@extends('admin.firewallplus.layout', ['fwpTab' => 'emergency'])

@section('fwp_title')
    Firewall-Plus: Incident controls
@endsection

@section('fwp_subtitle')
    Global freeze and recovery operations
@endsection

@section('fwp')
@if (session('success'))
    <div class="alert alert-success">{{ session('success') }}</div>
@endif

@if ($errors->any())
    <div class="alert alert-danger">
        <strong>Could not save:</strong>
        <ul style="margin-bottom: 0;">
            @foreach ($errors->all() as $message)
                <li>{{ $message }}</li>
            @endforeach
        </ul>
    </div>
@endif

<div class="box box-success">
    <div class="box-header with-border">
        <h3 class="box-title"><i class="fa fa-refresh"></i> Global reapply</h3>
    </div>
    <div class="box-body">
        <p class="text-muted" style="margin-bottom:10px;">
            Queues a forced re-apply for every server that currently has Firewall-Plus enabled.
            Servers on offline nodes are skipped. Safe to run at any time, it is idempotent.
        </p>
        <form method="POST" action="{{ route('admin.firewallplus.emergency.global_reapply') }}"
              onsubmit="return confirm('Queue a reapply on all active Firewall-Plus servers? Servers on offline nodes will be skipped.');">
            @csrf
            <button type="submit" class="btn btn-success btn-sm">
                <i class="fa fa-refresh"></i> Reapply all servers
            </button>
        </form>
    </div>
</div>

<div class="box box-warning">
    <div class="box-header with-border">
        <h3 class="box-title"><i class="fa fa-bar-chart"></i> Reset all analytics</h3>
    </div>
    <div class="box-body">
        <p class="text-muted" style="margin-bottom:10px;">
            Clears all Firewall-Plus analytics history (ring buffers / metrics storage) on every <strong>online</strong> node.
            Firewall rules and configs are <strong>not</strong> removed; only charts, counters history, and dashboard stats.
            Counters restart from zero on the next metrics tick.
        </p>
        <form method="POST" action="{{ route('admin.firewallplus.emergency.reset_analytics') }}"
              onsubmit="return confirm('Reset analytics on ALL online nodes? Historical dashboard data will be permanently cleared.');">
            @csrf
            <button type="submit" class="btn btn-warning btn-sm">
                <i class="fa fa-trash"></i> Reset analytics (all servers)
            </button>
        </form>
    </div>
</div>

<div class="box box-default">
    <div class="box-header with-border">
        <h3 class="box-title">Impact overview</h3>
        <div class="box-tools pull-right">
            <button type="button" class="btn btn-default btn-xs" id="refresh-preview-btn">
                <i class="fa fa-refresh"></i> Refresh
            </button>
        </div>
    </div>
    <div class="box-body">
        <div id="preview-loading" class="text-muted"><i class="fa fa-spinner fa-spin"></i> Loading impact…</div>
        <div id="preview-body" style="display:none;">
            <div class="row">
                <div class="col-md-3">
                    <strong>Servers (enabled):</strong>
                    <span id="preview-servers-enabled">…</span> / <span id="preview-servers-total">…</span>
                </div>
                <div class="col-md-3">
                    <strong>Nodes (online):</strong>
                    <span id="preview-nodes-online">…</span> / <span id="preview-nodes-total">…</span>
                </div>
                <div class="col-md-3">
                    <strong>Rules (enabled):</strong>
                    <span id="preview-rules-enabled">…</span> / <span id="preview-rules-total">…</span>
                </div>
                <div class="col-md-3 text-right">
                    <span class="label label-danger" id="preview-impact-tag">High impact</span>
                </div>
            </div>
        </div>
        <div id="preview-error" class="alert alert-danger" style="display:none;margin-top:10px;"></div>
    </div>
</div>

<form method="POST" action="{{ route('admin.firewallplus.emergency.update') }}" id="emergency-form">
    @csrf
    <input type="hidden" name="confirm_phrase" id="hidden-confirm-phrase">
    <input type="hidden" name="confirmation_token" id="hidden-confirmation-token">

    <div class="box box-danger">
        <div class="box-header with-border"><h3 class="box-title">Disable rule types</h3></div>
        <div class="box-body">
            <p class="text-muted">Users cannot create or update rules of these types while listed.</p>
            <div class="row">
                @php($oldDisabled = old('disabled_rules', $disabled_rules))
                @foreach ($rule_types as $type)
                    <div class="col-md-4" style="margin-bottom:8px;">
                        <label style="font-weight:normal;cursor:pointer;display:block;">
                            <input type="checkbox" name="disabled_rules[]" value="{{ $type }}"
                                {{ in_array($type, $oldDisabled, true) ? 'checked' : '' }}>
                            <code>{{ $type }}</code>
                        </label>
                    </div>
                @endforeach
            </div>
            <div class="form-group" style="margin-top:12px;">
                <label for="cb-flush-disabled-types" style="font-weight:normal;cursor:pointer;display:block;">
                    <input type="hidden" name="flush_disabled_rule_types" value="0">
                    <input type="checkbox" name="flush_disabled_rule_types" value="1"
                           id="cb-flush-disabled-types"
                           {{ old('flush_disabled_rule_types') ? 'checked' : '' }}>
                    Also flush matching rules from nodes
                </label>
                <p class="text-muted" style="margin:6px 0 0 24px;">
                    Removes iptables rules of the selected disabled types from every affected server on online nodes.
                    Future applies will omit these types until they are re-enabled here.
                </p>
            </div>
            @error('disabled_rules')<p class="text-red">{{ $message }}</p>@enderror
            @error('disabled_rules.*')<p class="text-red">{{ $message }}</p>@enderror
        </div>
    </div>

    <div class="box box-danger">
        <div class="box-header with-border"><h3 class="box-title">Global freeze</h3></div>
        <div class="box-body">
            <p class="text-muted" style="margin-bottom:10px;">
                Instantly blocks all user-initiated firewall mutations across every server on this panel. No new rules can be created, edited, or deleted while this is active, and any queued applies are rejected.
                <strong>When to use:</strong> activate this when you suspect a compromised account is modifying firewall rules, or during a maintenance window where rule changes could disrupt your network.
                Rules already applied to nodes stay active until a manual re-apply; this only blocks further changes.
            </p>
            <div class="form-group">
                <label for="cb-emergency-mode">Enable global freeze (block all firewall mutations)</label>
                <div>
                    <input type="hidden" name="emergency_mode" value="0">
                    <input type="checkbox" name="emergency_mode" value="1"
                           id="cb-emergency-mode"
                           {{ old('emergency_mode', $emergency_mode) ? 'checked' : '' }}>
                </div>
            </div>
        </div>
    </div>

    <div class="box box-danger">
        <div class="box-header with-border"><h3 class="box-title">Emergency flush</h3></div>
        <div class="box-body">
            <p class="text-muted" style="margin-bottom:10px;">
                Removes every <code>FWP-*</code> iptables chain managed by this addon from all online nodes.
                <strong>Only Firewall-Plus managed rules are removed.</strong> Docker rules, system-created chains, UFW rules, and any manually added iptables rules that do not carry an <code>FWP</code> comment tag will <strong>not</strong> be touched. Servers will be left without any FWP protections until you run a global re-apply.
            </p>
            <p class="text-muted" style="margin-bottom:10px;">
                <strong>When to use:</strong> if nodes are stuck with stale or conflicting FWP chains after a failed deploy, a rule-set rollback, or a node crash, run this to wipe the slate clean then trigger a re-apply. Not for routine use.
            </p>
            <div class="form-group">
                <label for="cb-confirm-flush">Queue flush of <strong>all</strong> managed server chains on every online node</label>
                <div>
                    <input type="hidden" name="confirm_flush" value="0">
                    <input type="checkbox" name="confirm_flush" value="1" id="cb-confirm-flush">
                </div>
            </div>
            <p class="text-muted">
                CLI equivalent: <code>php artisan firewall-plus:emergency-flush --all-nodes --confirm</code>
            </p>
        </div>
        <div class="box-footer">
            <button type="button" class="btn btn-danger" id="submit-emergency-btn">Execute selected actions</button>
        </div>
    </div>
</form>

<div class="modal fade" id="emergencyConfirmModal" tabindex="-1" role="dialog">
    <div class="modal-dialog" role="document">
        <div class="modal-content">
            <div class="modal-header">
                <button type="button" class="close" data-dismiss="modal"><span>&times;</span></button>
                <h4 class="modal-title">Confirm destructive action</h4>
            </div>
            <div class="modal-body">
                <div class="alert alert-danger">
                    <strong>Warning: this cannot be undone without manual re-apply.</strong> Type the
                    phrase below exactly to proceed. The confirmation token expires in 60 seconds.
                </div>
                <p>Type this phrase:</p>
                <pre id="confirm-phrase-display" class="well">{{ $confirm_phrase }}</pre>
                <div class="form-group">
                    <label for="confirm-phrase-input">Confirmation phrase</label>
                    <input type="text" id="confirm-phrase-input" class="form-control" autocomplete="off">
                </div>
                <p class="text-muted">
                    Token expires in <span id="confirm-token-ttl">60</span>s.
                </p>
            </div>
            <div class="modal-footer">
                <button type="button" class="btn btn-default" data-dismiss="modal">Cancel</button>
                <button type="button" class="btn btn-danger" id="confirm-submit-btn" disabled>Confirm &amp; Execute</button>
            </div>
        </div>
    </div>
</div>
@endsection

@section('footer-scripts')
    @parent
    <script>
        (function () {
            const csrf = '{{ csrf_token() }}';
            const expectedPhrase = @json($confirm_phrase);
            const form = document.getElementById('emergency-form');
            const submitBtn = document.getElementById('submit-emergency-btn');
            const cbEmergency = document.getElementById('cb-emergency-mode');
            const cbFlush = document.getElementById('cb-confirm-flush');
            const cbFlushDisabled = document.getElementById('cb-flush-disabled-types');
            const disabledCheckboxes = form.querySelectorAll('input[name="disabled_rules[]"]');
            const confirmInput = document.getElementById('confirm-phrase-input');
            const confirmBtn = document.getElementById('confirm-submit-btn');
            const ttlEl = document.getElementById('confirm-token-ttl');
            const hiddenPhrase = document.getElementById('hidden-confirm-phrase');
            const hiddenToken = document.getElementById('hidden-confirmation-token');

            let ttlInterval = null;

            async function loadPreview() {
                const loading = document.getElementById('preview-loading');
                const body = document.getElementById('preview-body');
                const err = document.getElementById('preview-error');
                loading.style.display = '';
                body.style.display = 'none';
                err.style.display = 'none';
                try {
                    const res = await fetch('{{ route('admin.firewallplus.emergency.preview') }}', {
                        headers: { 'Accept': 'application/json' },
                    });
                    const json = await res.json();
                    if (!json.success) {
                        err.textContent = json.error || 'Preview failed';
                        err.style.display = '';
                        return;
                    }
                    document.getElementById('preview-servers-enabled').textContent = json.data.servers_enabled;
                    document.getElementById('preview-servers-total').textContent = json.data.servers_total;
                    document.getElementById('preview-nodes-online').textContent = json.data.nodes_online;
                    document.getElementById('preview-nodes-total').textContent = json.data.nodes_total;
                    document.getElementById('preview-rules-enabled').textContent = json.data.rules_enabled;
                    document.getElementById('preview-rules-total').textContent = json.data.rules_total;
                    body.style.display = '';
                } catch (e) {
                    err.textContent = 'Preview error: ' + e.message;
                    err.style.display = '';
                } finally {
                    loading.style.display = 'none';
                }
            }

            document.getElementById('refresh-preview-btn').addEventListener('click', loadPreview);
            loadPreview();

            function anyDisabledRuleTypesChecked() {
                return Array.from(disabledCheckboxes).some(function (cb) { return cb.checked; });
            }

            function updateFlushDisabledToggle() {
                const enabled = anyDisabledRuleTypesChecked();
                cbFlushDisabled.disabled = !enabled;
                if (!enabled) {
                    cbFlushDisabled.checked = false;
                }
            }

            disabledCheckboxes.forEach(function (cb) {
                cb.addEventListener('change', updateFlushDisabledToggle);
            });
            updateFlushDisabledToggle();

            submitBtn.addEventListener('click', async function () {
                if (cbFlushDisabled.checked && anyDisabledRuleTypesChecked()) {
                    if (!confirm('Remove iptables rules of the selected disabled types from all affected servers on online nodes?')) {
                        return;
                    }
                }

                const destructive = cbEmergency.checked || cbFlush.checked;
                if (!destructive) {
                    hiddenPhrase.value = '';
                    hiddenToken.value = '';
                    form.submit();
                    return;
                }

                submitBtn.disabled = true;
                const originalText = submitBtn.textContent;
                submitBtn.textContent = 'Preparing…';

                try {
                    const res = await fetch('{{ route('admin.firewallplus.emergency.prepare') }}', {
                        method: 'POST',
                        headers: { 'X-CSRF-TOKEN': csrf, 'Accept': 'application/json' },
                    });
                    const json = await res.json();
                    if (!json.success) {
                        alert(json.error || 'Could not prepare confirmation token.');
                        return;
                    }

                    hiddenToken.value = json.data.confirmation_token;
                    let ttl = json.data.expires_in || 60;
                    ttlEl.textContent = String(ttl);
                    confirmInput.value = '';
                    confirmBtn.disabled = true;
                    $('#emergencyConfirmModal').modal('show');

                    if (ttlInterval) clearInterval(ttlInterval);
                    ttlInterval = setInterval(function () {
                        ttl -= 1;
                        ttlEl.textContent = String(Math.max(0, ttl));
                        if (ttl <= 0) {
                            clearInterval(ttlInterval);
                            confirmBtn.disabled = true;
                            confirmBtn.textContent = 'Token expired. Close and retry.';
                        }
                    }, 1000);
                } catch (e) {
                    alert('Prepare error: ' + e.message);
                } finally {
                    submitBtn.disabled = false;
                    submitBtn.textContent = originalText;
                }
            });

            confirmInput.addEventListener('input', function () {
                confirmBtn.disabled = confirmInput.value !== expectedPhrase;
            });

            confirmBtn.addEventListener('click', function () {
                hiddenPhrase.value = confirmInput.value;
                if (ttlInterval) clearInterval(ttlInterval);
                form.submit();
            });
        })();
    </script>
@endsection