<?php $pageTitle = t('ldap_settings_title'); ?>

<div class="page-header">
    <div class="page-header-left">
        <a href="/admin/plugins" class="btn btn-ghost btn-sm">← <?= t('plugins') ?></a>
        <h1 class="page-title"><?= t('ldap_settings_title') ?></h1>
    </div>
</div>

<?php if ($success): ?><div class="alert alert-success"><?= Helper::e($success) ?></div><?php endif; ?>
<?php if ($error):   ?><div class="alert alert-error"><?= Helper::e($error) ?></div><?php endif; ?>
<?php if (!empty($errors)): ?>
<div class="alert alert-error"><?php foreach ($errors as $e): ?><div><?= Helper::e($e) ?></div><?php endforeach; ?></div>
<?php endif; ?>

<?php if (!$cfg['has_ldap_extension']): ?>
<div class="alert alert-error"><strong><?= t('ldap_extension_missing') ?></strong></div>
<?php endif; ?>

<?php if (isset($testResult)): ?>
<div class="alert <?= $testResult['ok'] ? 'alert-success' : 'alert-error' ?>"><?= Helper::e($testResult['msg']) ?></div>
<?php endif; ?>

<div class="settings-grid">
<div class="settings-col">

    <!-- ── Basic ───────────────────────────────────────────────────────── -->
    <form method="POST">
        <?= Helper::csrf() ?>
        <input type="hidden" name="action" value="save">

        <div class="card">
            <div class="card-header"><h2 class="card-title"><?= t('ldap_section_general') ?></h2></div>
            <div class="card-body">
                <div class="form-group">
                    <label class="form-label">
                        <input type="checkbox" name="ldap_enabled" value="1" <?= $cfg['enabled'] ? 'checked' : '' ?>>
                        <?= t('ldap_enable') ?>
                    </label>
                    <p class="form-hint"><?= t('ldap_enable_hint') ?></p>
                </div>

                <div class="form-group">
                    <label class="form-label"><?= t('ldap_transport') ?></label>
                    <select name="ldap_transport" class="form-select">
                        <option value="ldaps"     <?= $cfg['transport'] === 'ldaps'     ? 'selected' : '' ?>><?= t('ldap_transport_ldaps') ?></option>
                        <option value="starttls"  <?= $cfg['transport'] === 'starttls'  ? 'selected' : '' ?>><?= t('ldap_transport_starttls') ?></option>
                        <option value="cleartext" <?= $cfg['transport'] === 'cleartext' ? 'selected' : '' ?>><?= t('ldap_transport_cleartext') ?></option>
                    </select>
                    <p class="form-hint"><?= t('ldap_transport_hint') ?></p>
                </div>

                <div class="form-group" style="border-left:3px solid var(--color-danger,#ef4444);padding-left:12px">
                    <label class="form-label">
                        <input type="checkbox" name="ldap_cleartext_ack" value="1" <?= $cfg['transport'] === 'cleartext' ? 'checked' : '' ?>>
                        <?= t('ldap_cleartext_ack') ?>
                    </label>
                    <p class="form-hint"><?= t('ldap_cleartext_ack_hint') ?></p>
                </div>

                <div class="form-row">
                    <div class="form-group" style="flex:2">
                        <label class="form-label"><?= t('ldap_host') ?></label>
                        <input type="text" name="ldap_host" class="form-input" value="<?= Helper::e($cfg['host']) ?>" placeholder="ldap.corp.example">
                    </div>
                    <div class="form-group" style="flex:1">
                        <label class="form-label"><?= t('ldap_port') ?></label>
                        <input type="number" name="ldap_port" class="form-input" value="<?= Helper::e($cfg['port']) ?>" min="1" max="65535">
                    </div>
                </div>

                <div class="form-group">
                    <label class="form-label"><?= t('ldap_base_dn') ?></label>
                    <input type="text" name="ldap_base_dn" class="form-input" value="<?= Helper::e($cfg['base_dn']) ?>" placeholder="dc=corp,dc=example">
                </div>
            </div>
        </div>

        <!-- ── Service account ───────────────────────────────────────── -->
        <div class="card">
            <div class="card-header"><h2 class="card-title"><?= t('ldap_section_service_account') ?></h2></div>
            <div class="card-body">
                <div class="form-group">
                    <label class="form-label"><?= t('ldap_bind_dn') ?></label>
                    <input type="text" name="ldap_bind_dn" class="form-input" value="<?= Helper::e($cfg['bind_dn']) ?>" placeholder="cn=plenvo-svc,ou=services,dc=corp,dc=example">
                    <p class="form-hint"><?= t('ldap_bind_dn_hint') ?></p>
                </div>
                <div class="form-group">
                    <label class="form-label"><?= t('ldap_bind_password') ?></label>
                    <input type="password" name="ldap_bind_password" class="form-input" autocomplete="new-password" placeholder="<?= $cfg['bind_password_set'] ? t('ldap_bind_password_set_keep') : '' ?>">
                    <p class="form-hint"><?= t('ldap_bind_password_hint') ?></p>
                </div>
            </div>
        </div>

        <!-- ── Filters / mapping ─────────────────────────────────────── -->
        <div class="card">
            <div class="card-header"><h2 class="card-title"><?= t('ldap_section_filters') ?></h2></div>
            <div class="card-body">
                <div class="form-group">
                    <label class="form-label"><?= t('ldap_user_filter') ?></label>
                    <input type="text" name="ldap_user_filter" class="form-input" value="<?= Helper::e($cfg['user_filter']) ?>">
                    <p class="form-hint"><?= t('ldap_user_filter_hint') ?></p>
                </div>
                <div class="form-group">
                    <label class="form-label"><?= t('ldap_active_filter') ?></label>
                    <input type="text" name="ldap_active_filter" class="form-input" value="<?= Helper::e($cfg['active_filter']) ?>" placeholder="(!(userAccountControl:1.2.840.113556.1.4.803:=2))">
                    <p class="form-hint"><?= t('ldap_active_filter_hint') ?></p>
                </div>
                <div class="form-row">
                    <div class="form-group" style="flex:1">
                        <label class="form-label"><?= t('ldap_attr_username') ?></label>
                        <input type="text" name="ldap_attr_username" class="form-input" value="<?= Helper::e($cfg['attr_username']) ?>">
                    </div>
                    <div class="form-group" style="flex:1">
                        <label class="form-label"><?= t('ldap_attr_email') ?></label>
                        <input type="text" name="ldap_attr_email" class="form-input" value="<?= Helper::e($cfg['attr_email']) ?>">
                    </div>
                    <div class="form-group" style="flex:1">
                        <label class="form-label"><?= t('ldap_attr_groups') ?></label>
                        <input type="text" name="ldap_attr_groups" class="form-input" value="<?= Helper::e($cfg['attr_groups']) ?>">
                    </div>
                </div>
                <div class="form-group">
                    <label class="form-label"><?= t('ldap_admin_group_dn') ?></label>
                    <input type="text" name="ldap_admin_group_dn" class="form-input" value="<?= Helper::e($cfg['admin_group_dn']) ?>" placeholder="cn=Plenvo-Admins,ou=Groups,dc=corp,dc=example">
                    <p class="form-hint"><?= t('ldap_admin_group_dn_hint') ?></p>
                </div>
                <div class="form-group">
                    <label class="form-label"><?= t('ldap_required_group_dn') ?></label>
                    <input type="text" name="ldap_required_group_dn" class="form-input" value="<?= Helper::e($cfg['required_group_dn']) ?>" placeholder="cn=Plenvo-Users,ou=Groups,dc=corp,dc=example">
                    <p class="form-hint"><?= t('ldap_required_group_dn_hint') ?></p>
                </div>
            </div>
        </div>

        <!-- ── Behaviour ─────────────────────────────────────────────── -->
        <div class="card">
            <div class="card-header"><h2 class="card-title"><?= t('ldap_section_behaviour') ?></h2></div>
            <div class="card-body">
                <div class="form-group">
                    <label class="form-label"><?= t('ldap_tls_require_cert') ?></label>
                    <select name="ldap_tls_require_cert" class="form-select">
                        <option value="demand" <?= $cfg['tls_require_cert'] === 'demand' ? 'selected' : '' ?>><?= t('ldap_tls_require_demand') ?></option>
                        <option value="try"    <?= $cfg['tls_require_cert'] === 'try'    ? 'selected' : '' ?>><?= t('ldap_tls_require_try') ?></option>
                        <option value="allow"  <?= $cfg['tls_require_cert'] === 'allow'  ? 'selected' : '' ?>><?= t('ldap_tls_require_allow') ?></option>
                        <option value="never"  <?= $cfg['tls_require_cert'] === 'never'  ? 'selected' : '' ?>><?= t('ldap_tls_require_never') ?></option>
                    </select>
                    <p class="form-hint"><?= t('ldap_tls_require_hint') ?></p>
                </div>
                <div class="form-group">
                    <label class="form-label">
                        <input type="checkbox" name="ldap_takeover_existing_users" value="1" <?= $cfg['takeover'] ? 'checked' : '' ?>>
                        <?= t('ldap_takeover_existing_users') ?>
                    </label>
                    <p class="form-hint"><?= t('ldap_takeover_existing_users_hint') ?></p>
                </div>
            </div>
        </div>

        <button type="submit" class="btn btn-primary"><?= t('save') ?></button>
    </form>

</div>

<div class="settings-col">

    <!-- ── CA cert ─────────────────────────────────────────────────── -->
    <div class="card">
        <div class="card-header"><h2 class="card-title"><?= t('ldap_section_ca') ?></h2></div>
        <div class="card-body">
            <?php if ($cfg['ca_path'] && is_file($cfg['ca_path'])): ?>
            <p><strong><?= t('ldap_ca_active') ?></strong></p>
            <p class="form-hint" style="word-break:break-all"><?= Helper::e($cfg['ca_subject']) ?></p>
            <?php if ($cfg['ca_valid_to'] > 0): ?>
            <p class="form-hint"><?= t('ldap_ca_valid_until') ?> <?= date('Y-m-d', $cfg['ca_valid_to']) ?></p>
            <?php endif; ?>
            <form method="POST" data-confirm="<?= Helper::e(t('confirm_delete')) ?>">
                <?= Helper::csrf() ?>
                <input type="hidden" name="action" value="remove_ca">
                <button type="submit" class="btn btn-ghost btn-sm danger"><?= t('ldap_ca_remove') ?></button>
            </form>
            <hr style="margin:16px 0">
            <?php else: ?>
            <p class="form-hint"><?= t('ldap_ca_none_hint') ?></p>
            <?php endif; ?>

            <form method="POST" enctype="multipart/form-data">
                <?= Helper::csrf() ?>
                <input type="hidden" name="action" value="upload_ca">
                <div class="form-group">
                    <label class="form-label"><?= t('ldap_ca_upload') ?></label>
                    <input type="file" name="ldap_ca" class="form-input" accept=".pem,.crt,.cer">
                    <p class="form-hint"><?= t('ldap_ca_upload_hint') ?></p>
                </div>
                <button type="submit" class="btn btn-secondary btn-sm"><?= t('ldap_ca_upload_btn') ?></button>
            </form>
        </div>
    </div>

    <!-- ── Test bind ─────────────────────────────────────────────── -->
    <div class="card">
        <div class="card-header"><h2 class="card-title"><?= t('ldap_section_test') ?></h2></div>
        <div class="card-body">
            <p class="form-hint"><?= t('ldap_test_hint') ?></p>
            <form method="POST">
                <?= Helper::csrf() ?>
                <input type="hidden" name="action" value="test_bind">
                <button type="submit" class="btn btn-secondary btn-sm"><?= t('ldap_test_run') ?></button>
            </form>
        </div>
    </div>

    <!-- ── Sync status ──────────────────────────────────────────── -->
    <div class="card">
        <div class="card-header"><h2 class="card-title"><?= t('ldap_section_sync') ?></h2></div>
        <div class="card-body">
            <?php if ($cfg['sync_last_run'] > 0): ?>
            <p class="form-hint"><?= t('ldap_sync_last_run') ?>: <?= date('Y-m-d H:i', $cfg['sync_last_run']) ?></p>
            <p class="form-hint"><?= t('ldap_sync_stats', ['n' => (string)$cfg['sync_last_checked'], 'd' => (string)$cfg['sync_last_disabled']]) ?></p>
            <?php else: ?>
            <p class="form-hint"><?= t('ldap_sync_never') ?></p>
            <?php endif; ?>
            <form method="POST">
                <?= Helper::csrf() ?>
                <input type="hidden" name="action" value="run_sync">
                <button type="submit" class="btn btn-secondary btn-sm"><?= t('ldap_sync_run_now') ?></button>
            </form>
        </div>
    </div>

</div>
</div>
