{% extends "base.html" %}
{% block title %}BBS Directory Admin — {{ config.BBS_NAME }}{% endblock %}

{% block content %}
<div class="container my-4">
  <div class="d-flex align-items-center justify-content-between mb-3">
    <h2 class="mb-0"><i class="bi bi-gear-fill"></i> BBS Directory Admin</h2>
    <a href="{{ url_for('peers.index') }}" class="btn btn-outline-secondary btn-sm">
      <i class="bi bi-arrow-left"></i> Back to Directory
    </a>
  </div>

  <!-- Pending submissions -->
  <!-- Security fix (templates audit): p.web_url below is submitted by any
       logged-in user via peers.submit with no scheme validation on save
       (web/peers.py) and rendered here for the SYSOP to review before
       approving. Without the scheme guard, a javascript: URI would have
       executed in the reviewing admin's own session on click -- a
       privilege-escalation path from any registered user straight into
       an admin browser session. Only http(s) is link-ified. -->
  {% set pending = peers | selectattr('is_approved', 'equalto', False) | list %}
  {% if pending %}
  <div class="card border-warning mb-4 shadow-sm">
    <div class="card-header bg-warning text-dark fw-semibold">
      <i class="bi bi-hourglass-split"></i> Pending Submissions ({{ pending|length }})
    </div>
    <div class="card-body p-0">
      <table class="table table-sm mb-0">
        <thead><tr>
          <th>Name</th><th>Telnet</th><th>Web</th><th>Location</th><th>Software</th><th>Description</th><th></th>
        </tr></thead>
        <tbody>
        {% for p in pending %}
        <tr>
          <td><strong>{{ p.name }}</strong></td>
          <td><code>{{ p.hostname }}{% if p.telnet_port and p.telnet_port != 23 %}:{{ p.telnet_port }}{% endif %}</code></td>
          <td>{% if p.web_url %}{% set _pw = p.web_url.strip() %}{% if _pw.lower().startswith('http://') or _pw.lower().startswith('https://') %}<a href="{{ _pw }}" target="_blank" rel="noopener">{{ _pw[:40] }}</a>{% else %}{{ _pw[:40] }}{% endif %}{% endif %}</td>
          <td><small>{{ p.location or '—' }}</small></td>
          <td><small>{{ p.software or '—' }}</small></td>
          <td><small class="text-muted">{{ (p.description or '')[:60] }}</small></td>
          <td class="text-end text-nowrap">
            <form method="post" class="d-inline">
              <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
              <input type="hidden" name="action" value="approve">
              <input type="hidden" name="peer_id" value="{{ p.id }}">
              <button class="btn btn-success btn-sm">Approve</button>
            </form>
            <form method="post" class="d-inline ms-1">
              <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
              <input type="hidden" name="action" value="delete">
              <input type="hidden" name="peer_id" value="{{ p.id }}">
              <button class="btn btn-outline-danger btn-sm"
                      onclick="return confirm('Reject and delete {{ p.name }}?')">Reject</button>
            </form>
          </td>
        </tr>
        {% endfor %}
        </tbody>
      </table>
    </div>
  </div>
  {% endif %}

  <!-- Approved local entries -->
  {% set approved = peers | selectattr('is_approved', 'equalto', True) | list %}
  <div class="card shadow-sm mb-4">
    <div class="card-header">
      <span><i class="bi bi-hdd-network"></i> Local Entries ({{ approved|length }})</span>
    </div>
    <div class="card-body p-0">
    {% if approved %}
      <table class="table table-sm mb-0">
        <thead><tr>
          <th>Status</th><th>Name</th><th>Telnet</th><th>Web</th>
          <th>Location</th><th>Software</th><th>FTN</th><th></th>
        </tr></thead>
        <tbody>
        {% for p in approved %}
        <tr {% if not p.is_active %}class="text-muted"{% endif %}>
          <td>
            {% if p.is_active %}<span class="badge bg-success">on</span>
            {% else %}<span class="badge bg-secondary">off</span>{% endif %}
          </td>
          <td><strong>{{ p.name }}</strong>
            {% if p.description %}<br><small class="text-muted">{{ p.description[:60] }}</small>{% endif %}
          </td>
          <td><code>{{ p.hostname }}{% if p.telnet_port and p.telnet_port != 23 %}:{{ p.telnet_port }}{% endif %}</code></td>
          <td>{% if p.web_url %}{% set _pw2 = p.web_url.strip() %}{% if _pw2.lower().startswith('http://') or _pw2.lower().startswith('https://') %}<a href="{{ _pw2 }}" target="_blank" rel="noopener" class="small">link</a>{% endif %}{% endif %}</td>
          <td><small>{{ p.location or '' }}</small></td>
          <td><small>{{ p.software or '' }}</small></td>
          <td><small class="text-muted">{{ p.ftn_address or '' }}</small></td>
          <td class="text-nowrap">
            <button class="btn btn-link btn-sm p-0 me-1"
                    data-bs-toggle="modal" data-bs-target="#editModal"
                    data-peer-id="{{ p.id }}"
                    data-name="{{ p.name | e }}"
                    data-hostname="{{ p.hostname | e }}"
                    data-telnet-port="{{ p.telnet_port or 23 }}"
                    data-web-url="{{ p.web_url or '' | e }}"
                    data-location="{{ p.location or '' | e }}"
                    data-software="{{ p.software or '' | e }}"
                    data-ftn-address="{{ p.ftn_address or '' | e }}"
                    data-description="{{ p.description or '' | e }}"
                    data-is-active="{{ '1' if p.is_active else '' }}"
                    onclick="fillEditModal(this)">edit</button>
            <form method="post" class="d-inline">
              <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
              <input type="hidden" name="action" value="toggle">
              <input type="hidden" name="peer_id" value="{{ p.id }}">
              <button class="btn btn-link btn-sm p-0 me-1">{{ 'disable' if p.is_active else 'enable' }}</button>
            </form>
            <form method="post" class="d-inline">
              <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
              <input type="hidden" name="action" value="delete">
              <input type="hidden" name="peer_id" value="{{ p.id }}">
              <button class="btn btn-link btn-sm text-danger p-0"
                      onclick="return confirm('Delete {{ p.name }}?')">delete</button>
            </form>
          </td>
        </tr>
        {% endfor %}
        </tbody>
      </table>
    {% else %}
      <div class="p-3 text-muted">No local entries yet. <a href="{{ url_for('peers.submit') }}">Add one</a>.</div>
    {% endif %}
    </div>
  </div>

  <!-- External source stats + manual refresh -->
  <div class="card shadow-sm">
    <div class="card-header"><i class="bi bi-cloud-download"></i> External Sources</div>
    <div class="card-body p-0">
      <table class="table table-sm mb-0">
        <thead><tr><th>Source</th><th>Entries</th><th>Last Refreshed</th><th></th></tr></thead>
        <tbody>
        {% for src, s in ext_stats.items() %}
        <tr>
          <td><strong>{{ s.label }}</strong></td>
          <td>{{ s.count }}</td>
          <td><small class="text-muted">
            {{ s.last_updated|eastern('%Y-%m-%d %H:%M', 'Never') }}
          </small></td>
          <td>
            <form method="post" class="d-inline">
              <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
              <input type="hidden" name="action" value="refresh_ext">
              <input type="hidden" name="source" value="{{ src }}">
              <button class="btn btn-outline-primary btn-sm">
                <i class="bi bi-arrow-clockwise"></i> Refresh
              </button>
            </form>
          </td>
        </tr>
        {% endfor %}
        </tbody>
      </table>
    </div>
  </div>

</div>

<!-- Edit modal -->
<div class="modal fade" id="editModal" tabindex="-1" aria-labelledby="editModalLabel" aria-hidden="true">
  <div class="modal-dialog">
    <div class="modal-content">
      <form method="post" action="{{ url_for('peers.admin') }}">
        <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
        <input type="hidden" name="action" value="edit">
        <input type="hidden" name="peer_id" id="editPeerId">
        <div class="modal-header">
          <h5 class="modal-title" id="editModalLabel"><i class="bi bi-pencil-square"></i> Edit BBS Entry</h5>
          <button type="button" class="btn-close" data-bs-dismiss="modal"></button>
        </div>
        <div class="modal-body">
          <div class="mb-2">
            <label class="form-label">Name</label>
            <input type="text" name="name" id="editName" class="form-control" required maxlength="120">
          </div>
          <div class="row g-2 mb-2">
            <div class="col-8">
              <label class="form-label">Hostname</label>
              <input type="text" name="hostname" id="editHostname" class="form-control" required maxlength="160">
            </div>
            <div class="col-4">
              <label class="form-label">Telnet Port</label>
              <input type="number" name="telnet_port" id="editTelnetPort" class="form-control" value="23" min="1" max="65535">
            </div>
          </div>
          <div class="mb-2">
            <label class="form-label">Web URL</label>
            <input type="url" name="web_url" id="editWebUrl" class="form-control" placeholder="https://...">
          </div>
          <div class="row g-2 mb-2">
            <div class="col-6">
              <label class="form-label">Location</label>
              <input type="text" name="location" id="editLocation" class="form-control" maxlength="120">
            </div>
            <div class="col-6">
              <label class="form-label">Software</label>
              <input type="text" name="software" id="editSoftware" class="form-control" maxlength="80">
            </div>
          </div>
          <div class="mb-2">
            <label class="form-label">FTN Address</label>
            <input type="text" name="ftn_address" id="editFtnAddress" class="form-control" placeholder="1:1/1" maxlength="60">
          </div>
          <div class="mb-2">
            <label class="form-label">Description</label>
            <textarea name="description" id="editDescription" class="form-control" rows="2"></textarea>
          </div>
          <div class="form-check">
            <input type="checkbox" name="is_active" id="editIsActive" class="form-check-input" value="1">
            <label class="form-check-label" for="editIsActive">Active (visible in directory)</label>
          </div>
        </div>
        <div class="modal-footer">
          <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
          <button type="submit" class="btn btn-primary"><i class="bi bi-save"></i> Save</button>
        </div>
      </form>
    </div>
  </div>
</div>

<script>
function fillEditModal(btn) {
    document.getElementById('editPeerId').value      = btn.dataset.peerId;
    document.getElementById('editName').value        = btn.dataset.name;
    document.getElementById('editHostname').value    = btn.dataset.hostname;
    document.getElementById('editTelnetPort').value  = btn.dataset.telnetPort;
    document.getElementById('editWebUrl').value      = btn.dataset.webUrl;
    document.getElementById('editLocation').value    = btn.dataset.location;
    document.getElementById('editSoftware').value    = btn.dataset.software;
    document.getElementById('editFtnAddress').value  = btn.dataset.ftnAddress;
    document.getElementById('editDescription').value = btn.dataset.description;
    document.getElementById('editIsActive').checked  = btn.dataset.isActive === '1';
}
</script>
{% endblock %}