'use client';
import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
import { useId, useState } from 'react';
import { Check, X } from 'lucide-react';
import { validateIpRange, } from '@actuate-media/cms-core/security-center';
import { SettingsSourceBadge } from './components.js';
import { SecurityCard, StatusRow } from './securityPrimitives.js';
export function AccessProtectionCard({ ipAllowlist, secrets, csrfEnabled, uploadValidation, sources, onNavigate, }) {
    const headingId = useId();
    const ipTestId = useId();
    const [ipTest, setIpTest] = useState('');
    const ipTestValid = ipTest.trim() === '' ? null : validateIpRange(ipTest);
    const distributed = secrets.rateLimitBackend === 'distributed';
    return (_jsxs(SecurityCard, { headingId: headingId, title: "Access & Request Protection", description: "Network-level access restrictions and request-level protections. These are enforced by the platform; edit network rules in config.", children: [_jsxs("div", { className: "space-y-2", children: [_jsxs("div", { className: "flex items-center justify-between gap-2", children: [_jsx("span", { className: "text-foreground text-sm font-medium", children: "Admin IP allowlist" }), _jsx(SettingsSourceBadge, { meta: sources.ipAllowlist })] }), _jsx(StatusRow, { status: ipAllowlist.enabled ? 'pass' : 'unknown', label: "Status", value: ipAllowlist.enabled ? `${ipAllowlist.ranges.length} range(s)` : 'Not configured' }), ipAllowlist.currentIp && (_jsx(StatusRow, { status: ipAllowlist.currentIpAllowed === null
                            ? 'unknown'
                            : ipAllowlist.currentIpAllowed
                                ? 'pass'
                                : 'fail', label: "Your current IP", value: _jsxs("span", { className: "font-mono text-xs", children: [ipAllowlist.currentIp, ipAllowlist.currentIpAllowed === false && ' (blocked)'] }) })), ipAllowlist.enabled && (_jsx("div", { className: "text-muted-foreground flex flex-wrap gap-1.5 pt-1", children: ipAllowlist.ranges.map((r) => (_jsx("code", { className: "bg-muted rounded px-1.5 py-0.5 font-mono text-xs", children: r }, r))) })), _jsxs("div", { className: "pt-1", children: [_jsx("label", { htmlFor: ipTestId, className: "text-muted-foreground mb-1 block text-sm", children: "Validate an IP or CIDR range" }), _jsxs("div", { className: "flex items-center gap-2", children: [_jsx("input", { id: ipTestId, type: "text", value: ipTest, onChange: (e) => setIpTest(e.target.value), placeholder: "e.g. 203.0.113.0/24", className: "border-border bg-input-background text-foreground focus-visible:ring-ring w-full max-w-xs rounded-md border px-3 py-1.5 font-mono text-sm focus-visible:ring-2 focus-visible:outline-none" }), ipTestValid === true && (_jsxs("span", { className: "text-success flex items-center gap-1 text-sm", children: [_jsx(Check, { size: 15, "aria-hidden": "true" }), " Valid"] })), ipTestValid === false && (_jsxs("span", { className: "text-destructive flex items-center gap-1 text-sm", children: [_jsx(X, { size: 15, "aria-hidden": "true" }), " Invalid"] }))] }), _jsxs("p", { className: "text-muted-foreground mt-1 text-xs", children: ["Add validated ranges to ", _jsx("code", { className: "font-mono", children: "admin.ipAllowlist" }), " in actuate.config.ts; the middleware enforces them."] })] })] }), _jsxs("div", { className: "border-border mt-4 space-y-2 border-t pt-4", children: [_jsx(StatusRow, { status: csrfEnabled ? 'pass' : 'fail', label: "CSRF protection", value: csrfEnabled ? 'Enabled' : 'Disabled', badge: _jsx(SettingsSourceBadge, { meta: sources.csrf }) }), _jsx(StatusRow, { status: distributed ? 'pass' : 'warning', label: "Rate limiting", value: distributed ? 'Distributed (Upstash)' : 'In-memory', badge: _jsx(SettingsSourceBadge, { meta: sources.rateLimiting }) }), _jsx(StatusRow, { status: uploadValidation ? 'pass' : 'warning', label: "Upload validation", value: "MIME + magic bytes + SVG sanitization", badge: _jsx(SettingsSourceBadge, { meta: sources.uploadValidation }) }), onNavigate && (_jsx("button", { type: "button", onClick: () => onNavigate('/media'), className: "text-brand mt-1 text-sm hover:underline", children: "Manage upload rules in Media \u2192" }))] })] }));
}
//# sourceMappingURL=AccessProtectionCard.js.map