{% extends "base.html" %}
{% from "partials/results_table.html" import results_table %}

{% block title %}Tools — Tsume{% endblock %}

{% block content %}
<div class="page-header">
  <div>
    <h1>Tools</h1>
    <p>Local file analysis — YARA scanning, IOC extraction, and Triage cloud detonation</p>
  </div>
</div>

{% if cache_pruned is not none %}
<div class="panel">
  <div class="panel__body">
    <div class="alert alert--success">Deleted {{ cache_pruned }} expired cache entr{{ "y" if cache_pruned == 1 else "ies" }}.</div>
  </div>
</div>
{% endif %}

<div class="panel">
  <div class="panel__header"><h2>YARA scan</h2><span class="tag">Local · offline</span></div>
  <div class="panel__body">
    <p class="helper-text">Scan a local file against YARA rules. Fully offline, no API calls.</p>
    <form method="post" action="/tools/scan" enctype="multipart/form-data" style="margin-top: var(--space-4);">
      <div class="field-row">
        <div class="field">
          <label for="scan-target">File to scan</label>
          <input type="file" id="scan-target" name="target" required>
        </div>
        <div class="field">
          <label for="scan-rules">YARA rule file (.yar/.yara)</label>
          <input type="file" id="scan-rules" name="rules" required>
        </div>
        <div class="field field--align-end">
          <button class="button button--primary" type="submit">Scan</button>
        </div>
      </div>
    </form>
  </div>
  {% if scan_error %}
  <div class="panel__body">
    <div class="alert alert--error">{{ scan_error }}</div>
  </div>
  {% elif scan_result %}
  {{ results_table([scan_result]) }}
  {% endif %}
</div>

<div class="panel">
  <div class="panel__header"><h2>Extract IOCs</h2><span class="tag">Local · offline</span></div>
  <div class="panel__body">
    <p class="helper-text">Pull hash/IP/URL/domain/CVE-shaped strings out of a PDF or email file.</p>
    <form method="post" action="/tools/extract" enctype="multipart/form-data" style="margin-top: var(--space-4);">
      <div class="field-row">
        <div class="field">
          <label for="extract-file">PDF (.pdf) or email (.eml)</label>
          <input type="file" id="extract-file" name="file" accept=".pdf,.eml" required>
        </div>
        <div class="field field--align-end">
          <button class="button button--primary" type="submit">Extract</button>
        </div>
      </div>
    </form>
  </div>
  {% if extract_error %}
  <div class="panel__body">
    <div class="alert alert--error">{{ extract_error }}</div>
  </div>
  {% elif extract_results is defined %}
  {% if extract_total %}
  <div class="table-scroll">
  <table class="data-table">
    <thead><tr><th>Type</th><th>Value</th></tr></thead>
    <tbody>
      {% for ioc_type, values in extract_results.items() %}
      {% for value in values %}
      <tr><td>{{ ioc_type.value }}</td><td class="mono">{{ value }}</td></tr>
      {% endfor %}
      {% endfor %}
    </tbody>
  </table>
  </div>
  {% else %}
  <div class="empty-state">
    <h3>No IOCs found</h3>
  </div>
  {% endif %}
  {% endif %}
</div>

<div class="panel panel--risk">
  <div class="panel__header"><h2>Detonate (Triage)</h2><span class="tag tag--risk">Cloud · risk</span></div>
  <div class="panel__body">
    <p class="helper-text">Upload a file to Triage's cloud sandbox for dynamic analysis.</p>
    <div class="alert alert--warning" style="margin-top: var(--space-3);">
      Depending on your Triage account tier, submitted samples may be <strong>public</strong> and visible to other Triage users.
    </div>
    <form method="post" action="/tools/detonate" enctype="multipart/form-data" style="margin-top: var(--space-4);">
      <div class="field-row">
        <div class="field">
          <label for="detonate-file">File to submit</label>
          <input type="file" id="detonate-file" name="file" required>
        </div>
        <div class="field">
          <label for="detonate-network">Network</label>
          <select id="detonate-network" name="network">
            <option value="internet">internet</option>
            <option value="drop">drop</option>
            <option value="tor">tor</option>
            <option value="vpn">vpn</option>
          </select>
        </div>
      </div>
      <div class="field" style="margin-top: var(--space-4);">
        <label>
          <input type="checkbox" name="confirm_public" value="1" required>
          I understand this sample may be publicly visible on Triage
        </label>
      </div>
      <div class="field" style="margin-top: var(--space-5);">
        <button class="button button--primary" type="submit">Submit for detonation</button>
      </div>
    </form>
  </div>

  {% if detonate_error %}
  <div class="panel__body">
    <div class="alert alert--error">{{ detonate_error }}</div>
  </div>
  {% endif %}

  {% if detonate_submission %}
  <div class="panel__body">
    <p>
      Submitted as <span class="mono">{{ detonate_submission.id }}</span>
      (status: {{ detonate_submission.status }}, visibility:
      {% if detonate_visibility == "public" %}<strong>PUBLIC</strong>
      {% elif detonate_visibility == "private" %}private
      {% else %}unknown{% endif %})
    </p>
    {% if detonate_visibility == "unknown" %}
    <div class="alert alert--warning">
      Triage didn't report a visibility flag for this submission — check your account settings at
      <a href="https://tria.ge" target="_blank" rel="noopener noreferrer">tria.ge</a> if you need to confirm privacy.
    </div>
    {% endif %}
    <p><a href="https://tria.ge/{{ detonate_submission.id }}" target="_blank" rel="noopener noreferrer">View on tria.ge ↗</a></p>
    <form method="post" action="/tools/detonate/status" style="margin-top: var(--space-3);">
      <input type="hidden" name="sample_id" value="{{ detonate_submission.id }}">
      <button class="button button--ghost" type="submit">Check status</button>
    </form>
  </div>
  {% endif %}

  {% if detonate_status %}
  <div class="panel__body">
    <form method="post" action="/tools/detonate/status">
      <input type="hidden" name="sample_id" value="{{ detonate_status_id }}">
      <p>Sample <span class="mono">{{ detonate_status_id }}</span>: status={{ detonate_status }}
        <button class="button button--ghost" type="submit">Refresh</button>
      </p>
    </form>
  </div>
  {% endif %}

  {% if detonate_status_result %}
  {{ results_table([detonate_status_result]) }}
  {% endif %}
</div>

<details class="panel details-panel">
  <summary class="panel__header">Maintenance<span class="tag">Local · offline</span></summary>
  <div class="panel__body">
    <p class="helper-text">Delete cache entries past their TTL. Still-fresh entries are left in place.</p>
    <form method="post" action="/tools/cache-prune" style="margin-top: var(--space-4);">
      <button class="button button--ghost" type="submit">Prune expired cache</button>
    </form>
  </div>
</details>
{% endblock %}