{% from "partials/_macros.html" import card_header, verdict_pill %}

{# File scan — the compiled YARA ruleset summary (what's loaded, from which
   sources, how many skipped) plus this run's matches. The ruleset lives only
   in the monitor process, so the monitor persists this summary for the
   read-only dashboard to render. #}

<div id="file-scan" class="bg-slate-900 border border-slate-800 rounded-lg p-5">
  {{ card_header("File scan — YARA ruleset & matches") }}

  {# ===== Ruleset summary ===== #}
  {% set st = data.status if data else none %}
  {% if st and st.rules_loaded %}
    {# Width-aware summary: a stats column (metric tiles + sources) on the
       left, the category breakdown spanning the remaining two columns. #}
    <div class="mb-5 grid grid-cols-1 lg:grid-cols-3 gap-x-8 gap-y-5">

      {# ----- left: ruleset stats ----- #}
      <div class="space-y-3">
        <div class="grid grid-cols-2 gap-3">
          <div class="bg-slate-950/40 border border-slate-800 rounded-lg p-3">
            <div class="text-xl font-semibold text-slate-100 tabular-nums">{{ "{:,}".format(st.rules_loaded) }}</div>
            <div class="text-[10px] uppercase tracking-wider text-slate-500">rules loaded</div>
          </div>
          <div class="bg-slate-950/40 border border-slate-800 rounded-lg p-3">
            <div class="text-xl font-semibold text-slate-100 tabular-nums">{{ "{:,}".format(st.files_loaded) }}</div>
            <div class="text-[10px] uppercase tracking-wider text-slate-500">files</div>
          </div>
          <div class="bg-slate-950/40 border border-slate-800 rounded-lg p-3">
            <div class="text-xl font-semibold tabular-nums {{ 'text-amber-300' if st.files_skipped else 'text-slate-100' }}">{{ "{:,}".format(st.files_skipped or 0) }}</div>
            <div class="text-[10px] uppercase tracking-wider text-slate-500">skipped</div>
            {% if st.files_skipped and st.skip_reasons %}
              <div class="mt-1 text-[10px] text-slate-600 leading-snug">
                {% for reason, n in st.skip_reasons.items() %}{{ n }} {{ reason }}{% if not loop.last %} · {% endif %}{% endfor %}
              </div>
            {% endif %}
          </div>
          <div class="bg-slate-950/40 border border-slate-800 rounded-lg p-3">
            <div class="text-xl font-semibold text-slate-100 tabular-nums">{{ st.category_count or (st.top_categories | length) }}</div>
            <div class="text-[10px] uppercase tracking-wider text-slate-500">categories</div>
          </div>
        </div>

        {% if st.sources %}
          <div>
            <div class="text-[10px] uppercase tracking-wider text-slate-600 mb-1.5">sources</div>
            <div class="flex flex-wrap gap-1.5">
              {% for name, n in st.sources.items() %}
                <span class="bg-slate-800 border border-slate-700 rounded-md px-2 py-0.5 text-[11px] text-slate-300">
                  {{ name }} <span class="text-slate-500">{{ "{:,}".format(n) }}</span>
                </span>
              {% endfor %}
            </div>
          </div>
        {% endif %}

        {% if st.compiled_at %}
          <div class="text-[10px] uppercase tracking-wider text-slate-600">compiled {{ st.compiled_at }}</div>
        {% endif %}
      </div>

      {# ----- right (2 cols): category breakdown, laid out 2-up ----- #}
      {% if st.top_categories %}
        {% set cat_max = (st.top_categories | map('last') | max) or 1 %}
        <div class="lg:col-span-2">
          <div class="text-[10px] uppercase tracking-wider text-slate-600 mb-1.5">
            top categories{% if st.category_count > st.top_categories|length %} (of {{ st.category_count }}){% endif %}
          </div>
          <div class="grid grid-cols-1 sm:grid-cols-2 gap-x-8 gap-y-1.5">
            {% for name, n in st.top_categories %}
              <div class="flex items-center gap-2 text-[11px]">
                <span class="w-20 shrink-0 text-right font-mono text-slate-400 truncate" title="{{ name }}">{{ name }}</span>
                <div class="flex-1 h-2 rounded bg-slate-800/70 overflow-hidden">
                  <div class="h-full bg-sky-500/60" style="width: {{ [(n / cat_max * 100) | round(0, 'floor'), 2] | max }}%"></div>
                </div>
                <span class="w-10 shrink-0 text-right font-mono tabular-nums text-slate-500">{{ "{:,}".format(n) }}</span>
              </div>
            {% endfor %}
          </div>
        </div>
      {% endif %}
    </div>
  {% elif st %}
    <div class="mb-5 text-slate-500 text-xs italic">
      no YARA rules loaded — drop rules under the rules dir, or fetch a pack
      with <span class="font-mono">scripts/update_rules.py</span>.
    </div>
  {% else %}
    <div class="mb-5 text-slate-500 text-xs italic">
      the file scanner hasn't compiled a ruleset yet — wait for a collection
      cycle to complete.
    </div>
  {% endif %}

  {# ===== Coverage assessment (LLM: does the ruleset fit this host?) ===== #}
  {% set cov = data.coverage if data else none %}
  {% if cov %}
    {% set posture_class = {"well_covered": "text-emerald-300 border-emerald-700/60 bg-emerald-900/20",
                             "partial": "text-amber-300 border-amber-700/60 bg-amber-900/20",
                             "thin": "text-rose-300 border-rose-700/60 bg-rose-900/20"} %}
    <div class="mb-5 border border-slate-800 rounded-lg p-4 bg-slate-900/40">
      <div class="flex items-center gap-2 mb-1">
        <span class="text-[10px] uppercase tracking-wider rounded px-1.5 py-0.5 border {{ posture_class.get(cov.posture, 'text-slate-300 border-slate-700') }}">
          {{ cov.posture.replace("_", " ") }}
        </span>
        <span class="text-[10px] uppercase tracking-wider text-slate-600">ruleset coverage</span>
      </div>
      <div class="text-sm font-medium text-slate-100">{{ cov.headline }}</div>
      {% if cov.summary %}<div class="text-xs text-slate-400 mt-1">{{ cov.summary }}</div>{% endif %}

      {% if cov.gaps %}
        <div class="mt-3">
          <div class="text-[10px] uppercase tracking-wider text-slate-600 mb-1">gaps</div>
          <ul class="space-y-1">
            {% for g in cov.gaps %}
              <li class="text-xs text-slate-300">
                <span class="text-slate-200 font-medium">{{ g.area }}</span>
                {% if g.detail %}<span class="text-slate-500"> — {{ g.detail }}</span>{% endif %}
              </li>
            {% endfor %}
          </ul>
        </div>
      {% endif %}

      {% if cov.recommendations %}
        <div class="mt-3">
          <div class="text-[10px] uppercase tracking-wider text-slate-600 mb-1">recommendations</div>
          <ul class="space-y-1">
            {% for r in cov.recommendations %}
              <li class="text-xs text-slate-300">
                <span class="text-slate-200 font-medium">{{ r.action }}</span>
                {% if r.detail %}<span class="text-slate-500"> — {{ r.detail }}</span>{% endif %}
              </li>
            {% endfor %}
          </ul>
        </div>
      {% endif %}
      {% if cov.created_at %}
        <div class="text-[10px] uppercase tracking-wider text-slate-600 mt-3">assessed {{ cov.created_at }}</div>
      {% endif %}
    </div>
  {% endif %}

  {# ===== Matches ===== #}
  {% if data %}
  <form id="file-scan-filters"
        class="mb-3 flex flex-wrap items-center gap-2 text-xs"
        onsubmit="return false;">
    <input type="search"
           name="q"
           value="{{ data.q }}"
           placeholder="search rule / path / author"
           aria-label="search YARA matches by rule, path or author"
           autocomplete="off"
           class="bg-slate-800 border border-slate-700 rounded px-2 py-1 w-56 focus:outline-none focus:border-slate-500 placeholder:text-slate-600"
           hx-get="/fragments/file-scan"
           hx-target="#file-scan"
           hx-include="#file-scan-filters"
           hx-trigger="keyup changed delay:300ms, search">

    <select name="verdict"
            aria-label="filter YARA matches by verdict"
            class="bg-slate-800 border border-slate-700 rounded px-2 py-1 focus:outline-none focus:border-slate-500"
            hx-get="/fragments/file-scan"
            hx-target="#file-scan"
            hx-include="#file-scan-filters"
            hx-trigger="change">
      <option value=""           {% if data.verdict == "" %}selected{% endif %}>all non-benign</option>
      <option value="malicious"  {% if data.verdict == "malicious" %}selected{% endif %}>malicious</option>
      <option value="suspicious" {% if data.verdict == "suspicious" %}selected{% endif %}>suspicious</option>
      <option value="unknown"    {% if data.verdict == "unknown" %}selected{% endif %}>unknown</option>
      <option value="benign"     {% if data.verdict == "benign" %}selected{% endif %}>benign (all)</option>
    </select>
  </form>
  {% endif %}

  {% if data and data.matches %}
    <div class="overflow-x-auto">
    <table class="w-full text-xs">
      <thead>
        <tr class="text-slate-500 uppercase tracking-wider text-[10px]">
          <th class="text-left font-semibold pb-2">verdict</th>
          <th class="text-left font-semibold pb-2">rule</th>
          <th class="text-left font-semibold pb-2">path</th>
          <th class="text-left font-semibold pb-2">author</th>
          <th class="text-left font-semibold pb-2">source</th>
          <th class="text-left font-semibold pb-2 w-1/4">why</th>
        </tr>
      </thead>
      <tbody class="divide-y divide-slate-800/80 [&>tr:nth-child(even)]:bg-slate-950/40">
        {% for m in data.matches %}
          <tr class="hover:bg-slate-800/40 transition-colors">
            <td class="py-2">
              {% if m.verdict %}{{ verdict_pill(m.verdict, m.confidence) }}
              {% else %}<span class="text-slate-600 text-[10px] uppercase tracking-wider">—</span>{% endif %}
            </td>
            <td class="py-2 font-mono text-slate-200 break-all">{{ m.rule or "—" }}</td>
            <td class="py-2 font-mono text-slate-300 break-all">{{ m.path or "—" }}</td>
            <td class="py-2 text-slate-400 break-all">{{ m.author or "—" }}</td>
            <td class="py-2 text-slate-500">{{ m.scan_source or "—" }}</td>
            <td class="py-2 text-slate-400 line-clamp-2">{{ m.reasoning }}</td>
          </tr>
        {% endfor %}
      </tbody>
    </table>
    </div>
  {% elif data %}
    <div class="text-slate-500 text-xs italic">
      no YARA matches{% if data.q or data.verdict %} for the current filters{% endif %} —
      a clean host with no rule hits looks exactly like this.
    </div>
  {% endif %}
</div>