{# SPDX-License-Identifier: Apache-2.0 #}
{# Copyright (C) 2025 Marcin Zieba <marcinpsk@gmail.com> #}
{# Lazy-loaded fragment: SNMP category (communities + v3 users + hosts + system info). #}
{# Secret-safe: community strings and v3 passwords are never shown — only hashes/flags. #}
{# Operators may Modify (edit) + Accept a row; the secret is supplied via the row's #}
{# Vault ref and resolved at Apply time (the single device Apply pushes it). #}
{% include "netbox_nso_plugin/categories/_adapter_error.html" %}
{% url 'dcim:device_nso' pk=object.pk as return_url %}

{% if snmp_data.communities or snmp_data.v3_users or snmp_data.hosts or snmp_data.system_info %}
  <p class="text-muted small mb-2">Edit non-secret policy inline. Community strings and v3 passwords stay secret-safe and are managed through the Vault-aware edit actions; identity fields remain read-only here.</p>

  {% if snmp_data.system_info %}
  {% url 'plugins:netbox_nso_plugin:overlay_field_edit' key='snmp_system_info' pk=snmp_data.system_info.pk as sysinfo_edit_url %}
  <h6 class="mb-1">System Information</h6>
  <div class="table-responsive mb-3">
  <table class="table table-sm table-hover mb-0">
    <thead><tr><th>Location / Contact</th><th>Status / Synced</th><th></th></tr></thead>
    <tbody><tr data-status="{{ snmp_data.system_info.status }}" data-owned="{{ snmp_data.system_info.accepted_at|yesno:'true,false' }}">
      <td>
        <a href="#" class="nso-popedit" title="Edit location and contact; this takes ownership"
           data-pe-url="{{ sysinfo_edit_url }}" data-pe-title="SNMP system information"
           data-pe-fields="location:text:Location,contact:text:Contact"
           data-pe-v-location="{{ snmp_data.system_info.location|default:'' }}"
           data-pe-v-contact="{{ snmp_data.system_info.contact|default:'' }}">{{ snmp_data.system_info.location|default:"no location" }} · {{ snmp_data.system_info.contact|default:"no contact" }}</a>
      </td>
      <td>
        {% include "netbox_nso_plugin/categories/_state_badge.html" with status=snmp_data.system_info.status %}
        <div class="text-muted small text-nowrap">{% if snmp_data.system_info.last_sync_at %}{{ snmp_data.system_info.last_sync_at|date:"Y-m-d H:i" }}{% else %}not synced{% endif %}</div>
      </td>
      <td class="text-nowrap">
        {% url 'plugins:netbox_nso_plugin:snmp_accept_system_info' pk=snmp_data.system_info.pk as accept_url %}{% include "netbox_nso_plugin/categories/_accept_cell.html" with accept_url=accept_url status=snmp_data.system_info.status %}
      </td>
    </tr></tbody>
  </table>
  </div>
  {% endif %}

  {% if snmp_data.communities %}
  <h6 class="mb-1">Communities</h6>
  <div id="flt-snmp-communities">
  {% include "netbox_nso_plugin/categories/_table_filter.html" with fid="flt-snmp-communities" placeholder="Filter by hash / access…" show_status=True %}
  <div class="table-responsive mb-3">
    <table class="table table-sm table-hover mb-0">
      <thead>
        <tr><th>Community / Policy</th><th>Vault</th><th>Status / Synced</th><th></th></tr>
      </thead>
      <tbody>
        {% for c in snmp_data.communities %}
        <tr data-status="{{ c.status }}" data-owned="{{ c.accepted_at|yesno:'true,false' }}">
          {% url 'plugins:netbox_nso_plugin:overlay_field_edit' key='snmp_community' pk=c.pk as community_edit_url %}
          <td>
            <code>{{ c.community_hash }}</code>
            <div class="small">
              <a href="#" class="nso-popedit" title="Edit access and ACL; this takes ownership"
                 data-pe-url="{{ community_edit_url }}" data-pe-title="Community policy"
                 data-pe-fields="access:select:Access,acl:text:ACL"
                 data-pe-v-access="{{ c.access|default:'RO' }}" data-pe-v-acl="{{ c.acl|default:'' }}"
                 data-pe-o-access='[{"value":"RO","label":"Read only"},{"value":"RW","label":"Read/write"}]'>{{ c.access|default:"RO" }} · {{ c.acl|default:"no ACL" }}</a>
            </div>
          </td>
          <td>
            {% if c.vault_ref %}
              <code title="{{ c.vault_ref }}">{{ c.vault_ref|truncatechars:34 }}</code>
              {% if c.vault_secret_hash %}
                {% if not snmp_data.snmp_value_compare %}
                  <span class="badge text-bg-info" title="This platform stores communities hashed on-device (Nokia hash2) — value comparison is impossible; the Vault secret is set (v{{ c.vault_secret_version|default:'?' }}).">Vault set — compare n/a</span>
                {% elif c.vault_secret_hash == c.community_hash %}
                  <span class="badge text-bg-success" title="sha256 fingerprint of the Vault-held secret equals the device's (v{{ c.vault_secret_version|default:'?' }}).">Vault ✓ matches device</span>
                {% else %}
                  <span class="badge text-bg-warning text-dark" title="The Vault-held secret differs from what the device reports — apply is pending, or the device changed out-of-band.">Vault differs</span>
                {% endif %}
              {% else %}
                <span class="badge text-bg-info" title="Vault ref set but the secret has not been verified — use Verify (or set a value) to record its fingerprint.">unverified</span>
              {% endif %}
            {% elif c.accepted_at %}
              <span class="badge text-bg-danger" title="This accepted community has no Vault ref — it is silently excluded from every push until one is set.">no ref — not pushable</span>
            {% else %}
              <span class="text-warning" title="Set a Vault ref (or a secret value) so the secret can be pushed">missing</span>
            {% endif %}
          </td>
          <td>
            {% include "netbox_nso_plugin/categories/_state_badge.html" with status=c.status residue=c.residue_survivor residue_job=c.residue_job_id %}
            <div class="text-muted small text-nowrap">{% if c.last_sync_at %}{{ c.last_sync_at|date:"Y-m-d H:i" }}{% else %}not synced{% endif %}</div>
          </td>
          <td>
            <div class="d-flex gap-1 align-items-center">
              {% url 'plugins:netbox_nso_plugin:nsosnmpcommunitystate_edit' pk=c.pk as edit_url %}{% include "netbox_nso_plugin/categories/_edit_link.html" with edit_url=edit_url return_url=return_url %}
              {% url 'plugins:netbox_nso_plugin:snmp_accept_community' pk=c.pk as accept_url %}{% include "netbox_nso_plugin/categories/_accept_cell.html" with accept_url=accept_url status=c.status %}
              {% if c.vault_ref %}
              <form method="post" action="{% url 'plugins:netbox_nso_plugin:snmp_verify_community_secret' pk=c.pk %}">{% csrf_token %}<button type="submit" class="btn btn-xs btn-outline-info" title="Resolve the Vault ref via the adapter and record the secret's fingerprint (values never displayed)"><span class="mdi mdi-shield-search"></span> Verify</button></form>
              {% endif %}
              {% if snmp_data.snmp_value_compare %}
              <form method="post" action="{% url 'plugins:netbox_nso_plugin:snmp_harvest_community_secret' pk=c.pk %}">{% csrf_token %}<button type="submit" class="btn btn-xs btn-outline-primary" title="Adopt the device-held community string into Vault (read from NSO's config mirror; never displayed)"><span class="mdi mdi-database-import"></span> Harvest</button></form>
              {% endif %}
            </div>
          </td>
        </tr>
        {% endfor %}
      </tbody>
    </table>
  </div>
  </div>
  {% endif %}

  {% if snmp_data.v3_users %}
  <h6 class="mb-1">v3 Users</h6>
  <div id="flt-snmp-v3">
  {% include "netbox_nso_plugin/categories/_table_filter.html" with fid="flt-snmp-v3" placeholder="Filter by username…" show_status=True %}
  <div class="table-responsive mb-3">
    <table class="table table-sm table-hover mb-0">
      <thead>
        <tr><th>User / Security</th><th>Vault</th><th>Status / Synced</th><th></th></tr>
      </thead>
      <tbody>
        {% for u in snmp_data.v3_users %}
        <tr data-status="{{ u.status }}" data-owned="{{ u.accepted_at|yesno:'true,false' }}">
          <td>
            <span class="fw-semibold">{{ u.username }}</span>
            <div class="small">
            {% if u.has_auth_secret %}<span class="badge text-bg-success">auth</span>{% else %}<span class="badge text-bg-light">no auth</span>{% endif %}
            {% if u.has_priv_secret %}<span class="badge text-bg-success">priv</span>{% else %}<span class="badge text-bg-light">no priv</span>{% endif %}
            {% if u.auth_protocol or u.priv_protocol %} · {{ u.auth_protocol|default:"no auth protocol" }}{% if u.priv_protocol %} / {{ u.priv_protocol }}{% endif %}{% endif %}
            </div>
          </td>
          <td>
            {% if u.vault_ref %}
              <code title="{{ u.vault_ref }} (fields auth/priv)">{{ u.vault_ref|truncatechars:30 }}</code>
              {% if u.vault_has_auth %}<span class="badge text-bg-success" title="Vault holds an 'auth' field at the ref. Value comparison with the device is impossible for v3 (keys are engine-ID-localized).">auth</span>{% endif %}
              {% if u.vault_has_priv %}<span class="badge text-bg-success" title="Vault holds a 'priv' field at the ref.">priv</span>{% endif %}
              {% if not u.vault_has_auth and not u.vault_has_priv %}<span class="badge text-bg-info" title="Vault ref set but not verified — use Verify to record which fields exist.">unverified</span>{% endif %}
            {% elif u.accepted_at %}
              <span class="badge text-bg-danger" title="This accepted v3 user has no Vault ref — it is silently excluded from every push until one is set.">no ref — not pushable</span>
            {% else %}
              <span class="text-warning" title="Set a Vault ref (or secret values) so the secrets can be pushed">missing</span>
            {% endif %}
          </td>
          <td>
            {% include "netbox_nso_plugin/categories/_state_badge.html" with status=u.status residue=u.residue_survivor residue_job=u.residue_job_id %}
            <div class="text-muted small text-nowrap">{% if u.last_sync_at %}{{ u.last_sync_at|date:"Y-m-d H:i" }}{% else %}not synced{% endif %}</div>
          </td>
          <td>
            <div class="d-flex gap-1 align-items-center">
              {% url 'plugins:netbox_nso_plugin:nsosnmpv3userstate_edit' pk=u.pk as edit_url %}{% include "netbox_nso_plugin/categories/_edit_link.html" with edit_url=edit_url return_url=return_url %}
              {% url 'plugins:netbox_nso_plugin:snmp_accept_v3_user' pk=u.pk as accept_url %}{% include "netbox_nso_plugin/categories/_accept_cell.html" with accept_url=accept_url status=u.status %}
              {% if u.vault_ref %}
              <form method="post" action="{% url 'plugins:netbox_nso_plugin:snmp_verify_v3_user_secret' pk=u.pk %}">{% csrf_token %}<button type="submit" class="btn btn-xs btn-outline-info" title="Resolve the Vault path via the adapter and record which fields (auth/priv) exist"><span class="mdi mdi-shield-search"></span> Verify</button></form>
              {% endif %}
            </div>
          </td>
        </tr>
        {% endfor %}
      </tbody>
    </table>
  </div>
  </div>
  {% endif %}

  {% if snmp_data.hosts %}
  <h6 class="mb-1">Trap / Inform Hosts</h6>
  <div id="flt-snmp-hosts">
  {% include "netbox_nso_plugin/categories/_table_filter.html" with fid="flt-snmp-hosts" placeholder="Filter by address…" show_status=True %}
  <div class="table-responsive">
    <table class="table table-sm table-hover mb-0">
      <thead>
        <tr><th>Destination</th><th>Notification</th><th>Status / Synced</th><th></th></tr>
      </thead>
      <tbody>
        {% for h in snmp_data.hosts %}
        <tr data-status="{{ h.status }}" data-owned="{{ h.accepted_at|yesno:'true,false' }}">
          {% url 'plugins:netbox_nso_plugin:overlay_field_edit' key='snmp_host' pk=h.pk as host_edit_url %}
          <td>
            <span class="fw-semibold">{{ h.address }}</span>
            <div class="text-muted small">UDP {{ h.port|default:"162" }}</div>
          </td>
          <td>
            <a href="#" class="nso-popedit" title="Edit notification settings; this takes ownership"
               data-pe-url="{{ host_edit_url }}" data-pe-title="{{ h.address }} notification"
               data-pe-fields="version:select:Version,notify_type:select:Notification,port:number:Port,username:text:v3 User"
               data-pe-v-version="{% if h.version == '1' or h.version == 'v1' %}v1{% elif h.version == '2' or h.version == '2c' or h.version == 'v2c' %}v2c{% else %}v3{% endif %}"
               data-pe-v-notify_type="{% if h.notify_type == 'inform' or h.notify_type == 'informs' %}inform{% else %}trap{% endif %}"
               data-pe-v-port="{{ h.port|default:'' }}" data-pe-v-username="{{ h.username }}"
               data-pe-o-version='[{"value":"v1","label":"v1"},{"value":"v2c","label":"v2c"},{"value":"v3","label":"v3"}]'
               data-pe-o-notify_type='[{"value":"trap","label":"Trap"},{"value":"inform","label":"Inform"}]'>{% if h.notify_type == "inform" or h.notify_type == "informs" %}inform{% else %}trap{% endif %} · {% if h.version == "1" or h.version == "v1" %}v1{% elif h.version == "2" or h.version == "2c" or h.version == "v2c" %}v2c{% else %}v3{% endif %}{% if h.username %} · {{ h.username }}{% endif %}</a>
          </td>
          <td>
            {% include "netbox_nso_plugin/categories/_state_badge.html" with status=h.status residue=h.residue_survivor residue_job=h.residue_job_id %}
            <div class="text-muted small text-nowrap">{% if h.last_sync_at %}{{ h.last_sync_at|date:"Y-m-d H:i" }}{% else %}not synced{% endif %}</div>
          </td>
          <td class="text-nowrap">
              {% url 'plugins:netbox_nso_plugin:snmp_accept_host' pk=h.pk as accept_url %}{% include "netbox_nso_plugin/categories/_accept_cell.html" with accept_url=accept_url status=h.status %}
          </td>
        </tr>
        {% endfor %}
      </tbody>
    </table>
  </div>
  </div>
  {% endif %}

{% else %}
  <p class="text-muted mb-0">No SNMP configuration.</p>
{% endif %}