<?php
if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

use WP_PowerSuite\Core\OptionStoreModuleSettingsRepository;
use LimitLoginAttempts\Module;

if ( ! function_exists( 'wp_powersuite_is_license_valid' ) || ! wp_powersuite_is_license_valid() ) {
	$license_page_url = admin_url( 'admin.php?page=powersuite-license' );
	?>
	<div class="wp-powersuite-module-settings wpps-settings-panel" data-module-id="<?php echo esc_attr( $module_id ?? 'limit-login-attempts' ); ?>">
		<div class="notice notice-warning inline" style="margin:0;">
			<p>
				<?php esc_html_e( 'Limit Login Attempts requires an active license. Activate your license to configure lockout rules.', 'wp-powersuite' ); ?>
				<a href="<?php echo esc_url( $license_page_url ); ?>"><?php esc_html_e( 'Activate license', 'wp-powersuite' ); ?></a>
			</p>
		</div>
	</div>
	<?php
	return;
}

if ( ! isset( $module_id ) || empty( $module_id ) ) {
	$module_id = 'limit-login-attempts';
}

$settings     = OptionStoreModuleSettingsRepository::forModule( $module_id )->all( [] );
if ( ! is_array( $settings ) ) {
	$settings = [];
}

$max_attempts               = max( 1, min( 20, absint( $settings['max_attempts'] ?? 3 ) ) );
$escalation_threshold       = max( 1, min( 10, absint( $settings['escalation_threshold'] ?? 2 ) ) );
$lockout_minutes            = max( 5, min( 1440, absint( $settings['lockout_minutes'] ?? 15 ) ) );
$lockout_minutes_escalated  = max( 5, min( 1440, absint( $settings['lockout_minutes_escalated'] ?? 30 ) ) );
$attempt_window_minutes     = max( 5, min( 1440, absint( $settings['attempt_window_minutes'] ?? 60 ) ) );
$log_retention_days         = max( 7, min( 365, absint( $settings['log_retention_days'] ?? 30 ) ) );
$lockout_mode               = isset( $settings['lockout_mode'] ) && $settings['lockout_mode'] === 'ip_username' ? 'ip_username' : 'ip';
$geo_lookup_enabled         = ! empty( $settings['geo_lookup_enabled'] );
$generic_error_messages     = ! empty( $settings['generic_error_messages'] );

$never_block_ips = Module::normalizeAllowlistIps( $settings['never_block_ips'] ?? '' );
$never_block_ips_text = implode( "\n", $never_block_ips );

$ip_header = Module::normalizeIpHeader( $settings['ip_header'] ?? '' );
?>

<div class="wp-powersuite-module-settings" data-module-id="<?php echo esc_attr( $module_id ); ?>">
	<form class="wp-powersuite-module-settings-form" data-module-id="<?php echo esc_attr( $module_id ); ?>">
		<?php wp_nonce_field( 'wp_powersuite_save_module_settings_' . $module_id, 'wp_powersuite_nonce' ); ?>

		<table class="form-table" role="presentation">
			<tbody>
				<tr>
					<th scope="row">
						<label for="<?php echo esc_attr( $module_id ); ?>_max_attempts">
							<?php esc_html_e( 'Failed logins before block', 'wp-powersuite' ); ?>
						</label>
						<?php
						wpps_render_modal_settings_tip(
							__( 'Help: failed login threshold', 'wp-powersuite' ),
							__( 'Number of failed attempts within the observation window before a temporary lockout begins.', 'wp-powersuite' )
						);
						?>
					</th>
					<td>
						<input
							type="number"
							id="<?php echo esc_attr( $module_id ); ?>_max_attempts"
							name="<?php echo esc_attr( $module_id ); ?>[max_attempts]"
							value="<?php echo esc_attr( $max_attempts ); ?>"
							min="1"
							max="20"
							class="small-text wp-powersuite-advanced-setting"
							data-setting-key="max_attempts"
						/>
					</td>
				</tr>

				<tr>
					<th scope="row">
						<label for="<?php echo esc_attr( $module_id ); ?>_attempt_window_minutes">
							<?php esc_html_e( 'Observation window (minutes)', 'wp-powersuite' ); ?>
						</label>
						<?php
						wpps_render_modal_settings_tip(
							__( 'Help: observation window', 'wp-powersuite' ),
							__( 'Failed attempts are counted within this rolling window. Spaced attacks cannot reset the counter by waiting out a shorter period.', 'wp-powersuite' )
						);
						?>
					</th>
					<td>
						<input
							type="number"
							id="<?php echo esc_attr( $module_id ); ?>_attempt_window_minutes"
							name="<?php echo esc_attr( $module_id ); ?>[attempt_window_minutes]"
							value="<?php echo esc_attr( $attempt_window_minutes ); ?>"
							min="5"
							max="1440"
							class="small-text wp-powersuite-advanced-setting"
							data-setting-key="attempt_window_minutes"
						/>
					</td>
				</tr>

				<tr>
					<th scope="row">
						<label for="<?php echo esc_attr( $module_id ); ?>_lockout_mode">
							<?php esc_html_e( 'Lockout mode', 'wp-powersuite' ); ?>
						</label>
						<?php
						wpps_render_modal_settings_tip(
							__( 'Help: lockout mode', 'wp-powersuite' ),
							__( 'IP only: one counter per address. IP + username: separate counters per login identifier from the same address (helps against distributed username guessing).', 'wp-powersuite' )
						);
						?>
					</th>
					<td>
						<select
							id="<?php echo esc_attr( $module_id ); ?>_lockout_mode"
							name="<?php echo esc_attr( $module_id ); ?>[lockout_mode]"
							class="wp-powersuite-advanced-setting"
							data-setting-key="lockout_mode"
						>
							<option value="ip" <?php selected( $lockout_mode, 'ip' ); ?>><?php esc_html_e( 'IP address only', 'wp-powersuite' ); ?></option>
							<option value="ip_username" <?php selected( $lockout_mode, 'ip_username' ); ?>><?php esc_html_e( 'IP address + username', 'wp-powersuite' ); ?></option>
						</select>
					</td>
				</tr>

				<tr>
					<th scope="row">
						<label for="<?php echo esc_attr( $module_id ); ?>_lockout_minutes">
							<?php esc_html_e( 'Lockout duration (minutes)', 'wp-powersuite' ); ?>
						</label>
						<?php
						wpps_render_modal_settings_tip(
							__( 'Help: lockout duration', 'wp-powersuite' ),
							__( 'How long an IP stays blocked after reaching the failed-login threshold (5–1440 minutes).', 'wp-powersuite' )
						);
						?>
					</th>
					<td>
						<input
							type="number"
							id="<?php echo esc_attr( $module_id ); ?>_lockout_minutes"
							name="<?php echo esc_attr( $module_id ); ?>[lockout_minutes]"
							value="<?php echo esc_attr( $lockout_minutes ); ?>"
							min="5"
							max="1440"
							class="small-text wp-powersuite-advanced-setting"
							data-setting-key="lockout_minutes"
						/>
					</td>
				</tr>

				<tr>
					<th scope="row">
						<label for="<?php echo esc_attr( $module_id ); ?>_escalation_threshold">
							<?php esc_html_e( 'Escalation threshold', 'wp-powersuite' ); ?>
						</label>
						<?php
						wpps_render_modal_settings_tip(
							__( 'Help: escalation', 'wp-powersuite' ),
							__( 'Number of lockouts allowed at the standard duration before the next lockout uses the escalated duration. Example: threshold 2 means the third lockout is escalated.', 'wp-powersuite' )
						);
						?>
					</th>
					<td>
						<input
							type="number"
							id="<?php echo esc_attr( $module_id ); ?>_escalation_threshold"
							name="<?php echo esc_attr( $module_id ); ?>[escalation_threshold]"
							value="<?php echo esc_attr( $escalation_threshold ); ?>"
							min="1"
							max="10"
							class="small-text wp-powersuite-advanced-setting"
							data-setting-key="escalation_threshold"
						/>
					</td>
				</tr>

				<tr>
					<th scope="row">
						<label for="<?php echo esc_attr( $module_id ); ?>_lockout_minutes_escalated">
							<?php esc_html_e( 'Escalated lockout (minutes)', 'wp-powersuite' ); ?>
						</label>
						<?php
						wpps_render_modal_settings_tip(
							__( 'Help: escalated lockout', 'wp-powersuite' ),
							__( 'Longer block applied after an IP exceeds the escalation threshold (repeat offenders).', 'wp-powersuite' )
						);
						?>
					</th>
					<td>
						<input
							type="number"
							id="<?php echo esc_attr( $module_id ); ?>_lockout_minutes_escalated"
							name="<?php echo esc_attr( $module_id ); ?>[lockout_minutes_escalated]"
							value="<?php echo esc_attr( $lockout_minutes_escalated ); ?>"
							min="5"
							max="1440"
							class="small-text wp-powersuite-advanced-setting"
							data-setting-key="lockout_minutes_escalated"
						/>
					</td>
				</tr>

				<tr>
					<th scope="row">
						<label for="<?php echo esc_attr( $module_id ); ?>_log_retention_days">
							<?php esc_html_e( 'Log retention (days)', 'wp-powersuite' ); ?>
						</label>
						<?php
						wpps_render_modal_settings_tip(
							__( 'Help: log retention', 'wp-powersuite' ),
							__( 'Failed-login log entries older than this are deleted automatically (minimum 7 days).', 'wp-powersuite' )
						);
						?>
					</th>
					<td>
						<input
							type="number"
							id="<?php echo esc_attr( $module_id ); ?>_log_retention_days"
							name="<?php echo esc_attr( $module_id ); ?>[log_retention_days]"
							value="<?php echo esc_attr( $log_retention_days ); ?>"
							min="7"
							max="365"
							class="small-text wp-powersuite-advanced-setting"
							data-setting-key="log_retention_days"
						/>
					</td>
				</tr>

				<tr>
					<th scope="row">
						<label for="<?php echo esc_attr( $module_id ); ?>_never_block_ips">
							<?php esc_html_e( 'Never block IP addresses', 'wp-powersuite' ); ?>
						</label>
						<?php
						wpps_render_modal_settings_tip(
							__( 'Help: allowlist IPs', 'wp-powersuite' ),
							__( 'One valid IPv4 or IPv6 address per line. Invalid lines are ignored when saving. Add your office or home IP here to avoid locking yourself out.', 'wp-powersuite' )
						);
						?>
					</th>
					<td>
						<textarea
							id="<?php echo esc_attr( $module_id ); ?>_never_block_ips"
							name="<?php echo esc_attr( $module_id ); ?>[never_block_ips]"
							rows="5"
							cols="50"
							class="large-text code wp-powersuite-advanced-setting"
							data-setting-key="never_block_ips"
							placeholder="<?php echo esc_attr( '103.250.148.152' . "\n" . '192.168.1.100' ); ?>"
						><?php echo esc_textarea( $never_block_ips_text ); ?></textarea>
						<p class="description">
							<?php esc_html_e( 'If you are locked out, another administrator can unblock your IP from Login Attempts logs, or you can add your IP here via the database or WP-CLI.', 'wp-powersuite' ); ?>
						</p>
					</td>
				</tr>

				<tr>
					<th scope="row">
						<label for="<?php echo esc_attr( $module_id ); ?>_ip_header">
							<?php esc_html_e( 'Real IP header', 'wp-powersuite' ); ?>
						</label>
						<?php
						wpps_render_modal_settings_tip(
							__( 'Help: proxy IP header', 'wp-powersuite' ),
							__( 'Leave blank to use REMOTE_ADDR. Behind Cloudflare, CF-Connecting-IP is used automatically when present. For other proxies, set the PHP $_SERVER key (e.g. HTTP_X_REAL_IP). X-Forwarded-For and similar headers are blocked because they are easily spoofed.', 'wp-powersuite' )
						);
						?>
					</th>
					<td>
						<input
							type="text"
							id="<?php echo esc_attr( $module_id ); ?>_ip_header"
							name="<?php echo esc_attr( $module_id ); ?>[ip_header]"
							value="<?php echo esc_attr( $ip_header ); ?>"
							class="regular-text wp-powersuite-advanced-setting"
							data-setting-key="ip_header"
							placeholder="<?php echo esc_attr( 'HTTP_X_REAL_IP' ); ?>"
						/>
					</td>
				</tr>

				<tr>
					<th scope="row">
						<?php esc_html_e( 'Privacy & messages', 'wp-powersuite' ); ?>
					</th>
					<td>
						<fieldset>
							<label>
								<input
									type="checkbox"
									name="<?php echo esc_attr( $module_id ); ?>[geo_lookup_enabled]"
									value="1"
									class="wp-powersuite-advanced-setting"
									data-setting-key="geo_lookup_enabled"
									<?php checked( $geo_lookup_enabled ); ?>
								/>
								<?php esc_html_e( 'Look up country for logged IPs (sends public IPs to ipwho.is over HTTPS)', 'wp-powersuite' ); ?>
							</label>
							<br />
							<label>
								<input
									type="checkbox"
									name="<?php echo esc_attr( $module_id ); ?>[generic_error_messages]"
									value="1"
									class="wp-powersuite-advanced-setting"
									data-setting-key="generic_error_messages"
									<?php checked( $generic_error_messages ); ?>
								/>
								<?php esc_html_e( 'Use generic login errors (hide remaining-attempt count)', 'wp-powersuite' ); ?>
							</label>
						</fieldset>
					</td>
				</tr>
			</tbody>
		</table>

		<p class="description">
			<a href="<?php echo esc_url( admin_url( 'admin.php?page=wpps-limit-login-attempts-logs' ) ); ?>" class="button"><?php esc_html_e( 'View logs', 'wp-powersuite' ); ?></a>
		</p>
	</form>
</div>
