{% extends "base.html" %}
{% block title %}Settings{% endblock %}
{% block content %}
<p><a href="{{ url_for('overview') }}" class="back-link">← Back</a></p>
<h1>Settings</h1>

<div class="row" style="justify-content: space-between">
  <h2 style="margin-top: 0">Accounts</h2>
  <a class="btn" href="{{ url_for('account_new') }}">Add account</a>
</div>
<p class="muted">Snapshots, the IP list, the Visual page and suggestions always show the
  <b>active</b> account (selector in the top bar). Rules are shared and can be limited to one account.</p>
<table class="accounts">
  <thead><tr><th>Account</th><th>Region</th><th>Auth</th><th>Credentials</th><th>Scheduled refresh</th><th></th></tr></thead>
  <tbody>
  {% for c in accounts %}
    {% set a = c.account %}
    <tr>
      <td><b>{{ c.label }}</b>
        {% if active_account and a.id == active_account.id %}<span class="badge ok">active</span>{% endif %}
        {% if a.aws_account_id %}<div class="muted mono small" title="AWS account id of the first successful connect">AWS {{ a.aws_account_id }}</div>{% endif %}
        {% if a.identity_warning %}<div class="badge warn identity-warning">Warning: {{ a.identity_warning }}</div>{% endif %}</td>
      <td class="mono">{{ a.region }}</td>
      <td>{{ a.mode_label }}{% if a.auth_mode == 'profile' %} <span class="mono">{{ a.profile }}</span>{% endif %}</td>
      <td>
        {% if a.auth_mode == 'env' %}<span class="muted">process environment</span>
        {% elif a.auth_mode == 'profile' %}<span class="muted">~/.aws profile</span>
        {% else %}
          {% if a.access_key_id %}<span class="mono">{{ a.access_key_id }}</span>{% endif %}
          {% if a.memory_only %}<span class="badge">memory only</span>{% else %}<span class="badge">encrypted</span>{% endif %}
          {% if a.problem %}<span class="badge err">{{ a.problem }}</span>
          {% elif a.auth_mode == 'temporary' %}<span class="badge warn">{{ a.status }}</span>{% endif %}
        {% endif %}
      </td>
      <td>
        <form class="inline" method="post" action="{{ url_for('account_schedule', account_id=a.id) }}">
          <input type="hidden" name="csrf_token" value="{{ csrf_token }}">
          <label for="interval-{{ a.id }}" class="sr-only">Scheduled refresh interval</label>
          <select id="interval-{{ a.id }}" name="interval" onchange="this.form.submit()">
            {% for hours, label in intervals.items() %}
              <option value="{{ hours }}" {{ 'selected' if schedules.get(a.id, 0) == hours }}>{{ label }}</option>
            {% endfor %}
          </select>
          <noscript><button type="submit" class="secondary">Set</button></noscript>
        </form>
      </td>
      <td style="white-space: nowrap">
        <a class="btn secondary" href="{{ url_for('account_edit', account_id=a.id) }}">Edit</a>
        <form class="inline" method="post" action="{{ url_for('account_test', account_id=a.id) }}">
          <input type="hidden" name="csrf_token" value="{{ csrf_token }}">
          <button type="submit" class="secondary">Test</button>
        </form>
        <form class="inline" method="post" action="{{ url_for('account_delete', account_id=a.id) }}"
              onsubmit="return confirm('Delete this account and all of its snapshots?')">
          <input type="hidden" name="csrf_token" value="{{ csrf_token }}">
          <button class="danger" type="submit">Delete</button>
        </form>
      </td>
    </tr>
  {% else %}
    <tr><td colspan="6" class="muted">No accounts yet — <a href="{{ url_for('account_new') }}">add one</a>.</td></tr>
  {% endfor %}
  </tbody>
</table>
<p class="muted small">Test calls sts:GetCallerIdentity and ec2:DescribeVpcs with the account's saved credentials.
  A scheduled refresh runs while IPLens is running, as a background job like the Refresh button (skipped while
  the account already has a job running).</p>

<form class="card" method="post" action="{{ url_for('settings_save') }}" autocomplete="off">
  <input type="hidden" name="csrf_token" value="{{ csrf_token }}">
  <h2 style="margin-top: 0">Logging</h2>
  <label for="log_dir">Log directory</label>
  <input id="log_dir" name="log_dir" value="{{ s.log_dir }}" size="60" class="mono" placeholder="{{ default_log_dir }}">
  <h2 id="retention">Snapshot retention</h2>
  <div class="row">
    <div><label for="retention_days">Keep snapshots for (days)</label>
      <input id="retention_days" name="retention_days" type="number" value="{{ s.retention_days }}"
             min="{{ retention_limits.keep[0] }}" max="{{ retention_limits.keep[1] }}" size="6"></div>
    <div><label for="downsample_days">One per day after (days)</label>
      <input id="downsample_days" name="downsample_days" type="number" value="{{ s.downsample_days }}"
             min="{{ retention_limits.thin[0] }}" max="{{ retention_limits.thin[1] }}" size="6"></div>
  </div>
  <p class="muted small">Applied after every Refresh: snapshots older than the window are deleted, and older than
    the downsample threshold only the newest successful snapshot of each day is kept (Trends stay bounded).
    The latest successful snapshot of each account is always kept.</p>
  <h2>Environments</h2>
  <label for="env_tag_keys">Environment tag keys</label>
  <input id="env_tag_keys" name="env_tag_keys" value="{{ s.env_tag_keys_text }}" size="40" class="mono" placeholder="Environment, env, stage">
  <p class="muted small">A resource's environment comes from the Terraform repo root × environment that manages it;
    otherwise from the Ownership environment tag key below, then the first of these tag keys found on the resource,
    its subnet or its VPC (case-insensitive).</p>

  <h2 id="ownership">Ownership</h2>
  <input type="hidden" name="own_form" value="1">
  <p class="muted small">Who manages each resource, first match wins: <b>CloudFormation</b> stack
    (<span class="mono">cloudformation:ListStacks / ListStackResources</span>) &gt; <b>IaC tag</b> (the project / repo
    tag key) &gt; <b>Terraform</b> state (only with the enrichment below) &gt; <b>CloudTrail</b> creator (a CI role →
    "IaC (unknown repo)", anyone else → "manual") &gt; <b>unmanaged</b>. Tags come from
    <span class="mono">tag:GetResources</span>. Only the values of these tag keys are kept; other tags are kept
    by key only (for the lists below).</p>
  <div class="row">
    {% for name, label in own_fields.items() %}
    <div><label for="own_{{ name }}_key">{{ label }} tag key</label>
      <select id="own_{{ name }}_key" name="own_{{ name }}_key" class="mono">
        <option value="" {{ 'selected' if not own_keys[name] }}>(not used)</option>
        {% for k in tag_key_choices %}<option value="{{ k }}" {{ 'selected' if k == own_keys[name] }}>{{ k }}{% if k not in seen_tag_keys %} (not seen){% endif %}</option>{% endfor %}
      </select></div>
    {% endfor %}
  </div>
  <p class="muted small">{% if seen_tag_keys %}{{ seen_tag_keys | length }} tag key(s) seen in the active account's latest snapshot.
    {% else %}No tag keys seen yet: Refresh the active account to fill these lists.{% endif %}
    A newly chosen key applies to every resource from the next Refresh.</p>
  <label for="ci_patterns">CI role name patterns</label>
  <textarea id="ci_patterns" name="ci_patterns" rows="2" cols="60" class="mono" placeholder="*github*, deploy-*, ci-*">{{ s.ci_patterns | join(', ') }}</textarea>
  <p class="muted small">Glob patterns (case-insensitive), comma or newline separated. A CloudTrail creator whose
    role / IAM user name matches one is a CI pipeline ("IaC (unknown repo)"); any other creator is "manual".</p>
  <label class="check"><input type="checkbox" name="cloudtrail_lookup" value="1" {{ 'checked' if s.cloudtrail_lookup }}>
    Look up the creator of still unowned resources in CloudTrail (<span class="mono">cloudtrail:LookupEvents</span>)</label>
  <p class="muted small">Opt-in, at most {{ cloudtrail_max }} resources per Refresh. CloudTrail event history only
    covers the last {{ cloudtrail_days }} days: older resources stay unmanaged. Only the creating role / user name is
    kept, never its ARN or session name.</p>
  <label class="check"><input type="checkbox" name="tf_enrichment" value="1" {{ 'checked' if s.tf_enrichment }}>
    Terraform enrichment: use loaded / synced Terraform state as an ownership source</label>
  <p class="muted small">Off by default. When on, mapped Terraform repos are also re-synced with every Refresh.</p>
  <h2>Terraform sync</h2>
  <label for="tf_timeout">Timeout per terraform command (seconds)</label>
  <input id="tf_timeout" name="tf_timeout" value="{{ s.tf_timeout }}" size="6" inputmode="numeric" pattern="[0-9]+">
  <p class="muted small">Applies to <span class="mono">terraform init</span> and <span class="mono">terraform show -json</span>
    (default 120) of roots whose backend is not S3. Roots on an <span class="mono">s3</span> backend never run terraform:
    their state object is read directly (read-only) with the mapped account's credentials, eight at a time; set
    values CI passes with <span class="mono">-backend-config</span> per root on the Terraform repo page. Two terraform
    root × environment pairs run at a time; providers are cached once in the IPLens data directory, and git module
    fetches fail instead of prompting for credentials.</p>
  <p><button type="submit">Save</button></p>
</form>

<section class="card" id="terraform">
  <h2 style="margin-top: 0">Terraform state</h2>
  <p class="muted">Load one or more <span class="mono">.tfstate</span> files or
    <span class="mono">terraform show -json</span> outputs, each as a named <b>root</b>. IPLens
    reads them locally and never modifies them. Only resource ids, addresses and types are kept
    (for <span class="mono">{{ tf_types | join(', ') }}</span>); attribute values, outputs and
    sensitive data are discarded while reading. The IP List, ENI pages and the Visual page then show
    which root manages each resource.</p>
  <table class="tf-roots">
    <thead><tr><th>Root</th><th>Source</th><th>Resource ids</th><th>Loaded</th><th></th></tr></thead>
    <tbody>
    {% for r in tf_roots %}
      <tr>
        <td><b>{{ r.name }}</b></td>
        <td class="mono small">{{ r.source }}{% if r.origin == 'repo' %} <span class="badge">repo sync</span>{% elif not r.source_path %} <span class="badge">upload</span>{% endif %}</td>
        <td>{{ r.resources }}</td>
        <td>{{ r.loaded_at | localtime }}</td>
        <td style="white-space: nowrap">
          {% if r.source_path %}
          <form class="inline" method="post" action="{{ url_for('terraform_reload', root_id=r.id) }}">
            <input type="hidden" name="csrf_token" value="{{ csrf_token }}">
            <button type="submit" class="secondary">Reload</button>
          </form>
          {% endif %}
          <form class="inline" method="post" action="{{ url_for('terraform_delete', root_id=r.id) }}"
                onsubmit="return confirm('Remove this Terraform root from IPLens? The state file is not touched.')">
            <input type="hidden" name="csrf_token" value="{{ csrf_token }}">
            <button class="danger" type="submit">Remove</button>
          </form>
        </td>
      </tr>
    {% else %}
      <tr><td colspan="5" class="muted">No Terraform roots loaded.</td></tr>
    {% endfor %}
    </tbody>
  </table>
  <form method="post" action="{{ url_for('terraform_add') }}" enctype="multipart/form-data" autocomplete="off">
    <input type="hidden" name="csrf_token" value="{{ csrf_token }}">
    <div class="row">
      <div><label for="tf-name">Root name</label>
        <input id="tf-name" name="name" size="24" maxlength="64" placeholder="e.g. root-a (default: file name)"></div>
      <div><label for="tf-files">Upload state file(s)</label>
        <input id="tf-files" name="files" type="file" multiple accept=".tfstate,.json,application/json"></div>
      <div><label for="tf-path">…or local path</label>
        <input id="tf-path" name="path" size="40" class="mono" placeholder="/path/to/root-a/terraform.tfstate"></div>
    </div>
    <p><button type="submit">Load</button>
      <span class="muted small">Loading a root name again replaces it.</span></p>
  </form>
</section>

<section class="card" id="tfrepos">
  <h2 style="margin-top: 0">Terraform repos</h2>
  <p class="muted">Add a local Terraform repository. IPLens scans its <span class="mono">.tf</span> /
    <span class="mono">.tfvars</span> files (without running terraform) for roots, environments
    (env folders, <span class="mono">*.tfvars</span>, workspaces) and backends, and guesses each
    environment's AWS account. After you confirm the mapping, <b>Sync</b> (and every Refresh of a mapped
    account) runs only <span class="mono">terraform init -input=false -lockfile=readonly</span>,
    <span class="mono">terraform workspace select</span> and <span class="mono">terraform show -json</span>
    with the mapped account's credentials and <span class="mono">TF_DATA_DIR</span> in the IPLens data
    directory: the repository is never modified, and plan / apply / import are never run. Only
    resource ids, addresses and types are kept. See <a href="{{ url_for('ownership_page') }}#terraform">Ownership</a>
    for sync status and drift. Terraform is an optional ownership source: enable the Terraform enrichment
    under <a href="#ownership">Ownership</a> to use it (and to re-sync mapped repos with every Refresh).</p>
  <table class="tf-repos">
    <thead><tr><th>Repository</th><th>Roots</th><th>Root × env</th><th>Synced pairs</th><th>Scanned</th><th></th></tr></thead>
    <tbody>
    {% for p in tf_repos %}
      <tr>
        <td class="mono small">{{ p.path }}</td>
        <td>{{ p.roots }}</td>
        <td>{{ p.envs }}</td>
        <td>{{ p.confirmed }}</td>
        <td>{{ p.discovered_at | localtime }}</td>
        <td style="white-space: nowrap">
          <a class="btn secondary" href="{{ url_for('settings_tfrepo', repo_id=p.id) }}">Review mapping</a>
          <form class="inline" method="post" action="{{ url_for('terraform_sync') }}" data-job="tfsync">
            <input type="hidden" name="csrf_token" value="{{ csrf_token }}">
            <input type="hidden" name="repo_id" value="{{ p.id }}">
            <input type="hidden" name="next" value="{{ url_for('settings_page') }}#tfrepos">
            <button type="submit" class="secondary"{% if not p.confirmed %} disabled title="Confirm the mapping first"{% endif %}>Sync</button>
          </form>
          <form class="inline" method="post" action="{{ url_for('tfrepo_delete', repo_id=p.id) }}"
                onsubmit="return confirm('Remove this repository and the roots its syncs loaded? The repository itself is not touched.')">
            <input type="hidden" name="csrf_token" value="{{ csrf_token }}">
            <button class="danger" type="submit">Remove</button>
          </form>
        </td>
      </tr>
    {% else %}
      <tr><td colspan="6" class="muted">No Terraform repos added.</td></tr>
    {% endfor %}
    </tbody>
  </table>
  <form method="post" action="{{ url_for('tfrepo_add') }}" autocomplete="off">
    <input type="hidden" name="csrf_token" value="{{ csrf_token }}">
    <div class="row">
      <div><label for="tfrepo-path">Local repository path</label>
        <input id="tfrepo-path" name="path" size="50" class="mono" placeholder="/path/to/infra-repo"></div>
    </div>
    <p><button type="submit">Add and scan</button></p>
  </form>
</section>

<div class="card muted">
  IPLens only performs read-only AWS calls (Describe*/List*/Get*). Minimal IAM permissions:
  <span class="mono">ec2:DescribeVpcs, ec2:DescribeSubnets, ec2:DescribeNetworkInterfaces,
  ec2:DescribeVpcEndpoints, lambda:ListFunctions, elasticloadbalancing:DescribeLoadBalancers</span>.
  Optional: <span class="mono">iam:ListAccountAliases</span> (account name in the header);
  <span class="mono">elasticloadbalancing:DescribeTargetGroups, elasticloadbalancing:DescribeTargetHealth,
  ec2:DescribeSecurityGroups</span> (connections and security group names on the Visual page);
  <span class="mono">elasticloadbalancing:DescribeTags, lambda:ListTags</span> (load balancer and
  Lambda tags); <span class="mono">tag:GetResources, cloudformation:ListStacks,
  cloudformation:ListStackResources</span> (ownership) and, when enabled,
  <span class="mono">cloudtrail:LookupEvents</span> (creator of unowned resources). The Extended view's Kafka nodes need <span class="mono">kafka:ListClustersV2</span>
  (Amazon MSK clusters) and <span class="mono">lambda:ListEventSourceMappings</span>; without them the
  source is skipped with a warning.
</div>
{% endblock %}