{% extends 'base/layout.html' %}
{% load form_helpers %}
{% load i18n %}
{% load proxbox_tags %}

{% block title %}{% trans "Proxbox Settings" %}{% endblock %}

{% block content %}
<div class="row">
    <div class="col col-md-12">
        <h4 class="mb-3">{% trans "Plugin Settings" %}</h4>
        {% include "netbox_proxbox/partials/bootstrap_status_card.html" %}
        <form method="post">
            {% csrf_token %}
            {# Sync Settings Card #}
            <div class="card mb-3">
                <h5 class="card-header">
                    <i class="mdi mdi-sync"></i>
                    {% trans "Sync Settings" %}
                </h5>
                <div class="card-body">
                    <p class="text-muted">
                        {% blocktrans trimmed %}
                        Configure runtime behavior for Proxbox synchronization.
                        {% endblocktrans %}
                    </p>
                    {% render_field form.vm_interface_sync_strategy %}
                    {% render_field form.use_guest_agent_interface_name %}
                    {% render_field form.proxbox_fetch_max_concurrency %}
                    {% render_field form.ignore_ipv6_link_local_addresses %}
                    {% render_field form.ensure_netbox_objects %}
                    {% render_field form.delete_orphans %}
                    {% render_field form.custom_fields_enabled %}
                    {% render_field form.primary_ip_preference %}
                    {% render_field form.parse_description_metadata %}
                    {% render_field form.embed_description_metadata %}
                    {% render_field form.default_role_qemu %}
                    {% render_field form.default_role_lxc %}
                    {% render_field form.backend_log_file_path %}
                </div>
            </div>
            {# Sync Mode Controls #}
            <div class="card mb-3">
                <h5 class="card-header">
                    <i class="mdi mdi-source-branch-sync"></i>
                    {% trans "Sync Mode Controls" %}
                </h5>
                <div class="card-body">
                    <p class="text-muted">
                        {% blocktrans trimmed %}
                        Control whether each resource type syncs every run, only bootstraps new
                        records, or is skipped entirely. Individual Proxmox endpoints can override
                        these global defaults.
                        {% endblocktrans %}
                    </p>
                    {% if netbox_bgp_status %}
                    <div class="alert {% if netbox_bgp_status.installed %}alert-success{% else %}alert-warning{% endif %}" role="status">
                        <i class="mdi mdi-source-branch"></i>
                        {{ netbox_bgp_status.message }}
                    </div>
                    {% endif %}
                    {% for group_label, group_fields in sync_mode_field_groups %}
                        <h6 class="mt-3">{{ group_label }}</h6>
                        {% for field_name in group_fields %}
                            {% render_field form|form_field:field_name %}
                        {% endfor %}
                    {% endfor %}
                </div>
            </div>
            {# NetBox Integration Card #}
            <div class="card mb-3">
                <h5 class="card-header">
                    <i class="mdi mdi-database"></i>
                    {% trans "NetBox Integration" %}
                </h5>
                <div class="card-body">
                    <p class="text-muted">
                        {% blocktrans trimmed %}
                        Configure NetBox API connection behavior, caching, and bulk operation parameters.
                        {% endblocktrans %}
                    </p>
                    {% render_field form.netbox_max_concurrent %}
                    {% render_field form.netbox_timeout %}
                    {% render_field form.netbox_write_concurrency %}
                    {% render_field form.proxmox_fetch_concurrency %}
                    {% render_field form.netbox_max_retries %}
                    {% render_field form.netbox_retry_delay %}
                    {% render_field form.netbox_get_cache_ttl %}
                    {% render_field form.netbox_get_cache_max_entries %}
                    {% render_field form.netbox_get_cache_max_bytes %}
                    {% render_field form.bulk_batch_size %}
                    {% render_field form.bulk_batch_delay_ms %}
                    {% render_field form.backup_batch_size %}
                    {% render_field form.backup_batch_delay_ms %}
                    {% render_field form.vm_sync_max_concurrency %}
                    {% render_field form.interface_batch_size %}
                    {% render_field form.interface_batch_delay_ms %}
                    {% render_field form.reconciliation_engine %}
                    {% render_field form.reconciliation_compare_strict %}
                    {% render_field form.custom_fields_request_delay %}
                </div>
            </div>
            {# Sync Overwrite Behavior — one card per resource category #}
            <div class="card mb-3">
                <h5 class="card-header">
                    <i class="mdi mdi-pencil-circle"></i>
                    {% trans "Sync Overwrite Behavior" %}
                </h5>
                <div class="card-body">
                    <p class="text-muted">
                        {% blocktrans trimmed %}
                        Control whether sync overwrites specific fields on existing NetBox objects.
                        These are the global defaults; individual Proxmox endpoints can override
                        each value from their Settings tab.
                        {% endblocktrans %}
                    </p>
                </div>
            </div>
            {% for group_label, group_fields in overwrite_field_groups %}
            <div class="card mb-3">
                <h5 class="card-header">
                    <i class="mdi mdi-pencil-circle-outline"></i>
                    {{ group_label }}
                </h5>
                <div class="card-body">
                    {% for field_name in group_fields %}
                        {% render_field form|form_field:field_name %}
                    {% endfor %}
                </div>
            </div>
            {% endfor %}
            {# Tenant Assignment Card #}
            <div class="card mb-3">
                <h5 class="card-header">
                    <i class="mdi mdi-account-switch"></i>
                    {% trans "Tenant Assignment" %}
                </h5>
                <div class="card-body">
                    <p class="text-muted">
                        {% blocktrans trimmed %}
                        Configure optional post-sync Tenant assignment for synced virtual machines.
                        Existing Tenant values are preserved.
                        {% endblocktrans %}
                    </p>
                    {% render_field form.enable_tenant_name_regex %}
                    {% render_field form.tenant_name_regex_rules %}
                    {% render_field form.enable_tenant_tag_assignment %}
                    {% render_field form.enable_tenant_from_cluster %}
                </div>
            </div>
            {# Cloud Customer Network Card #}
            <div class="card mb-3">
                <h5 class="card-header">
                    <i class="mdi mdi-lan"></i>
                    {% trans "Cloud customer network" %}
                </h5>
                <div class="card-body">
                    <p class="text-muted">
                        {% blocktrans trimmed %}
                        Designate the NetBox IPAM network that proxbox-api and nms-backend
                        use for customer-facing cloud instance interfaces.
                        {% endblocktrans %}
                    </p>
                    {% render_field form.cloud_network_lock_enabled %}
                    {% render_field form.cloud_customer_prefix_id %}
                    {% render_field form.cloud_customer_bridge %}
                    {% render_field form.cloud_customer_vlan_tag %}
                    {% render_field form.cloud_customer_gateway %}
                </div>
            </div>
            {# Proxmox API Card #}
            <div class="card mb-3">
                <h5 class="card-header">
                    <i class="mdi mdi-server"></i>
                    {% trans "Proxmox API" %}
                </h5>
                <div class="card-body">
                    <p class="text-muted">
                        {% blocktrans trimmed %}
                        Configure default timeout and retry behavior for Proxmox API requests.
                        Individual endpoints can override these values.
                        {% endblocktrans %}
                    </p>
                    {% render_field form.proxmox_timeout %}
                    {% render_field form.proxmox_max_retries %}
                    {% render_field form.proxmox_retry_backoff %}
                </div>
            </div>
            {# Ceph Control Plane Card #}
            <div class="card mb-3">
                <h5 class="card-header">
                    <i class="mdi mdi-database-clock"></i>
                    {% trans "Ceph Control Plane" %}
                </h5>
                <div class="card-body">
                    <p class="text-muted">
                        {% blocktrans trimmed %}
                        Configure the bounded task polling and durable operation lease timings
                        used by the proxbox-api Ceph write control plane.
                        {% endblocktrans %}
                    </p>
                    {% render_field form.ceph_task_timeout %}
                    {% render_field form.ceph_task_poll_interval %}
                    {% render_field form.ceph_run_lease_seconds %}
                </div>
            </div>
            {# SSRF Protection Card #}
            <div class="card mb-3">
                <h5 class="card-header">
                    <i class="mdi mdi-shield-check"></i>
                    {% trans "SSRF Protection" %}
                </h5>
                <div class="card-body">
                    <p class="text-muted">
                        {% blocktrans trimmed %}
                        Configure Server-Side Request Forgery (SSRF) protection for endpoint validation.
                        Endpoints registered in the database are automatically allowed.
                        {% endblocktrans %}
                    </p>
                    {% render_field form.ssrf_protection_enabled %}
                    {% render_field form.allow_private_ips %}
                    {% render_field form.additional_allowed_ip_ranges %}
                    {% render_field form.explicitly_blocked_ip_ranges %}
                </div>
            </div>
            {# Diagnostics Card #}
            <div class="card mb-3">
                <h5 class="card-header">
                    <i class="mdi mdi-bug"></i>
                    {% trans "Diagnostics" %}
                </h5>
                <div class="card-body">
                    <p class="text-muted">
                        {% blocktrans trimmed %}
                        Toggle diagnostic logging and error-detail behavior on the proxbox-api service.
                        {% endblocktrans %}
                    </p>
                    {% render_field form.debug_cache %}
                    {% render_field form.expose_internal_errors %}
                </div>
            </div>
            {# Schema Resolution Card #}
            <div class="card mb-3">
                <h5 class="card-header">
                    <i class="mdi mdi-file-document-outline"></i>
                    {% trans "Schema resolution" %}
                </h5>
                <div class="card-body">
                    <p class="text-muted">
                        {% blocktrans trimmed %}
                        Control whether proxbox-api caches the resolved NetBox OpenAPI schema on
                        disk. Disable to run schema resolution fully in-memory for read-only
                        filesystems or no-disk-write deployments.
                        {% endblocktrans %}
                    </p>
                    {% render_field form.netbox_openapi_persist %}
                </div>
            </div>
            {# NetBox Branching Integration Card #}
            <div class="card mb-3">
                <h5 class="card-header">
                    <i class="mdi mdi-source-branch"></i>
                    {% trans "NetBox Branching Integration" %}
                </h5>
                <div class="card-body">
                    <p class="text-muted">
                        {% blocktrans trimmed %}
                        Auto-create a NetBox branch per Proxbox sync job and merge it
                        back into main on success. Requires the netbox_branching
                        plugin to be installed and listed last in PLUGINS.
                        {% endblocktrans %}
                    </p>
                    {% render_field form.branching_enabled %}
                    {% render_field form.branch_name_prefix %}
                    {% render_field form.branch_on_conflict %}
                    <hr>
                    <p class="text-danger">
                        <strong>
                            {% trans "NetBox → Proxmox intent direction (advanced)" %}
                        </strong>
                        <br>
                        {% blocktrans trimmed %}
                        Enabling these settings allows merging a NetBox branch flagged
                        apply_to_proxmox=True to dispatch CREATE / UPDATE writes to
                        Proxmox via proxbox-api. DELETE still requires a separate
                        DeletionRequest authorization chain. Off by default.
                        {% endblocktrans %}
                    </p>
                    {% render_field form.netbox_to_proxmox_enabled %}
                    {% render_field form.netbox_to_proxmox_typed_confirmation %}
                    {% render_field form.intent_warn_plaintext_password %}
                    {% render_field form.apply_destroy_confirmed %}
                    {% render_field form.intent_apply_authorization_self_approve_allowed %}
                    {% render_field form.intent_deletion_request_ttl_days %}
                </div>
            </div>
            {# Hardware Discovery Card #}
            <div class="card mb-3">
                <h5 class="card-header">
                    <i class="mdi mdi-server-network"></i>
                    {% trans "Hardware Discovery" %}
                </h5>
                <div class="card-body">
                    <p class="text-muted">
                        {% blocktrans trimmed %}
                        Enable the opt-in SSH discovery pass that reflects chassis and NIC
                        hardware facts onto NetBox custom fields during Proxmox sync.
                        {% endblocktrans %}
                    </p>
                    {% render_field form.hardware_discovery_enabled %}
                    {% render_field form.hardware_discovery_sync_nic_macs %}
                </div>
            </div>
            {# Encryption Card #}
            <div class="card mb-3">
                <h5 class="card-header">
                    <i class="mdi mdi-lock"></i>
                    {% trans "Plugin database encryption" %}
                </h5>
                <div class="card-body">
                    <p>
                        {% blocktrans trimmed %}
                        This key protects only netbox-proxbox ciphertext stored in the NetBox
                        database. It is separate from proxbox-api's PROXBOX_ENCRYPTION_KEY and
                        separate from the FastAPI endpoint key used to authenticate API requests.
                        {% endblocktrans %}
                    </p>
                    {% if encryption_recovery_required %}
                        <div class="alert alert-danger" role="alert">
                            <strong>{% trans "Encrypted data recovery required." %}</strong>
                            {% trans "At least one stored value cannot be decrypted with the configured plugin key. Synchronization that needs that credential is blocked until it is rotated, replaced, or explicitly reset." %}
                        </div>
                    {% elif encryption_payloads_exist %}
                        <div class="alert alert-info" role="status">
                            {% trans "The key is protected because encrypted values exist. Use verified rotation below to change it." %}
                        </div>
                    {% endif %}
                    {% render_field form.encryption_enabled %}
                    {% render_field form.encryption_key %}
                    {% if encryption_family_statuses %}
                        <div class="table-responsive mt-3">
                            <table class="table table-sm table-hover" aria-label="{% trans 'Plugin encryption family status' %}">
                                <thead>
                                    <tr>
                                        <th scope="col">{% trans "Encrypted family" %}</th>
                                        <th scope="col">{% trans "Rows" %}</th>
                                        <th scope="col">{% trans "State" %}</th>
                                    </tr>
                                </thead>
                                <tbody>
                                    {% for status in encryption_family_statuses %}
                                        <tr data-encryption-family="{{ status.key }}">
                                            <td>{{ status.label }}</td>
                                            <td>{{ status.rows_with_ciphertext }}</td>
                                            <td>
                                                {% if status.recovery_required %}
                                                    <span class="badge text-bg-danger">{% trans "Recovery required" %}</span>
                                                {% elif status.rows_with_ciphertext %}
                                                    <span class="badge text-bg-success">{% trans "Configured" %}</span>
                                                {% else %}
                                                    <span class="badge text-bg-secondary">{% trans "Not configured" %}</span>
                                                {% endif %}
                                            </td>
                                        </tr>
                                    {% endfor %}
                                </tbody>
                            </table>
                        </div>
                    {% endif %}
                </div>
            </div>
            <div class="mb-3">
                <button type="submit" class="btn btn-primary">
                    <i class="mdi mdi-content-save"></i>
                    {% trans "Save Settings" %}
                </button>
            </div>
        </form>

        {% if encryption_rotation_form %}
        <div class="card border-warning mb-3">
            <h5 class="card-header">
                <i class="mdi mdi-key-change"></i>
                {% trans "Verified plugin key rotation" %}
            </h5>
            <div class="card-body">
                <p class="text-muted">
                    {% trans "Rotation first verifies every registered ciphertext with the current key. It then re-encrypts every value and updates the key in one database transaction. Any wrong key or corrupt row aborts without partial writes." %}
                </p>
                <form method="post" action="{% url 'plugins:netbox_proxbox:encryption_key_rotate' %}" autocomplete="off">
                    {% csrf_token %}
                    {% render_field encryption_rotation_form.old_key %}
                    {% render_field encryption_rotation_form.new_key %}
                    {% render_field encryption_rotation_form.confirm_new_key %}
                    <button type="submit" class="btn btn-warning">
                        <i class="mdi mdi-key-change"></i>
                        {% trans "Verify and rotate key" %}
                    </button>
                </form>
            </div>
        </div>
        {% endif %}

        {% if can_reset_encrypted_secrets and encrypted_secret_reset_form %}
        <div class="card border-danger mb-3">
            <h5 class="card-header text-bg-danger">
                <i class="mdi mdi-alert-octagon"></i>
                {% trans "Destructive encrypted-secret reset" %}
            </h5>
            <div class="card-body">
                <p>
                    {% trans "Use only when the old key is unavailable. The selected ciphertext and associated trust fingerprints are permanently cleared using non-signaling database updates. Endpoint synchronization remains blocked until credentials are re-entered." %}
                </p>
                <form method="post" action="{% url 'plugins:netbox_proxbox:encrypted_secret_reset' %}" autocomplete="off">
                    {% csrf_token %}
                    {% render_field encrypted_secret_reset_form.families %}
                    {% render_field encrypted_secret_reset_form.acknowledge_data_loss %}
                    {% render_field encrypted_secret_reset_form.confirmation %}
                    <button type="submit" class="btn btn-danger">
                        <i class="mdi mdi-delete-alert"></i>
                        {% trans "Permanently reset selected encrypted data" %}
                    </button>
                </form>
            </div>
        </div>
        {% endif %}
    </div>
</div>
{% endblock %}