{% from "partials/_macros.html" import card_header %}

{% set verdict_cls = {
  'malicious':  'bg-red-900/40 text-red-300 border border-red-900/60',
  'suspicious': 'bg-amber-900/40 text-amber-300 border border-amber-900/60',
  'unknown':    'bg-slate-700/40 text-slate-300 border border-slate-600',
  'benign':     'bg-emerald-900/30 text-emerald-300 border border-emerald-900/50',
} %}

{% macro verdict_pill(row) %}
  {% if row.verdict %}
    <span class="inline-flex items-center px-2 py-0.5 rounded-full text-[10px]
                 font-semibold uppercase tracking-wider
                 {{ verdict_cls.get(row.verdict, verdict_cls['unknown']) }}">
      {{ row.verdict }}{% if row.confidence is not none %}
        <span class="ml-1 opacity-70">{{ "%.0f"|format(row.confidence * 100) }}%</span>
      {% endif %}
    </span>
  {% else %}
    <span class="text-slate-600 text-[10px] uppercase tracking-wider">—</span>
  {% endif %}
{% endmacro %}

{% macro subhead(title, c) %}
  <div class="flex items-center gap-2 mt-4 mb-2">
    <h4 class="text-[11px] uppercase tracking-wider text-slate-400 font-semibold">{{ title }}</h4>
    <span class="text-[10px] text-slate-500">{{ c.total }}</span>
    {% if c.malicious %}<span class="text-[10px] px-1.5 rounded bg-red-900/40 text-red-300">{{ c.malicious }} malicious</span>{% endif %}
    {% if c.suspicious %}<span class="text-[10px] px-1.5 rounded bg-amber-900/40 text-amber-300">{{ c.suspicious }} suspicious</span>{% endif %}
  </div>
{% endmacro %}

<div class="bg-slate-900 border border-slate-800 rounded-lg p-5">
  {{ card_header("persistence & tampering — SSH keys · hosts file · privileges") }}

  {% if data and data.any %}

    {# ---------- SSH authorized keys ---------- #}
    {{ subhead("SSH authorized keys", data.counts.ssh_keys) }}
    {% if data.ssh_keys %}
      <table class="w-full text-xs">
        <thead>
          <tr class="text-slate-500 uppercase tracking-wider text-[10px]">
            <th class="text-left font-semibold pb-2">verdict</th>
            <th class="text-left font-semibold pb-2">account</th>
            <th class="text-left font-semibold pb-2">type</th>
            <th class="text-left font-semibold pb-2">fingerprint</th>
            <th class="text-left font-semibold pb-2">comment</th>
            <th class="text-left font-semibold pb-2">restrictions</th>
          </tr>
        </thead>
        <tbody class="divide-y divide-slate-800/80">
          {% for k in data.ssh_keys %}
            <tr class="hover:bg-slate-800/40 transition-colors" title="{{ k.path }}{% if k.reasoning %} — {{ k.reasoning }}{% endif %}">
              <td class="py-2">{{ verdict_pill(k) }}</td>
              <td class="py-2 text-slate-200 font-mono">{{ k.owner }}</td>
              <td class="py-2 text-slate-400 font-mono">{{ k.key_type }}</td>
              <td class="py-2 text-slate-400 font-mono break-all">{{ k.fingerprint or "—" }}</td>
              <td class="py-2 text-slate-300">{{ k.comment or "—" }}</td>
              <td class="py-2 font-mono {{ 'text-amber-300' if not k.options else 'text-slate-400' }}">{{ k.options or "none" }}</td>
            </tr>
          {% endfor %}
        </tbody>
      </table>
    {% else %}
      <div class="text-slate-600 text-xs italic">no authorized keys found</div>
    {% endif %}

    {# ---------- /etc/hosts ---------- #}
    {{ subhead("/etc/hosts mappings", data.counts.hosts) }}
    {% if data.hosts %}
      <table class="w-full text-xs">
        <thead>
          <tr class="text-slate-500 uppercase tracking-wider text-[10px]">
            <th class="text-left font-semibold pb-2">verdict</th>
            <th class="text-left font-semibold pb-2">ip</th>
            <th class="text-left font-semibold pb-2">hostnames</th>
            <th class="text-left font-semibold pb-2 w-1/3">why</th>
          </tr>
        </thead>
        <tbody class="divide-y divide-slate-800/80">
          {% for hrow in data.hosts %}
            <tr class="hover:bg-slate-800/40 transition-colors">
              <td class="py-2">{{ verdict_pill(hrow) }}</td>
              <td class="py-2 text-slate-200 font-mono">{{ hrow.ip }}</td>
              <td class="py-2 text-slate-300 font-mono break-all">{{ hrow.hostnames }}</td>
              <td class="py-2 text-slate-400 line-clamp-2">{{ hrow.reasoning }}</td>
            </tr>
          {% endfor %}
        </tbody>
      </table>
    {% else %}
      <div class="text-slate-600 text-xs italic">no host mappings found</div>
    {% endif %}

    {# ---------- privilege config ---------- #}
    {{ subhead("privilege config", data.counts.privilege) }}
    {% if data.privilege %}
      <table class="w-full text-xs">
        <thead>
          <tr class="text-slate-500 uppercase tracking-wider text-[10px]">
            <th class="text-left font-semibold pb-2">verdict</th>
            <th class="text-left font-semibold pb-2">kind</th>
            <th class="text-left font-semibold pb-2">subject</th>
            <th class="text-left font-semibold pb-2 w-2/5">detail</th>
            <th class="text-left font-semibold pb-2">source</th>
          </tr>
        </thead>
        <tbody class="divide-y divide-slate-800/80">
          {% for p in data.privilege %}
            <tr class="hover:bg-slate-800/40 transition-colors" title="{{ p.reasoning }}">
              <td class="py-2">{{ verdict_pill(p) }}</td>
              <td class="py-2 text-slate-400 font-mono">{{ p.kind }}</td>
              <td class="py-2 text-slate-200 font-mono">{{ p.subject }}</td>
              <td class="py-2 text-slate-300 font-mono break-all">{{ p.detail }}</td>
              <td class="py-2 text-slate-500 font-mono break-all">{{ p.source_path }}</td>
            </tr>
          {% endfor %}
        </tbody>
      </table>
    {% else %}
      <div class="text-slate-600 text-xs italic">no privilege entries found</div>
    {% endif %}

  {% else %}
    <div class="text-slate-500 italic">
      no persistence data yet — these collectors read SSH
      <span class="font-mono">authorized_keys</span>,
      <span class="font-mono">/etc/hosts</span> and privilege config; run the
      monitor (with <span class="font-mono">sudo</span> for full visibility)
      and let a cycle complete.
    </div>
  {% endif %}
</div>