grid">
								<label>
									<input type="checkbox" name="<?php echo esc_attr( $module_id ); ?>[basic_forms]" value="1" <?php checked( $basic_forms ); ?> class="wp-powersuite-advanced-setting" data-setting-key="basic_forms" <?php disabled( ! $premium_unlocked ); ?> />
									<?php esc_html_e( 'Basic Forms (WP PowerSuite)', 'wp-powersuite' ); ?>
								</label>
								<?php foreach ( $wpps_cf_ts_integrations as $wpps_cf_ts_int ) : ?>
									<?php
									$ik = $wpps_cf_ts_int['key'];
									$ia = $wpps_cf_ts_int['available'];
									$iv = ! empty( $settings[ $ik ] );
									?>
								<label<?php echo $ia ? '' : ' class="wpps-ts-integration--unavailable"'; ?>>
									<input type="checkbox" name="<?php echo esc_attr( $module_id ); ?>[<?php echo esc_attr( $ik ); ?>]" value="1" <?php checked( $iv ); ?> class="wp-powersuite-advanced-setting" data-setting-key="<?php echo esc_attr( $ik ); ?>" <?php disabled( ! $ia || ! $premium_unlocked ); ?> />
									<?php echo esc_html( $wpps_cf_ts_int['label'] ); ?>
								</label>
								<?php endforeach; ?>
							</div>
							<?php if ( ! empty( $integration_mc4wp ) || ( defined( 'MC4WP_VERSION' ) || function_exists( 'mc4wp_show_form' ) ) ) : ?>
								<p class="description" style="margin-top:10px;">
									<?php esc_html_e( 'MC4WP: when enabled, add this shortcode in the MC4WP form editor (above the submit button):', 'wp-powersuite' ); ?>
									<code style="font-weight:600;">[wpps-mc4wp-turnstile]</code>
								</p>
							<?php endif; ?>
						</div>
					</div>
				</div>
			</div>

			<div class="wpps-ts-accordion">
				<button type="button" class="wpps-ts-accordion-header" id="<?php echo esc_attr( $uid ); ?>_acc_head_adv" aria-expanded="false" aria-controls="<?php echo esc_attr( $uid ); ?>_acc_body_adv">
					<span class="wpps-ts-accordion-title"><?php esc_html_e( 'Advanced options', 'wp-powersuite' ); ?><?php if ( ! $premium_unlocked ) : ?> <span class="wpps-pro-badge"><?php esc_html_e( 'Premium', 'wp-powersuite' ); ?></span><?php endif; ?></span>
					<span class="dashicons dashicons-arrow-down-alt2 wpps-ts-accordion-chevron" aria-hidden="true"></span>
				</button>
				<div class="wpps-ts-accordion-body" id="<?php echo esc_attr( $uid ); ?>_acc_body_adv" role="region" aria-labelledby="<?php echo esc_attr( $uid ); ?>_acc_head_adv">
					<?php $wpps_cf_ts_render_premium_notice(); ?>
					<div class="wpps-ts-field">
						<div class="wpps-ts-controls-row wpps-ts-controls-row--adv-2col">
							<div class="wpps-ts-controls-row__cell">
								<div class="wpps-ts-field__label-row">
									<label for="<?php echo esc_attr( $module_id ); ?>_widget_language"><?php esc_html_e( 'Widget language', 'wp-powersuite' ); ?></label>
									<?php
									wpps_render_modal_settings_tip(
										__( 'Help: widget language', 'wp-powersuite' ),
										__( 'Optional ISO language code for Turnstile (for example en or de). Leave blank to let Cloudflare auto-detect.', 'wp-powersuite' )
									);
									?>
								</div>
								<input
									type="text"
									id="<?php echo esc_attr( $module_id ); ?>_widget_language"
									name="<?php echo esc_attr( $module_id ); ?>[widget_language]"
									value="<?php echo esc_attr( $widget_language ); ?>"
									class="wp-powersuite-advanced-setting"
									data-setting-key="widget_language"
									placeholder="auto"
									autocomplete="off"
									<?php disabled( ! $premium_unlocked ); ?>
								/>
							</div>
							<div class="wpps-ts-controls-row__cell">
								<div class="wpps-ts-field__label-row">
									<label for="<?php echo esc_attr( $module_id ); ?>_refresh_timeout"><?php esc_html_e( 'Refresh timeout', 'wp-powersuite' ); ?></label>
									<?php
									wpps_render_modal_settings_tip(
										__( 'Help: refresh timeout', 'wp-powersuite' ),
										__( 'Maps to data-refresh-timeout: auto or a number of milliseconds.', 'wp-powersuite' )
									);
									?>
								</div>
								<input
									type="text"
									id="<?php echo esc_attr( $module_id ); ?>_refresh_timeout"
									name="<?php echo esc_attr( $module_id ); ?>[refresh_timeout]"
									value="<?php echo esc_attr( $refresh_timeout ); ?>"
									class="wp-powersuite-advanced-setting"
									data-setting-key="refresh_timeout"
									placeholder="auto"
									<?php disabled( ! $premium_unlocked ); ?>
								/>
							</div>
						</div>
					</div>

					<div class="wpps-ts-field">
						<div class="wpps-ts-field__label-row"><?php esc_html_e( 'Behavior', 'wp-powersuite' ); ?></div>
						<div class="wpps-ts-field__control">
							<div class="wpps-check-grid">
								<label>
									<input type="checkbox" name="<?php echo esc_attr( $module_id ); ?>[disable_submit]" value="1" <?php checked( $disable_submit ); ?> class="wp-powersuite-advanced-setting" data-setting-key="disable_submit" <?php disabled( ! $premium_unlocked ); ?> />
									<?php esc_html_e( 'Disable submit until solved', 'wp-powersuite' ); ?>
								</label>
								<label>
									<input type="checkbox" name="<?php echo esc_attr( $module_id ); ?>[ajax_comment_reset]" value="1" <?php checked( $ajax_comment_reset ); ?> class="wp-powersuite-advanced-setting" data-setting-key="ajax_comment_reset" <?php disabled( ! $premium_unlocked ); ?> />
									<?php esc_html_e( 'Reset Turnstile when replying to comments (AJAX)', 'wp-powersuite' ); ?>
								</label>
								<label>
									<input type="checkbox" name="<?php echo esc_attr( $module_id ); ?>[login_canonical_only]" value="1" <?php checked( $login_canonical_only ); ?> class="wp-powersuite-advanced-setting" data-setting-key="login_canonical_only" <?php disabled( ! $premium_unlocked ); ?> />
									<?php esc_html_e( 'Protect wp-login.php login only', 'wp-powersuite' ); ?>
								</label>
								<label>
									<input type="checkbox" name="<?php echo esc_attr( $module_id ); ?>[register_canonical_only]" value="1" <?php checked( $register_canonical_only ); ?> class="wp-powersuite-advanced-setting" data-setting-key="register_canonical_only" <?php disabled( ! $premium_unlocked ); ?> />
									<?php esc_html_e( 'Protect wp-login.php registration only', 'wp-powersuite' ); ?>
								</label>
								<?php if ( class_exists( 'WooCommerce' ) ) : ?>
								<label>
									<input type="checkbox" name="<?php echo esc_attr( $module_id ); ?>[woo_checkout_guest_only]" value="1" <?php checked( $woo_checkout_guest_only ); ?> class="wp-powersuite-advanced-setting" data-setting-key="woo_checkout_guest_only" <?php disabled( ! $premium_unlocked ); ?> />
									<?php esc_html_e( 'WooCommerce checkout: guests only', 'wp-powersuite' ); ?>
								</label>
								<?php endif; ?>
							</div>
						</div>
					</div>

					<div class="wpps-ts-field">
						<div class="wpps-ts-field__label-row"><?php esc_html_e( 'Cloudflare outage failsafe', 'wp-powersuite' ); ?></div>
						<div class="wpps-ts-field__control">
							<select name="<?php echo esc_attr( $module_id ); ?>[failsafe_mode]" class="wp-powersuite-advanced-setting" data-setting-key="failsafe_mode" id="<?php echo esc_attr( $module_id ); ?>_failsafe_mode" <?php disabled( ! $premium_unlocked ); ?>>
								<option value="off" <?php selected( $failsafe_mode, 'off' ); ?>><?php esc_html_e( 'Off', 'wp-powersuite' ); ?></option>
								<option value="allow" <?php selected( $failsafe_mode, 'allow' ); ?>><?php esc_html_e( 'Allow submissions (signed server marker)', 'wp-powersuite' ); ?></option>
								<option value="recaptcha" <?php selected( $failsafe_mode, 'recaptcha' ); ?>><?php esc_html_e( 'Fallback to Google reCAPTCHA', 'wp-powersuite' ); ?></option>
							</select>
							<p class="description"><?php esc_html_e( 'When our server cannot reach Cloudflare, optionally relax verification or show reCAPTCHA instead.', 'wp-powersuite' ); ?></p>
							<div id="<?php echo esc_attr( $module_id ); ?>_failsafe_allow_warn" class="wpps-settings-alert wpps-settings-alert--warning" role="alert" style="margin-top:12px;"<?php echo $failsafe_mode !== 'allow' ? ' hidden' : ''; ?>>
								<p>
									<strong><?php esc_html_e( 'Security notice', 'wp-powersuite' ); ?></strong>
									<?php esc_html_e( 'Allow mode bypasses Turnstile while the server probe reports Cloudflare unreachable. Use only as a temporary outage measure — not for routine production hardening.', 'wp-powersuite' ); ?>
								</p>
							</div>
							<div id="<?php echo esc_attr( $module_id ); ?>_failsafe_recaptcha_wrap" class="wpps-ts-failsafe-recaptcha-wrap"<?php echo $failsafe_mode !== 'recaptcha' ? ' hidden' : ''; ?>>
							<div class="wpps-ts-inline-keys" style="margin-top:12px;">
								<div class="wpps-ts-inline-keys__cell">
									<label for="<?php echo esc_attr( $module_id ); ?>_failsafe_recaptcha_site_key"><?php esc_html_e( 'Fallback reCAPTCHA site key', 'wp-powersuite' ); ?></label>
									<input type="text" id="<?php echo esc_attr( $module_id ); ?>_failsafe_recaptcha_site_key" name="<?php echo esc_attr( $module_id ); ?>[failsafe_recaptcha_site_key]" value="<?php echo esc_attr( $failsafe_recaptcha_site_key ); ?>" class="wp-powersuite-advanced-setting" data-setting-key="failsafe_recaptcha_site_key" autocomplete="off" <?php disabled( ! $premium_unlocked ); ?> />
								</div>
								<div class="wpps-ts-inline-keys__cell">
									<label for="<?php echo esc_attr( $module_id ); ?>_failsafe_recaptcha_secret_key"><?php esc_html_e( 'Fallback reCAPTCHA secret key', 'wp-powersuite' ); ?></label>
									<input type="password" id="<?php echo esc_attr( $module_id ); ?>_failsafe_recaptcha_secret_key" name="<?php echo esc_attr( $module_id ); ?>[failsafe_recaptcha_secret_key]" value="<?php echo esc_attr( $failsafe_recaptcha_secret_display ); ?>" class="wp-powersuite-advanced-setting" data-setting-key="failsafe_recaptcha_secret_key" autocomplete="new-password" <?php disabled( ! $premium_unlocked ); ?> />
								</div>
							</div>
							</div>
						</div>
					</div>

					<div class="wpps-ts-field">
						<div class="wpps-ts-field__label-row"><?php esc_html_e( 'Performance & theme', 'wp-powersuite' ); ?></div>
						<div class="wpps-ts-field__control">
							<div class="wpps-check-grid">
								<label>
									<input type="checkbox" name="<?php echo esc_attr( $module_id ); ?>[perf_compat]" value="1" <?php checked( $perf_compat ); ?> class="wp-powersuite-advanced-setting" data-setting-key="perf_compat" <?php disabled( ! $premium_unlocked ); ?> />
									<?php esc_html_e( 'Compatibility tweaks for optimizers', 'wp-powersuite' ); ?>
								</label>
								<label>
									<input type="checkbox" name="<?php echo esc_attr( $module_id ); ?>[resource_hints]" value="1" <?php checked( $resource_hints ); ?> class="wp-powersuite-advanced-setting" data-setting-key="resource_hints" <?php disabled( ! $premium_unlocked ); ?> />
									<?php esc_html_e( 'DNS prefetch / preconnect hints', 'wp-powersuite' ); ?>
								</label>
								<label>
									<input type="checkbox" name="<?php echo esc_attr( $module_id ); ?>[blocksy_compat]" value="1" <?php checked( $blocksy_compat ); ?> class="wp-powersuite-advanced-setting" data-setting-key="blocksy_compat" <?php disabled( ! $premium_unlocked ); ?> />
									<?php esc_html_e( 'Blocksy account modal reset', 'wp-powersuite' ); ?>
								</label>
							</div>
						</div>
					</div>
				</div>
			</div>

			<div class="wpps-ts-accordion">
				<button type="button" class="wpps-ts-accordion-header" id="<?php echo esc_attr( $uid ); ?>_acc_head_skip" aria-expanded="false" aria-controls="<?php echo esc_attr( $uid ); ?>_acc_body_skip">
					<span class="wpps-ts-accordion-title"><?php esc_html_e( 'Skip rules', 'wp-powersuite' ); ?><?php if ( ! $premium_unlocked ) : ?> <span class="wpps-pro-badge"><?php esc_html_e( 'Premium', 'wp-powersuite' ); ?></span><?php endif; ?></span>
					<span class="dashicons dashicons-arrow-down-alt2 wpps-ts-accordion-chevron" aria-hidden="true"></span>
				</button>
				<div class="wpps-ts-accordion-body" id="<?php echo esc_attr( $uid ); ?>_acc_body_skip" role="region" aria-labelledby="<?php echo esc_attr( $uid ); ?>_acc_head_skip">
					<?php $wpps_cf_ts_render_premium_notice(); ?>
					<div class="wpps-ts-field">
						<div class="wpps-ts-field__label-row">
							<span><?php esc_html_e( 'Trusted visitors', 'wp-powersuite' ); ?></span>
							<?php
							wpps_render_modal_settings_tip(
								__( 'Help: skip rules', 'wp-powersuite' ),
								__( 'Matching roles, IPs, or User-Agent substrings bypass the widget (no challenge and no server verification for matching visitors). IP rules require correct proxy/Cloudflare configuration — User-Agent matches are spoofable. Leave lists empty when skip is enabled to effectively disable skipping.', 'wp-powersuite' )
							);
							?>
						</div>
						<div class="wpps-ts-field__control">
							<label class="wpps-ts-inline-check">
								<input type="checkbox" name="<?php echo esc_attr( $module_id ); ?>[skip_rules][enabled]" value="1" <?php checked( $skip_enabled ); ?> class="wp-powersuite-advanced-setting" data-setting-key="skip_rules.enabled" <?php disabled( ! $premium_unlocked ); ?> />
								<?php esc_html_e( 'Enable skip rules', 'wp-powersuite' ); ?>
							</label>
						</div>
					</div>

					<div class="wpps-ts-field">
						<div class="wpps-ts-field__label-row"><?php esc_html_e( 'Allowed roles', 'wp-powersuite' ); ?></div>
						<div class="wpps-ts-field__control">
							<div class="wpps-check-grid wpps-check-grid--roles">
								<?php if ( ! empty( $all_roles ) ) : ?>
									<?php foreach ( $all_roles as $slug => $role_data ) : ?>
										<label>
											<input type="checkbox" name="<?php echo esc_attr( $module_id ); ?>[skip_rules][roles][]" value="<?php echo esc_attr( $slug ); ?>" <?php checked( in_array( $slug, $skip_roles_saved, true ) ); ?> class="wp-powersuite-advanced-setting" data-setting-key="skip_rules.roles" <?php disabled( ! $premium_unlocked ); ?> />
											<?php echo esc_html( is_array( $role_data ) && isset( $role_data['name'] ) ? $role_data['name'] : $slug ); ?>
										</label>
									<?php endforeach; ?>
								<?php endif; ?>
							</div>
						</div>
					</div>

					<div class="wpps-ts-field">
						<div class="wpps-ts-field__label-row">
							<label for="<?php echo esc_attr( $module_id ); ?>_skip_ips"><?php esc_html_e( 'Allowed IPs / CIDR', 'wp-powersuite' ); ?></label>
							<?php
							wpps_render_modal_settings_tip(
								__( 'Help: IP allowlist', 'wp-powersuite' ),
								__( 'One IP or CIDR per line. Supports IPv4 and IPv6. Useful for office networks; misconfiguration can weaken protection.', 'wp-powersuite' )
							);
							?>
						</div>
						<div class="wpps-ts-field__control">
							<textarea
								id="<?php echo esc_attr( $module_id ); ?>_skip_ips"
								name="<?php echo esc_attr( $module_id ); ?>[skip_rules][ips]"
								class="large-text code wp-powersuite-advanced-setting"
								data-setting-key="skip_rules.ips"
								rows="4"
								placeholder="203.0.113.5&#10;10.0.0.0/24"
								spellcheck="false"
								<?php disabled( ! $premium_unlocked ); ?>
							><?php echo esc_textarea( $skip_ips_textarea ); ?></textarea>
						</div>
					</div>

					<div class="wpps-ts-field">
						<div class="wpps-ts-field__label-row">
							<label for="<?php echo esc_attr( $module_id ); ?>_skip_user_agents"><?php esc_html_e( 'User-Agent substrings', 'wp-powersuite' ); ?></label>
							<?php
							wpps_render_modal_settings_tip(
								__( 'Help: User-Agent skip list', 'wp-powersuite' ),
								__( 'One substring per line matched against the visitor User-Agent (case-sensitive). Useful for trusted bots or internal tools.', 'wp-powersuite' )
							);
							?>
						</div>
						<div class="wpps-ts-field__control">
							<textarea
								id="<?php echo esc_attr( $module_id ); ?>_skip_user_agents"
								name="<?php echo esc_attr( $module_id ); ?>[skip_rules][user_agents]"
								class="large-text code wp-powersuite-advanced-setting"
								data-setting-key="skip_rules.user_agents"
								rows="3"
								placeholder="SomeBot/1.0"
								spellcheck="false"
								<?php disabled( ! $premium_unlocked ); ?>
							><?php echo esc_textarea( $skip_uas_textarea ); ?></textarea>
						</div>
					</div>
				</div>
			</div>
		</div>
	</form>
	<script>
	(function () {
		var panel = document.querySelector('.wpps-settings-panel--accordion-stack[data-module-id="<?php echo esc_js( $module_id ); ?>"]');
		if (!panel) {
			return;
		}
		var sel = panel.querySelector('#<?php echo esc_attr( $module_id ); ?>_failsafe_mode');
		var wrap = panel.querySelector('#<?php echo esc_attr( $module_id ); ?>_failsafe_recaptcha_wrap');
		function syncFailsafeRecaptchaFields() {
			if (!sel || !wrap) {
				return;
			}
			wrap.hidden = sel.value !== 'recaptcha';
		}
		if (sel) {
			sel.addEventListener('change', syncFailsafeRecaptchaFields);
			syncFailsafeRecaptchaFields();
		}
		var failsafeSel = panel.querySelector('#<?php echo esc_attr( $module_id ); ?>_failsafe_mode');
		var failsafeWarn = panel.querySelector('#<?php echo esc_attr( $module_id ); ?>_failsafe_allow_warn');
		function syncFailsafeAllowWarning() {
			if (!failsafeSel || !failsafeWarn) {
				return;
			}
			failsafeWarn.hidden = failsafeSel.value !== 'allow';
		}
		if (failsafeSel && failsafeWarn) {
			failsafeSel.addEventListener('change', syncFailsafeAllowWarning);
			syncFailsafeAllowWarning();
		}
	})();
	</script>
</div>
