'use client';
import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
import { useId } from 'react';
import { AlertTriangle } from 'lucide-react';
import { validateIpRange, } from '@actuate-media/cms-core/security-center';
import { SettingsSourceBadge, SettingsToggleRow } from './components.js';
import { SecurityCard, StatusRow } from './securityPrimitives.js';
import { parseAllowlistText } from './useSecuritySettings.js';
export function AccessProtectionCard({ form, setField, canEdit, ipAllowlist, secrets, csrfEnabled, uploadValidation, sources, onNavigate, }) {
    const headingId = useId();
    const allowlistId = useId();
    const allowlistHintId = useId();
    const entries = parseAllowlistText(form.ipAllowlistText);
    const invalidEntries = entries.filter((entry) => !validateIpRange(entry));
    const configRanges = ipAllowlist.configRanges ?? [];
    const distributed = secrets.rateLimitBackend === 'distributed';
    return (_jsxs(SecurityCard, { headingId: headingId, title: "Access Control", description: "Restrict where the admin and CMS API can be reached from, and control the audit trail.", children: [_jsxs("div", { className: "space-y-2", children: [_jsxs("div", { className: "flex items-center justify-between gap-2", children: [_jsx("label", { htmlFor: allowlistId, className: "text-foreground text-base font-medium", children: "Allowed IP addresses" }), _jsx(SettingsSourceBadge, { meta: sources.ipAllowlist })] }), _jsx("textarea", { id: allowlistId, rows: 3, value: form.ipAllowlistText, disabled: !canEdit, onChange: (e) => setField('ipAllowlistText', e.target.value), placeholder: '203.0.113.0/24\n198.51.100.42', "aria-describedby": allowlistHintId, "aria-invalid": invalidEntries.length > 0 || undefined, className: "border-border bg-input-background text-foreground focus-visible:ring-ring w-full resize-y rounded-md border px-3 py-2 font-mono text-sm focus-visible:ring-2 focus-visible:outline-none disabled:cursor-not-allowed disabled:opacity-50" }), _jsx("p", { id: allowlistHintId, className: "text-muted-foreground text-sm", children: "Restrict admin access to these ranges. One IP or CIDR range per line; leave empty to allow all addresses." }), invalidEntries.length > 0 && (_jsxs("p", { className: "text-destructive text-sm", role: "alert", children: ["Invalid entries: ", invalidEntries.join(', ')] })), entries.length > 0 && (_jsxs("div", { className: "border-warning/30 bg-warning/10 text-warning flex items-start gap-2 rounded-md border p-2.5 text-sm", children: [_jsx(AlertTriangle, { size: 15, className: "mt-0.5 shrink-0", "aria-hidden": "true" }), _jsxs("span", { children: ["Make sure your own IP", ipAllowlist.currentIp ? (_jsxs(_Fragment, { children: [' ', "(", _jsx("span", { className: "font-mono", children: ipAllowlist.currentIp }), ")"] })) : null, ' ', "is covered \u2014 saving a list that excludes it will lock you out of the admin."] })] })), configRanges.length > 0 && (_jsxs("div", { className: "pt-1", children: [_jsxs("p", { className: "text-muted-foreground text-sm", children: ["Always enforced from ", _jsx("code", { className: "font-mono", children: "admin.ipAllowlist" }), " in actuate.config.ts:"] }), _jsx("div", { className: "text-muted-foreground mt-1 flex flex-wrap gap-1.5", children: configRanges.map((r) => (_jsx("code", { className: "bg-muted rounded px-1.5 py-0.5 font-mono text-xs", children: r }, r))) })] })), ipAllowlist.currentIp && ipAllowlist.enabled && (_jsx(StatusRow, { status: ipAllowlist.currentIpAllowed === null
                            ? 'unknown'
                            : ipAllowlist.currentIpAllowed
                                ? 'pass'
                                : 'fail', label: "Your current IP", value: _jsxs("span", { className: "font-mono text-xs", children: [ipAllowlist.currentIp, ipAllowlist.currentIpAllowed === false && ' (blocked)'] }) }))] }), _jsx("div", { className: "border-border mt-4 border-t pt-4", children: _jsx(SettingsToggleRow, { label: "Audit logging", description: "Record every content change, login and settings update. Security-critical events (failed logins, MFA and security policy changes) are always recorded.", checked: form.auditLoggingEnabled, disabled: !canEdit, onChange: (value) => setField('auditLoggingEnabled', value) }) }), _jsxs("div", { className: "border-border mt-4 space-y-2 border-t pt-4", children: [_jsx(StatusRow, { status: csrfEnabled ? 'pass' : 'fail', label: "CSRF protection", value: csrfEnabled ? 'Enabled' : 'Disabled', badge: _jsx(SettingsSourceBadge, { meta: sources.csrf }) }), _jsx(StatusRow, { status: distributed ? 'pass' : 'warning', label: "Rate limiting", value: distributed ? 'Distributed (Upstash)' : 'In-memory', badge: _jsx(SettingsSourceBadge, { meta: sources.rateLimiting }) }), _jsx(StatusRow, { status: uploadValidation ? 'pass' : 'warning', label: "Upload validation", value: "MIME + magic bytes + SVG sanitization", badge: _jsx(SettingsSourceBadge, { meta: sources.uploadValidation }) }), onNavigate && (_jsx("button", { type: "button", onClick: () => onNavigate('/media'), className: "text-brand mt-1 text-sm hover:underline", children: "Manage upload rules in Media \u2192" }))] })] }));
}
//# sourceMappingURL=AccessProtectionCard.js.map