@extends('layouts.app')

@section('content')
@php
    $nftLines = is_array($nftLines ?? null) ? $nftLines : [];
    $nftText  = strtolower(trim((string) ($nftRaw ?? '')));
    $nftBlocked = str_contains($nftText, 'permission denied')
               || str_contains($nftText, 'you must be root')
               || str_contains($nftText, 'operation not permitted');
@endphp

<div class="d-flex justify-content-between align-items-center flex-wrap grid-margin mb-3">
    <div>
        <h4 class="mb-0 d-flex align-items-center gap-2">
            <i data-lucide="terminal" style="width:20px;height:20px;"></i>
            <span>Raw Firewall Rules</span>
        </h4>
        <div class="text-secondary small mt-1">Read-only live snapshot of the nftables ruleset on this host.</div>
    </div>
    <form method="GET" action="{{ route('firewall.rules') }}" class="mt-2 mt-md-0">
        <button type="submit" class="btn btn-outline-secondary btn-sm">
            <i data-lucide="refresh-cw" style="width:14px;height:14px;"></i> Reload
        </button>
    </form>
</div>

<div class="row g-3 mb-4">
    <div class="col-md-4">
        <div class="card text-center py-3">
            <div class="text-secondary small mb-1">Total Lines</div>
            <div class="fs-5 fw-bold">{{ count($nftLines) }}</div>
        </div>
    </div>
    <div class="col-md-4">
        <div class="card text-center py-3">
            <div class="text-secondary small mb-1">Drop / Reject Rules</div>
            <div class="fs-5 fw-bold text-danger">
                {{ count(array_filter($nftLines, fn($l) => str_contains(strtolower($l), ' drop') || str_contains(strtolower($l), ' reject'))) }}
            </div>
        </div>
    </div>
    <div class="col-md-4">
        <div class="card text-center py-3">
            <div class="text-secondary small mb-1">Status</div>
            <div class="fs-6 fw-bold {{ $nftBlocked ? 'text-danger' : (empty($nftLines) ? 'text-warning' : 'text-success') }}">
                {{ $nftBlocked ? 'Permission Denied' : (empty($nftLines) ? 'No Output' : 'Loaded') }}
            </div>
        </div>
    </div>
</div>

<div class="card">
    <div class="card-header d-flex justify-content-between align-items-center">
        <span class="fw-semibold">nftables Ruleset</span>
        <code class="small text-secondary">sudo nft list ruleset</code>
    </div>
    <div class="card-body p-0">
        @if ($nftBlocked)
            <div class="alert alert-danger m-3">
                Permission denied. Grant <code>www-data</code> sudo access to run <code>nft list ruleset</code> in <code>/etc/sudoers.d/pbx-web</code>.
            </div>
        @elseif (empty($nftLines))
            <div class="alert alert-warning m-3">
                No nftables output received. The web server may lack sudo permission — add <code>www-data ALL=(ALL) NOPASSWD: /usr/sbin/nft list ruleset</code> to sudoers.
            </div>
        @else
            <div style="max-height:600px; overflow:auto; background:#0f172a; border-radius:0 0 8px 8px; padding:16px 20px;">
                <pre class="mb-0 small" style="white-space:pre-wrap; color:#e2e8f0;">@foreach ($nftLines as $line)
@php
    $trim   = trim($line);
    $lower  = strtolower($trim);
    $isDrop = str_contains($lower, ' drop') || str_contains($lower, 'drop;');
    $isRej  = str_contains($lower, ' reject') || str_contains($lower, 'reject;');
    $isRet  = str_contains($lower, ' return') || str_contains($lower, 'return;');
    $isCom  = str_starts_with($trim, '#');
    $cls    = $isDrop || $isRej ? 'color:#f87171' : ($isRet ? 'color:#34d399' : ($isCom ? 'color:#64748b' : ''));
@endphp
<span style="{{ $cls }}">{{ $trim }}</span>
@endforeach</pre>
            </div>
        @endif
    </div>
</div>
@endsection