<%- include("partials/layout-top", { title }) %>

<section class="card">
  <%- include("partials/page-header", {
    eyebrow: "Maintenance",
    pageTitle: "Production diagnostics",
    description: "Run safe health checks locally or grant temporary read-only diagnostic access for production troubleshooting."
  }) %>

  <div class="callout info">
    <strong>Insight only — no remote control</strong>
    <p>This service has no shell, file browser, SQL input, URL fetching, or write actions. It only runs the fixed checks listed below, redacts secrets and local paths, rate-limits requests, and records access in Lumi's logs.</p>
  </div>

  <div class="update-meta-grid">
    <div><span>Remote access</span><strong><%= diagnosticsAccess.enabled ? "Enabled" : "Disabled" %></strong></div>
    <div><span>Access key</span><strong><%= diagnosticsAccess.configured ? diagnosticsAccess.key_prefix : "Not created" %></strong></div>
    <div><span>Created</span><strong><%= diagnosticsAccess.created_at ? new Date(diagnosticsAccess.created_at).toLocaleString() : "Never" %></strong></div>
    <div><span>Endpoint</span><strong><code><%= diagnosticsEndpointUrl %></code></strong></div>
  </div>

  <% if (issuedKey) { %>
  <div class="callout success">
    <strong>Save this key now</strong>
    <p>It is shown once. Store it on the computer that will run diagnostics, preferably in the ignored <code>.secrets</code> directory. Lumi stores only its hash.</p>
    <div class="input-action-row">
      <input value="<%= issuedKey %>" readonly aria-label="New production diagnostics key" />
      <button class="button subtle" type="button" data-copy="<%= issuedKey %>"><span data-copy-label>Copy key</span></button>
    </div>
  </div>
  <% } %>

  <div class="inline-actions">
    <form method="post" action="/admin/diagnostics/access/renew" data-confirm-mode="modal" data-confirm-title="<%= diagnosticsAccess.configured ? "Replace diagnostics key" : "Enable remote diagnostics" %>" data-confirm-text="<%= diagnosticsAccess.configured ? "Replace the current key? Existing diagnostic clients will immediately lose access." : "Create a one-time key and enable the fixed read-only diagnostic endpoint?" %>" data-confirm-label="<%= diagnosticsAccess.configured ? "Replace key" : "Enable diagnostics" %>">
      <button class="button" type="submit"><%= diagnosticsAccess.configured ? "Replace access key" : "Create access key" %></button>
    </form>
    <% if (diagnosticsAccess.enabled || diagnosticsAccess.configured) { %>
    <form method="post" action="/admin/diagnostics/access/revoke" data-confirm-mode="modal" data-confirm-title="Revoke diagnostics access" data-confirm-text="Disable the endpoint and permanently invalidate the current diagnostics key?" data-confirm-label="Revoke access">
      <button class="button danger" type="submit">Revoke access</button>
    </form>
    <% } %>
  </div>
</section>

<section class="card">
  <fieldset>
    <legend>Available checks</legend>
    <p class="hint">These are the only operations the remote endpoint accepts. Running one here uses the same redaction and output format.</p>
    <form method="post" action="/admin/diagnostics/run" class="input-action-row">
      <label class="field">
        <span>Diagnostic check</span>
        <select name="check" required>
          <% diagnosticsAccess.checks.forEach((check) => { %>
          <option value="<%= check.id %>" <%= selectedCheck === check.id ? "selected" : "" %>><%= check.id.replaceAll("_", " ") %> — <%= check.description %></option>
          <% }) %>
        </select>
      </label>
      <button class="button subtle" type="submit">Run check</button>
    </form>
  </fieldset>

  <% if (diagnosticError) { %>
  <div class="callout danger"><strong>Check failed</strong><p><%= diagnosticError %></p></div>
  <% } %>
  <% if (diagnosticResult) { %>
  <details class="lumi-expandable-settings" open>
    <summary><span><strong>Diagnostic result</strong><span class="hint"><%= diagnosticResult.check %> · <%= diagnosticResult.duration_ms %> ms</span></span></summary>
    <div class="lumi-expandable-body">
      <pre class="log-details"><%= JSON.stringify(diagnosticResult, null, 2) %></pre>
    </div>
  </details>
  <% } %>
</section>

<section class="card">
  <fieldset>
    <legend>Connect from a trusted computer</legend>
    <p>Use the public HTTPS address for this Lumi installation. Plain HTTP is accepted only from the same machine.</p>
    <pre class="log-details">curl -X POST "<%= diagnosticsEndpointUrl %>" \
  -H "Authorization: Bearer $LUMI_DIAGNOSTICS_KEY" \
  -H "Content-Type: application/json" \
  --data '{"check":"update_state"}'</pre>
    <p class="hint">Keep the key out of shell history, tickets, chat, and logs. A local environment variable or an ignored <code>.secrets</code> file is safer than placing it directly in a command.</p>
    <p class="hint">Repository maintainers can save <code>{ "base_url": "<%= diagnosticsBaseUrl %>", "key": "…" }</code> in <code>.secrets/production-diagnostics.json</code>, then run <code>npm run diagnostics:production -- update_state</code>.</p>
  </fieldset>
</section>

<section class="card">
  <fieldset>
    <legend>Recent diagnostic access</legend>
    <% if (!diagnosticAudit.length) { %>
    <p class="hint">No diagnostic access has been recorded yet.</p>
    <% } else { %>
    <div class="log-window">
      <% diagnosticAudit.forEach((entry) => { %>
      <details class="log-entry level-<%= entry.level %>">
        <summary>
          <span class="log-marker" aria-hidden="true"></span>
          <span class="log-message"><%= entry.message %></span>
          <span class="log-level-pill"><%= entry.level %></span>
          <span class="log-time"><%= new Date(entry.created_at).toLocaleString() %></span>
        </summary>
        <pre class="log-details"><%= entry.details || "No additional details." %></pre>
      </details>
      <% }) %>
    </div>
    <% } %>
  </fieldset>
</section>

<%- include("partials/layout-bottom") %>
