@extends('layouts.app')
@section('title','API Clients - NGBVD')

@section('content')
@include('integrations.partials.settings_style')
@php
    $clients = $clients ?? collect();
    $districts = $districts ?? collect();
    $partners = $partners ?? collect();
@endphp
<div class="ni-shell">
    <div class="ni-hero">
        <div>
            <span class="ni-kicker">Zero Trust Credential Management</span>
            <h2 class="ni-title">API Clients</h2>
            <p class="ni-subtitle">Create and manage dedicated credentials, data scopes, rate limits, signing controls and outbound partner URLs for approved systems.</p>
        </div>
        <div class="ni-actions">
            <a href="{{ url('/integrations') }}" class="btn ngbvd-btn-soft"><i class="ti-arrow-left"></i> Overview</a>
            <a href="{{ url('/integrations/logs') }}" class="btn ngbvd-btn-primary"><i class="ti-clipboard"></i> Sharing Logs</a>
        </div>
    </div>

    @if($errors->any())
        <div class="alert alert-danger">
            <strong>Please correct the highlighted API client settings.</strong>
            <ul class="mb-0">@foreach($errors->all() as $error)<li>{{ $error }}</li>@endforeach</ul>
        </div>
    @endif

    @if(session('new_api_client_secret') || session('message'))
        <div class="ni-secret">
            <i class="ti-key"></i>
            <div>
                <strong>{{ session('message') ?: 'API client created. Copy the secret now; it will not be shown again.' }}</strong>
                @if(session('new_api_client_key'))<br>Client Key: <code>{{ session('new_api_client_key') }}</code>@endif
                @if(session('new_api_client_secret'))<br>Client Secret: <code>{{ session('new_api_client_secret') }}</code>@endif
            </div>
        </div>
    @endif

    <div class="ni-layout-wide">
        <div class="ni-card">
            <div class="ni-card-body">
                <div class="ni-heading">
                    <div><h4>Registered API Clients</h4><p>Use separate clients for production, test and partner environments.</p></div>
                    <span class="ni-heading-icon"><i class="ti-server"></i></span>
                </div>
                <div class="ni-table-wrap">
                    <table class="table table-hover ni-table" data-datatable="false">
                        <thead>
                            <tr>
                                <th>Client</th>
                                <th>Client Key</th>
                                <th>Scopes</th>
                                <th>Zero Trust</th>
                                <th>Outbound URL</th>
                                <th>Status</th>
                            </tr>
                        </thead>
                        <tbody>
                        @forelse($clients as $client)
                            @php
                                $scopes = is_array($client->allowed_scopes) ? $client->allowed_scopes : preg_split('/[,\s]+/', (string)$client->allowed_scopes, -1, PREG_SPLIT_NO_EMPTY);
                                $selectedDistricts = preg_split('/[,\s]+/', (string) $client->allowed_district_ids, -1, PREG_SPLIT_NO_EMPTY);
                                $selectedDistrictNames = $districts->filter(function($district) use ($selectedDistricts) {
                                    return in_array((string) $district->id, array_map('strval', $selectedDistricts), true);
                                })->pluck('name')->values()->all();
                                $outboundUrl = $client->outbound_base_url ? rtrim($client->outbound_base_url, '/').'/'.ltrim($client->outbound_push_endpoint ?: '', '/') : null;
                            @endphp
                            <tr>
                                <td>
                                    <strong>{{ $client->name }}</strong><br>
                                    <small class="text-muted">{{ $client->system_name ?: 'External system' }}</small><br>
                                    <span class="ni-chip">{{ $client->integration_code ?: 'PARTNER_SYSTEM' }}</span>
                                </td>
                                <td>
                                    <code class="ni-code">{{ $client->client_key }}</code><br>
                                    <small class="text-muted">Secret hashed and hidden.</small>
                                </td>
                                <td>
                                    @forelse($scopes as $scope)<span class="ni-chip">{{ $scope }}</span>@empty<span class="text-muted">No scopes</span>@endforelse
                                    @if(!empty($client->allowed_district_ids))
                                        <br><small>Districts: {{ !empty($selectedDistrictNames) ? implode(', ', $selectedDistrictNames) : $client->allowed_district_ids }}</small>
                                    @endif
                                    @if(!empty($client->partner_id))
                                        @php $clientPartner = $partners->firstWhere('id', $client->partner_id); @endphp
                                        <br><small>Partner: {{ $clientPartner->name ?? ('ID '.$client->partner_id) }}</small>
                                    @endif
                                </td>
                                <td>
                                    <span class="ni-badge {{ $client->require_https ? 'ni-success' : 'ni-warning' }}">HTTPS {{ $client->require_https ? 'On' : 'Off' }}</span>
                                    <span class="ni-badge {{ $client->require_signed_requests ? 'ni-success' : 'ni-muted' }}">Signed {{ $client->require_signed_requests ? 'On' : 'Off' }}</span>
                                    <span class="ni-badge {{ $client->require_payload_encryption ? 'ni-success' : 'ni-muted' }}">Encryption {{ $client->require_payload_encryption ? 'On' : 'Off' }}</span>
                                    <br><small>Rate: {{ $client->rate_limit_per_minute ?: 60 }}/min | Window: {{ $client->signature_window_seconds ?: 300 }}s</small>
                                </td>
                                <td>
                                    @if($client->outbound_enabled && $outboundUrl)
                                        <span class="ni-badge ni-success">Enabled</span><br><small style="word-break:break-all">{{ $outboundUrl }}</small>
                                    @else
                                        <span class="ni-badge ni-danger">Not configured</span>
                                    @endif
                                </td>
                                <td>
                                    <span class="ni-badge {{ $client->is_active ? 'ni-success' : 'ni-danger' }}">{{ $client->is_active ? 'Active' : 'Inactive' }}</span><br>
                                    <small>{{ $client->last_used_at ? \Carbon\Carbon::parse($client->last_used_at)->format('d M Y H:i') : 'Never used' }}</small>
                                </td>
                            </tr>
                            <tr>
                                <td colspan="6">
                                    <details>
                                        <summary><strong>Edit client configuration</strong> <small class="text-muted">Scopes, IPs, data scope, rate limits and outbound URL only.</small></summary>
                                        <form method="POST" action="{{ url('/integrations/api-clients/'.$client->uuid) }}" class="mt-3">
                                            @csrf
                                            @method('PUT')
                                            <input type="hidden" name="is_active" value="0">
                                            <input type="hidden" name="outbound_enabled" value="0">
                                            <input type="hidden" name="outbound_verify_ssl" value="0">
                                            <input type="hidden" name="require_https" value="0">
                                            <input type="hidden" name="require_signed_requests" value="0">
                                            <input type="hidden" name="require_payload_encryption" value="0">

                                            <div class="row">
                                                <div class="col-md-4 form-group"><label>Client Name</label><input class="form-control" name="name" required value="{{ old('name', $client->name) }}"></div>
                                                <div class="col-md-4 form-group"><label>System Name</label><input class="form-control" name="system_name" required value="{{ old('system_name', $client->system_name) }}"></div>
                                                <div class="col-md-4 form-group">
                                                    <label>Integration Code</label>
                                                    <select class="form-control" name="integration_code">
                                                        @foreach(['UBOS_GBV_PORTAL'=>'UBOS GBV Portal','NSR'=>'National Single Registry','SAUTI'=>'Sauti','PARTNER_SYSTEM'=>'Other Partner System'] as $code=>$label)
                                                            <option value="{{ $code }}" {{ old('integration_code', $client->integration_code ?: 'PARTNER_SYSTEM') === $code ? 'selected' : '' }}>{{ $label }}</option>
                                                        @endforeach
                                                    </select>
                                                </div>
                                            </div>

                                            <div class="row">
                                                <div class="col-md-6 form-group"><label>Allowed Scopes</label><textarea class="form-control" rows="3" name="allowed_scopes">{{ old('allowed_scopes', $client->allowed_scopes) }}</textarea><small>Example: reference_data.read,incident_statistics.read,ubos.push,data_scope.district</small></div>
                                                <div class="col-md-6 form-group"><label>Allowed IPs / CIDR</label><textarea class="form-control" rows="3" name="allowed_ips">{{ old('allowed_ips', $client->allowed_ips) }}</textarea><small>Example: 41.210.143.163, 10.0.0.0/24</small></div>
                                            </div>

                                            <div class="row">
                                                <div class="col-md-6 form-group">
                                                    <label>Allowed Districts</label>
                                                    @php $oldDistricts = old('allowed_district_ids', $selectedDistricts); @endphp
                                                    <select class="form-control" name="allowed_district_ids[]" multiple size="8">
                                                        @foreach($districts as $district)
                                                            <option value="{{ $district->id }}" {{ in_array((string) $district->id, array_map('strval', (array) $oldDistricts), true) ? 'selected' : '' }}>
                                                                {{ $district->name }}
                                                            </option>
                                                        @endforeach
                                                    </select>
                                                    <small class="text-muted">Hold Ctrl to select multiple districts. Required when using <code>data_scope.district</code>.</small>
                                                </div>
                                                <div class="col-md-6 form-group">
                                                    <label>Partner</label>
                                                    <select class="form-control" name="partner_id">
                                                        <option value="">No partner restriction</option>
                                                        @foreach($partners as $partner)
                                                            <option value="{{ $partner->id }}" {{ (string) old('partner_id', $client->partner_id) === (string) $partner->id ? 'selected' : '' }}>
                                                                {{ $partner->name }}
                                                            </option>
                                                        @endforeach
                                                    </select>
                                                    <small class="text-muted">Required when using <code>data_scope.partner</code>. Only one partner is allowed.</small>
                                                </div>
                                            </div>

                                            <div class="row">
                                                <div class="col-md-4 form-group"><label>Rate Limit / Minute</label><input type="number" min="1" max="10000" class="form-control" name="rate_limit_per_minute" value="{{ old('rate_limit_per_minute', $client->rate_limit_per_minute ?: 60) }}"></div>
                                                <div class="col-md-4 form-group"><label>Signature Window Seconds</label><input type="number" min="60" max="3600" class="form-control" name="signature_window_seconds" value="{{ old('signature_window_seconds', $client->signature_window_seconds ?: 300) }}"></div>
                                                <div class="col-md-4 form-group"><label>API Version</label><input class="form-control" name="outbound_api_version" value="{{ old('outbound_api_version', $client->outbound_api_version ?: 'v2') }}"></div>
                                            </div>

                                            <div class="row">
                                                <div class="col-md-3 form-group"><label><input type="checkbox" name="is_active" value="1" {{ old('is_active', $client->is_active) ? 'checked' : '' }}> Active</label></div>
                                                <div class="col-md-3 form-group"><label><input type="checkbox" name="require_https" value="1" {{ old('require_https', is_null($client->require_https) ? true : $client->require_https) ? 'checked' : '' }}> Require HTTPS</label></div>
                                                <div class="col-md-3 form-group"><label><input type="checkbox" name="require_signed_requests" value="1" {{ old('require_signed_requests', $client->require_signed_requests) ? 'checked' : '' }}> Require Signed Requests</label></div>
                                                <div class="col-md-3 form-group"><label><input type="checkbox" name="require_payload_encryption" value="1" {{ old('require_payload_encryption', $client->require_payload_encryption) ? 'checked' : '' }}> Require Payload Encryption</label></div>
                                            </div>

                                            <hr>
                                            <h5>Outbound Sharing Destination</h5>
                                            <div class="row">
                                                <div class="col-md-5 form-group"><label>Outbound Base URL</label><input class="form-control" name="outbound_base_url" value="{{ old('outbound_base_url', $client->outbound_base_url) }}" placeholder="https://partner-api.example.go.ug"></div>
                                                <div class="col-md-3 form-group"><label>Push Endpoint</label><input class="form-control" name="outbound_push_endpoint" value="{{ old('outbound_push_endpoint', $client->outbound_push_endpoint ?: '/api/v2/incidents') }}"></div>
                                                <div class="col-md-2 form-group"><label>Timeout</label><input type="number" min="5" max="300" class="form-control" name="outbound_timeout" value="{{ old('outbound_timeout', $client->outbound_timeout ?: 30) }}"></div>
                                                <div class="col-md-2 form-group"><label><input type="checkbox" name="outbound_enabled" value="1" {{ old('outbound_enabled', $client->outbound_enabled) ? 'checked' : '' }}> Enable</label><br><label><input type="checkbox" name="outbound_verify_ssl" value="1" {{ old('outbound_verify_ssl', is_null($client->outbound_verify_ssl) ? true : $client->outbound_verify_ssl) ? 'checked' : '' }}> Verify SSL</label></div>
                                            </div>

                                            <div class="form-group"><label>Notes</label><textarea class="form-control" rows="2" name="outbound_notes">{{ old('outbound_notes', $client->outbound_notes) }}</textarea></div>
                                            <button class="btn ngbvd-btn-primary"><i class="ti-save"></i> Save Configuration</button>
                                        </form>
                                    </details>
                                </td>
                            </tr>
                        @empty
                            <tr><td colspan="6"><div class="ni-empty"><i class="ti-key"></i><strong>No API clients registered</strong><span>Create the first authorised client using the panel on the right.</span></div></td></tr>
                        @endforelse
                        </tbody>
                    </table>
                </div>
            </div>
        </div>

        <div class="ni-card ni-panel ni-filter-card">
            <div class="ni-card-body">
                <div class="ni-heading"><div><h4>Create API Client</h4><p>The generated secret is displayed once only.</p></div><span class="ni-heading-icon"><i class="ti-plus"></i></span></div>
                <form method="POST" action="{{ url('/integrations/api-clients') }}">
                    @csrf
                    <input type="hidden" name="is_active" value="1">
                    <input type="hidden" name="outbound_verify_ssl" value="1">
                    <input type="hidden" name="require_https" value="1">

                    <div class="form-group"><label>Client Name</label><input class="form-control" name="name" required placeholder="e.g. UBOS Production Client"></div>
                    <div class="form-group"><label>System Name</label><input class="form-control" name="system_name" required placeholder="UBOS GBV Portal"></div>
                    <div class="form-group"><label>Integration Code</label><select class="form-control" name="integration_code"><option value="UBOS_GBV_PORTAL">UBOS GBV Portal</option><option value="NSR">National Single Registry</option><option value="SAUTI">Sauti</option><option value="PARTNER_SYSTEM">Other Partner System</option></select></div>
                    <div class="form-group"><label>Allowed Scopes</label><textarea class="form-control" rows="4" name="allowed_scopes">reference_data.read,incident_statistics.read,ubos.push,data_scope.national</textarea><small>Use the smallest required scopes. Example district scope: data_scope.district.</small></div>
                    <div class="form-group"><label>Allowed IPs / CIDR</label><textarea class="form-control" rows="2" name="allowed_ips" placeholder="Optional comma-separated IP addresses or CIDR ranges"></textarea></div>
                    <div class="form-group">
                        <label>Allowed Districts</label>
                        <select class="form-control" name="allowed_district_ids[]" multiple size="8">
                            @foreach($districts as $district)
                                <option value="{{ $district->id }}" {{ in_array((string) $district->id, array_map('strval', (array) old('allowed_district_ids', [])), true) ? 'selected' : '' }}>
                                    {{ $district->name }}
                                </option>
                            @endforeach
                        </select>
                        <small class="text-muted">Hold Ctrl to select multiple districts. Required when using <code>data_scope.district</code>.</small>
                    </div>
                    <div class="form-group">
                        <label>Partner</label>
                        <select class="form-control" name="partner_id">
                            <option value="">No partner restriction</option>
                            @foreach($partners as $partner)
                                <option value="{{ $partner->id }}" {{ (string) old('partner_id') === (string) $partner->id ? 'selected' : '' }}>
                                    {{ $partner->name }}
                                </option>
                            @endforeach
                        </select>
                        <small class="text-muted">Required when using <code>data_scope.partner</code>. Only one partner is allowed.</small>
                    </div>

                    <div class="row">
                        <div class="col-md-6 form-group"><label>Rate Limit / Minute</label><input type="number" min="1" max="10000" class="form-control" name="rate_limit_per_minute" value="60"></div>
                        <div class="col-md-6 form-group"><label>Signature Window Seconds</label><input type="number" min="60" max="3600" class="form-control" name="signature_window_seconds" value="300"></div>
                    </div>

                    <div class="form-group"><label><input type="checkbox" name="require_signed_requests" value="1"> Require signed requests</label></div>
                    <div class="form-group"><label><input type="checkbox" name="require_payload_encryption" value="1"> Require encrypted payloads</label></div>

                    <hr>
                    <h5>Outbound Sharing Destination</h5>
                    <div class="form-group"><label><input type="checkbox" name="outbound_enabled" value="1"> Enable outbound sharing</label></div>
                    <div class="form-group"><label>Outbound Base URL</label><input class="form-control" name="outbound_base_url" placeholder="https://partner-api.example.go.ug"></div>
                    <div class="form-group"><label>Push Endpoint</label><input class="form-control" name="outbound_push_endpoint" value="/api/v2/incidents"></div>
                    <div class="row"><div class="col-md-6 form-group"><label>API Version</label><input class="form-control" name="outbound_api_version" value="v2"></div><div class="col-md-6 form-group"><label>Timeout Seconds</label><input type="number" min="5" max="300" class="form-control" name="outbound_timeout" value="30"></div></div>
                    <div class="form-group"><label><input type="checkbox" name="outbound_verify_ssl" value="1" checked> Verify SSL certificate</label></div>
                    <button class="btn ngbvd-btn-primary btn-block"><i class="ti-save"></i> Create Client</button>
                </form>
            </div>
        </div>
    </div>
</div>
@endsection