<?php
$currentSlug = trim($settings['admin_login_slug'] ?? '');
$siteUrl = rtrim(Setting::get('site_url', ''), '/');
$currentLoginUrl = $currentSlug !== '' ? $siteUrl . '/' . $currentSlug : $siteUrl . '/admin/login';
?>

<form method="POST" action="/admin/settings">
    <?= Router::csrfField() ?>
    <input type="hidden" name="_tab" value="security">
    <input type="hidden" name="_sub" value="admin_url">

    <div class="bg-white rounded-xl border border-gray-200 p-6 max-w-2xl">
        <h3 class="text-base font-semibold text-gray-900 mb-1">Custom Admin Login URL</h3>
        <p class="text-sm text-gray-500 mb-5">Change the admin login URL for additional security through obscurity. The admin dashboard will always remain at <code class="bg-gray-100 px-1.5 py-0.5 rounded text-xs">/admin</code>.</p>

        <div class="mb-4">
            <label for="admin_login_slug" class="block text-sm font-medium text-gray-700 mb-1">Custom login slug</label>
            <div class="flex items-center gap-2">
                <span class="text-sm text-gray-500"><?= htmlspecialchars($siteUrl) ?>/</span>
                <input type="text" id="admin_login_slug" name="admin_login_slug"
                       value="<?= htmlspecialchars($currentSlug) ?>"
                       placeholder="admin/login"
                       pattern="[a-z0-9][a-z0-9-]*[a-z0-9]"
                       minlength="3" maxlength="50"
                       class="flex-1 px-3 py-2 border border-gray-300 rounded-lg text-sm focus:ring-2 focus:ring-primary-500 focus:border-primary-500">
            </div>
            <p class="mt-1.5 text-xs text-gray-400">Leave empty to use the default <code class="bg-gray-100 px-1 py-0.5 rounded">/admin/login</code>. Use lowercase letters, numbers and hyphens only (3-50 characters).</p>
        </div>

        <div class="mb-5 p-3 rounded-lg bg-gray-50 border border-gray-200">
            <div class="text-xs font-medium text-gray-500 mb-1">Current login URL</div>
            <code class="text-sm text-primary-600 break-all" id="previewUrl"><?= htmlspecialchars($currentLoginUrl) ?></code>
        </div>

        <div class="mb-5 p-3 rounded-lg bg-amber-50 border border-amber-200">
            <div class="flex gap-2">
                <svg class="w-5 h-5 text-amber-500 shrink-0 mt-0.5" fill="none" stroke="currentColor" stroke-width="2" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" d="M12 9v3.75m-9.303 3.376c-.866 1.5.217 3.374 1.948 3.374h14.71c1.73 0 2.813-1.874 1.948-3.374L13.949 3.378c-.866-1.5-3.032-1.5-3.898 0L2.697 16.126zM12 15.75h.007v.008H12v-.008z"/></svg>
                <div>
                    <p class="text-sm font-medium text-amber-800">Important</p>
                    <ul class="mt-1 text-xs text-amber-700 list-disc ml-4 space-y-0.5">
                        <li>Bookmark your new login URL — you won't be able to access <code class="bg-amber-100 px-1 rounded">/admin/login</code> when a custom slug is active.</li>
                        <li>This is security through obscurity — it is not a substitute for strong passwords and 2FA.</li>
                        <li>If you forget your custom URL, you can reset it in the database: <code class="bg-amber-100 px-1 rounded">DELETE FROM settings WHERE setting_key='admin_login_slug'</code></li>
                    </ul>
                </div>
            </div>
        </div>

        <button type="submit" class="px-5 py-2.5 bg-primary-600 text-white text-sm font-medium rounded-lg hover:bg-primary-700 transition-colors">Save</button>
    </div>
</form>

<script>
(function() {
    var input = document.getElementById('admin_login_slug');
    var preview = document.getElementById('previewUrl');
    var base = <?= json_encode($siteUrl) ?>;

    input.addEventListener('input', function() {
        var val = this.value.replace(/[^a-z0-9-]/g, '').toLowerCase();
        this.value = val;
        preview.textContent = val ? base + '/' + val : base + '/admin/login';
    });
})();
</script>
