{% extends "base.html" %}
{% block title %}Settings{% endblock %}
{% block heading %}Settings{% endblock %}
{% block content %}
<div class="card form-card" id="caches">
  <div class="card-header">
    <h2>Caches</h2>
    <span class="badge-group">{% include "_cache_badges.html" %}</span>
  </div>
  <p class="muted">Security lookups are cached in the application database: NVD CVSS data per CVE (table <code>nvd_cache</code>), Canonical security data per CVE (<code>cve_metadata_cache</code>) and Amazon Linux updateinfo per repository (<code>amazon_updateinfo_cache</code>). An entry younger than its TTL is used without a request; an older one is refreshed on its next lookup and only used as a fallback when the source cannot be reached. Changing a TTL never deletes entries. Failed lookups are never cached.</p>
  <form method="post" action="/settings/cache-ttl">
    <div class="ttl-grid">
    {% for key, label in cache_ttl_labels.items() %}
    <div class="field{% if cache_ttl_errors.get(key) %} has-error{% endif %}">
      <label for="ttl_{{ key }}">{{ label }}</label>
      <input type="text" id="ttl_{{ key }}" name="{{ key }}" value="{{ cache_ttl_values.get(key, '') }}" autocomplete="off" spellcheck="false" size="8" data-cache-ttl="{{ key }}">
      {% if cache_ttl_errors.get(key) %}<div class="field-error">{{ cache_ttl_errors[key] }}</div>{% endif %}
    </div>
    {% endfor %}
    </div>
    <div class="hint">Hours (<code>24h</code>) or days (<code>30d</code>), between 1 hour and 365 days. Defaults: NVD 30d, Canonical 24h (1h while a release is under investigation), Amazon updateinfo 24h.{% if not cache_ttl_saved %} The defaults are in use.{% endif %}</div>
    <div class="form-actions">
      <button type="submit" name="action" value="save" class="btn btn-primary">Save TTLs</button>
      <button type="submit" name="action" value="reset" class="btn btn-secondary">Reset to Default</button>
    </div>
  </form>
  <p class="muted">Clear Security Cache empties all three caches (NVD, Canonical and Amazon updateinfo) and the in-memory lookup state.</p>
  <form method="post" action="/settings/clear-cache">
    <button type="submit" class="btn btn-secondary">Clear Security Cache</button>
  </form>
</div>
<div class="card form-card">
  <h2>Patch &amp; Download Settings</h2>
  <form method="post" action="/settings/staging">
    <div class="field{% if template_error %} has-error{% endif %}">
      <label for="template">Local Patch Download Directory</label>
      <input type="text" id="template" name="template" value="{{ staging_template }}" autocomplete="off">
      {% if template_error %}<div class="field-error">{{ template_error }}</div>{% endif %}
      <div class="hint">Must contain <code>${server_name}</code> and resolve to an absolute path (<code>~</code> is expanded). Default: <code>{{ default_staging_template }}</code>. Changes apply to future patch executions only.</div>
    </div>
    <dl class="kv staging-preview">
      <dt>Saved Template</dt><dd><code>{{ saved_template }}</code></dd>
      <dt>Resolved for {{ preview_name }}</dt><dd>{% if preview %}<code>{{ preview }}</code>{% else %}<span class="text-danger">{{ preview_error }}</span>{% endif %}</dd>
      <dt>Remote Staging</dt><dd><code>{{ remote_example }}</code> <span class="muted small">(fixed: /tmp/${server_name} on the server)</span></dd>
    </dl>
    <div class="form-actions">
      <button type="submit" name="action" value="save" class="btn btn-primary">Save</button>
      <button type="submit" name="action" value="reset" class="btn btn-secondary">Reset to Default</button>
    </div>
  </form>
  {% if server_names|length > 1 %}
  <form method="get" action="/settings" class="inline preview-form">
    <label for="server" class="muted small">Preview for server</label>
    <select id="server" name="server">{% for n in server_names %}<option value="{{ n }}"{% if n == preview_name %} selected{% endif %}>{{ n }}</option>{% endfor %}</select>
    <button type="submit" class="btn btn-secondary btn-sm">Preview</button>
  </form>
  {% endif %}
</div>
<div class="card form-card" id="nvd-key">
  <h2>NVD API Key</h2>
  <p class="muted">Optional key for faster CVSS lookups (50 instead of 5 NVD requests per 30 s). A key saved here is stored encrypted and is used instead of the <code>NVD_API_KEY</code> environment variable. Only its last 4 characters are ever shown.</p>
  <dl class="kv">
    <dt>Saved key</dt><dd>{% if nvd_key.error %}<span class="text-danger nvd-key-error">{{ nvd_key.error }}</span>{% elif nvd_key.saved %}<code class="nvd-key-masked">{{ nvd_key.masked }}</code>{% else %}<span class="muted">none</span>{% endif %}</dd>
    <dt>NVD_API_KEY env var</dt><dd>{% if nvd_key.env_set %}set{% if nvd_key.saved %} <span class="muted small">(overridden by the saved key)</span>{% endif %}{% else %}<span class="muted">not set</span>{% endif %}</dd>
    <dt>Status</dt><dd>{% include "_nvd_key_badge.html" %}</dd>
  </dl>
  <form method="post" action="/settings/nvd-key">
    <div class="field{% if nvd_key_error %} has-error{% endif %}">
      <label for="nvd_api_key">{{ "Replace with a new key" if nvd_key.saved else "NVD API key" }}</label>
      {# Never pre-filled: the key is never sent back to the browser. #}
      <input type="password" id="nvd_api_key" name="nvd_api_key" value="" autocomplete="off" spellcheck="false">
      {% if nvd_key_error %}<div class="field-error">{{ nvd_key_error }}</div>{% endif %}
    </div>
    <div class="form-actions">
      <button type="submit" name="action" value="save" class="btn btn-primary">{{ "Replace" if nvd_key.saved else "Save" }}</button>
      {% if nvd_key.testable %}<button type="submit" name="action" value="test" class="btn btn-secondary" title="Send one request with the key in use to NVD now">Test key</button>{% endif %}
      {% if nvd_key.saved %}<button type="submit" name="action" value="clear" class="btn btn-secondary">Clear</button>{% endif %}
    </div>
  </form>
</div>
<div class="card form-card" id="logging">
  <h2>Logging</h2>
  <form method="post" action="/settings/log-dir">
    <div class="field{% if log_dir_error %} has-error{% endif %}">
      <label for="log_dir_path">Log directory</label>
      <input type="text" id="log_dir_path" name="log_dir_path" value="{{ log_dir_value }}" autocomplete="off" spellcheck="false">
      {% if log_dir_error %}<div class="field-error">{{ log_dir_error }}</div>{% endif %}
      <div class="hint">Absolute path (<code>~</code> is expanded); it is created if needed and must be writable. Default: <code>{{ default_log_dir }}</code>.</div>
    </div>
    <dl class="kv">
      <dt>Current log file</dt><dd>{% if active_log_file %}<code class="log-file">{{ active_log_file }}</code>{% else %}<code class="log-file">{{ log_file }}</code> <span class="muted small">(file logging is not active in this process)</span>{% endif %}</dd>
      <dt>Rotation</dt><dd>{{ log_backups }} &times; {{ log_max_mb }} MB (oldest file is removed)</dd>
    </dl>
    <div class="form-actions">
      <button type="submit" name="action" value="save" class="btn btn-primary">Save</button>
      <button type="submit" name="action" value="reset" class="btn btn-secondary">Reset to Default</button>
    </div>
  </form>
</div>
<div class="card">
  <h2>Application</h2>
  <dl class="kv">
    <dt>Version</dt><dd>{{ version }}</dd>
    <dt>Database</dt><dd><code>{{ db_path }}</code></dd>
    <dt>SSH user</dt><dd>Per server (default <code>ubuntu</code>)</dd>
    <dt>SSH login</dt><dd>Per server: PEM key (default) or username + password via <code>sshpass</code>; passwords are stored per server, encrypted</dd>
    <dt>Encryption key</dt><dd><code>{{ secret_key_path }}</code> <span class="muted small">(mode 0600, never in the database; without it stored secrets must be entered again)</span></dd>
  </dl>
</div>
<div class="card">
  <h2>Security Data</h2>
  <p class="muted">Canonical security data is queried online per CVE during analysis. Each fetched CVE is also cached in the application database (see <a href="#caches">Caches</a> for the TTLs); an expired copy is used (and marked with its age) only when ubuntu.com cannot be reached.</p>
  <dl class="kv">
    <dt>Cache</dt><dd>table <code>cve_metadata_cache</code> in <code>{{ metadata_status.cache_db }}</code></dd>
    <dt>Cache TTL</dt><dd>{{ "%g"|format(metadata_status.cache_ttl_hours) }} hours ({{ "%g"|format(metadata_status.investigating_ttl_hours) }} hour{{ "" if metadata_status.investigating_ttl_hours == 1 else "s" }} while a release is under investigation) &mdash; <a href="#caches">change</a></dd>
    <dt>Requests</dt><dd>{{ "%g"|format(metadata_status.timeout_seconds) }} s timeout, {{ "%g"|format(metadata_status.pace_seconds) }} s apart, up to {{ metadata_status.attempts }} attempts with backoff; lookups pause for the rest of the run after {{ metadata_status.breaker_threshold }} consecutive failures</dd>
    <dt>Proxy</dt><dd>HTTPS_PROXY / NO_PROXY from the environment</dd>
  </dl>
</div>
<div class="card">
  <h2>APT Resolution</h2>
  <p class="muted">APT candidates and the .deb plan are resolved on this workstation against private package lists per Ubuntu release and architecture (release, -updates and -security pockets). Servers are only read (dpkg-query); the system APT configuration is never used or changed.</p>
  <dl class="kv">
    <dt>Private APT state</dt><dd><code>{{ apt_state_dir }}</code></dd>
    <dt>Refresh when older than</dt><dd>{{ "%g"|format(apt_max_age_hours) }} hours{% if not apt_max_age_hours %} (every analysis run){% endif %}</dd>
  </dl>
</div>
<div class="card danger-zone">
  <h2>Reset Database</h2>
  <p class="muted">Permanently removes servers, reports, analyses, and settings.</p>
  <form method="post" action="/settings/reset-database">
    <label for="reset_confirm_text">Type <strong>RESET</strong> to confirm</label>
    <input type="text" id="reset_confirm_text" name="confirm_text" autocomplete="off" data-required-text="RESET" placeholder="RESET">
    <button type="submit" class="btn btn-danger" data-enable-when-confirmed>Reset Database</button>
  </form>
</div>
{% endblock %}