{% extends 'base.html' %}
{% from '_partials/page_header.html' import page_header %}
{% block title %}Networking · Security{% endblock %}
{% block content %}
    {{ page_header('Networking', tabs=tabs, active_tab='firewall') }}
    <div x-data="{ addOpen: false }">
        <div class="flex justify-between items-center mb-4">
            <p class="text-sm text-slate-500">{{ rules|length }} firewall rules ·
                {% if applied %}<span class="text-emerald-600">rules active</span>{% else %}<span class="text-slate-400">not applied yet — add a rule to activate</span>{% endif %}</p>
            <button @click="addOpen = true" class="inline-flex items-center gap-2 btn-primary px-3 py-1.5 rounded-md text-sm"><i data-lucide="plus" class="h-4 w-4"></i>Add rule</button>
        </div>

        <div class="mb-4 rounded-lg border border-slate-200 dark:border-slate-800 bg-slate-50 dark:bg-slate-800/50 px-5 py-3 text-xs text-slate-500">
            <span class="font-semibold text-slate-600 dark:text-slate-300">Always allowed, ahead of your rules:</span>
            {{ pinned | join(' · ') }} — so no rule here can lock you out of the device.
        </div>

        <div class="rounded-lg border border-slate-200 dark:border-slate-800 bg-white dark:bg-slate-900 overflow-hidden">
            <table class="w-full text-sm">
                <thead class="text-xs uppercase text-slate-500"><tr><th class="text-left px-5 py-2">Dir</th><th class="py-2 text-left">Source</th><th class="py-2 text-left">Destination</th><th class="py-2 text-left">Action</th><th class="py-2 text-left">State</th><th class="py-2 pr-5 text-right">Actions</th></tr></thead>
                <tbody>
                    {% for r in rules %}
                    <tr class="border-t border-slate-100 dark:border-slate-800">
                        <td class="px-5 py-2 font-mono text-xs uppercase">{{ r.direction }}</td>
                        <td class="py-2 font-mono">{{ r.source }}</td>
                        <td class="py-2 font-mono">{{ r.dest }}</td>
                        <td class="py-2"><span class="px-2 py-0.5 text-xs rounded {% if r.action == 'allow' %}bg-emerald-100 dark:bg-emerald-900/30 text-emerald-700{% else %}bg-red-100 dark:bg-red-900/30 text-red-700{% endif %}">{{ r.action }}</span></td>
                        <td class="py-2">{% if r.enabled %}<span class="text-emerald-600 text-xs">Active</span>{% else %}<span class="text-slate-400 text-xs">Disabled</span>{% endif %}</td>
                        <td class="py-2 pr-5 text-right">
                            <form method="post" action="{{ url_for('networking_firewall') }}" class="inline"><input type="hidden" name="action" value="toggle"><input type="hidden" name="rule_id" value="{{ r.id }}"><button class="text-xs px-2 py-1 rounded border border-slate-200 dark:border-slate-700">{% if r.enabled %}Disable{% else %}Enable{% endif %}</button></form>
                            <form method="post" action="{{ url_for('networking_firewall') }}" class="inline"><input type="hidden" name="action" value="delete"><input type="hidden" name="rule_id" value="{{ r.id }}"><button class="text-xs px-2 py-1 rounded text-red-600 hover:bg-red-50 dark:hover:bg-red-900/20">Delete</button></form>
                        </td>
                    </tr>
                    {% endfor %}
                </tbody>
            </table>
        </div>

        <div x-show="addOpen" x-transition.opacity class="fixed inset-0 z-40 bg-black/50 flex items-center justify-center p-4" style="display:none" @click.self="addOpen = false">
            <form method="post" action="{{ url_for('networking_firewall') }}" class="bg-white dark:bg-slate-900 rounded-lg shadow-xl max-w-md w-full p-6 space-y-4">
                <input type="hidden" name="action" value="add">
                <h3 class="font-semibold text-lg">Add firewall rule</h3>
                <div class="grid grid-cols-2 gap-3">
                    <div><label class="block text-xs text-slate-500 mb-1">Direction</label><select name="direction" class="w-full rounded-md border-slate-300 dark:border-slate-700 dark:bg-slate-800 text-sm"><option value="in">Inbound</option><option value="out">Outbound</option><option value="forward">Forward (routed through)</option></select></div>
                    <div><label class="block text-xs text-slate-500 mb-1">Action</label><select name="fw_action" class="w-full rounded-md border-slate-300 dark:border-slate-700 dark:bg-slate-800 text-sm"><option>allow</option><option>deny</option></select></div>
                </div>
                <div><label class="block text-xs text-slate-500 mb-1">Source</label><input name="source" value="any" class="w-full rounded-md border-slate-300 dark:border-slate-700 dark:bg-slate-800 text-sm font-mono"></div>
                <div><label class="block text-xs text-slate-500 mb-1">Destination</label><input name="dest" placeholder="tcp/443, udp/51820, tcp/2001-2024 or any" class="w-full rounded-md border-slate-300 dark:border-slate-700 dark:bg-slate-800 text-sm font-mono" required></div>
                <div class="flex justify-end gap-2"><button type="button" @click="addOpen = false" class="px-3 py-1.5 text-sm">Cancel</button><button class="btn-primary px-3 py-1.5 rounded-md text-sm">Add</button></div>
            </form>
        </div>
    </div>
    {# NAT is not offered in this release. The rule model, generation and
       validation are all in backends/firewall.py and the POST actions still
       work, so this is one panel to put back rather than a feature to
       rebuild. Filter and forward rules above are unaffected. #}
{% endblock %}