<?php

require_once __DIR__ . '/../app/config/config.php';
require_once __DIR__ . '/../app/config/database.php';
require_once __DIR__ . '/../app/helpers/functions.php';
require_once __DIR__ . '/../app/helpers/auth.php';
require_once __DIR__ . '/../app/helpers/settings.php';
require_once __DIR__ . '/../app/helpers/activity.php';

require_admin();

$pageTitle = 'Security Settings';
$success = '';
$error = '';

if (isset($_GET['updated'])) {
    $success = 'Security settings updated successfully.';
}

if (is_post()) {
    if (!verify_csrf()) {
        $error = 'Invalid request. Please refresh and try again.';
    } else {
        $loginLimiterEnabled = isset($_POST['login_limiter_enabled']) ? '1' : '0';
        $maxLoginAttempts = max(1, (int) ($_POST['max_login_attempts'] ?? 5));
        $lockoutMinutes = max(1, (int) ($_POST['lockout_minutes'] ?? 15));
        $adminSessionTimeout = max(5, (int) ($_POST['admin_session_timeout'] ?? 60));

        update_setting('login_limiter_enabled', $loginLimiterEnabled, 'security');
update_setting('max_login_attempts', (string) $maxLoginAttempts, 'security');
update_setting('lockout_minutes', (string) $lockoutMinutes, 'security');
update_setting('admin_session_timeout', (string) $adminSessionTimeout, 'security');

log_admin_activity(
    'security_settings_updated',
    'Security settings updated. Login limiter: ' . $loginLimiterEnabled .
    ', Max attempts: ' . $maxLoginAttempts .
    ', Lockout minutes: ' . $lockoutMinutes .
    ', Session timeout: ' . $adminSessionTimeout
);

redirect(ADMIN_URL . '/security.php?updated=1');
    }
}

require_once __DIR__ . '/includes/header.php';
require_once __DIR__ . '/includes/sidebar.php';
?>

<main class="admin-main">
    <div class="admin-topbar">
        <div>
            <h1>Security Settings</h1>
            <div class="admin-user">Control admin login protection and basic security rules.</div>
        </div>
    </div>

    <?php if ($success): ?>
        <div class="admin-alert admin-alert-success"><?= e($success); ?></div>
    <?php endif; ?>

    <?php if ($error): ?>
        <div class="admin-alert admin-alert-error"><?= e($error); ?></div>
    <?php endif; ?>

    <section class="admin-panel">
        <h2>Admin Login Protection</h2>

        <form method="POST">
            <?= csrf_field(); ?>

            <div class="admin-field">
                <label style="display:flex; align-items:center; gap:10px;">
                    <input
                        type="checkbox"
                        name="login_limiter_enabled"
                        value="1"
                        <?= get_setting('login_limiter_enabled', '1') === '1' ? 'checked' : ''; ?>
                    >
                    Enable Login Attempt Limiter
                </label>
            </div>

            <div class="admin-form-grid">
                <div class="admin-field">
                    <label>Maximum Failed Attempts</label>
                    <input
                        type="number"
                        name="max_login_attempts"
                        min="1"
                        value="<?= e(get_setting('max_login_attempts', '5')); ?>"
                    >
                    <small>Example: 5 wrong attempts before lockout.</small>
                </div>

                <div class="admin-field">
                    <label>Lockout Duration</label>
                    <input
                        type="number"
                        name="lockout_minutes"
                        min="1"
                        value="<?= e(get_setting('lockout_minutes', '15')); ?>"
                    >
                    <small>Duration in minutes.</small>
                </div>

                <div class="admin-field">
                    <label>Admin Session Timeout</label>
                    <input
                        type="number"
                        name="admin_session_timeout"
                        min="5"
                        value="<?= e(get_setting('admin_session_timeout', '60')); ?>"
                    >
                    <small>Duration in minutes. Full timeout enforcement can be connected next.</small>
                </div>
            </div>

            <button type="submit" class="admin-btn">Save Security Settings</button>
        </form>
    </section>

    <section class="admin-panel" style="margin-top:24px;">
        <h2>Current Protection Status</h2>

        <table class="admin-table">
            <tbody>
                <tr>
                    <th>Login Limiter</th>
                    <td><?= get_setting('login_limiter_enabled', '1') === '1' ? 'Enabled' : 'Disabled'; ?></td>
                </tr>

                <tr>
                    <th>Max Failed Attempts</th>
                    <td><?= e(get_setting('max_login_attempts', '5')); ?></td>
                </tr>

                <tr>
                    <th>Lockout Duration</th>
                    <td><?= e(get_setting('lockout_minutes', '15')); ?> minutes</td>
                </tr>

                <tr>
                    <th>Session Timeout</th>
                    <td><?= e(get_setting('admin_session_timeout', '60')); ?> minutes</td>
                </tr>
            </tbody>
        </table>
    </section>
</main>

<?php require_once __DIR__ . '/includes/footer.php'; ?>