<?php
/**
 * FirewallPage — Full admin page for the Firewall module.
 *
 * Tabs: Overview (stat cards + charts), Rules, Logs, IP Management, Settings.
 *
 * @package UltraguardPro\modules\firewall\pages
 */

namespace UltraguardPro\modules\firewall\pages;

use UltraguardPro\Plugin;
use UltraguardPro\modules\core\BasePage;

if ( ! defined( 'ABSPATH' ) ) { exit; }

class FirewallPage extends BasePage {

    public function __construct( Plugin $plugin ) {
        parent::__construct( $plugin );
    }

    public function get_scheme( $context ): array {

        return apply_filters( 'ultraguard_firewall_page_scheme', [
            'type'      => 'page',
            'id'        => 'ultraguard-firewall',
            'page_slug' => 'firewall',
            'class'     => 'ultraguard-firewall-page',
            'header'    => [
                'id'       => 'firewall-header',
                'title'    => __( 'Firewall', 'ultraguard-security-suite' ),
                'subtitle' => __( 'WAF rules, IP management, rate limiting and geo-blocking', 'ultraguard-security-suite' ),
                'actions'  => [
                    $this->create_url_button(
                        __( 'Add Rule', 'ultraguard-security-suite' ),
                        admin_url( 'admin.php?page=ultraguard-security-suite-dashboard&ug_page=firewall-add-rules' ),
                        'primary',
                        'dashicons-plus-alt'
                    ),
                    $this->create_url_button(
                        __( 'Block IP', 'ultraguard-security-suite' ),
                        admin_url( 'admin.php?page=ultraguard-security-suite-dashboard&ug_page=firewall-ip-management' ),
                        'danger',
                        'dashicons-shield-alt'
                    ),
                ],
            ],
            'data' => [
                $this->stats_row(),
                [
                    'type' => 'tabs',
                    'id'   => 'firewall-tabs',
                    'tabs' => [
                        [
                            'id'       => 'overview',
                            'label'    => __( 'Overview', 'ultraguard-security-suite' ),
                            'icon'     => 'dashicons-dashboard',
                            'children' => [ $this->overview_content() ],
                        ],
                        [
                            'id'       => 'rules',
                            'label'    => __( 'Rules', 'ultraguard-security-suite' ),
                            'icon'     => 'dashicons-filter',
                            'children' => [ $this->rules_table() ],
                        ],
                        [
                            'id'       => 'logs',
                            'label'    => __( 'Logs', 'ultraguard-security-suite' ),
                            'icon'     => 'dashicons-list-view',
                            'children' => [ $this->logs_table() ],
                        ],
                        [
                            'id'       => 'ip-management',
                            'label'    => __( 'IP Management', 'ultraguard-security-suite' ),
                            'icon'     => 'dashicons-networking',
                            'children' => [ $this->ip_management_content() ],
                        ],
                        [
                            'id'       => 'settings',
                            'label'    => __( 'Settings', 'ultraguard-security-suite' ),
                            'icon'     => 'dashicons-admin-settings',
                            'children' => [ $this->settings_content() ],
                        ],
                    ],
                ],
            ],
            'form' => [ 'enable' => false ],
        ], $context );
    }

    // ── Stats row ─────────────────────────────────────────────────────────────

    private function stats_row(): array {
        $db        = $this->plugin->modules->get_db_tables();
        $rules_t   = $db ? $db->get_table( 'firewall_rules' )   : null;
        $logs_t    = $db ? $db->get_table( 'firewall_logs' )    : null;
        $blocked_t = $db ? $db->get_table( 'blocked_requests' ) : null;
        $black_t   = $db ? $db->get_table( 'ip_blacklist' )     : null;
        $white_t   = $db ? $db->get_table( 'ip_whitelist' )     : null;

        $active_rules    = $rules_t   ? $rules_t->count( [ 'is_active' => 1 ] )   : 0;
        $total_rules     = $rules_t   ? $rules_t->count()                          : 0;
        $logs_today      = $logs_t    ? $logs_t->count( [ 'created_at >=' => gmdate( 'Y-m-d 00:00:00' ) ] ) : 0;
        $blocked_today   = $blocked_t ? $blocked_t->count( [ 'created_at >=' => gmdate( 'Y-m-d 00:00:00' ) ] ) : 0;
        $blacklisted_ips = $black_t   ? $black_t->count( [ 'is_active' => 1 ] )   : 0;
        $whitelisted_ips = $white_t   ? $white_t->count()                          : 0;

        return [
            'type'       => 'grid',
            'columns'    => 12,
            'gap'        => '16px',
            'responsive' => true,
            'items'      => [
                [
                    'span'       => 4,
                    'responsive' => [ 'sm' => 12, 'md' => 6, 'lg' => 4 ],
                    'component'  => [
                        'type'   => 'stat-card',
                        'title'  => __( 'Active Rules', 'ultraguard-security-suite' ),
                        'value'  => $active_rules,
                        'format' => 'number',
                        'icon'   => 'dashicons-filter',
                        'class'  => 'info',
                        'trend'  => [ 'direction' => 'neutral', 'value' => $total_rules, 'text' => __( 'total', 'ultraguard-security-suite' ) ],
                    ],
                ],
                [
                    'span'       => 4,
                    'responsive' => [ 'sm' => 12, 'md' => 6, 'lg' => 4 ],
                    'component'  => [
                        'type'   => 'stat-card',
                        'title'  => __( 'Blocked Today', 'ultraguard-security-suite' ),
                        'value'  => $blocked_today,
                        'format' => 'number',
                        'icon'   => 'dashicons-dismiss',
                        'class'  => 'danger',
                    ],
                ],
                [
                    'span'       => 4,
                    'responsive' => [ 'sm' => 12, 'md' => 6, 'lg' => 4 ],
                    'component'  => [
                        'type'   => 'stat-card',
                        'title'  => __( 'Requests Today', 'ultraguard-security-suite' ),
                        'value'  => $logs_today,
                        'format' => 'number',
                        'icon'   => 'dashicons-visibility',
                        'class'  => 'info',
                    ],
                ],
                [
                    'span'       => 4,
                    'responsive' => [ 'sm' => 12, 'md' => 6, 'lg' => 4 ],
                    'component'  => [
                        'type'   => 'stat-card',
                        'title'  => __( 'Blacklisted IPs', 'ultraguard-security-suite' ),
                        'value'  => $blacklisted_ips,
                        'format' => 'number',
                        'icon'   => 'dashicons-ban',
                        'class'  => 'warning',
                    ],
                ],
                [
                    'span'       => 4,
                    'responsive' => [ 'sm' => 12, 'md' => 6, 'lg' => 4 ],
                    'component'  => [
                        'type'   => 'stat-card',
                        'title'  => __( 'Whitelisted IPs', 'ultraguard-security-suite' ),
                        'value'  => $whitelisted_ips,
                        'format' => 'number',
                        'icon'   => 'dashicons-yes-alt',
                        'class'  => 'success',
                    ],
                ],
                [
                    'span'       => 4,
                    'responsive' => [ 'sm' => 12, 'md' => 6, 'lg' => 4 ],
                    'component'  => [
                        'type'   => 'stat-card',
                        'title'  => __( 'Total Rules', 'ultraguard-security-suite' ),
                        'value'  => $total_rules,
                        'format' => 'number',
                        'icon'   => 'dashicons-admin-network',
                        'class'  => 'info',
                    ],
                ],
            ],
        ];
    }

    // ── Overview ──────────────────────────────────────────────────────────────

    private function overview_content(): array {
        $db          = $this->plugin->modules->get_db_tables();
        $logs_t      = $db ? $db->get_table( 'firewall_logs' ) : null;
        $chart_data  = $logs_t ? $logs_t->get_chart_data( 'created_at', 'id', 'day', [], 7 ) : [ 'labels' => [], 'data' => [] ];
        $blocked_cdt = $logs_t ? $logs_t->get_chart_data( 'created_at', 'id', 'day', [ 'action' => 'blocked' ], 7 ) : [ 'labels' => [], 'data' => [] ];
        $waf_on      = $this->get_setting( 'firewall_waf_enabled', true );
        $geo_on      = $this->get_setting( 'firewall_geo_blocking', false );
        $rate_on     = $this->get_setting( 'firewall_rate_limiting', true );
        $scan_on     = $this->get_setting( 'firewall_sql_injection_scan', true );

        $db2     = $this->plugin->modules->get_db_tables();
        $black_t = $db2 ? $db2->get_table( 'ip_blacklist' ) : null;
        $recent  = $black_t ? $black_t->get_by( [ 'is_active' => 1 ], 5, 'created_at', 'DESC' ) : [];
        $ip_items = [];
        foreach ( $recent as $row ) {
            $ip_items[] = [
                'icon'  => 'dashicons-ban',
                'text'  => esc_html( $row['ip_address'] ?? '' ),
                'badge' => [
                    'text'       => ucfirst( $row['severity'] ?? 'medium' ),
                    'badge_type' => $this->severity_badge( $row['severity'] ?? 'medium' ),
                ],
            ];
        }
        if ( empty( $ip_items ) ) {
            $ip_items[] = [ 'icon' => 'dashicons-yes-alt', 'text' => __( 'No blocked IPs', 'ultraguard-security-suite' ) ];
        }

        return [
            'type'    => 'grid',
            'columns' => 1,
            'gap'     => '20px',
            'items'   => [
                [
                    'component' => [
                        'type'  => 'card',
                        'title' => __( 'Firewall Traffic (Last 7 Days)', 'ultraguard-security-suite' ),
                        'icon'  => 'dashicons-chart-line',
                        'data'  => [
                            [
                                'type'       => 'chart',
                                'chart_type' => 'line',
                                'height'     => '260px',
                                'labels'     => $chart_data['labels'],
                                'datasets'   => [
                                    [
                                        'label'           => __( 'All Requests', 'ultraguard-security-suite' ),
                                        'data'            => $chart_data['data'],
                                        'borderColor'     => '#3b82f6',
                                        'backgroundColor' => 'rgba(59,130,246,0.1)',
                                        'tension'         => 0.4,
                                        'fill'            => true,
                                    ],
                                    [
                                        'label'           => __( 'Blocked', 'ultraguard-security-suite' ),
                                        'data'            => $blocked_cdt['data'],
                                        'borderColor'     => '#dc2626',
                                        'backgroundColor' => 'rgba(220,38,38,0.1)',
                                        'tension'         => 0.4,
                                        'fill'            => true,
                                    ],
                                ],
                                'security_theme' => true,
                            ],
                        ],
                    ],
                ],
                [
                    'component' => [
                        'type'    => 'grid',
                        'columns' => 2,
                        'gap'     => '20px',
                        'items'   => [
                            [
                                'component' => [
                                    'type'  => 'card',
                                    'title' => __( 'Firewall Status', 'ultraguard-security-suite' ),
                                    'icon'  => 'dashicons-shield-alt',
                                    'badge' => [ 'text' => __( 'Active', 'ultraguard-security-suite' ), 'badge_type' => 'success' ],
                                    'data'  => [
                                        [
                                            'type'      => 'list',
                                            'list_type' => 'ul',
                                            'items'     => [
                                                [ 'icon' => 'dashicons-shield',   'text' => __( 'WAF Engine',       'ultraguard-security-suite' ), 'badge' => [ 'text' => $waf_on  ? __( 'On', 'ultraguard-security-suite' ) : __( 'Off', 'ultraguard-security-suite' ), 'badge_type' => $waf_on  ? 'success' : 'secondary' ] ],
                                                [ 'icon' => 'dashicons-location', 'text' => __( 'Geo Blocking',     'ultraguard-security-suite' ), 'badge' => [ 'text' => $geo_on  ? __( 'On', 'ultraguard-security-suite' ) : __( 'Off', 'ultraguard-security-suite' ), 'badge_type' => $geo_on  ? 'success' : 'secondary' ] ],
                                                [ 'icon' => 'dashicons-clock',    'text' => __( 'Rate Limiting',    'ultraguard-security-suite' ), 'badge' => [ 'text' => $rate_on ? __( 'On', 'ultraguard-security-suite' ) : __( 'Off', 'ultraguard-security-suite' ), 'badge_type' => $rate_on ? 'success' : 'secondary' ] ],
                                                [ 'icon' => 'dashicons-database', 'text' => __( 'SQLi / XSS Scan', 'ultraguard-security-suite' ), 'badge' => [ 'text' => $scan_on ? __( 'On', 'ultraguard-security-suite' ) : __( 'Off', 'ultraguard-security-suite' ), 'badge_type' => $scan_on ? 'success' : 'secondary' ] ],
                                            ],
                                        ],
                                    ],
                                ],
                            ],
                            [
                                'component' => [
                                    'type'  => 'card',
                                    'title' => __( 'Recently Blocked IPs', 'ultraguard-security-suite' ),
                                    'icon'  => 'dashicons-ban',
                                    'data'  => [
                                        [
                                            'type'      => 'list',
                                            'list_type' => 'ul',
                                            'items'     => $ip_items,
                                        ],
                                    ],
                                ],
                            ],
                        ],
                    ],
                ],
            ],
        ];
    }

    // ── Rules data-table ──────────────────────────────────────────────────────

    private function rules_table(): array {
        $db      = $this->plugin->modules->get_db_tables();
        $rules_t = $db ? $db->get_table( 'firewall_rules' ) : null;
        $rows    = $rules_t ? $rules_t->get_by( [], 200, 'priority', 'ASC' ) : [];

        $data = array_map( function( $row ) {
            return [
                'id'            => 'rule-row-' . ( $row['id'] ?? 0 ),
                'data-rule-id'  => (int) ( $row['id'] ?? 0 ),
                'name'          => esc_html( $row['name'] ?? '' ),
                'rule_type'     => [ 'content' => esc_html( $row['rule_type'] ?? '' ), 'class' => 'info' ],
                'match_field'   => esc_html( $row['match_field'] ?? '' ),
                'action'        => [
                    'content' => strtoupper( $row['action'] ?? 'block' ),
                    'class'   => ( $row['action'] ?? 'block' ) === 'block' ? 'danger' : 'info',
                ],
                'hits_count'    => number_format_i18n( (int) ( $row['hits_count'] ?? 0 ) ),
                'priority'      => (int) ( $row['priority'] ?? 100 ),
                'is_active'     => [
                    'content' => $row['is_active'] ? __( 'Active', 'ultraguard-security-suite' ) : __( 'Paused', 'ultraguard-security-suite' ),
                    'class'   => $row['is_active'] ? 'success' : 'secondary',
                ],
            ];
        }, $rows );

        return [
            'type'     => 'data-table',
            'id'       => 'firewall-rules-table',
            'title'    => __( 'Firewall Rules', 'ultraguard-security-suite' ),
            'columns'  => [
                'name'        => [ 'title' => __( 'Name',     'ultraguard-security-suite' ), 'sortable' => true ],
                'rule_type'   => [ 'title' => __( 'Type',     'ultraguard-security-suite' ) ],
                'match_field' => [ 'title' => __( 'Match',    'ultraguard-security-suite' ) ],
                'action'      => [ 'title' => __( 'Action',   'ultraguard-security-suite' ) ],
                'hits_count'  => [ 'title' => __( 'Hits',     'ultraguard-security-suite' ), 'sortable' => true ],
                'priority'    => [ 'title' => __( 'Priority', 'ultraguard-security-suite' ), 'sortable' => true ],
                'is_active'   => [ 'title' => __( 'Status',   'ultraguard-security-suite' ) ],
            ],
            'data'          => $data,
            'searchable'    => true,
            'search_placeholder' => __( 'Search rules…', 'ultraguard-security-suite' ),
            'bulk_actions'  => [
                'bulk_delete' => __( 'Delete Selected', 'ultraguard-security-suite' ),
                'bulk_toggle' => __( 'Toggle Active',   'ultraguard-security-suite' ),
            ],
            'pagination'    => [ 'enabled' => true, 'page_size' => 20 ],
            'empty_state'   => [
                'title'       => __( 'No rules configured', 'ultraguard-security-suite' ),
                'description' => __( 'Click "Add Rule" to create your first firewall rule.', 'ultraguard-security-suite' ),
            ],
        ];
    }

    // ── Logs data-table ───────────────────────────────────────────────────────

    private function logs_table(): array {
        $db     = $this->plugin->modules->get_db_tables();
        $logs_t = $db ? $db->get_table( 'firewall_logs' ) : null;
        $rows   = $logs_t ? $logs_t->get_by( [], 200, 'created_at', 'DESC' ) : [];

        $data = array_map( function( $row ) {
            return [
                'ip_address'     => esc_html( $row['ip_address'] ?? '' ),
                'request_method' => [
                    'content' => esc_html( $row['request_method'] ?? 'GET' ),
                    'class'   => 'info',
                ],
                'request_uri'    => esc_html( substr( $row['request_uri'] ?? '', 0, 80 ) ),
                'action'         => [
                    'content' => strtoupper( $row['action'] ?? 'allowed' ),
                    'class'   => ( $row['action'] ?? 'allowed' ) === 'block' ? 'danger' : 'success',
                ],
                'threat_level'   => [
                    'content' => ucfirst( $row['threat_level'] ?? 'none' ),
                    'class'   => $this->severity_badge( $row['threat_level'] ?? 'none' ),
                ],
                'country_code'   => esc_html( $row['country_code'] ?? '—' ),
                'created_at'     => esc_html( $this->format_date_time( $row['created_at'] ?? '' ) ),
            ];
        }, $rows );

        return [
            'type'       => 'data-table',
            'id'         => 'firewall-logs-table',
            'title'      => __( 'Firewall Logs', 'ultraguard-security-suite' ),
            'columns'    => [
                'ip_address'     => [ 'title' => __( 'IP',      'ultraguard-security-suite' ), 'sortable' => true ],
                'request_method' => [ 'title' => __( 'Method',  'ultraguard-security-suite' ) ],
                'request_uri'    => [ 'title' => __( 'URI',     'ultraguard-security-suite' ) ],
                'action'         => [ 'title' => __( 'Action',  'ultraguard-security-suite' ) ],
                'threat_level'   => [ 'title' => __( 'Threat',  'ultraguard-security-suite' ) ],
                'country_code'   => [ 'title' => __( 'Country', 'ultraguard-security-suite' ) ],
                'created_at'     => [ 'title' => __( 'Time',    'ultraguard-security-suite' ), 'sortable' => true ],
            ],
            'data'        => $data,
            'searchable'  => true,
            'search_placeholder' => __( 'Search logs…', 'ultraguard-security-suite' ),
            'pagination'  => [ 'enabled' => true, 'page_size' => 25 ],
            'empty_state' => [
                'title' => __( 'No log entries', 'ultraguard-security-suite' ),
            ],
        ];
    }

    // ── IP Management ─────────────────────────────────────────────────────────

    private function ip_management_content(): array {
        return [
            'type'    => 'grid',
            'columns' => 2,
            'gap'     => '20px',
            'items'   => [
                [ 'component' => $this->blacklist_card() ],
                [ 'component' => $this->whitelist_card() ],
            ],
        ];
    }

    private function blacklist_card(): array {
        $db      = $this->plugin->modules->get_db_tables();
        $black_t = $db ? $db->get_table( 'ip_blacklist' ) : null;
        $rows    = $black_t ? $black_t->get_by( [ 'is_active' => 1 ], 100, 'created_at', 'DESC' ) : [];

        $data = array_map( function( $row ) {
            return [
                'data-ip-id' => (int) ( $row['id'] ?? 0 ),
                'ip_address' => esc_html( $row['ip_address'] ?? '' ),
                'reason'     => esc_html( $row['reason'] ?? '—' ),
                'severity'   => [
                    'content' => ucfirst( $row['severity'] ?? 'medium' ),
                    'class'   => $this->severity_badge( $row['severity'] ?? 'medium' ),
                ],
                'created_at' => esc_html( $this->format_date_time( $row['created_at'] ?? '' ) ),
            ];
        }, $rows );

        return [
            'type'    => 'card',
            'title'   => __( 'IP Blacklist', 'ultraguard-security-suite' ),
            'icon'    => 'dashicons-ban',
            'actions' => [
                $this->create_url_button( __( 'Block IP', 'ultraguard-security-suite' ), admin_url( 'admin.php?page=ultraguard-security-suite-dashboard&ug_page=firewall-ip-management' ), 'danger', 'dashicons-plus-alt' ),
            ],
            'data'    => [
                [
                    'type'       => 'data-table',
                    'id'         => 'ip-blacklist-table',
                    'columns'    => [
                        'ip_address' => [ 'title' => __( 'IP',       'ultraguard-security-suite' ), 'sortable' => true ],
                        'reason'     => [ 'title' => __( 'Reason',   'ultraguard-security-suite' ) ],
                        'severity'   => [ 'title' => __( 'Severity', 'ultraguard-security-suite' ) ],
                        'created_at' => [ 'title' => __( 'Blocked',  'ultraguard-security-suite' ), 'sortable' => true ],
                    ],
                    'data'        => $data,
                    'searchable'  => true,
                    'pagination'  => [ 'enabled' => true, 'page_size' => 15 ],
                    'bulk_actions'=> [ 'unblock' => __( 'Unblock Selected', 'ultraguard-security-suite' ) ],
                    'empty_state' => [ 'title' => __( 'No blocked IPs', 'ultraguard-security-suite' ) ],
                ],
            ],
        ];
    }

    private function whitelist_card(): array {
        $db      = $this->plugin->modules->get_db_tables();
        $white_t = $db ? $db->get_table( 'ip_whitelist' ) : null;
        $rows    = $white_t ? $white_t->get_by( [], 100, 'created_at', 'DESC' ) : [];

        $data = array_map( function( $row ) {
            return [
                'data-ip-id' => (int) ( $row['id'] ?? 0 ),
                'ip_address' => esc_html( $row['ip_address'] ?? '' ),
                'label'      => esc_html( $row['label'] ?? '—' ),
                'created_at' => esc_html( $this->format_date_time( $row['created_at'] ?? '' ) ),
            ];
        }, $rows );

        return [
            'type'    => 'card',
            'title'   => __( 'IP Whitelist', 'ultraguard-security-suite' ),
            'icon'    => 'dashicons-yes-alt',
            'actions' => [
                $this->create_url_button( __( 'Add IP', 'ultraguard-security-suite' ), admin_url( 'admin.php?page=ultraguard-security-suite-dashboard&ug_page=firewall-ip-management' ), 'primary', 'dashicons-plus-alt' ),
            ],
            'data'    => [
                [
                    'type'        => 'data-table',
                    'id'          => 'ip-whitelist-table',
                    'columns'     => [
                        'ip_address' => [ 'title' => __( 'IP',    'ultraguard-security-suite' ), 'sortable' => true ],
                        'label'      => [ 'title' => __( 'Label', 'ultraguard-security-suite' ) ],
                        'created_at' => [ 'title' => __( 'Added', 'ultraguard-security-suite' ), 'sortable' => true ],
                    ],
                    'data'        => $data,
                    'searchable'  => true,
                    'pagination'  => [ 'enabled' => true, 'page_size' => 15 ],
                    'bulk_actions'=> [ 'remove' => __( 'Remove Selected', 'ultraguard-security-suite' ) ],
                    'empty_state' => [ 'title' => __( 'No whitelisted IPs', 'ultraguard-security-suite' ) ],
                ],
            ],
        ];
    }

    // ── Settings ──────────────────────────────────────────────────────────────

    private function settings_content(): array {
        return [
            'type'       => 'grid',
            'columns'    => 12,
            'gap'        => '20px',
            'responsive' => true,
            'items'      => [
                [
                    'span'       => 6,
                    'responsive' => [ 'md' => 12, 'lg' => 6 ],
                    'component'  => [
                        'type'  => 'card',
                        'title' => __( 'Core WAF Settings', 'ultraguard-security-suite' ),
                        'icon'  => 'dashicons-shield-alt',
                        'data'  => [
                            [ 'type' => 'toggle', 'name' => 'firewall_waf_enabled',         'label' => __( 'Enable WAF',              'ultraguard-security-suite' ), 'description' => __( 'Web Application Firewall protection',         'ultraguard-security-suite' ), 'default' => true  ],
                            [ 'type' => 'toggle', 'name' => 'firewall_sql_injection_scan',  'label' => __( 'Block SQL Injection',      'ultraguard-security-suite' ), 'description' => __( 'Detect and block SQL injection attempts',     'ultraguard-security-suite' ), 'default' => true  ],
                            [ 'type' => 'toggle', 'name' => 'firewall_xss_scan',            'label' => __( 'Block XSS Attacks',        'ultraguard-security-suite' ), 'description' => __( 'Detect cross-site scripting patterns',        'ultraguard-security-suite' ), 'default' => true  ],
                            [ 'type' => 'toggle', 'name' => 'firewall_directory_traversal', 'label' => __( 'Block Directory Traversal','ultraguard-security-suite' ), 'description' => __( 'Block path traversal attack patterns',        'ultraguard-security-suite' ), 'default' => true  ],
                            [ 'type' => 'toggle', 'name' => 'firewall_scan_uploads',        'label' => __( 'Scan File Uploads',        'ultraguard-security-suite' ), 'description' => __( 'Inspect uploaded files for malicious content','ultraguard-security-suite' ), 'default' => false ],
                            [ 'type' => 'select', 'name' => 'firewall_default_action',      'label' => __( 'Default Rule Action',      'ultraguard-security-suite' ),
                              'options' => [ 'block' => __( 'Block', 'ultraguard-security-suite' ), 'log' => __( 'Log Only', 'ultraguard-security-suite' ), 'captcha' => __( 'CAPTCHA Challenge', 'ultraguard-security-suite' ) ],
                              'default' => 'block',
                            ],
                        ],
                    ],
                ],
                [
                    'span'       => 6,
                    'responsive' => [ 'md' => 12, 'lg' => 6 ],
                    'component'  => [
                        'type'  => 'card',
                        'title' => __( 'Rate Limiting', 'ultraguard-security-suite' ),
                        'icon'  => 'dashicons-clock',
                        'data'  => [
                            [ 'type' => 'toggle', 'name' => 'firewall_rate_limiting',        'label' => __( 'Enable Rate Limiting', 'ultraguard-security-suite' ), 'description' => __( 'Throttle IPs exceeding request limits', 'ultraguard-security-suite' ), 'default' => true  ],
                            [ 'type' => 'number', 'name' => 'firewall_rate_limit_requests',  'label' => __( 'Max Requests / Window', 'ultraguard-security-suite' ), 'min' => 10,  'max' => 10000, 'default' => 200 ],
                            [ 'type' => 'number', 'name' => 'firewall_rate_limit_window',    'label' => __( 'Window (seconds)',      'ultraguard-security-suite' ), 'min' => 10,  'max' => 3600,  'default' => 60  ],
                            [ 'type' => 'select', 'name' => 'firewall_rate_limit_action',    'label' => __( 'Action on Limit Hit',   'ultraguard-security-suite' ),
                              'options' => [ 'block' => __( 'Block', 'ultraguard-security-suite' ), 'throttle' => __( 'Throttle (503)', 'ultraguard-security-suite' ), 'captcha' => __( 'CAPTCHA', 'ultraguard-security-suite' ) ],
                              'default' => 'throttle',
                            ],
                        ],
                    ],
                ],
                [
                    'span'       => 6,
                    'responsive' => [ 'md' => 12, 'lg' => 6 ],
                    'component'  => [
                        'type'  => 'card',
                        'title' => __( 'Geo Blocking', 'ultraguard-security-suite' ),
                        'icon'  => 'dashicons-location',
                        'data'  => [
                            [ 'type' => 'toggle',           'name' => 'firewall_geo_blocking', 'label' => __( 'Enable Geo Blocking', 'ultraguard-security-suite' ), 'default' => false ],
                            [ 'type' => 'select',           'name' => 'firewall_geo_mode',      'label' => __( 'Mode', 'ultraguard-security-suite' ),
                              'options' => [ 'blacklist' => __( 'Block listed countries', 'ultraguard-security-suite' ), 'whitelist' => __( 'Allow listed countries only', 'ultraguard-security-suite' ) ],
                              'default' => 'blacklist',
                            ],
                            [ 'type' => 'country-selector', 'name' => 'firewall_geo_countries', 'label' => __( 'Countries', 'ultraguard-security-suite' ) ],
                        ],
                    ],
                ],
                [
                    'span'       => 6,
                    'responsive' => [ 'md' => 12, 'lg' => 6 ],
                    'component'  => [
                        'type'  => 'card',
                        'title' => __( 'Log Retention', 'ultraguard-security-suite' ),
                        'icon'  => 'dashicons-list-view',
                        'data'  => [
                            [ 'type' => 'toggle', 'name' => 'firewall_log_blocked_only',   'label' => __( 'Log Blocked Requests Only', 'ultraguard-security-suite' ), 'description' => __( 'Reduces log volume significantly', 'ultraguard-security-suite' ), 'default' => true ],
                            [ 'type' => 'number', 'name' => 'firewall_log_retention_days', 'label' => __( 'Retention Days',            'ultraguard-security-suite' ), 'description' => __( 'Auto-delete logs older than N days', 'ultraguard-security-suite' ), 'min' => 1, 'max' => 365, 'default' => 30 ],
                        ],
                        'footer' => [
                            'type'      => 'button-group',
                            'alignment' => 'right',
                            'buttons'   => [
                                $this->create_ajax_button(
                                    __( 'Save Settings', 'ultraguard-security-suite' ),
                                    'ultraguard_save_firewall_settings',
                                    [],
                                    'primary',
                                    'dashicons-saved'
                                ),
                            ],
                        ],
                    ],
                ],
            ],
        ];
    }

    // ── Helper ────────────────────────────────────────────────────────────────

    private function severity_badge( string $sev ): string {
        return match ( strtolower( $sev ) ) {
            'critical', 'high'  => 'danger',
            'medium'            => 'warning',
            'low', 'none'       => 'secondary',
            default             => 'info',
        };
    }
}
