<?php
/**
 * PasskeysSettings - Admin settings page for the Passkeys module.
 *
 * Administrator-only. Controls:
 *   - Role enforcement (which roles must enrol a passkey before accessing wp-admin)
 *   - Allow/disallow recovery codes site-wide
 *
 * Follows the standard UltraGuard Pro page pattern:
 *   - Fields live inside card > data as toggle/select items
 *   - Saving is wired through the top-level 'form' key (no 'type'=>'form' in data)
 *   - The form posts to ultraguard_passkeys_save_settings, handled by PasskeysAjax
 *
 * @package UltraguardPro\modules\authenticator\pages
 */

namespace UltraguardPro\modules\authenticator\pages;

use UltraguardPro\Plugin;
use UltraguardPro\modules\core\BasePage;

if ( ! defined( 'ABSPATH' ) ) { exit; }

class PasskeysSettings extends BasePage {

    public function __construct( Plugin $plugin ) {
        parent::__construct( $plugin );
    }

    public function get_scheme( $context ): array {
        $s     = $this->settings->get_module_settings('passkeys');
        $nonce = $this->create_nonce( 'ultraguard_admin_nonce' );

        // Build role options for multiple select
        $role_names     = wp_roles()->get_names();
        $required_roles = (array) $s['passkey_required_roles']??[];

        $role_options = [];
        foreach ( $role_names as $slug => $label ) {
            $role_options[] = [
                'value'    => $slug,
                'label'    => translate_user_role( $label ),
                'selected' => in_array( $slug, $required_roles, true ),
            ];
        }

        return [
            'type'      => 'page',
            'id'        => 'passkeys-settings',
            'page_slug' => 'passkeys-settings',

            'header' => [
                'title'    => __( 'Passkeys Settings', 'ultraguard-security-suite' ),
                'subtitle' => __( 'Configure role enforcement and recovery code policy for passkey authentication.', 'ultraguard-security-suite' ),
                'icon'     => 'dashicons-admin-settings',
                'actions'  => [
                    $this->create_url_button(
                        __( 'Back to Passkeys', 'ultraguard-security-suite' ),
                        admin_url( 'admin.php?page=ultraguard-security-suite-dashboard&ug_page=passkeys' ),
                        'secondary',
                        'dashicons-arrow-left-alt'
                    ),
                ],
            ],

            'data' => [

                // ── Enforcement settings ──────────────────────────────────
                [
                    'type'  => 'card',
                    'title' => __( 'Role Enforcement', 'ultraguard-security-suite' ),
                    'icon'  => 'dashicons-admin-users',
                    'data'  => [
                        [
                            'type'        => 'select',
                            'multiple'    => true,
                            'size'        => 6,
                            'name'        => 'passkey_required_roles',
                            'label'       => __( 'Require passkeys for roles', 'ultraguard-security-suite' ),
                            'description' => __( 'Users with these roles will be redirected to enrol a passkey before accessing wp-admin. Leave empty to make passkeys optional.', 'ultraguard-security-suite' ),
                            'options'     => $role_options,
                            'value'       => $required_roles,
                        ],
                    ],
                ],

                // ── Recovery code policy ──────────────────────────────────
                [
                    'type'  => 'card',
                    'title' => __( 'Recovery Code Policy', 'ultraguard-security-suite' ),
                    'icon'  => 'dashicons-backup',
                    'data'  => [
                        [
                            'type'        => 'toggle',
                            'name'        => 'passkey_allow_recovery_codes',
                            'label'       => __( 'Allow recovery codes', 'ultraguard-security-suite' ),
                            'description' => __( 'Allow users to generate single-use recovery codes as a passkey fallback. Disable to enforce strict passkey-only access.', 'ultraguard-security-suite' ),
                            'value'       =>$s['passkey_allow_recovery_codes']??0,
                        ],
                    ],
                ],

            ],

            'form' => [
                'enable' => true,
                'id'     => 'passkeys-settings-form',
                'ajax'   => true,
                'action' => 'ultraguard_passkeys_save_settings',
                'nonce'  => $nonce,
                'data'   => [ 'module' => 'passkeys' ],
                'submit' => [
                    'text'         => __( 'Save Settings', 'ultraguard-security-suite' ),
                    'button_style' => 'primary',
                    'icon'         => 'dashicons-saved',
                ],
            ],
        ];
    }
}