<?php
namespace AdvancedSecurityHeaders;

use WP_PowerSuite\Core\OptionStoreModuleSettingsRepository;

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

if ( ! function_exists( 'wp_powersuite_is_license_valid' ) || ! wp_powersuite_is_license_valid() ) {
	$license_page_url = admin_url( 'admin.php?page=powersuite-license' );
	?>
	<div class="wp-powersuite-module-settings wpps-settings-panel" data-module-id="<?php echo esc_attr( $module_id ?? 'advanced-security-headers' ); ?>">
		<div class="notice notice-warning inline" style="margin:0;">
			<p>
				<?php esc_html_e( 'Security Headers requires an active license. Activate your license to configure HTTP security headers.', 'wppowersuite-lite' ); ?>
				<a href="<?php echo esc_url( $license_page_url ); ?>"><?php esc_html_e( 'Activate license', 'wppowersuite-lite' ); ?></a>
			</p>
		</div>
	</div>
	<?php
	return;
}

if ( ! isset( $module_id ) ) {
	$module_id = 'advanced-security-headers';
}
$stored = OptionStoreModuleSettingsRepository::forModule( $module_id )->all( [] );
if ( ! is_array( $stored ) ) {
	$stored = [];
}
$settings = Module::sanitizeSettings( $stored );

?>
<div class="wp-powersuite-module-settings wpps-settings-panel wpps-settings-panel--compact-form wpps-ash-settings" data-module-id="<?php echo esc_attr( $module_id ); ?>">
	<form class="wp-powersuite-module-settings-form" data-module-id="<?php echo esc_attr( $module_id ); ?>">
		<?php wp_nonce_field( 'wp_powersuite_save_module_settings_' . $module_id, 'wp_powersuite_nonce' ); ?>


		<p class="description wpps-module-settings-lead">
			<?php esc_html_e( 'Add security headers to help protect against clickjacking, MIME sniffing, referrer leakage, and script risks. Core defaults are enabled automatically; legacy XSS, HSTS, and CSP controls stay optional.', 'wppowersuite-lite' ); ?>
		</p>

		<table class="form-table" role="presentation">
			<tbody>
				<tr>
					<th scope="row" colspan="2">
						<h4 style="margin: 0 0 10px 0;">
							<?php esc_html_e( 'Core Headers', 'wppowersuite-lite' ); ?>
							<?php
							wpps_render_modal_settings_tip(
								__( 'Help: core headers', 'wppowersuite-lite' ),
								__( 'Frame embedding, MIME sniffing, and referrer policy are enabled by default. The legacy XSS filter hint is available here but starts off.', 'wppowersuite-lite' )
							);
							?>
						</h4>
						<p class="description" style="margin-bottom: 15px;">
							<?php esc_html_e( 'Review the shipped header set and disable individual headers only when another trusted layer already owns them.', 'wppowersuite-lite' ); ?>
						</p>
					</th>
				</tr>
				<tr>
					<th scope="row">
						<label for="<?php echo esc_attr( $module_id ); ?>_x_xss_protection">
							<?php esc_html_e( 'X-XSS-Protection', 'wppowersuite-lite' ); ?>
						</label>
						<?php
						wpps_render_modal_settings_tip(
							__( 'Help: X-XSS-Protection', 'wppowersuite-lite' ),
							__( 'Legacy browser hint to enable XSS filtering (1; mode=block). Modern apps often rely on CSP instead.', 'wppowersuite-lite' )
						);
						?>
					</th>
					<td>
						<label>
							<input
								type="checkbox"
								id="<?php echo esc_attr( $module_id ); ?>_x_xss_protection"
								name="x_xss_protection"
								value="1"
								<?php checked( ! empty( $settings['x_xss_protection'] ) ); ?>
								class="wp-powersuite-advanced-setting"
								data-setting-key="x_xss_protection"
							/>
							<strong><?php esc_html_e( 'Enable X-XSS-Protection', 'wppowersuite-lite' ); ?></strong>
						</label>
						<p class="description">
							<?php esc_html_e( 'Legacy browser hint. Most modern browsers ignore this header; CSP is preferred. Off by default.', 'wppowersuite-lite' ); ?>
						</p>
					</td>
				</tr>
				<tr>
					<th scope="row">
						<label for="<?php echo esc_attr( $module_id ); ?>_x_frame_options">
							<?php esc_html_e( 'X-Frame-Options', 'wppowersuite-lite' ); ?>
						</label>
						<?php
						wpps_render_modal_settings_tip(
							__( 'Help: X-Frame-Options', 'wppowersuite-lite' ),
							__( 'SAMEORIGIN prevents other sites embedding your pages in iframes (clickjacking). May affect legitimate embeds.', 'wppowersuite-lite' )
						);
						?>
					</th>
					<td>
						<label>
							<input
								type="checkbox"
								id="<?php echo esc_attr( $module_id ); ?>_x_frame_options"
								name="x_frame_options"
								value="1"
								<?php checked( ! empty( $settings['x_frame_options'] ) ); ?>
								class="wp-powersuite-advanced-setting"
								data-setting-key="x_frame_options"
							/>
							<strong><?php esc_html_e( 'Enable X-Frame-Options', 'wppowersuite-lite' ); ?></strong>
						</label>
						<p class="description">
							<?php esc_html_e( 'Prevents your site from being embedded in iframes on other sites (clickjacking protection). Header: X-Frame-Options: SAMEORIGIN', 'wppowersuite-lite' ); ?>
						</p>
					</td>
				</tr>
				<tr>
					<th scope="row">
						<label for="<?php echo esc_attr( $module_id ); ?>_x_content_type_options">
							<?php esc_html_e( 'X-Content-Type-Options', 'wppowersuite-lite' ); ?>
						</label>
						<?php
						wpps_render_modal_settings_tip(
							__( 'Help: X-Content-Type-Options', 'wppowersuite-lite' ),
							__( 'nosniff reduces MIME-type confusion attacks so browsers stick to declared content types.', 'wppowersuite-lite' )
						);
						?>
					</th>
					<td>
						<label>
							<input
								type="checkbox"
								id="<?php echo esc_attr( $module_id ); ?>_x_content_type_options"
								name="x_content_type_options"
								value="1"
								<?php checked( ! empty( $settings['x_content_type_options'] ) ); ?>
								class="wp-powersuite-advanced-setting"
								data-setting-key="x_content_type_options"
							/>
							<strong><?php esc_html_e( 'Enable X-Content-Type-Options', 'wppowersuite-lite' ); ?></strong>
						</label>
						<p class="description">
							<?php esc_html_e( 'Stops browsers from guessing content types (MIME sniffing). Header: X-Content-Type-Options: nosniff', 'wppowersuite-lite' ); ?>
						</p>
					</td>
				</tr>
				<tr>
					<th scope="row">
						<label for="<?php echo esc_attr( $module_id ); ?>_referrer_policy">
							<?php esc_html_e( 'Referrer-Policy', 'wppowersuite-lite' ); ?>
						</label>
						<?php
						wpps_render_modal_settings_tip(
							__( 'Help: Referrer-Policy', 'wppowersuite-lite' ),
							__( 'Controls how much referrer URL data browsers send on navigations and subresource requests.', 'wppowersuite-lite' )
						);
						?>
					</th>
					<td>
						<label>
							<input
								type="checkbox"
								id="<?php echo esc_attr( $module_id ); ?>_referrer_policy"
								name="referrer_policy"
								value="1"
								<?php checked( ! empty( $settings['referrer_policy'] ) ); ?>
								class="wp-powersuite-advanced-setting"
								data-setting-key="referrer_policy"
							/>
							<strong><?php esc_html_e( 'Enable Referrer-Policy', 'wppowersuite-lite' ); ?></strong>
						</label>
						<p class="description">
							<?php esc_html_e( 'Controls how much referrer data is sent with requests.', 'wppowersuite-lite' ); ?>
						</p>
						<label for="<?php echo esc_attr( $module_id ); ?>_referrer_policy_value" class="screen-reader-text"><?php esc_html_e( 'Referrer-Policy value', 'wppowersuite-lite' ); ?></label>
						<select
							id="<?php echo esc_attr( $module_id ); ?>_referrer_policy_value"
							name="referrer_policy_value"
							class="wp-powersuite-advanced-setting"
							data-setting-key="referrer_policy_value"
							style="margin-top: 8px;"
							<?php disabled( empty( $settings['referrer_policy'] ) ); ?>
						>
							<?php
							$referrer_choices = [
								'no-referrer'                     => 'no-referrer',
								'no-referrer-when-downgrade'      => 'no-referrer-when-downgrade',
								'origin'                          => 'origin',
								'origin-when-cross-origin'        => 'origin-when-cross-origin',
								'same-origin'                     => 'same-origin',
								'strict-origin'                   => 'strict-origin',
								'strict-origin-when-cross-origin' => 'strict-origin-when-cross-origin',
								'unsafe-url'                      => 'unsafe-url',
							];
							$current_referrer = $settings['referrer_policy_value'] ?? 'strict-origin-when-cross-origin';
							foreach ( $referrer_choices as $value => $label ) :
								?>
								<option value="<?php echo esc_attr( $value ); ?>" <?php selected( $current_referrer, $value ); ?>><?php echo esc_html( $label ); ?></option>
							<?php endforeach; ?>
						</select>
					</td>
				</tr>

				<tr>
					<th scope="row" colspan="2">
						<h4 style="margin: 30px 0 10px 0;">
							<?php esc_html_e( 'Optional Headers', 'wppowersuite-lite' ); ?>
							<?php
							wpps_render_modal_settings_tip(
								__( 'Help: optional headers', 'wppowersuite-lite' ),
								__( 'HSTS and CSP are powerful; misconfiguration can lock visitors out or break assets. Test on staging.', 'wppowersuite-lite' )
							);
							?>
						</h4>
						<p class="description" style="margin-bottom: 15px;">
							<?php esc_html_e( 'These headers require careful consideration. Enable only if you understand the implications.', 'wppowersuite-lite' ); ?>
						</p>
					</th>
				</tr>
				<tr>
					<th scope="row">
						<label for="<?php echo esc_attr( $module_id ); ?>_strict_transport_security">
							<?php esc_html_e( 'HSTS (HTTP Strict Transport Security)', 'wppowersuite-lite' ); ?>
						</label>
						<?php
						wpps_render_modal_settings_tip(
							__( 'Help: HSTS', 'wppowersuite-lite' ),
							__( 'Tells browsers to use HTTPS only for this host (and optionally subdomains) for max-age seconds. Requires reliable HTTPS.', 'wppowersuite-lite' )
						);
						?>
					</th>
					<td>
						<label>
							<input
								type="checkbox"
								id="<?php echo esc_attr( $module_id ); ?>_strict_transport_security"
								name="strict_transport_security"
								value="1"
								<?php checked( ! empty( $settings['strict_transport_security'] ) ); ?>
								class="wp-powersuite-advanced-setting"
								data-setting-key="strict_transport_security"
							/>
							<strong><?php esc_html_e( 'Enable HSTS', 'wppowersuite-lite' ); ?></strong>
						</label>
						<p class="description">
							<?php esc_html_e( 'Forces HTTPS-only connections. Only enable if your site is fully HTTPS.', 'wppowersuite-lite' ); ?>
						</p>
						<p style="margin-top: 10px;">
							<label for="<?php echo esc_attr( $module_id ); ?>_hsts_max_age">
								<?php esc_html_e( 'Max-Age (seconds)', 'wppowersuite-lite' ); ?>
							</label><br />
							<input
								type="number"
								id="<?php echo esc_attr( $module_id ); ?>_hsts_max_age"
								name="hsts_max_age"
								value="<?php echo esc_attr( (string) ( $settings['hsts_max_age'] ?? 31536000 ) ); ?>"
								min="0"
								max="63072000"
								step="1"
								class="small-text wp-powersuite-advanced-setting"
								data-setting-key="hsts_max_age"
								<?php disabled( empty( $settings['strict_transport_security'] ) ); ?>
							/>
						</p>
						<?php if ( ! is_ssl() ) : ?>
							<p class="description" style="color: #d63638;">
								<strong><?php esc_html_e( 'Warning:', 'wppowersuite-lite' ); ?></strong>
								<?php esc_html_e( 'Your site is not using HTTPS. Do not enable HSTS until SSL is properly configured.', 'wppowersuite-lite' ); ?>
							</p>
						<?php endif; ?>
						<div style="margin-top: 10px;">
							<label>
								<input
									type="checkbox"
									name="hsts_include_subdomains"
									value="1"
									<?php checked( ! empty( $settings['hsts_include_subdomains'] ) ); ?>
									<?php disabled( empty( $settings['strict_transport_security'] ) ); ?>
									class="wp-powersuite-advanced-setting"
									data-setting-key="hsts_include_subdomains"
								/>
								<?php esc_html_e( 'Include subdomains', 'wppowersuite-lite' ); ?>
							</label>
							<p class="description">
								<?php esc_html_e( 'Only enable if every subdomain on this site supports HTTPS. Off by default to avoid accidental lockouts.', 'wppowersuite-lite' ); ?>
							</p>
						</div>
					</td>
				</tr>
				<tr>
					<th scope="row">
						<label for="<?php echo esc_attr( $module_id ); ?>_content_security_policy">
							<?php esc_html_e( 'Content-Security-Policy (CSP)', 'wppowersuite-lite' ); ?>
						</label>
						<?php
						wpps_render_modal_settings_tip(
							__( 'Help: CSP', 'wppowersuite-lite' ),
							__( 'Restricts scripts, styles, images, and other loads. Typos or overly strict directives can break themes, CDNs, or embeds.', 'wppowersuite-lite' )
						);
						?>
					</th>
					<td>
						<label>
							<input
								type="checkbox"
								id="<?php echo esc_attr( $module_id ); ?>_content_security_policy"
								name="content_security_policy"
								value="1"
								<?php checked( ! empty( $settings['content_security_policy'] ) ); ?>
								class="wp-powersuite-advanced-setting"
								data-setting-key="content_security_policy"
							/>
							<strong><?php esc_html_e( 'Enable Content-Security-Policy', 'wppowersuite-lite' ); ?></strong>
						</label>
						<p class="description">
							<?php esc_html_e( 'Restricts which resources can load on your pages. May break external resources like Google Fonts, analytics scripts, or CDN libraries. Test thoroughly before enabling.', 'wppowersuite-lite' ); ?>
						</p>
						<div style="margin-top: 10px;">
							<label>
								<input
									type="checkbox"
									id="<?php echo esc_attr( $module_id ); ?>_content_security_policy_report_only"
									name="content_security_policy_report_only"
									value="1"
									<?php checked( ! empty( $settings['content_security_policy_report_only'] ) ); ?>
									<?php disabled( empty( $settings['content_security_policy'] ) ); ?>
									class="wp-powersuite-advanced-setting"
									data-setting-key="content_security_policy_report_only"
								/>
								<strong><?php esc_html_e( 'Report-only mode (recommended first)', 'wppowersuite-lite' ); ?></strong>
							</label>
							<p class="description">
								<?php esc_html_e( 'Sends Content-Security-Policy-Report-Only so browsers log violations without blocking resources. Switch off after verifying on staging.', 'wppowersuite-lite' ); ?>
							</p>
						</div>
						<textarea
							id="<?php echo esc_attr( $module_id ); ?>_content_security_policy_value"
							name="content_security_policy_value"
							rows="3"
							cols="50"
							class="large-text code wp-powersuite-advanced-setting"
							data-setting-key="content_security_policy_value"
							placeholder="default-src 'self'"
							style="margin-top: 10px;"
							<?php disabled( empty( $settings['content_security_policy'] ) ); ?>
						><?php echo esc_textarea( $settings['content_security_policy_value'] ?? "default-src 'self'" ); ?></textarea>
						<p class="description">
							<?php esc_html_e( 'Example: default-src \'self\'; script-src \'self\' \'unsafe-inline\'; style-src \'self\' \'unsafe-inline\';', 'wppowersuite-lite' ); ?>
						</p>
					</td>
				</tr>
			</tbody>
		</table>

		<div class="wpps-settings-alert wpps-settings-alert--warning wpps-settings-alert--after-sheet" role="note">
			<p>
				<strong><?php esc_html_e( 'Important notes:', 'wppowersuite-lite' ); ?></strong>
				<?php esc_html_e( 'If Cloudflare, nginx, or your host already sends HSTS or CSP, configure headers in only one place. Enable HSTS only after confirming the whole site is HTTPS. Use CSP report-only mode on staging first because some themes and plugins load external resources.', 'wppowersuite-lite' ); ?>
			</p>
		</div>
	</form>
</div>

<?php ob_start(); ?>
jQuery(document).ready(function($) {
	$('input[name="strict_transport_security"]').on('change', function() {
		var on = $(this).is(':checked');
		$('input[name="hsts_include_subdomains"]').prop('disabled', !on);
		$('input[name="hsts_max_age"]').prop('disabled', !on);
	});

	$('input[name="referrer_policy"]').on('change', function() {
		$('select[name="referrer_policy_value"]').prop('disabled', !$(this).is(':checked'));
	});

	$('input[name="content_security_policy"]').on('change', function() {
		var on = $(this).is(':checked');
		$('textarea[name="content_security_policy_value"]').prop('disabled', !on);
		$('input[name="content_security_policy_report_only"]').prop('disabled', !on);
	});
});
<?php \WP_PowerSuite\Core\InlineAssets::script( 'wpps-ia-modules-advanced-security-headers-admin-php-script-1', (string) ob_get_clean() ); ?>
