<?php
error_reporting(E_ALL);
ini_set('display_errors', 0);
ini_set('log_errors', 1);

require_once __DIR__ . '/../config.php';
require_once __DIR__ . '/../includes/Database.php';
require_once __DIR__ . '/../includes/Auth.php';
require_once __DIR__ . '/../includes/Notifier.php';
require_once __DIR__ . '/../includes/I18n.php';

$auth = new Auth();
$auth->requireAdmin();
I18n::init();

$db = Database::getInstance();
$appTitle = $db->getSetting('app_title', 'UniFi Voucher System');

$error = '';
$success = '';

if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['save'])) {
    if (!$auth->validateCsrfToken($_POST['csrf_token'] ?? '')) {
        $error = __('error_csrf');
    } else {
        $db->setSetting('enforce_2fa_admins',   isset($_POST['enforce_2fa_admins']) ? '1' : '0');
        $db->setSetting('session_driver',       ($_POST['session_driver'] ?? 'php') === 'db' ? 'db' : 'php');
        $cm = in_array($_POST['captcha_mode'] ?? 'off', ['off','math','hcaptcha'], true) ? $_POST['captcha_mode'] : 'off';
        $db->setSetting('captcha_mode',         $cm);
        $db->setSetting('captcha_site_key',     trim($_POST['captcha_site_key'] ?? ''));
        if (!empty($_POST['captcha_secret'])) { $db->setSetting('captcha_secret', trim($_POST['captcha_secret'])); }
        $db->setSetting('sms_enabled',  isset($_POST['sms_enabled']) ? '1' : '0');
        $db->setSetting('twilio_sid',   trim($_POST['twilio_sid'] ?? ''));
        $db->setSetting('twilio_from',  trim($_POST['twilio_from'] ?? ''));
        if (!empty($_POST['twilio_token'])) { $db->setSetting('twilio_token', trim($_POST['twilio_token'])); }
        $db->setSetting('oidc_enabled',      isset($_POST['oidc_enabled']) ? '1' : '0');
        $db->setSetting('oidc_name',         trim($_POST['oidc_name'] ?? 'SSO'));
        $db->setSetting('oidc_client_id',    trim($_POST['oidc_client_id'] ?? ''));
        $db->setSetting('oidc_auth_url',     trim($_POST['oidc_auth_url'] ?? ''));
        $db->setSetting('oidc_token_url',    trim($_POST['oidc_token_url'] ?? ''));
        $db->setSetting('oidc_userinfo_url', trim($_POST['oidc_userinfo_url'] ?? ''));
        $db->setSetting('oidc_scopes',       trim($_POST['oidc_scopes'] ?? 'openid profile email'));
        if (!empty($_POST['oidc_client_secret'])) { $db->setSetting('oidc_client_secret', trim($_POST['oidc_client_secret'])); }
        $db->setSetting('user_daily_voucher_limit', max(0, (int)($_POST['user_daily_voucher_limit'] ?? 0)));
        $db->setSetting('trusted_proxy',        trim($_POST['trusted_proxy'] ?? ''));
        $db->setSetting('webhook_enabled',      isset($_POST['webhook_enabled']) ? '1' : '0');
        $db->setSetting('webhook_url',          trim($_POST['webhook_url'] ?? ''));
        $db->setSetting('cleanup_expired_days', max(0, (int)($_POST['cleanup_expired_days'] ?? 0)));
        $db->setSetting('cleanup_audit_days',   max(0, (int)($_POST['cleanup_audit_days'] ?? 0)));
        $db->setSetting('cleanup_login_days',   max(0, (int)($_POST['cleanup_login_days'] ?? 30)));
        $auth->writeAuditLog($_SESSION['user_id'], 'settings_update', 'config', null, 'Integration/Wartung gespeichert');
        $success = __('settings_saved');
    }
}

if (isset($_GET['test_webhook']) && isset($_GET['token']) && $auth->validateCsrfToken($_GET['token'])) {
    Notifier::send('✅ Test-Benachrichtigung vom UniFi Voucher System.', ['type' => 'test']);
    $success = __('int_webhook_test_sent');
}

$enforce2fa        = $db->getSetting('enforce_2fa_admins', '0') === '1';
$sessionDriver     = $db->getSetting('session_driver', 'php');
$captchaMode       = $db->getSetting('captcha_mode', 'off');
$captchaSiteKey    = $db->getSetting('captcha_site_key', '');
$captchaSecretSet  = $db->getSetting('captcha_secret', '') !== '';
$smsEnabled        = $db->getSetting('sms_enabled', '0') === '1';
$twilioSid         = $db->getSetting('twilio_sid', '');
$twilioFrom        = $db->getSetting('twilio_from', '');
$twilioTokenSet    = $db->getSetting('twilio_token', '') !== '';
$oidcEnabled       = $db->getSetting('oidc_enabled', '0') === '1';
$oidcName          = $db->getSetting('oidc_name', 'SSO');
$oidcClientId      = $db->getSetting('oidc_client_id', '');
$oidcAuthUrl       = $db->getSetting('oidc_auth_url', '');
$oidcTokenUrl      = $db->getSetting('oidc_token_url', '');
$oidcUserinfoUrl   = $db->getSetting('oidc_userinfo_url', '');
$oidcScopes        = $db->getSetting('oidc_scopes', 'openid profile email');
$oidcSecretSet     = $db->getSetting('oidc_client_secret', '') !== '';
$dailyLimit        = (int)$db->getSetting('user_daily_voucher_limit', 0);
$trustedProxy      = $db->getSetting('trusted_proxy', '');
$webhookEnabled    = $db->getSetting('webhook_enabled', '0') === '1';
$webhookUrl        = $db->getSetting('webhook_url', '');
$cleanupExpired    = (int)$db->getSetting('cleanup_expired_days', 0);
$cleanupAudit      = (int)$db->getSetting('cleanup_audit_days', 0);
$cleanupLogin      = (int)$db->getSetting('cleanup_login_days', 30);
$lastCleanup       = $db->getSetting('last_cleanup', '');
$csrf = $auth->getCsrfToken();
$currentPage = 'integrations';
$adminBase   = '';
?>
<!DOCTYPE html>
<html lang="<?= I18n::getLanguage() ?>">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title><?= __('int_title') ?> – <?= htmlspecialchars($appTitle) ?></title>
<?php require __DIR__ . '/../includes/admin_nav.php'; ?>
<div class="page-header">
    <div>
        <h1 class="page-title"><?= __('int_title') ?></h1>
        <p class="page-subtitle"><?= __('int_subtitle') ?></p>
    </div>
</div>

<?php if ($error): ?><div class="alert alert-error"><?= htmlspecialchars($error) ?></div><?php endif; ?>
<?php if ($success): ?><div class="alert alert-ok"><?= htmlspecialchars($success) ?></div><?php endif; ?>

<form method="post">
<input type="hidden" name="csrf_token" value="<?= htmlspecialchars($csrf) ?>">

<div class="card">
    <h2><?= __('int_security') ?></h2>
    <p class="muted"><?= __('int_security_hint') ?></p>
    <label class="chk"><input type="checkbox" name="enforce_2fa_admins" <?= $enforce2fa ? 'checked' : '' ?>> <?= __('int_enforce_2fa') ?></label>
    <label><?= __('int_daily_limit') ?></label>
    <input class="input" type="number" min="0" name="user_daily_voucher_limit" value="<?= $dailyLimit ?>" style="max-width:200px;">
    <label><?= __('int_session_driver') ?></label>
    <select class="input" name="session_driver" style="max-width:340px;">
        <option value="php" <?= $sessionDriver==='php'?'selected':'' ?>><?= __('int_session_php') ?></option>
        <option value="db"  <?= $sessionDriver==='db'?'selected':'' ?>><?= __('int_session_db') ?></option>
    </select>
    <label><?= __('int_captcha') ?></label>
    <select class="input" name="captcha_mode" style="max-width:340px;">
        <option value="off"      <?= $captchaMode==='off'?'selected':'' ?>><?= __('int_captcha_off') ?></option>
        <option value="math"     <?= $captchaMode==='math'?'selected':'' ?>><?= __('int_captcha_math') ?></option>
        <option value="hcaptcha" <?= $captchaMode==='hcaptcha'?'selected':'' ?>>hCaptcha</option>
    </select>
    <div class="row3" style="margin-top:10px;">
        <div><label>hCaptcha Site-Key</label><input class="input" type="text" name="captcha_site_key" value="<?= htmlspecialchars($captchaSiteKey) ?>"></div>
        <div><label>hCaptcha Secret<?= $captchaSecretSet ? __('int_secret_set') : '' ?></label><input class="input" type="password" name="captcha_secret" placeholder="<?= $captchaSecretSet ? __('int_secret_placeholder') : '' ?>"></div>
    </div>
</div>

<div class="card">
    <h2><?= __('int_proxy') ?></h2>
    <p class="muted"><?= __('int_proxy_hint') ?> <code>X-Forwarded-For</code> <?= __('int_proxy_hint2') ?></p>
    <input class="input" type="text" name="trusted_proxy" value="<?= htmlspecialchars($trustedProxy) ?>" placeholder="z.B. 10.0.0.1, 172.18.0.1">
</div>

<div class="card">
    <h2><?= __('int_webhook') ?></h2>
    <p class="muted"><?= __('int_webhook_hint') ?></p>
    <label class="chk"><input type="checkbox" name="webhook_enabled" <?= $webhookEnabled ? 'checked' : '' ?>> <?= __('int_webhook_active') ?></label>
    <label><?= __('int_webhook_url') ?></label>
    <input class="input" type="url" name="webhook_url" value="<?= htmlspecialchars($webhookUrl) ?>" placeholder="https://hooks.slack.com/services/…">
    <div style="margin-top:12px;">
        <a class="btn btn-secondary" href="?test_webhook=1&token=<?= urlencode($csrf) ?>"><?= __('int_webhook_test') ?></a>
    </div>
</div>

<div class="card">
    <h2><?= __('int_sms') ?></h2>
    <p class="muted"><?= __('int_sms_hint') ?></p>
    <label class="chk"><input type="checkbox" name="sms_enabled" <?= $smsEnabled ? 'checked' : '' ?>> <?= __('int_sms_active') ?></label>
    <div class="row3" style="margin-top:10px;">
        <div><label>Account SID</label><input class="input" type="text" name="twilio_sid" value="<?= htmlspecialchars($twilioSid) ?>"></div>
        <div><label>Auth Token<?= $twilioTokenSet ? __('int_secret_set') : '' ?></label><input class="input" type="password" name="twilio_token" placeholder="<?= $twilioTokenSet ? __('int_secret_placeholder') : '' ?>"></div>
        <div><label><?= __('int_sms_from') ?></label><input class="input" type="text" name="twilio_from" value="<?= htmlspecialchars($twilioFrom) ?>" placeholder="+49…"></div>
    </div>
</div>

<div class="card">
    <h2><?= __('int_sso') ?></h2>
    <p class="muted"><?= __('int_sso_hint') ?> <code><?= htmlspecialchars(((!empty($_SERVER['HTTPS'])&&$_SERVER['HTTPS']!=='off')?'https':'http').'://'.$_SERVER['HTTP_HOST'].rtrim(dirname($_SERVER['SCRIPT_NAME']),'/').'/../oidc_callback.php') ?></code></p>
    <label class="chk"><input type="checkbox" name="oidc_enabled" <?= $oidcEnabled ? 'checked' : '' ?>> <?= __('int_sso_active') ?></label>
    <div class="row3" style="margin-top:10px;">
        <div><label><?= __('int_sso_button') ?></label><input class="input" type="text" name="oidc_name" value="<?= htmlspecialchars($oidcName) ?>"></div>
        <div><label>Client ID</label><input class="input" type="text" name="oidc_client_id" value="<?= htmlspecialchars($oidcClientId) ?>"></div>
        <div><label>Client Secret<?= $oidcSecretSet ? __('int_secret_set') : '' ?></label><input class="input" type="password" name="oidc_client_secret" placeholder="<?= $oidcSecretSet ? __('int_secret_placeholder') : '' ?>"></div>
    </div>
    <label>Authorization Endpoint</label><input class="input" type="url" name="oidc_auth_url" value="<?= htmlspecialchars($oidcAuthUrl) ?>" placeholder="https://idp/authorize">
    <label>Token Endpoint</label><input class="input" type="url" name="oidc_token_url" value="<?= htmlspecialchars($oidcTokenUrl) ?>" placeholder="https://idp/token">
    <label>Userinfo Endpoint</label><input class="input" type="url" name="oidc_userinfo_url" value="<?= htmlspecialchars($oidcUserinfoUrl) ?>" placeholder="https://idp/userinfo">
    <label>Scopes</label><input class="input" type="text" name="oidc_scopes" value="<?= htmlspecialchars($oidcScopes) ?>">
</div>

<div class="card">
    <h2><?= __('int_cleanup') ?></h2>
    <p class="muted"><?= __('int_cleanup_hint') ?> <code>cron_cleanup.php</code> <?= __('int_cleanup_hint2') ?>
        <?php if ($lastCleanup): ?><br><?= __('int_cleanup_last') ?> <?= htmlspecialchars($lastCleanup) ?><?php endif; ?>
    </p>
    <div class="row">
        <div><label><?= __('int_cleanup_expired') ?></label><input class="input" type="number" min="0" name="cleanup_expired_days" value="<?= $cleanupExpired ?>"></div>
        <div><label><?= __('int_cleanup_audit') ?></label><input class="input" type="number" min="0" name="cleanup_audit_days" value="<?= $cleanupAudit ?>"></div>
        <div><label><?= __('int_cleanup_logins') ?></label><input class="input" type="number" min="0" name="cleanup_login_days" value="<?= $cleanupLogin ?>"></div>
    </div>
</div>

<button class="btn btn-primary" type="submit" name="save"><?= __('btn_save') ?></button>
</form>

</main>
<script src="../assets/global.js"></script>
</body>
</html>