<?php
/**
 * Settings tab: Security.
 *
 * @package advan
 *
 * @since 5.2.0
 */

declare(strict_types=1);

use ADVAN\Helpers\Settings;
use ADVAN\Settings\Settings_Builder;

// Exit if accessed directly.
if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

Settings::build_option(
	array(
		'title' => \esc_html__( 'Security Settings', '0-day-analytics' ),
		'id'    => 'security-settings-tab',
		'type'  => 'tab-title',
	)
);

// ─── Module Status ──────────────────────────────────────────────────────────

Settings::build_option(
	array(
		'type'  => 'header',
		'id'    => 'security-module-status-header',
		'title' => \esc_html__( 'Module Status', '0-day-analytics' ),
	)
);

Settings::build_option(
	array(
		'name'    => \esc_html__( 'Enable Security Module', '0-day-analytics' ),
		'id'      => 'security_module_enabled',
		'type'    => 'checkbox',
		'hint'    => \esc_html__( 'Master switch for all security features. When disabled, no security monitoring or protection is active.', '0-day-analytics' ),
		'default' => Settings::get_option( 'security_module_enabled' ),
	)
);

// ─── DDoS / DoS Mitigation ─────────────────────────────────────────────────

Settings::build_option(
	array(
		'type'  => 'header',
		'id'    => 'security-rate-limit-header',
		'title' => \esc_html__( 'DDoS / DoS Mitigation', '0-day-analytics' ),
	)
);

Settings::build_option(
	array(
		'name'    => \esc_html__( 'Enable Rate Limiting', '0-day-analytics' ),
		'id'      => 'advana_security_rate_limit_enable',
		'type'    => 'checkbox',
		'hint'    => \esc_html__( 'Block IPs that exceed request rate limits. Uses APCu (if available) or filesystem counters for zero-DB overhead.', '0-day-analytics' ),
		'default' => Settings::get_option( 'advana_security_rate_limit_enable' ),
	)
);

Settings::build_option(
	array(
		'name'    => \esc_html__( 'Requests per minute (per IP)', '0-day-analytics' ),
		'id'      => 'security_rate_limit_per_minute',
		'type'    => 'number',
		'hint'    => \esc_html__( 'Maximum requests allowed per IP per minute before the IP is temporarily blocked. Default: 1200.', '0-day-analytics' ),
		'min'     => 10,
		'max'     => 3000,
		'default' => Settings::get_option( 'security_rate_limit_per_minute' ),
	)
);

Settings::build_option(
	array(
		'name'    => \esc_html__( 'Burst limit (per 5 seconds, per IP)', '0-day-analytics' ),
		'id'      => 'security_burst_limit',
		'type'    => 'number',
		'hint'    => \esc_html__( 'Maximum requests allowed per IP within a 5-second burst window. Catches sudden request spikes that might not trigger the per-minute limit. Increase for high-traffic sites with aggressive prefetching or AJAX-heavy pages. Default: 15.', '0-day-analytics' ),
		'min'     => 5,
		'max'     => 100,
		'default' => Settings::get_option( 'security_burst_limit' ),
	)
);

Settings::build_option(
	array(
		'name'    => \esc_html__( 'Block duration (seconds)', '0-day-analytics' ),
		'id'      => 'security_block_duration',
		'type'    => 'number',
		'hint'    => \esc_html__( 'How long to block an IP after it exceeds the rate limit. Default: 300 (5 minutes).', '0-day-analytics' ),
		'min'     => 60,
		'max'     => 86400,
		'default' => Settings::get_option( 'security_block_duration' ),
	)
);

Settings::build_option(
	array(
		'name'    => \esc_html__( 'Trust proxy headers', '0-day-analytics' ),
		'id'      => 'security_trust_proxy_headers',
		'type'    => 'checkbox',
		'hint'    => \esc_html__( 'Enable only if your site is behind a reverse proxy or CDN (Cloudflare, AWS ALB, etc.). Trusts X-Forwarded-For and CF-Connecting-IP headers. Leave disabled otherwise — proxy headers can be spoofed.', '0-day-analytics' ),
		'default' => Settings::get_option( 'security_trust_proxy_headers' ),
	)
);

// ─── Login Protection ───────────────────────────────────────────────────────

Settings::build_option(
	array(
		'type'  => 'header',
		'id'    => 'security-login-header',
		'title' => \esc_html__( 'Login Protection', '0-day-analytics' ),
	)
);

Settings::build_option(
	array(
		'name'    => \esc_html__( 'Login attempts per IP (per 5 min)', '0-day-analytics' ),
		'id'      => 'security_login_rate_limit',
		'type'    => 'number',
		'hint'    => \esc_html__( 'Maximum failed login attempts per IP within a 5-minute window. After this limit, the IP is blocked. Default: 5.', '0-day-analytics' ),
		'min'     => 1,
		'max'     => 50,
		'default' => Settings::get_option( 'security_login_rate_limit' ),
	)
);

// ─── Privilege Escalation Defense ───────────────────────────────────────────

Settings::build_option(
	array(
		'type'  => 'header',
		'id'    => 'security-priv-guard-header',
		'title' => \esc_html__( 'Privilege Escalation Defense', '0-day-analytics' ),
	)
);

Settings::build_option(
	array(
		'name'    => \esc_html__( 'Enable Privilege Guard', '0-day-analytics' ),
		'id'      => 'advana_security_priv_guard_enable',
		'type'    => 'checkbox',
		'hint'    => \esc_html__( 'Monitor role changes, capability injection, critical option tampering, and user enumeration attempts.', '0-day-analytics' ),
		'default' => Settings::get_option( 'advana_security_priv_guard_enable' ),
	)
);

Settings::build_option(
	array(
		'name'    => \esc_html__( 'Block user enumeration', '0-day-analytics' ),
		'id'      => 'advana_security_block_user_enum',
		'type'    => 'checkbox',
		'hint'    => \esc_html__( 'Block unauthenticated user enumeration via REST API (/wp/v2/users) and author archives (?author=N).', '0-day-analytics' ),
		'default' => Settings::get_option( 'advana_security_block_user_enum' ),
	)
);

// ─── Incident Detection & Response ─────────────────────────────────────────

Settings::build_option(
	array(
		'type'  => 'header',
		'id'    => 'security-incident-header',
		'title' => \esc_html__( 'Incident Detection & Response', '0-day-analytics' ),
	)
);

Settings::build_option(
	array(
		'name'    => \esc_html__( 'Enable Incident Detection', '0-day-analytics' ),
		'id'      => 'advana_security_incident_detect_enable',
		'type'    => 'checkbox',
		'hint'    => \esc_html__( 'Automatically detect coordinated attacks (DDoS, distributed brute force, escalation chains) using pattern analysis.', '0-day-analytics' ),
		'default' => Settings::get_option( 'advana_security_incident_detect_enable' ),
	)
);

Settings::build_option(
	array(
		'name'    => \esc_html__( 'Auto-lockdown on incident', '0-day-analytics' ),
		'id'      => 'advana_security_auto_lockdown',
		'type'    => 'checkbox',
		'hint'    => \esc_html__( 'Automatically tighten rate limits when an attack is detected. Rate limits are reduced by 75% during lockdown.', '0-day-analytics' ),
		'default' => Settings::get_option( 'advana_security_auto_lockdown' ),
	)
);

Settings::build_option(
	array(
		'name'    => \esc_html__( 'Email alerts', '0-day-analytics' ),
		'id'      => 'advana_security_email_alerts',
		'type'    => 'checkbox',
		'hint'    => \esc_html__( 'Send email notifications to the site admin when a security incident is detected. Rate-limited to one email per 15 minutes per incident type.', '0-day-analytics' ),
		'default' => Settings::get_option( 'advana_security_email_alerts' ),
	)
);

// ─── Thresholds ─────────────────────────────────────────────────────────────

Settings::build_option(
	array(
		'type'  => 'header',
		'id'    => 'security-thresholds-header',
		'title' => \esc_html__( 'Detection Thresholds', '0-day-analytics' ),
	)
);

Settings::build_option(
	array(
		'id'      => 'security-thresholds-hint',
		'content' => \esc_html__( 'These thresholds control when the incident detector flags an attack. Lower values are more sensitive but may produce false positives. Adjust based on your site\'s traffic patterns.', '0-day-analytics' ),
		'type'    => 'hint',
	)
);

Settings::build_option(
	array(
		'name'    => \esc_html__( 'DDoS: unique IPs threshold', '0-day-analytics' ),
		'id'      => 'security_ddos_ip_threshold',
		'type'    => 'number',
		'hint'    => \esc_html__( 'Number of unique blocked IPs in the detection window that triggers a DDoS alert. Default: 50.', '0-day-analytics' ),
		'min'     => 10,
		'max'     => 500,
		'default' => Settings::get_option( 'security_ddos_ip_threshold' ),
	)
);

Settings::build_option(
	array(
		'name'    => \esc_html__( 'DDoS: detection window (minutes)', '0-day-analytics' ),
		'id'      => 'security_ddos_window_minutes',
		'type'    => 'number',
		'hint'    => \esc_html__( 'Time window for DDoS detection. Default: 5 minutes.', '0-day-analytics' ),
		'min'     => 1,
		'max'     => 60,
		'default' => Settings::get_option( 'security_ddos_window_minutes' ),
	)
);

Settings::build_option(
	array(
		'name'    => \esc_html__( 'Brute force: attempts threshold', '0-day-analytics' ),
		'id'      => 'security_brute_force_threshold',
		'type'    => 'number',
		'hint'    => \esc_html__( 'Total login attempts in the window that triggers a campaign alert. Default: 20.', '0-day-analytics' ),
		'min'     => 5,
		'max'     => 200,
		'default' => Settings::get_option( 'security_brute_force_threshold' ),
	)
);

Settings::build_option(
	array(
		'name'    => \esc_html__( 'Brute force: detection window (minutes)', '0-day-analytics' ),
		'id'      => 'security_brute_force_window_minutes',
		'type'    => 'number',
		'hint'    => \esc_html__( 'Time window for brute force campaign detection. Default: 10 minutes.', '0-day-analytics' ),
		'min'     => 1,
		'max'     => 60,
		'default' => Settings::get_option( 'security_brute_force_window_minutes' ),
	)
);

Settings::build_option(
	array(
		'name'    => \esc_html__( 'Escalation: events threshold', '0-day-analytics' ),
		'id'      => 'security_escalation_threshold',
		'type'    => 'number',
		'hint'    => \esc_html__( 'Number of privilege escalation events that triggers a chain alert. Default: 3.', '0-day-analytics' ),
		'min'     => 1,
		'max'     => 50,
		'default' => Settings::get_option( 'security_escalation_threshold' ),
	)
);

Settings::build_option(
	array(
		'name'    => \esc_html__( 'Escalation: detection window (minutes)', '0-day-analytics' ),
		'id'      => 'security_escalation_window_minutes',
		'type'    => 'number',
		'hint'    => \esc_html__( 'Time window for escalation chain detection. Default: 30 minutes.', '0-day-analytics' ),
		'min'     => 5,
		'max'     => 1440,
		'default' => Settings::get_option( 'security_escalation_window_minutes' ),
	)
);

Settings::build_option(
	array(
		'name'    => \esc_html__( 'Lockdown duration (minutes)', '0-day-analytics' ),
		'id'      => 'security_lockdown_duration_minutes',
		'type'    => 'number',
		'hint'    => \esc_html__( 'How long auto-lockdown lasts when triggered. Default: 30 minutes.', '0-day-analytics' ),
		'min'     => 5,
		'max'     => 1440,
		'default' => Settings::get_option( 'security_lockdown_duration_minutes' ),
	)
);

// ─── Data Retention ─────────────────────────────────────────────────────────

Settings::build_option(
	array(
		'type'  => 'header',
		'id'    => 'security-retention-header',
		'title' => \esc_html__( 'Data Retention', '0-day-analytics' ),
	)
);

Settings::build_option(
	array(
		'name'    => \esc_html__( 'Keep security events for (days)', '0-day-analytics' ),
		'id'      => 'security_event_retention_days',
		'type'    => 'number',
		'hint'    => \esc_html__( 'Security events older than this number of days are automatically pruned. Default: 90 days.', '0-day-analytics' ),
		'min'     => 7,
		'max'     => 365,
		'default' => Settings::get_option( 'security_event_retention_days' ),
	)
);