<?php
/**
 * FirewallIpManagement — IP Blacklist + Whitelist management page.
 *
 * Features:
 *   • Tabbed view: Blacklist | Whitelist | CIDR Ranges | Geo Intelligence
 *   • Add single IP / bulk import / CIDR range
 *   • Quick unblock / whitelist actions
 *   • Geo data enrichment per IP (country, ISP, proxy flag)
 *   • Import / export both lists as CSV or JSON
 *   • Auto-expired entries indicator
 *
 * @package UltraguardPro\modules\firewall\pages
 */

namespace UltraguardPro\modules\firewall\pages;

use UltraguardPro\Plugin;
use UltraguardPro\modules\core\BasePage;

if ( ! defined( 'ABSPATH' ) ) { exit; }

class FirewallIpManagement extends BasePage {

    public function __construct( Plugin $plugin ) {
        parent::__construct( $plugin );
    }

    private function import_ips_modal(): array {
        return [
            'id'      => 'fw-import-ips',
            'title'   => __( 'Import IP Addresses', 'ultraguard-security-suite' ),
            'size'    => 'large',
            'content' => $this->modal_content( [
                [
                    'type'    => 'select',
                    'name'    => 'list_target',
                    'label'   => __( 'Import To', 'ultraguard-security-suite' ),
                    'value'   => 'blocked',
                    'options' => [
                        'blocked' => __( 'Blacklist', 'ultraguard-security-suite' ),
                        'allowed' => __( 'Whitelist', 'ultraguard-security-suite' ),
                    ],
                ],
                [
                    'type'        => 'textarea',
                    'name'        => 'ip_list',
                    'label'       => __( 'IP Addresses', 'ultraguard-security-suite' ),
                    'rows'        => 10,
                    'placeholder' => "203.0.113.10\n198.51.100.25\n10.0.0.0/8",
                    'description' => __( 'Enter one IP or CIDR range per line. You can also paste comma-separated values.', 'ultraguard-security-suite' ),
                ],
                [
                    'type'        => 'text',
                    'name'        => 'bulk_reason',
                    'label'       => __( 'Blacklist Reason', 'ultraguard-security-suite' ),
                    'value'       => '',
                    'placeholder' => __( 'e.g. Abuse reports, manual review', 'ultraguard-security-suite' ),
                ],
                [
                    'type'    => 'select',
                    'name'    => 'bulk_severity',
                    'label'   => __( 'Blacklist Severity', 'ultraguard-security-suite' ),
                    'value'   => 'medium',
                    'options' => [
                        'low'      => __( 'Low', 'ultraguard-security-suite' ),
                        'medium'   => __( 'Medium', 'ultraguard-security-suite' ),
                        'high'     => __( 'High', 'ultraguard-security-suite' ),
                        'critical' => __( 'Critical', 'ultraguard-security-suite' ),
                    ],
                ],
                [
                    'type'        => 'text',
                    'name'        => 'whitelist_label',
                    'label'       => __( 'Whitelist Label', 'ultraguard-security-suite' ),
                    'value'       => '',
                    'placeholder' => __( 'e.g. Office network, trusted admin IP', 'ultraguard-security-suite' ),
                ],
            ] ),
            'footer'  => $this->modal_footer_save( 'ultraguard_firewall_import_ips' ),
        ];
    }

    public function get_scheme( $context ): array {
        $db      = $this->plugin->modules->get_db_tables();
        $bl_t    = $db ? $db->get_table( 'ip_blacklist' )     : null;
        $wl_t    = $db ? $db->get_table( 'ip_whitelist' )     : null;
        $geo_t   = $db ? $db->get_table( 'geolocation_data' ) : null;
        $nonce   = $this->create_nonce( 'ultraguard_admin_nonce' );

        $add_blacklist_modal = [
            'id'      => 'fw-add-blacklist',
            'title'   => __( 'Block IP Address', 'ultraguard-security-suite' ),
            'size'    => 'medium',
            'content' => $this->modal_content( [
                [ 'type' => 'text',   'name' => 'ip_address', 'label' => __( 'IP Address', 'ultraguard-security-suite' ), 'value' => '', 'placeholder' => __( 'e.g. 203.0.113.55 or 10.0.0.0/8', 'ultraguard-security-suite' ) ],
                [ 'type' => 'text',   'name' => 'reason',     'label' => __( 'Reason', 'ultraguard-security-suite' ), 'value' => '', 'placeholder' => __( 'Why is this IP being blocked?', 'ultraguard-security-suite' ) ],
                [ 'type' => 'select', 'name' => 'severity',   'label' => __( 'Severity', 'ultraguard-security-suite' ), 'value' => 'high', 'options' => [ 'low' => __( 'Low', 'ultraguard-security-suite' ), 'medium' => __( 'Medium', 'ultraguard-security-suite' ), 'high' => __( 'High', 'ultraguard-security-suite' ), 'critical' => __( 'Critical', 'ultraguard-security-suite' ) ] ],
                [ 'type' => 'text',   'name' => 'expires_at', 'label' => __( 'Expires At (UTC)', 'ultraguard-security-suite' ), 'value' => '', 'placeholder' => __( 'YYYY-MM-DD HH:MM:SS — blank = permanent', 'ultraguard-security-suite' ) ],
            ] ),
            'footer'  => $this->modal_footer_save( 'ultraguard_firewall_block_ip' ),
        ];

        $add_whitelist_modal = [
            'id'      => 'fw-add-whitelist',
            'title'   => __( 'Add Trusted IP', 'ultraguard-security-suite' ),
            'size'    => 'small',
            'content' => $this->modal_content( [
                [ 'type' => 'text', 'name' => 'ip_address', 'label' => __( 'IP Address', 'ultraguard-security-suite' ), 'value' => '', 'placeholder' => __( 'e.g. 203.0.113.55 or 192.168.1.0/24', 'ultraguard-security-suite' ) ],
                [ 'type' => 'text', 'name' => 'label',      'label' => __( 'Label', 'ultraguard-security-suite' ), 'value' => '', 'placeholder' => __( 'e.g. Office IP, Admin workstation', 'ultraguard-security-suite' ) ],
            ] ),
            'footer'  => $this->modal_footer_save( 'ultraguard_firewall_add_whitelist' ),
        ];

        // ── Counts ──────────────────────────────────────────────────────────
        $total_bl    = $bl_t ? $bl_t->count( [ 'is_active' => 1 ] )      : 0;
        $total_wl    = $wl_t ? $wl_t->count()                              : 0;
        $auto_bl     = $bl_t ? $bl_t->count( [ 'source' => 'auto', 'is_active' => 1 ] )       : 0;
        $manual_bl   = $bl_t ? $bl_t->count( [ 'source' => 'manual', 'is_active' => 1 ] )     : 0;
        $rep_bl      = $bl_t ? $bl_t->count( [ 'source' => 'reputation', 'is_active' => 1 ] ) : 0;

        // ── Blacklist rows ───────────────────────────────────────────────────
        $bl_rows = $bl_t ? $bl_t->get_by( [ 'is_active' => 1 ], 500, 'created_at', 'DESC' ) : [];
        $bl_data = array_map( function( array $r ) use ( $nonce ): array {
            $id      = (int) ( $r['id'] ?? 0 );
            $ip      = esc_html( $r['ip_address'] ?? '' );
            $expires = ! empty( $r['expires_at'] ) ? $this->format_date_time( $r['expires_at'] ) : __( 'Never', 'ultraguard-security-suite' );

            // View modal
            $view_modal = [
                'id'      => 'fw-view-bl-' . $id,
                /* translators: %s: string */
                'title'   => sprintf( __( 'Blocked IP: %s', 'ultraguard-security-suite' ), $ip ),
                'size'    => 'medium',
                'content' => $this->modal_content( [
                    [ 'type' => 'text', 'name' => 'vbl_ip',  'label' => __( 'IP Address',  'ultraguard-security-suite' ), 'value' => $ip,                                                             'readonly' => true ],
                    [ 'type' => 'text', 'name' => 'vbl_rng', 'label' => __( 'CIDR Range',  'ultraguard-security-suite' ), 'value' => esc_html( $r['ip_range']   ?? '—' ),                             'readonly' => true ],
                    [ 'type' => 'text', 'name' => 'vbl_rsn', 'label' => __( 'Reason',      'ultraguard-security-suite' ), 'value' => esc_html( $r['reason']     ?? '—' ),                             'readonly' => true ],
                    [ 'type' => 'text', 'name' => 'vbl_src', 'label' => __( 'Source',      'ultraguard-security-suite' ), 'value' => esc_html( ucfirst( $r['source'] ?? 'manual' ) ),                 'readonly' => true ],
                    [ 'type' => 'text', 'name' => 'vbl_sev', 'label' => __( 'Severity',    'ultraguard-security-suite' ), 'value' => esc_html( ucfirst( $r['severity'] ?? 'medium' ) ),               'readonly' => true ],
                    [ 'type' => 'text', 'name' => 'vbl_hit', 'label' => __( 'Hits',        'ultraguard-security-suite' ), 'value' => number_format_i18n( (int) ( $r['hits_count'] ?? 0 ) ),           'readonly' => true ],
                    [ 'type' => 'text', 'name' => 'vbl_exp', 'label' => __( 'Expires',     'ultraguard-security-suite' ), 'value' => esc_html( $expires ),                                             'readonly' => true ],
                    [ 'type' => 'text', 'name' => 'vbl_dt',  'label' => __( 'Blocked At',  'ultraguard-security-suite' ), 'value' => esc_html( $this->format_date_time( $r['created_at'] ?? '' ) ),   'readonly' => true ],
                ] ),
            ];

            // Edit modal
            $edit_modal = [
                'id'      => 'fw-edit-bl-' . $id,
                /* translators: %s: string */
                'title'   => sprintf( __( 'Edit Block: %s', 'ultraguard-security-suite' ), $ip ),
                'size'    => 'medium',
                'content' => $this->modal_content( [
                    [ 'type' => 'text',   'name' => 'ip_address', 'label' => __( 'IP Address',       'ultraguard-security-suite' ), 'value' => $ip,                                 'readonly' => true ],
                    [ 'type' => 'text',   'name' => 'reason',     'label' => __( 'Reason',           'ultraguard-security-suite' ), 'value' => esc_html( $r['reason'] ?? '' ),       'placeholder' => __( 'Why is this IP blocked?', 'ultraguard-security-suite' ) ],
                    [ 'type' => 'select', 'name' => 'severity',   'label' => __( 'Severity',         'ultraguard-security-suite' ), 'value' => esc_attr( $r['severity'] ?? 'medium' ), 'options' => [ 'low' => __( 'Low', 'ultraguard-security-suite' ), 'medium' => __( 'Medium', 'ultraguard-security-suite' ), 'high' => __( 'High', 'ultraguard-security-suite' ), 'critical' => __( 'Critical', 'ultraguard-security-suite' ) ] ],
                    [ 'type' => 'text',   'name' => 'expires_at', 'label' => __( 'Expires At (UTC)', 'ultraguard-security-suite' ), 'value' => esc_html( $r['expires_at'] ?? '' ),   'placeholder' => __( 'YYYY-MM-DD HH:MM:SS — blank = permanent', 'ultraguard-security-suite' ) ],
                ] ),
                'footer' => $this->modal_footer_save( 'ultraguard_firewall_edit_blacklist', [ 'blacklist_id' => $id ] ),
            ];

            return [
                'id'          => 'ug-fw-blacklist-row-' . $id,
                'data-ip-id'  => $id,
                'ip_address'  => $ip,
                'ip_range'    => esc_html( $r['ip_range']  ?? '—' ),
                'reason'      => esc_html( $r['reason']    ?? '—' ),
                'source'      => [ 'content' => ucfirst( $r['source'] ?? 'manual' ),   'class' => $this->source_badge( $r['source'] ?? 'manual' ) ],
                'severity'    => [ 'content' => ucfirst( $r['severity'] ?? 'medium' ), 'class' => $this->severity_badge( $r['severity'] ?? 'medium' ) ],
                'hits'        => number_format_i18n( (int) ( $r['hits_count'] ?? 0 ) ),
                'expires'     => esc_html( $expires ),
                'created_at'  => esc_html( $this->format_date_time( $r['created_at'] ?? '' ) ),
                'actions'     => $this->row_actions( [
                    [ 'type' => 'button', 'text' => '', 'icon' => 'dashicons-visibility', 'button_style' => 'secondary', 'title' => __( 'View details',   'ultraguard-security-suite' ), 'modal' => $view_modal ],
                    [ 'type' => 'button', 'text' => '', 'icon' => 'dashicons-edit',       'button_style' => 'primary',   'title' => __( 'Edit',           'ultraguard-security-suite' ), 'modal' => $edit_modal ],
                    [ 'type' => 'button', 'text' => '', 'icon' => 'dashicons-unlock',     'button_style' => 'warning',   'title' => __( 'Unblock IP',     'ultraguard-security-suite' ),
                      /* translators: %s: string */
                      'ajax' => [ 'action' => 'ultraguard_firewall_unblock_ip', 'data' => [ 'blacklist_id' => $id, 'ip_address' => $ip ], 'confirm' => sprintf( __( 'Unblock %s?', 'ultraguard-security-suite' ), $ip ) ] ],
                    [ 'type' => 'button', 'text' => '', 'icon' => 'dashicons-trash',      'button_style' => 'danger',    'title' => __( 'Delete record',  'ultraguard-security-suite' ),
                      /* translators: %s: string */
                      'ajax' => [ 'action' => 'ultraguard_firewall_delete_blacklist_ip', 'data' => [ 'blacklist_id' => $id ], 'confirm' => sprintf( __( 'Delete blacklist record for %s?', 'ultraguard-security-suite' ), $ip ) ] ],
                ] ),
            ];
        }, $bl_rows );

        // ── Whitelist rows ───────────────────────────────────────────────────
        $wl_rows = $wl_t ? $wl_t->get_by( [], 500, 'created_at', 'DESC' ) : [];
        $wl_data = array_map( function( array $r ) use ( $nonce ): array {
            $id = (int) ( $r['id'] ?? 0 );
            $ip = esc_html( $r['ip_address'] ?? '' );

            $view_modal = [
                'id'      => 'fw-view-wl-' . $id,
                /* translators: %s: string */
                'title'   => sprintf( __( 'Trusted IP: %s', 'ultraguard-security-suite' ), $ip ),
                'size'    => 'small',
                'content' => $this->modal_content( [
                    [ 'type' => 'text', 'name' => 'vwl_ip',  'label' => __( 'IP Address', 'ultraguard-security-suite' ), 'value' => $ip,                                                            'readonly' => true ],
                    [ 'type' => 'text', 'name' => 'vwl_rng', 'label' => __( 'CIDR Range', 'ultraguard-security-suite' ), 'value' => esc_html( $r['ip_range']  ?? '—' ),                             'readonly' => true ],
                    [ 'type' => 'text', 'name' => 'vwl_lbl', 'label' => __( 'Label',      'ultraguard-security-suite' ), 'value' => esc_html( $r['label']     ?? '—' ),                             'readonly' => true ],
                    [ 'type' => 'text', 'name' => 'vwl_sts', 'label' => __( 'Status',     'ultraguard-security-suite' ), 'value' => (bool) ( $r['is_active'] ?? 1 ) ? __( 'Active', 'ultraguard-security-suite' ) : __( 'Disabled', 'ultraguard-security-suite' ), 'readonly' => true ],
                    [ 'type' => 'text', 'name' => 'vwl_dt',  'label' => __( 'Added At',   'ultraguard-security-suite' ), 'value' => esc_html( $this->format_date_time( $r['created_at'] ?? '' ) ), 'readonly' => true ],
                ] ),
            ];

            $edit_modal = [
                'id'      => 'fw-edit-wl-' . $id,
                /* translators: %s: string */
                'title'   => sprintf( __( 'Edit Trusted IP: %s', 'ultraguard-security-suite' ), $ip ),
                'size'    => 'small',
                'content' => $this->modal_content( [
                    [ 'type' => 'text',   'name' => 'ip_address', 'label' => __( 'IP Address', 'ultraguard-security-suite' ), 'value' => $ip, 'readonly' => true ],
                    [ 'type' => 'text',   'name' => 'label',      'label' => __( 'Label',      'ultraguard-security-suite' ), 'value' => esc_html( $r['label'] ?? '' ), 'placeholder' => __( 'e.g. Office IP, Admin workstation', 'ultraguard-security-suite' ) ],
                    [ 'type' => 'toggle', 'name' => 'is_active',  'label' => __( 'Active',     'ultraguard-security-suite' ), 'value' => (bool) ( $r['is_active'] ?? 1 ) ? '1' : '0' ],
                ] ),
                'footer' => $this->modal_footer_save( 'ultraguard_firewall_edit_whitelist', [ 'whitelist_id' => $id ] ),
            ];

            return [
                'id'         => 'ug-fw-whitelist-row-' . $id,
                'data-ip-id' => $id,
                'ip_address' => $ip,
                'ip_range'   => esc_html( $r['ip_range']  ?? '—' ),
                'label'      => esc_html( $r['label']     ?? '—' ),
                'status'     => [ 'content' => $r['is_active'] ? __( 'Active', 'ultraguard-security-suite' ) : __( 'Disabled', 'ultraguard-security-suite' ), 'class' => $r['is_active'] ? 'success' : 'secondary' ],
                'created_at' => esc_html( $this->format_date_time( $r['created_at'] ?? '' ) ),
                'actions'    => $this->row_actions( [
                    [ 'type' => 'button', 'text' => '', 'icon' => 'dashicons-visibility', 'button_style' => 'secondary', 'title' => __( 'View details',        'ultraguard-security-suite' ), 'modal' => $view_modal ],
                    [ 'type' => 'button', 'text' => '', 'icon' => 'dashicons-edit',       'button_style' => 'primary',   'title' => __( 'Edit',                'ultraguard-security-suite' ), 'modal' => $edit_modal ],
                    [ 'type' => 'button', 'text' => '', 'icon' => 'dashicons-no-alt',     'button_style' => 'danger',    'title' => __( 'Remove from whitelist', 'ultraguard-security-suite' ),
                      /* translators: %s: string */
                      'ajax' => [ 'action' => 'ultraguard_firewall_remove_whitelist', 'data' => [ 'whitelist_id' => $id ], 'confirm' => sprintf( __( 'Remove %s from whitelist?', 'ultraguard-security-suite' ), $ip ) ] ],
                ] ),
            ];
        }, $wl_rows );

        // ── Geo intelligence rows ────────────────────────────────────────────
        $geo_rows = $geo_t ? $geo_t->get_by( [], 200, 'cached_at', 'DESC' ) : [];
        $geo_data = array_map( function( array $r ): array {
            return [
                'ip_address'   => esc_html( $r['ip_address']   ?? '' ),
                'country'      => esc_html( ( $r['country_code'] ?? '—' ) . ' ' . ( $r['country_name'] ?? '' ) ),
                'isp'          => esc_html( $r['isp']           ?? '—' ),
                'is_proxy'     => [ 'content' => $r['is_proxy']      ? __( 'Yes', 'ultraguard-security-suite' ) : __( 'No', 'ultraguard-security-suite' ), 'class' => $r['is_proxy']      ? 'danger' : 'success' ],
                'is_tor'       => [ 'content' => $r['is_tor']        ? __( 'Yes', 'ultraguard-security-suite' ) : __( 'No', 'ultraguard-security-suite' ), 'class' => $r['is_tor']        ? 'danger' : 'success' ],
                'threat_score' => [ 'content' => (int) ( $r['threat_score'] ?? 0 ) . '/100', 'class' => (int)( $r['threat_score'] ?? 0 ) > 70 ? 'danger' : ( (int)( $r['threat_score'] ?? 0 ) > 30 ? 'warning' : 'success' ) ],
                'cached_at'    => esc_html( $this->format_date_time( $r['cached_at'] ?? '' ) ),
            ];
        }, $geo_rows );

        return apply_filters( 'ultraguard_firewall_ip_management_scheme', [
            'type'      => 'page',
            'id'        => 'ultraguard-firewall-ip-management',
            'page_slug' => 'firewall-ip-management',
            'class'     => 'ultraguard-firewall-ip-management-page',

            'header' => [
                'title'    => __( 'IP Management', 'ultraguard-security-suite' ),
                'subtitle' => __( 'Manage IP blacklists, whitelists, CIDR ranges and geo intelligence data', 'ultraguard-security-suite' ),
                /* translators: %d: integer */
                'badge'    => [ 'text' => sprintf( __( '%d Blocked IPs', 'ultraguard-security-suite' ), $total_bl ), 'badge_type' => $total_bl > 0 ? 'danger' : 'success' ],
                'actions'  => [
                    [ 'type' => 'button', 'text' => __( 'Block IP', 'ultraguard-security-suite' ), 'button_style' => 'danger', 'icon' => 'dashicons-dismiss', 'modal' => $add_blacklist_modal ],
                    [ 'type' => 'button', 'text' => __( 'Whitelist IP', 'ultraguard-security-suite' ), 'button_style' => 'primary', 'icon' => 'dashicons-yes-alt', 'modal' => $add_whitelist_modal ],
                    [ 'type' => 'button', 'text' => __( 'Import IPs', 'ultraguard-security-suite' ), 'button_style' => 'secondary', 'icon' => 'dashicons-upload', 'modal' => $this->import_ips_modal() ],
                    $this->create_ajax_button( __( 'Export IPs', 'ultraguard-security-suite' ), 'ultraguard_export_ips',              [], 'secondary', 'dashicons-download' ),
                ],
            ],

            'data' => [

                // ── Stat cards ───────────────────────────────────────────────
                [
                    'type'    => 'grid',
                    'columns' => 12,
                    'gap'     => '16px',
                    'items'   => [
                        [ 'span' => 3, 'component' => [ 'type' => 'stat-card', 'title' => __( 'Blacklisted',    'ultraguard-security-suite' ), 'value' => $total_bl,  'format' => 'number', 'icon' => 'dashicons-dismiss',   'class' => $total_bl  > 0 ? 'danger'  : 'success' ] ],
                        [ 'span' => 3, 'component' => [ 'type' => 'stat-card', 'title' => __( 'Whitelisted',    'ultraguard-security-suite' ), 'value' => $total_wl,  'format' => 'number', 'icon' => 'dashicons-yes-alt',   'class' => 'success' ] ],
                        [ 'span' => 3, 'component' => [ 'type' => 'stat-card', 'title' => __( 'Auto-Blocked',   'ultraguard-security-suite' ), 'value' => $auto_bl,   'format' => 'number', 'icon' => 'dashicons-shield',    'class' => $auto_bl   > 0 ? 'warning' : 'success' ] ],
                        [ 'span' => 3, 'component' => [ 'type' => 'stat-card', 'title' => __( 'Manual Blocks',  'ultraguard-security-suite' ), 'value' => $manual_bl, 'format' => 'number', 'icon' => 'dashicons-admin-users','class' => 'info' ] ],
                        [ 'span' => 3, 'component' => [ 'type' => 'stat-card', 'title' => __( 'From Feed',      'ultraguard-security-suite' ), 'value' => $rep_bl,    'format' => 'number', 'icon' => 'dashicons-rss',       'class' => 'info' ] ],
                        [ 'span' => 3, 'component' => [ 'type' => 'stat-card', 'title' => __( 'Geo Cached',     'ultraguard-security-suite' ), 'value' => count( $geo_rows ), 'format' => 'number', 'icon' => 'dashicons-location-alt', 'class' => 'info' ] ],
                    ],
                ],

                // ── Tabs: Blacklist | Whitelist | Geo ────────────────────────
                [
                    'type' => 'tabs',
                    'id'   => 'ip-management-tabs',
                    'tabs' => [

                        // ── Tab 1: Blacklist ───────────────────────────────
                        [
                            'id'       => 'blacklist',
                            'title'    => __( 'Blacklist', 'ultraguard-security-suite' ),
                            'icon'     => 'dashicons-dismiss',
                            'badge'    => $total_bl,
                            'data' => [ [
                                'type'  => 'card',
                                'title' => __( 'Blocked IP Addresses', 'ultraguard-security-suite' ),
                                'icon'  => 'dashicons-dismiss',
                                'actions' => [
                                    [ 'type' => 'button', 'text' => __( 'Block IP', 'ultraguard-security-suite' ), 'button_style' => 'danger', 'icon' => 'dashicons-plus-alt', 'modal' => $add_blacklist_modal ],
                                    $this->create_ajax_button( __( 'Clear Expired',  'ultraguard-security-suite' ), 'ultraguard_clear_expired_ips',   [], 'secondary', 'dashicons-trash'       ),
                                    $this->create_ajax_button( __( 'Export',         'ultraguard-security-suite' ), 'ultraguard_export_ips',          [ 'list' => 'blacklist' ], 'secondary', 'dashicons-download' ),
                                ],
                                'data' => [ [
                                    'type'         => 'data-table',
                                    'id'           => 'ip-blacklist-table',
                                    'columns'      => [
                                        'ip_address' => [ 'title' => __( 'IP Address', 'ultraguard-security-suite' ), 'sortable' => true ],
                                        'ip_range'   => [ 'title' => __( 'CIDR Range', 'ultraguard-security-suite' ) ],
                                        'reason'     => [ 'title' => __( 'Reason',     'ultraguard-security-suite' ) ],
                                        'source'     => [ 'title' => __( 'Source',     'ultraguard-security-suite' ) ],
                                        'severity'   => [ 'title' => __( 'Severity',   'ultraguard-security-suite' ) ],
                                        'hits'       => [ 'title' => __( 'Hits',       'ultraguard-security-suite' ), 'sortable' => true ],
                                        'expires'    => [ 'title' => __( 'Expires',    'ultraguard-security-suite' ) ],
                                        'created_at' => [ 'title' => __( 'Blocked At', 'ultraguard-security-suite' ), 'sortable' => true ],
                                        'actions'    => [ 'title' => __( 'Actions',    'ultraguard-security-suite' ), 'width' => '130px' ],
                                    ],
                                    'data'         => $bl_data,
                                    'searchable'   => true,
                                    'bulk_actions' => [
                                        'unblock_ip'  => __( 'Unblock Selected',   'ultraguard-security-suite' ),
                                        'whitelist_ip'=> __( 'Move to Whitelist',  'ultraguard-security-suite' ),
                                        'delete'      => __( 'Delete Records',     'ultraguard-security-suite' ),
                                    ],
                                    'pagination'   => [ 'enabled' => true, 'page_size' => 25 ],
                                    'empty_state'  => [
                                        'title'       => __( 'Blacklist is empty', 'ultraguard-security-suite' ),
                                        'description' => __( 'No IPs are currently blocked. The firewall will add IPs here automatically when attacks are detected.', 'ultraguard-security-suite' ),
                                    ],
                                ] ],
                            ] ],
                        ],

                        // ── Tab 2: Whitelist ───────────────────────────────
                        [
                            'id'       => 'whitelist',
                            'title'    => __( 'Whitelist', 'ultraguard-security-suite' ),
                            'icon'     => 'dashicons-yes-alt',
                            'badge'    => $total_wl,
                            'data' => [ [
                                'type'  => 'card',
                                'title' => __( 'Trusted IP Addresses', 'ultraguard-security-suite' ),
                                'icon'  => 'dashicons-yes-alt',
                                'actions' => [
                                    [ 'type' => 'button', 'text' => __( 'Add IP', 'ultraguard-security-suite' ), 'button_style' => 'primary', 'icon' => 'dashicons-plus-alt', 'modal' => $add_whitelist_modal ],
                                    $this->create_ajax_button( __( 'Export',  'ultraguard-security-suite' ), 'ultraguard_export_ips',            [ 'list' => 'whitelist' ], 'secondary', 'dashicons-download' ),
                                ],
                                'data' => [ [
                                    'type'         => 'data-table',
                                    'id'           => 'ip-whitelist-table',
                                    'columns'      => [
                                        'ip_address' => [ 'title' => __( 'IP Address', 'ultraguard-security-suite' ), 'sortable' => true ],
                                        'ip_range'   => [ 'title' => __( 'CIDR Range', 'ultraguard-security-suite' ) ],
                                        'label'      => [ 'title' => __( 'Label',      'ultraguard-security-suite' ) ],
                                        'status'     => [ 'title' => __( 'Status',     'ultraguard-security-suite' ) ],
                                        'created_at' => [ 'title' => __( 'Added At',   'ultraguard-security-suite' ), 'sortable' => true ],
                                        'actions'    => [ 'title' => __( 'Actions',    'ultraguard-security-suite' ), 'width' => '110px' ],
                                    ],
                                    'data'         => $wl_data,
                                    'searchable'   => true,
                                    'bulk_actions' => [
                                        'remove_whitelist' => __( 'Remove Selected', 'ultraguard-security-suite' ),
                                        'blacklist_ip'     => __( 'Move to Blacklist', 'ultraguard-security-suite' ),
                                    ],
                                    'pagination'   => [ 'enabled' => true, 'page_size' => 25 ],
                                    'empty_state'  => [
                                        'title'       => __( 'Whitelist is empty', 'ultraguard-security-suite' ),
                                        'description' => __( 'Add trusted IPs (e.g. your own office) to prevent them from ever being blocked.', 'ultraguard-security-suite' ),
                                    ],
                                ] ],
                            ] ],
                        ],

                        // ── Tab 3: Geo Intelligence ────────────────────────
                        [
                            'id'       => 'geo-intel',
                            'title'    => __( 'Geo Intelligence', 'ultraguard-security-suite' ),
                            'icon'     => 'dashicons-location-alt',
                            'data' => [
                                [
                                    'type'    => 'grid',
                                    'columns' => 12,
                                    'gap'     => '20px',
                                    'items'   => [
                                        [
                                            'span'      => 8,
                                            'component' => [
                                                'type'    => 'card',
                                                'title'   => __( 'Geo-Enriched IP Cache', 'ultraguard-security-suite' ),
                                                'icon'    => 'dashicons-location-alt',
                                                'actions' => [
                                                    $this->create_ajax_button( __( 'Clear Geo Cache', 'ultraguard-security-suite' ), 'ultraguard_clear_firewall_cache', [ 'type' => 'geo' ], 'secondary', 'dashicons-trash' ),
                                                ],
                                                'data' => [ [
                                                    'type'       => 'data-table',
                                                    'id'         => 'geo-intel-table',
                                                    'columns'    => [
                                                        'ip_address'   => [ 'title' => __( 'IP Address',    'ultraguard-security-suite' ), 'sortable' => true ],
                                                        'country'      => [ 'title' => __( 'Country',       'ultraguard-security-suite' ) ],
                                                        'isp'          => [ 'title' => __( 'ISP',           'ultraguard-security-suite' ) ],
                                                        'is_proxy'     => [ 'title' => __( 'Proxy/VPN',     'ultraguard-security-suite' ) ],
                                                        'is_tor'       => [ 'title' => __( 'Tor Node',      'ultraguard-security-suite' ) ],
                                                        'threat_score' => [ 'title' => __( 'Threat Score',  'ultraguard-security-suite' ), 'sortable' => true ],
                                                        'cached_at'    => [ 'title' => __( 'Cached',        'ultraguard-security-suite' ), 'sortable' => true ],
                                                    ],
                                                    'data'         => $geo_data,
                                                    'searchable'   => true,
                                                    'pagination'   => [ 'enabled' => true, 'page_size' => 20 ],
                                                    'empty_state'  => [
                                                        'title'       => __( 'No geo data cached', 'ultraguard-security-suite' ),
                                                        'description' => __( 'Geo data is cached when visitors are checked by the firewall.', 'ultraguard-security-suite' ),
                                                    ],
                                                ] ],
                                            ],
                                        ],
                                        [
                                            'span'      => 4,
                                            'component' => [
                                                'type'  => 'card',
                                                'title' => __( 'Lookup IP', 'ultraguard-security-suite' ),
                                                'icon'  => 'dashicons-search',
                                                'data'  => [
                                                    [ 'type' => 'text', 'name' => 'lookup_ip', 'label' => __( 'IP Address', 'ultraguard-security-suite' ), 'placeholder' => '1.2.3.4' ],
                                                ],
                                                'footer' => [
                                                    'type'      => 'button-group',
                                                    'alignment' => 'right',
                                                    'buttons'   => [
                                                        $this->create_ajax_button( __( 'Lookup',     'ultraguard-security-suite' ), 'ultraguard_scan_ip_logs',       [], 'primary',   'dashicons-search'  ),
                                                        [ 'type' => 'button', 'text' => __( 'Block IP', 'ultraguard-security-suite' ), 'button_style' => 'danger', 'icon' => 'dashicons-dismiss', 'modal' => $add_blacklist_modal ],
                                                        [ 'type' => 'button', 'text' => __( 'Whitelist', 'ultraguard-security-suite' ), 'button_style' => 'success', 'icon' => 'dashicons-yes', 'modal' => $add_whitelist_modal ],
                                                    ],
                                                ],
                                            ],
                                        ],
                                    ],
                                ],
                            ],
                        ],

                        // ── Tab 4: Bulk Import / Export ────────────────────
                        [
                            'id'       => 'bulk-import',
                            'title'    => __( 'Bulk Import', 'ultraguard-security-suite' ),
                            'icon'     => 'dashicons-upload',
                            'data' => [ [
                                'type'    => 'grid',
                                'columns' => 12,
                                'gap'     => '20px',
                                'items'   => [
                                    [
                                        'span'      => 6,
                                        'component' => [
                                            'type'  => 'card',
                                            'title' => __( 'Bulk Block IPs', 'ultraguard-security-suite' ),
                                            'icon'  => 'dashicons-dismiss',
                                            'data'  => [
                                                [ 'type' => 'textarea', 'name' => 'ip_list', 'label' => __( 'IP Addresses (one per line)', 'ultraguard-security-suite' ), 'rows' => 10, 'placeholder' => "1.2.3.4\n5.6.7.8\n10.0.0.0/8" ],
                                                [ 'type' => 'select',   'name' => 'bulk_severity', 'label' => __( 'Severity', 'ultraguard-security-suite' ), 'options' => [ 'low' => __( 'Low', 'ultraguard-security-suite' ), 'medium' => __( 'Medium', 'ultraguard-security-suite' ), 'high' => __( 'High', 'ultraguard-security-suite' ), 'critical' => __( 'Critical', 'ultraguard-security-suite' ) ], 'default' => 'medium' ],
                                                [ 'type' => 'text',     'name' => 'bulk_reason', 'label' => __( 'Reason', 'ultraguard-security-suite' ), 'placeholder' => __( 'e.g. Manual bulk block', 'ultraguard-security-suite' ) ],
                                            ],
                                            'footer' => [
                                                'type'      => 'button-group',
                                                'alignment' => 'right',
                                                'buttons'   => [
                                                    $this->create_ajax_button( __( 'Validate',  'ultraguard-security-suite' ), 'ultraguard_validate_ips',   [], 'secondary', 'dashicons-yes'    ),
                                                    $this->create_ajax_button( __( 'Block All', 'ultraguard-security-suite' ), 'ultraguard_bulk_block_ips', [], 'danger',    'dashicons-dismiss', __( 'Block all IPs in the list?', 'ultraguard-security-suite' ) ),
                                                ],
                                            ],
                                        ],
                                    ],
                                    [
                                        'span'      => 6,
                                        'component' => [
                                            'type'  => 'card',
                                            'title' => __( 'Bulk Whitelist IPs', 'ultraguard-security-suite' ),
                                            'icon'  => 'dashicons-yes-alt',
                                            'data'  => [
                                                [ 'type' => 'textarea', 'name' => 'whitelist_ip_list', 'label' => __( 'IP Addresses (one per line)', 'ultraguard-security-suite' ), 'rows' => 10, 'placeholder' => "192.168.1.0/24\n203.0.113.5" ],
                                                [ 'type' => 'text',     'name' => 'whitelist_label', 'label' => __( 'Label', 'ultraguard-security-suite' ), 'placeholder' => __( 'e.g. Office network', 'ultraguard-security-suite' ) ],
                                            ],
                                            'footer' => [
                                                'type'      => 'button-group',
                                                'alignment' => 'right',
                                                'buttons'   => [
                                                    $this->create_ajax_button( __( 'Whitelist All', 'ultraguard-security-suite' ), 'ultraguard_bulk_whitelist_ips', [], 'primary', 'dashicons-yes-alt', __( 'Add all IPs to whitelist?', 'ultraguard-security-suite' ) ),
                                                ],
                                            ],
                                        ],
                                    ],
                                ],
                            ] ],
                        ],

                    ],
                ],
            ],

            'form' => [ 'enable' => false ],
        ], $context );
    }

    // ── Helpers ───────────────────────────────────────────────────────────────

    private function severity_badge( string $sev ): string {
        return match ( strtolower( $sev ) ) {
            'critical'       => 'danger',
            'high'           => 'danger',
            'medium'         => 'warning',
            'low', 'none'    => 'secondary',
            default          => 'info',
        };
    }

    private function source_badge( string $src ): string {
        return match ( strtolower( $src ) ) {
            'auto'       => 'warning',
            'reputation' => 'info',
            'manual'     => 'secondary',
            default      => 'secondary',
        };
    }
}
