// SPDX-License-Identifier: Apache-2.0

package server

import (
	"bytes"
	"context"
	"crypto/rand"
	"crypto/sha256"
	"crypto/tls"
	"database/sql"
	"encoding/base64"
	"encoding/csv"
	"encoding/hex"
	"encoding/json"
	"fmt"
	"html/template"
	"image/png"
	"io"
	"io/fs"
	"log"
	"net"
	"net/http"
	"net/smtp"
	"net/url"
	"os"
	"slices"
	"sort"
	"strconv"
	"strings"
	"sync"
	"sync/atomic"
	"time"

	"github.com/X4Applegate/caddyui/internal/analytics"
	"github.com/X4Applegate/caddyui/internal/auth"
	"github.com/X4Applegate/caddyui/internal/caddy"
	"github.com/X4Applegate/caddyui/internal/caddylogs"
	appdb "github.com/X4Applegate/caddyui/internal/db"
	"github.com/X4Applegate/caddyui/internal/dns"
	"github.com/X4Applegate/caddyui/internal/models"
	"github.com/go-chi/chi/v5"
	"github.com/go-chi/chi/v5/middleware"
	otplib "github.com/pquerna/otp"
	totplib "github.com/pquerna/otp/totp"
)

type Server struct {
	DB            *sql.DB
	Caddy         *caddy.Client
	Templates     map[string]*template.Template
	Static        fs.FS
	CaddyfilePath string
	Version       string
	// DBPath is the filesystem path to the SQLite DB. Stored so the backup
	// handler can write its VACUUM INTO temp file next to the real DB (same
	// volume, guaranteed writable by our UID) — `os.TempDir()` → /tmp doesn't
	// exist in the scratch final image, and creating it at runtime as a
	// non-root UID isn't allowed. v2.7.5.
	DBPath      string
	pendingTOTP sync.Map   // token → userID (int64), auto-deleted after 5 min
	setupMu     sync.Mutex // serializes first-run setup (see postSetup)
	syncMu      sync.Mutex // serializes syncCaddy: it swaps the shared s.Caddy client
	// pendingTOTPAttempts counts wrong second-factor codes per pending token
	// (token → *int32) so one password check cannot buy unlimited guesses.
	pendingTOTPAttempts sync.Map

	// CSRF HMAC key, loaded from (or generated into) the settings table on
	// first use. Per-Server rather than package-level so two Servers in the
	// same test binary don't share one another's key. v2.29.0.
	csrfSecretOnce  sync.Once
	csrfSecretCache []byte

	// version-check cache (Docker Hub, 1h TTL)
	versionMu        sync.Mutex
	latestVersion    string
	versionCheckedAt time.Time

	// health-poller hysteresis: count consecutive failed pings per server so
	// a single WG/network blip doesn't instantly flap a server to offline.
	// Only flip to offline after healthFailThreshold consecutive failures.
	healthMu       sync.Mutex
	healthFailures map[int64]int

	// app-response health cache — end-to-end HTTPS GET / result per proxy host,
	// refreshed by StartAppHealthPoller. Keyed by ProxyHost.ID. Independent of
	// the TCP/port health (which Caddy's admin API reports): this probes the
	// public domain through Caddy, so it catches cases where the port is open
	// but the app is wedged (e.g. DB unreachable, slow startup).
	appHealthMu sync.RWMutex
	appHealth   map[int64]appHealthEntry
	// v2.38.0: post-apply expectation results, per process (see expectations.go).
	expectationMu      sync.RWMutex
	expectationResults map[int64][]expectationResult
	expectationRuns    map[int64]expectationRun

	// Serializes source-to-target fleet copies inside this process. The
	// deployment mapping table supplies durable idempotency; this mutex closes
	// the check-then-create race between concurrent UI submissions.
	fleetDeployMu sync.Mutex

	// v2.7.0: handle to the analytics ingest listener. Wired by main.go
	// via SetAnalyticsIngest after Server construction (rather than as a
	// New() arg) so the wiring order stays readable — the ingest owns a
	// DB ref that has to exist before we hand it over.
	analyticsIngest *analytics.Ingest

	// Runtime Caddy logs share the analytics NDJSON socket but stay in a
	// bounded in-memory hub. Only the latest certificate lifecycle projection
	// is persisted. Temporary full-log captures are guarded by expiry timers.
	caddyLogHub        *caddylogs.Hub
	runtimeLogMu       sync.Mutex
	runtimeLogTimers   map[int64]*time.Timer
	certificateProbeFn func(models.CaddyServer, models.Certificate) managedCertificateServerStatus
	// v2.39.0: live TLS probes of custom (PEM / file-path) certificates, see
	// certificate_probe.go. certProbeTargetFn lets tests point the dial at a
	// local listener instead of <admin host>:443.
	certProbeRunMu    sync.Mutex
	certProbeTargetFn func(serverID int64, probeName string) string
	// v2.42.0: serializes certificate export passes (certificate_export.go).
	certExportRunMu sync.Mutex
	// v2.43.0: analytics retention — one prune and one VACUUM at a time.
	accessPruneMu sync.Mutex
	vacuumMu      sync.Mutex
}

type apiTokenScopeContextKey struct{}

// SetAnalyticsIngest plumbs the analytics ingest listener into the server
// so handlers can surface its stats on /analytics and /settings. Called
// once at startup from main.go after the ingest listener has bound.
// Passing nil is valid and disables the stats card — happens when the
// CADDYUI_INGEST_LISTEN env var is blank or the bind failed at startup.
func (s *Server) SetAnalyticsIngest(ing *analytics.Ingest) {
	s.analyticsIngest = ing
}

func (s *Server) SetCaddyLogHub(hub *caddylogs.Hub) {
	s.caddyLogHub = hub
	if hub != nil {
		// v2.42.0: an issuance/renewal reported by a node triggers the
		// export of every exporting certificate that covers the name.
		hub.OnCertificateActive = s.handleCertificateActive
	}
}

func New(db *sql.DB, caddyClient *caddy.Client, templates fs.FS, static fs.FS, caddyfilePath string, version string, dbPath string) (*Server, error) {
	tpl, err := parseTemplates(templates)
	if err != nil {
		return nil, err
	}
	// Resolve the active timezone once at startup so the very first render
	// uses the admin's picked zone (DB) rather than whatever time.Local
	// happens to be. Priority: DB value → TZ env var → UTC. See timezone.go.
	loc := loadActiveLocation(db)
	log.Printf("timezone: rendering timestamps in %s", loc)
	s := &Server{
		DB:               db,
		Caddy:            caddyClient,
		Templates:        tpl,
		Static:           static,
		CaddyfilePath:    caddyfilePath,
		Version:          version,
		DBPath:           dbPath,
		healthFailures:   map[int64]int{},
		appHealth:        map[int64]appHealthEntry{},
		runtimeLogTimers: map[int64]*time.Timer{},
	}
	go s.runHealthChecker()
	go s.runAutoSyncLoop()
	go s.runFleetDeletionReconciler() // v2.59.0 (issue #120)
	go s.runMaintenanceWindowLoop()
	go s.runActivityLogCleanup()
	go s.runAccessDailyAggregator()
	// v2.43.0: this loop existed since v2.7.0 but was never started, so
	// access_events grew without bound (analytics_retention.go).
	go s.pruneAccessLoop()
	return s, nil
}

// runAccessDailyAggregator backfills the access_daily rollup table once at
// startup (so a freshly-upgraded install picks up historical days) and then
// every hour to catch the previous day shortly after UTC midnight rolls over.
// All access_events older than today (UTC) are summarised into per-(day, host)
// rows that AccessTotalsSince consults for long windows. v2.9.206.
func (s *Server) runAccessDailyAggregator() {
	if n, err := models.AggregateAccessDaily(s.DB); err != nil {
		log.Printf("access_daily: initial backfill failed: %v", err)
	} else if n > 0 {
		log.Printf("access_daily: initial backfill aggregated %d day(s)", n)
	}
	t := time.NewTicker(1 * time.Hour)
	defer t.Stop()
	for range t.C {
		if n, err := models.AggregateAccessDaily(s.DB); err != nil {
			log.Printf("access_daily: hourly backfill failed: %v", err)
		} else if n > 0 {
			log.Printf("access_daily: aggregated %d new day(s)", n)
		}
	}
}

// healthFailThreshold is the number of consecutive failed pings required
// before the health poller flips a server to "offline". Tunable here so WG
// blips don't cause the dashboard to flap.
const healthFailThreshold = 3

func parseTemplates(tplFS fs.FS) (map[string]*template.Template, error) {
	funcs := template.FuncMap{
		"t":     tFunc, // v2.62.0 (issue #128): {{t $ "key"}}
		"join":  func(sep string, parts []string) string { return strings.Join(parts, sep) },
		"upper": strings.ToUpper,
		// dict builds a map from alternating key/value args so templates can pass
		// structured context to sub-templates (e.g. layout's navItem definition).
		"dict": func(kv ...any) (map[string]any, error) {
			if len(kv)%2 != 0 {
				return nil, fmt.Errorf("dict requires an even number of arguments")
			}
			m := make(map[string]any, len(kv)/2)
			for i := 0; i < len(kv); i += 2 {
				k, ok := kv[i].(string)
				if !ok {
					return nil, fmt.Errorf("dict key at %d must be string", i)
				}
				m[k] = kv[i+1]
			}
			return m, nil
		},
		"splitDomains": func(s string) []string {
			parts := strings.FieldsFunc(s, func(r rune) bool { return r == ',' || r == '\n' || r == ' ' })
			out := make([]string, 0, len(parts))
			for _, d := range parts {
				d = strings.TrimSpace(d)
				if d != "" {
					out = append(out, d)
				}
			}
			return out
		},
		// rawRouteSourceHosts extracts the match.host[] entries from a raw
		// route's JSON blob so the /raw-routes table and the dashboard's
		// "Recent advanced routes" block can render hostname pills the same
		// way proxy hosts do. v2.7.9. Returns nil for path-only / port-only
		// routes (no host matcher) — templates fall back to the route label
		// in that case so the Source column never renders empty.
		"rawRouteSourceHosts": func(jsonData string) []string {
			return rawRouteHosts(models.RawRoute{JSONData: jsonData})
		},
		"prettyJSON": func(s string) string {
			var v any
			if err := json.Unmarshal([]byte(s), &v); err != nil {
				return s
			}
			out, err := json.MarshalIndent(v, "", "  ")
			if err != nil {
				return s
			}
			return string(out)
		},
		// httpCodeName returns the standard reason phrase for common redirect
		// status codes so templates can surface human-readable descriptions
		// (e.g. "301 Moved Permanently") on hover/tooltip.
		"httpCodeName": func(code int) string {
			switch code {
			case 301:
				return "Moved Permanently"
			case 302:
				return "Found (Temporary)"
			case 303:
				return "See Other"
			case 307:
				return "Temporary Redirect"
			case 308:
				return "Permanent Redirect"
			}
			return ""
		},
		// Timezone-aware time formatters. Every visible timestamp pulled from
		// the DB should flow through one of these so the admin's picked zone
		// (Settings → Timezone) actually takes effect. activeLocation()
		// resolves DB → TZ env → UTC; see timezone.go.
		//
		// Templates pass a time.Time and get back a formatted string:
		//   {{ fmtDate .CreatedAt }}      → "2026-04-22"
		//   {{ fmtDateTime .CreatedAt }}  → "2026-04-22 14:30"
		//   {{ fmtTime .CreatedAt }}      → "14:30:45"
		//   {{ tzName }}                  → "America/New_York"
		//
		// Zero-value times render as an empty string so we don't surface
		// "0001-01-01" when a nullable DB column is NULL.
		"fmtDate": func(t time.Time) string {
			if t.IsZero() {
				return ""
			}
			return t.In(activeLocation()).Format("2006-01-02")
		},
		"fmtDateTime": func(t time.Time) string {
			if t.IsZero() {
				return ""
			}
			return t.In(activeLocation()).Format("2006-01-02 15:04")
		},
		"fmtTime": func(t time.Time) string {
			if t.IsZero() {
				return ""
			}
			return t.In(activeLocation()).Format("15:04:05")
		},
		// fmtIn is the escape-hatch: pass any Go time layout string and it
		// renders in the active zone. Used by templates that need a specific
		// visible format (e.g. "Jan 2, 2006 3:04 PM") that fmtDate/fmtDateTime
		// don't cover. Keeps the existing look of the page while switching
		// the underlying zone.
		"fmtIn": func(t time.Time, layout string) string {
			if t.IsZero() {
				return ""
			}
			return t.In(activeLocation()).Format(layout)
		},
		"tzName": func() string { return activeLocation().String() },
		// v2.11.12: hasPrefix / hasSuffix exposed for template-side action
		// string classification on the dashboard "Recently edited" widget.
		"hasPrefix": strings.HasPrefix,
		"hasSuffix": strings.HasSuffix,
		// truncate returns the first n bytes of s, or s itself if shorter.
		// Used in sessions.html to display a shortened token prefix.
		"truncate": func(s string, n int) string {
			if len(s) <= n {
				return s
			}
			return s[:n]
		},
		// httpCodeDesc returns a plain-English one-liner explaining what a
		// redirect status code means in practice. Used in tooltips.
		"httpCodeDesc": func(code int) string {
			switch code {
			case 301:
				return "301 Moved Permanently — cached forever by browsers & search engines. Best for SEO when a URL has permanently changed. May convert POST to GET."
			case 302:
				return "302 Found (Temporary) — not cached. Use when the redirect is temporary or might change. May convert POST to GET."
			case 303:
				return "303 See Other — always converts the request to GET. Used after form submissions (POST → GET)."
			case 307:
				return "307 Temporary Redirect — like 302 but preserves the HTTP method (POST stays POST). Safer for APIs."
			case 308:
				return "308 Permanent Redirect — like 301 but preserves the HTTP method. Modern replacement for 301."
			}
			return fmt.Sprintf("HTTP %d", code)
		},
		// Integer math helpers for SVG bar-chart rendering in the analytics
		// page. html/template doesn't support arithmetic on ints, so we ship
		// these three minimal operations rather than pulling in a full
		// expression language. Kept deliberately narrow — bar height = views
		// × maxPx / maxViews, bar y = chartHeight - barHeight, next bucket
		// = index + 1. Any more and we should wire up sprig.
		"mulDivInt": func(a, b, c int) int {
			if c == 0 {
				return 0
			}
			return (a * b) / c
		},
		"subInt": func(a, b int) int { return a - b },
		"addInt": func(a, b int) int { return a + b },
		// mulDivInt64 is the int64 analogue of mulDivInt for use with
		// BandwidthBucket.BytesOut (int64) SVG bar-height calculations.
		"mulDivInt64": func(a, b, c int64) int64 {
			if c == 0 {
				return 0
			}
			return (a * b) / c
		},
		"subInt64": func(a, b int64) int64 { return a - b },
		// ssoLabel shortens an issuer URL for a badge. v2.68.0.
		"ssoLabel": ssoProviderLabel,
		// addInt64 lets a chart bar compute its own bucket's end time
		// (bucket start + bucket seconds) for an exact drill-through link.
		// v2.66.0 (issue #145).
		"addInt64": func(a, b int64) int64 { return a + b },
		// fmtBytes renders a byte count as a human-readable size string.
		// Used in analytics cards to show bandwidth totals without overwhelming
		// the reader with raw byte counts (e.g. "1.4 GB" instead of "1503238553").
		"fmtBytes": func(b int64) string {
			switch {
			case b >= 1<<30:
				return fmt.Sprintf("%.1f GB", float64(b)/(1<<30))
			case b >= 1<<20:
				return fmt.Sprintf("%.1f MB", float64(b)/(1<<20))
			case b >= 1<<10:
				return fmt.Sprintf("%.1f KB", float64(b)/(1<<10))
			default:
				return fmt.Sprintf("%d B", b)
			}
		},
		// fmtRel renders a time as a short human-readable interval from now
		// ("3m", "2h", "4d"). Used in analytics tables where an absolute
		// timestamp would eat column width and the admin only cares how
		// stale the data is. Zero time → "never" so callers don't need to
		// bracket every use with {{if ...}}. Future times (clock skew)
		// render as "in <interval>" so we don't silently swallow bad data.
		"fmtRel": func(t time.Time) string {
			if t.IsZero() {
				return "never"
			}
			d := time.Since(t)
			prefix := ""
			if d < 0 {
				prefix = "in "
				d = -d
			} else {
				// Past — add "ago" suffix after formatting.
			}
			var body string
			switch {
			case d < time.Minute:
				body = fmt.Sprintf("%ds", int(d.Seconds()))
			case d < time.Hour:
				body = fmt.Sprintf("%dm", int(d.Minutes()))
			case d < 24*time.Hour:
				body = fmt.Sprintf("%dh", int(d.Hours()))
			case d < 30*24*time.Hour:
				body = fmt.Sprintf("%dd", int(d.Hours())/24)
			default:
				body = t.In(activeLocation()).Format("2006-01-02")
				return prefix + body
			}
			if prefix != "" {
				return prefix + body
			}
			return body + " ago"
		},
		// colorDotClass returns Tailwind bg-* classes for a host color label.
		// Returns an empty string when the color is blank so the dot can be
		// hidden entirely ({{ if .Host.Color }} guard in templates).
		"colorDotClass": func(c string) string {
			switch c {
			case "red":
				return "bg-red-400"
			case "orange":
				return "bg-orange-400"
			case "yellow":
				return "bg-yellow-400"
			case "green":
				return "bg-green-400"
			case "teal":
				return "bg-teal-400"
			case "blue":
				return "bg-blue-400"
			case "purple":
				return "bg-purple-400"
			case "pink":
				return "bg-pink-400"
			case "gray":
				return "bg-gray-400"
			default:
				return ""
			}
		},
	}
	entries, err := fs.ReadDir(tplFS, ".")
	if err != nil {
		return nil, err
	}
	pages := map[string]*template.Template{}
	for _, e := range entries {
		if e.IsDir() || e.Name() == "layout.html" || !strings.HasSuffix(e.Name(), ".html") {
			continue
		}
		t, err := template.New("").Funcs(funcs).ParseFS(tplFS, "layout.html", e.Name())
		if err != nil {
			return nil, err
		}
		pages[e.Name()] = t
	}
	return pages, nil
}

// safeLogFormatter is chi's request logger minus the query string. The default
// logger writes the full request URI, and several flows carry a bearer secret in
// the query: ?token= (password reset, invitations), ?created= (a freshly created
// API token), ?t= (a pending second-factor token), the OIDC ?code=&state=. Anyone
// who can read the container logs, Portainer or a log shipper would otherwise be
// handed a working credential (v2.57.1). The request line is %q-quoted so
// control characters in a path cannot forge log lines.
type safeLogFormatter struct{}

func (safeLogFormatter) NewLogEntry(r *http.Request) middleware.LogEntry {
	scheme := "http"
	if r.TLS != nil {
		scheme = "https"
	}
	line := fmt.Sprintf("%s %s://%s%s %s", r.Method, scheme, r.Host, r.URL.Path, r.Proto)
	return &safeLogEntry{prefix: fmt.Sprintf("%q from %s - ", line, r.RemoteAddr)}
}

type safeLogEntry struct{ prefix string }

func (e *safeLogEntry) Write(status, bytes int, _ http.Header, elapsed time.Duration, _ interface{}) {
	log.Printf("%s%d %dB in %s", e.prefix, status, bytes, elapsed)
}

func (e *safeLogEntry) Panic(v interface{}, stack []byte) { middleware.PrintPrettyStack(v) }

func (s *Server) Routes() http.Handler {
	r := chi.NewRouter()
	r.Use(s.adminIPGate)
	r.Use(s.securityHeaders)
	r.Use(middleware.RequestLogger(safeLogFormatter{})) // v2.57.1: path only — see safeLogFormatter
	r.Use(middleware.Recoverer)

	staticSub, err := fs.Sub(s.Static, ".")
	if err == nil {
		// v2.12.38: wrap the static FileServer with a Cache-Control header.
		// Without this, browsers refused to cache /static/app.css, the PWA
		// icons, etc. and re-fetched them on every cold navigation.
		//
		// 1 day (not 1 year) because the URLs aren't versioned — if we said
		// `immutable, max-age=31536000` then a docker pull to a newer
		// CaddyUI build wouldn't show up until users hard-refreshed. 86400
		// is the sweet spot: repeat visits within the same day are instant,
		// upgrades take effect within a day, and Ctrl-Shift-R always works.
		// (The PWA service worker does a separate cache-first pass at the
		// JS layer for assets it precaches — this header is the safety net
		// for first-visit / SW-not-yet-installed cases.)
		staticHandler := http.StripPrefix("/static/", http.FileServer(http.FS(staticSub)))
		r.Handle("/static/*", http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
			w.Header().Set("Cache-Control", "public, max-age=86400")
			staticHandler.ServeHTTP(w, req)
		}))
	}

	// PWA root files — must be served from / scope for the service worker to control the whole app.
	r.Get("/manifest.json", func(w http.ResponseWriter, r *http.Request) {
		f, err := s.Static.Open("manifest.json")
		if err != nil {
			http.NotFound(w, r)
			return
		}
		defer f.Close()
		w.Header().Set("Content-Type", "application/manifest+json")
		io.Copy(w, f)
	})
	r.Get("/sw.js", func(w http.ResponseWriter, r *http.Request) {
		f, err := s.Static.Open("sw.js")
		if err != nil {
			http.NotFound(w, r)
			return
		}
		defer f.Close()
		w.Header().Set("Content-Type", "application/javascript")
		w.Header().Set("Service-Worker-Allowed", "/")
		io.Copy(w, f)
	})

	r.Get("/setup", s.getSetup)
	r.Post("/setup", s.postSetup)
	r.Get("/login", s.getLogin)
	r.Post("/login", s.postLogin)
	r.Post("/logout", s.postLogout)
	r.Get("/auth/oidc/login", s.getOIDCLogin)       // issue #106 (SSO)
	r.Get("/auth/oidc/callback", s.getOIDCCallback) // issue #106 (SSO)
	r.Get("/login/totp", s.getTOTPVerify)
	r.Post("/login/totp", s.postTOTPVerify)
	r.Get("/forgot-password", s.getForgotPassword)
	r.Post("/forgot-password", s.postForgotPassword)
	r.Get("/reset-password", s.getResetPassword)
	r.Post("/reset-password", s.postResetPassword)
	r.Get("/accept-invite", s.getAcceptInvite)
	r.Post("/accept-invite", s.postAcceptInvite)

	r.Group(func(r chi.Router) {
		r.Use(s.requireAuth)
		// v2.29.0: CSRF must sit *inside* requireAuth — it reads the API-token
		// scope that requireAuth puts on the context to decide whether a
		// request is bearer-authenticated (and so not CSRF-reachable).
		r.Use(s.requireCSRF)
		r.Get("/", s.dashboard)
		r.Get("/onboarding", s.getOnboarding)

		// Read routes — open to both admin and viewer roles.
		r.Get("/proxy-hosts", s.listProxyHosts)
		r.Get("/redirection-hosts", s.listRedirectionHosts)
		r.Get("/caddyfile-import", s.getCaddyfileImport)
		r.Get("/activity", s.listActivityLog)
		r.Get("/activity/export.csv", s.exportActivityCSV)
		r.Get("/certificates", s.listCertificates)
		r.Get("/certificates/{id}/inspect", s.getCertificateInspect)
		r.Get("/certificates/{id}/managed-status", s.getManagedCertificateStatus)
		// v2.39.0: live TLS probes of custom certificates. Read-only towards
		// Caddy, so viewers may trigger them like the Refresh button before.
		r.Post("/certificates/probe", s.probeCertificatesHandler)
		r.Post("/certificates/{id}/probe", s.probeCertificateHandler)
		// v2.42.0: Export now — writes files, so write access is required.
		r.With(s.requireWrite).Post("/certificates/{id}/export", s.exportCertificateHandler)
		r.Get("/raw-routes", s.listRawRoutes)
		r.Get("/docs", s.getDocs)
		r.Get("/api/docs", s.getAPIDocs)

		// Server picker — available to every authenticated role. The route
		// only flips the caddyui_server cookie (a per-user preference) so
		// viewers and non-admin users can switch between Caddy instances
		// the admin has registered without needing write access. Admin-only
		// CRUD on the server list still lives in the admin-gated group below.
		r.Post("/servers/{id}/select", s.selectServer)

		// Feature B: upstream health check API (authenticated, no requireWrite).
		r.Get("/api/upstream-health", s.apiUpstreamHealth)

		// v2.11.5: ⌘K command palette — returns every visible resource on the
		// active server in one flat list. Frontend caches per palette open.
		r.Get("/api/search", s.globalSearch)

		// v2.11.15: AI assistant — proxies prompts to the configured Ollama
		// instance. /api/ai/status reports whether AI is enabled so the
		// frontend can hide the floating button when not configured.
		r.Get("/api/ai/status", s.apiAIStatus)
		r.With(s.requireWrite).Post("/api/ai/chat", s.apiAIChat) // v2.57.1: spends the admin's LLM key — not for read-only accounts

		// v2.12.27: per-user color-theme persistence so the picker in
		// Settings follows the account across devices instead of being
		// trapped in per-browser localStorage.
		r.Post("/api/me/color-theme", s.postMyColorTheme)

		// Live upstream status — proxies Caddy's /reverse_proxy/upstreams response.
		r.Get("/api/caddy-upstreams", s.apiCaddyUpstreams)
		r.With(s.requireWrite).Post("/api/proxy-hosts/test-upstream", s.apiTestUpstream) // v2.57.1: writers only
		// v2.11.13: live Caddyfile/JSON preview — takes the in-progress
		// proxy-host edit form and returns the route JSON Caddy would see.
		r.With(s.requireWrite).Post("/api/proxy-hosts/preview", s.apiPreviewProxyHost) // v2.57.1: writers only
		// v2.9.228: validate a raw-route's Caddyfile/JSON via /load?validate_only=true
		// before saving the row. Lets the form catch syntax/schema errors at edit
		// time instead of waiting for the next sync to surface them.
		r.With(s.requireWrite).Post("/api/raw-routes/validate", s.apiValidateRawRoute) // v2.57.1: writers only

		// Feature F: notifier status API (authenticated).

		// Phase 7: system stats API (authenticated, read-only).
		r.Get("/api/system-stats", s.apiSystemStats)

		// v2.15.0: dashboard sparklines — 7-day daily totals for the three
		// stat cards (views, visitors, bandwidth). Scoped to active server.
		r.Get("/api/dashboard-sparklines", s.apiDashboardSparklines)

		// Caddy version from the admin API root endpoint.
		r.Get("/api/caddy-version", s.apiCaddyVersion)

		// Update-check: fetches latest tag from Docker Hub (cached 1h).
		r.Get("/api/version-check", s.apiVersionCheck)

		// Unified DNS-provider zones endpoint — /api/dns-zones?provider=<id>.
		// Replaces the v2.2.x per-provider /api/cf-zones and /api/pb-domains
		// endpoints with a single handler that routes on ?provider=.
		r.Get("/api/dns-zones", s.apiDNSZones)

		// v2.4.8: warn when a proxy host would collide with a pre-existing
		// DNS record. Proxy-host form JS calls this after the user picks
		// provider + zone + first domain; response drives the "record
		// already exists — Cancel / Override?" dialog.
		r.Get("/api/dns-zones/check-record", s.apiDNSCheckRecord)

		// v2.5.2: post-save deployment status — drives the "deploying"
		// page's live checklist (DNS propagated, cert issued). Read-only,
		// so it lives outside the write-guarded group. v2.5.5 extends the
		// same checklist to advanced (raw) routes that have a host matcher.
		r.Get("/proxy-hosts/{id}/deploying", s.proxyHostDeploying)
		r.Get("/api/proxy-hosts/{id}/deploy-status", s.apiProxyHostDeployStatus)
		r.Get("/raw-routes/{id}/deploying", s.rawRouteDeploying)
		r.Get("/api/raw-routes/{id}/deploy-status", s.apiRawRouteDeployStatus)
		// v2.9.2: per-host health history page (read-only, authenticated).
		r.Get("/proxy-hosts/{id}/health", s.getProxyHostHealth)

		// v2.9.5: REST JSON API for proxy hosts and redirection hosts (read endpoints).
		r.Get("/api/v1/proxy-hosts", s.apiV1ListProxyHosts)
		r.Get("/api/v1/proxy-hosts/{id}", s.apiV1GetProxyHost)
		r.Get("/api/v1/redirection-hosts", s.apiV1ListRedirectionHosts)
		r.Get("/api/v1/redirection-hosts/{id}", s.apiV1GetRedirectionHost)
		r.Get("/api/v1/raw-routes", s.apiV1ListRawRoutes)
		r.Get("/api/v1/raw-routes/{id}", s.apiV1GetRawRoute)
		r.Get("/api/v1/certificates", s.apiV1ListCertificates)
		r.Get("/api/v1/certificates/{id}", s.apiV1GetCertificate)
		r.Get("/api/v1/servers", s.apiV1ListServers)

		// Write routes — admin-only in practice. Viewers get 403 via requireWrite.
		r.Group(func(r chi.Router) {
			r.Use(s.requireWrite)

			// v2.12.11: AI tool calling — model proposes a proxy host or
			// redirection via tool_calls; user confirms; this endpoint
			// actually creates it. GHSA-5h8j-xxm3-7ggr: this was previously
			// registered outside the requireWrite group above, so a
			// read-only viewer could reach it directly (bypassing the UI's
			// own confirmation step entirely) and create proxy hosts or
			// redirections despite being blocked from every other write
			// path. Moved here so the same role gate every other mutating
			// route already gets is no longer something this one handler
			// has to remember to check for itself.
			r.Post("/api/ai/exec-tool", s.apiAIExecTool)

			r.Get("/proxy-hosts/new", s.newProxyHost)
			r.Post("/proxy-hosts", s.createProxyHost)
			r.Get("/proxy-hosts/{id}/export.json", s.exportProxyHost)
			r.Get("/proxy-hosts/export-all.json", s.exportAllProxyHosts)
			// v2.12.49: Caddyfile export — inverse of /caddyfile-import paste flow.
			r.Get("/proxy-hosts/export-all.caddyfile", s.exportServerCaddyfile)
			// v2.12.50: per-host Caddyfile export.
			r.Get("/proxy-hosts/{id}/export.caddyfile", s.exportProxyHostCaddyfile)
			r.Post("/proxy-hosts/import", s.importProxyHost)
			r.Get("/proxy-hosts/{id}/edit", s.editProxyHost)
			r.Post("/proxy-hosts/{id}", s.updateProxyHost)
			r.Post("/proxy-hosts/{id}/delete", s.deleteProxyHost)
			r.Post("/proxy-hosts/{id}/clone", s.cloneProxyHost)
			r.Post("/proxy-hosts/{id}/toggle", s.toggleProxyHost)
			r.Post("/proxy-hosts/{id}/expectations/run", s.runProxyHostExpectationsHandler) // v2.38.0
			r.Post("/proxy-hosts/{id}/maintenance", s.toggleMaintenanceMode)
			r.Post("/proxy-hosts/bulk-toggle", s.bulkToggleProxyHosts)
			r.Post("/proxy-hosts/bulk-maintenance", s.bulkMaintenanceProxyHosts)
			r.Post("/proxy-hosts/bulk-certificate", s.bulkCertificateProxyHosts)
			r.Post("/proxy-hosts/bulk-delete", s.bulkDeleteProxyHosts)
			// v2.11.11: drag-to-reorder rows — accepts ids[] in desired
			// display order, writes sort_order = (index * 10) for each.
			r.Post("/proxy-hosts/reorder", s.reorderProxyHosts)

			// v2.9.5: REST JSON API write routes (write-scoped, honours requireWrite).
			r.Post("/api/v1/proxy-hosts", s.apiV1CreateProxyHost)
			r.Put("/api/v1/proxy-hosts/{id}", s.apiV1UpdateProxyHost)
			r.Delete("/api/v1/proxy-hosts/{id}", s.apiV1DeleteProxyHost)
			r.Post("/api/v1/proxy-hosts/{id}/toggle", s.apiV1ToggleProxyHost)
			r.Post("/api/v1/proxy-hosts/{id}/maintenance", s.apiV1ToggleMaintenanceProxyHost)
			r.Post("/api/v1/redirection-hosts", s.apiV1CreateRedirectionHost)
			r.Put("/api/v1/redirection-hosts/{id}", s.apiV1UpdateRedirectionHost)
			r.Delete("/api/v1/redirection-hosts/{id}", s.apiV1DeleteRedirectionHost)
			r.Post("/api/v1/redirection-hosts/{id}/toggle", s.apiV1ToggleRedirectionHost)
			r.Post("/api/v1/raw-routes", s.apiV1CreateRawRoute)
			r.Put("/api/v1/raw-routes/{id}", s.apiV1UpdateRawRoute)
			r.Delete("/api/v1/raw-routes/{id}", s.apiV1DeleteRawRoute)
			r.Post("/api/v1/raw-routes/{id}/toggle", s.apiV1ToggleRawRoute)
			r.Post("/api/v1/certificates", s.apiV1CreateCertificate)
			r.Put("/api/v1/certificates/{id}", s.apiV1UpdateCertificate)
			r.Delete("/api/v1/certificates/{id}", s.apiV1DeleteCertificate)

			r.Get("/redirection-hosts/new", s.newRedirectionHost)
			r.Post("/redirection-hosts", s.createRedirectionHost)
			r.Get("/redirection-hosts/{id}/edit", s.editRedirectionHost)
			r.Post("/redirection-hosts/{id}", s.updateRedirectionHost)
			r.Post("/redirection-hosts/{id}/delete", s.deleteRedirectionHost)
			r.Post("/redirection-hosts/{id}/toggle", s.toggleRedirectionHost)
			r.Post("/redirection-hosts/{id}/clone", s.cloneRedirectionHost)
			// v2.11.6: bulk operations on /redirection-hosts (parallel of proxy-host bulk).
			r.Post("/redirection-hosts/bulk-toggle", s.bulkToggleRedirectionHosts)
			r.Post("/redirection-hosts/bulk-delete", s.bulkDeleteRedirectionHosts)
			// v2.11.11: drag-to-reorder rows.
			r.Post("/redirection-hosts/reorder", s.reorderRedirectionHosts)

			r.Post("/caddy/reload", s.reloadCaddy)
			r.Post("/caddyfile-import", s.postCaddyfileImport)

			// v2.7.2: certificate create + edit are writer-level, not admin-only.
			// Each cert now carries owner_id (NULL = global/admin, >0 = private
			// to a user). user-role uploads land with owner_id = cu.ID so they
			// don't collide with other tenants' TLS material. The per-handler
			// 403 in editCertificate / updateCertificate enforces ownership
			// defensively — route layer only filters view-role out.
			//
			// Delete stays admin-only (see /certificates/{id}/delete down in
			// the requireAdmin group) because its blast radius is NULL-ing
			// certificate_id on proxy_hosts/redirection_hosts/raw_routes across
			// owners. That check would be racy if we distributed it.
			r.Get("/certificates/new", s.newCertificate)
			r.Post("/certificates", s.createCertificate)
			r.Get("/certificates/{id}/edit", s.editCertificate)
			r.Post("/certificates/{id}", s.updateCertificate)
			r.Post("/certificates/{id}/delete", s.deleteCertificate)
			// v2.11.10: bulk delete on /certificates — same ownership / in-use
			// guards as the single-row deleteCertificate handler.
			r.Post("/certificates/bulk-delete", s.bulkDeleteCertificates)

			r.Get("/raw-routes/new", s.newRawRoute)
			r.Post("/raw-routes", s.createRawRoute)
			r.Get("/raw-routes/{id}/edit", s.editRawRoute)
			r.Post("/raw-routes/{id}", s.updateRawRoute)
			r.Post("/raw-routes/{id}/delete", s.deleteRawRoute)
			// v2.11.9: bulk operations on /raw-routes (parallel of /proxy-hosts).
			r.Post("/raw-routes/bulk-toggle", s.bulkToggleRawRoutes)
			r.Post("/raw-routes/bulk-delete", s.bulkDeleteRawRoutes)
			// v2.10.9: bulk re-run the classifier over Advanced routes —
			// useful for users who imported before v2.10.7 (auto-classify)
			// shipped, when every block landed in Advanced.
			r.Post("/raw-routes/reclassify", s.postReclassifyRawRoutes)

			// Phase 7: database backup download.
		})

		// TOTP setup — available to all authenticated users.
		r.Get("/totp/setup", s.getTOTPSetup)
		r.Post("/totp/setup", s.postTOTPSetup)
		r.Post("/totp/regenerate-backup-codes", s.postRegenerateBackupCodes)

		// v2.7.0: visitor analytics — read-only for every signed-in
		// user. userAllowedHosts scopes non-admins to their owned
		// sites so the page doesn't leak traffic for hosts they
		// don't have Edit permission on.
		r.Get("/analytics", s.getAnalytics)
		r.Get("/analytics/export.csv", s.exportAnalyticsCSV)
		r.Get("/analytics/requests", s.getAnalyticsRequests) // issue #145: cross-dimension request explorer
		r.Get("/analytics/{host}", s.getAnalyticsHost)
		r.Get("/analytics/{host}/visitor", s.getAnalyticsVisitor) // issue #94
		r.Get("/analytics/{host}/path", s.getAnalyticsPath)       // issue #94
		r.Get("/analytics/{host}/status", s.getAnalyticsStatus)   // issue #94 follow-up
		r.Post("/analytics/{host}/block", s.postAnalyticsBlock)   // issue #100
		r.Get("/live-traffic", s.getLiveTraffic)
		r.Get("/api/live-traffic/stream", s.liveTrafficStream)

		// Global search — read-only, available to every authenticated role.
		r.Get("/search", s.getSearch)

		// Session manager — every user can view and revoke their own sessions;
		// admins see all sessions across all users.
		r.Get("/sessions", s.getSessions)
		r.Post("/sessions/{token}/revoke", s.revokeSession)

		// API token manager — every authenticated user can create/revoke their
		// own tokens; admins see all users' tokens.
		r.Get("/api-tokens", s.listAPITokens)
		r.Post("/api-tokens", s.createAPIToken)
		r.Post("/api-tokens/{id}/revoke", s.revokeAPIToken)

		// Profile page — every authenticated user can update their own name/password.
		r.Get("/profile", s.getProfile)
		r.Post("/profile", s.postProfile)

		// User management and settings — admin-only (both read and write).
		r.Group(func(r chi.Router) {
			r.Use(s.requireAdmin)

			// Security (v2.57.1): everything that exposes or replaces the live
			// Caddy config, the database, or the stored credentials is
			// admin-only. These used to sit in the read-for-any-role and
			// requireWrite groups, so a viewer could read certificate private
			// keys and DNS API tokens from /caddy-config and a customer-level
			// user could download the whole database from /backup.
			r.Get("/caddy-config", s.getCaddyConfig)
			// v2.58.0 (issue #122): Layer4 (TCP/UDP) proxies. Admin-only — a
			// layer4 listener opens a port on the host and forwards to anything
			// the host can reach.
			r.Get("/middleware-profiles", s.listMiddlewareProfiles) // v2.60.0 (issue #124)
			r.Get("/middleware-profiles/new", s.newMiddlewareProfile)
			r.Post("/middleware-profiles", s.createMiddlewareProfile)
			r.Get("/middleware-profiles/{id}/edit", s.editMiddlewareProfile)
			r.Post("/middleware-profiles/{id}", s.updateMiddlewareProfile)
			r.Post("/middleware-profiles/{id}/delete", s.deleteMiddlewareProfile)
			r.Get("/layer4-proxies", s.listLayer4Proxies)
			r.Get("/layer4-proxies/new", s.newLayer4Proxy)
			r.Post("/layer4-proxies", s.createLayer4Proxy)
			r.Get("/layer4-proxies/{id}/edit", s.editLayer4Proxy)
			r.Post("/layer4-proxies/{id}", s.updateLayer4Proxy)
			r.Post("/layer4-proxies/{id}/toggle", s.toggleLayer4Proxy)
			r.Post("/layer4-proxies/{id}/delete", s.deleteLayer4Proxy)
			r.Get("/import", s.getImport)
			r.Post("/import", s.postImport)
			r.Get("/snapshots", s.listSnapshots)
			r.Get("/snapshots/{id}/download", s.downloadSnapshot)
			r.Get("/snapshots/{id}/diff", s.getSnapshotDiff)
			r.Post("/snapshots", s.createManualSnapshot)
			r.Post("/snapshots/upload", s.uploadSnapshot)
			r.Post("/snapshots/auto", s.setAutoSnapshots)
			r.Post("/snapshots/{id}/restore", s.restoreSnapshot)
			r.Post("/snapshots/{id}/delete", s.deleteSnapshot)
			r.Get("/backup", s.getBackup)
			// The Porkbun import uses the admin's own Porkbun API keys and
			// returns SSL bundles including the private key.
			r.Get("/certificates/import/porkbun", s.importPorkbunCertificatePage)
			r.Post("/certificates/import/porkbun", s.importPorkbunCertificate)
			// Webhook / ntfy destinations are bearer secrets.
			r.Get("/api/notifier-status", s.apiNotifierStatus)

			r.Get("/users", s.listUsers)
			r.Get("/users/new", s.newUser)
			r.Post("/users", s.createUser)
			r.Post("/users/invite", s.postInviteUser)
			r.Get("/users/{id}/edit", s.editUser)
			r.Post("/users/{id}", s.updateUser)
			r.Post("/users/{id}/delete", s.deleteUser)

			// v2.7.4: group CRUD. Admin puts user-role accounts into a shared
			// group; members then see each other's rows (proxy/redirect/raw/
			// certs) read-only in List* queries. Edit/delete still goes
			// through the per-row ownership gate inside each handler, so
			// "view teammates' work" doesn't imply "mutate teammates' work".
			r.Get("/groups", s.listGroups)
			r.Get("/groups/new", s.newGroup)
			r.Post("/groups", s.createGroup)
			r.Get("/groups/{id}/edit", s.editGroup)
			r.Post("/groups/{id}", s.updateGroup)
			r.Post("/groups/{id}/delete", s.deleteGroup)

			r.Get("/servers", s.listServersPage)
			r.Get("/servers/new", s.newServerPage)
			r.Post("/servers", s.createServer)
			r.Get("/servers/{id}/edit", s.editServerPage)
			r.Get("/servers/{id}/config", s.viewServerConfig)
			r.Post("/servers/{id}", s.updateServer)
			r.Post("/servers/{id}/sync-from-current", s.syncServerFromCurrent)
			r.Post("/servers/{id}/sync-reapply", s.reapplySyncHandler)        // v2.38.0
			r.Post("/servers/{id}/sync-hold/clear", s.clearSyncHoldHandler)   // v2.38.0
			r.Post("/servers/{id}/sync-error/clear", s.clearSyncErrorHandler) // v2.42.1
			r.Post("/servers/{id}/delete", s.deleteServer)
			r.Post("/servers/{id}/pending-deletions/retry", s.retryFleetPendingDeletions)    // v2.59.0 (issue #120)
			r.Post("/servers/{id}/pending-deletions/discard", s.discardFleetPendingDeletion) // v2.59.0 (issue #120)
			r.Get("/server-logs", s.getServerLogs)
			r.Get("/api/server-logs/status", s.serverLogStatus)
			r.Get("/api/server-logs/stream", s.serverLogStream)
			r.Post("/api/server-logs/enable", s.enableServerLogs)
			r.Post("/api/server-logs/disable", s.disableServerLogs)
			r.Post("/api/server-logs/clear", s.clearServerLogs) // v2.35.5 (issue #60)
			r.Post("/dashboard/recommendations/unused-certificates/dismiss", s.dismissUnusedCertificateRecommendation)
			r.Post("/dashboard/recommendations/two-factor-policy/dismiss", s.dismissTOTPPolicyRecommendation) // v2.64.2 (issue #138)

			// v2.7.2: create/edit moved up to the requireWrite group so
			// user-role accounts can manage their own certs. The remaining
			// admin-only cert concern — whole-cert delete with its
			// cross-owner blast radius — is enforced by the inline role check
			// inside deleteCertificate, not by route gating, so a user-role
			// account can still delete a cert they own (see the ownership
			// branch in that handler).

			// Feature F: settings page (admin-only).
			r.Get("/settings", s.getSettings)
			r.Get("/settings/{section}", s.getSettings) // v2.44.0
			r.Post("/settings", s.postSettings)
			r.Post("/settings/analytics/prune", s.pruneAnalyticsHandler)   // v2.43.0
			r.Post("/settings/analytics/vacuum", s.vacuumAnalyticsHandler) // v2.43.0
			r.Post("/settings/backup/run", s.postBackupRun)                // v2.52.0 (issue #104)
			r.Post("/settings/test-webhook", s.postTestWebhook)
			r.Post("/settings/test-email", s.postTestEmail)
			r.Post("/settings/test-crowdsec", s.postTestCrowdSec)
			r.Post("/settings/dns-provider/{id}/clear", s.postClearDNSProvider)
		})
	})

	return r
}

// securityHeaders sets baseline response headers on every CaddyUI response
// regardless of whether the request reached us through a reverse proxy or
// directly. Defense-in-depth: even if you bypass Caddy and hit CaddyUI on
// its bound port (or behind a different proxy that doesn't add security
// headers), these still ship.
//
// Headers set:
//   - X-Frame-Options: SAMEORIGIN — page can only be iframed by itself,
//     mitigates clickjacking against the management UI.
//   - X-Content-Type-Options: nosniff — browser respects the Content-Type
//     header instead of MIME-sniffing, mitigates MIME confusion.
//   - Referrer-Policy: strict-origin-when-cross-origin — hides path/query
//     from cross-origin navigations.
//
// HSTS is intentionally NOT set here — CaddyUI may be served on plain HTTP
// when accessed via Tailscale / Wireguard / localhost during dev/test, and
// HSTS would make those flows uncomfortable. The fronting Caddy adds HSTS
// for public HTTPS access via the Security Headers checkbox on the
// proxy host fronting CaddyUI. v2.10.3.
func (s *Server) securityHeaders(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		// v2.12.15: honour Settings → "Globally stripped response headers"
		// for CaddyUI's own responses too (not just proxied upstream replies).
		// Without this, a user setting `X-Frame-Options` in the global-strip
		// field still saw SAMEORIGIN on CaddyUI-served pages (login redirect,
		// admin UI, etc.) because this middleware unconditionally set it.
		stripped := map[string]bool{}
		if globalStrip, _ := models.GetSetting(s.DB, settingGlobalStripResponseHeaders); strings.TrimSpace(globalStrip) != "" {
			for _, hh := range strings.Split(globalStrip, ",") {
				hh = strings.ToLower(strings.TrimSpace(hh))
				if hh != "" {
					stripped[hh] = true
				}
			}
		}
		h := w.Header()
		// Set-only-if-not-already-present so a more restrictive value from
		// a fronting proxy (e.g. X-Frame-Options: DENY) still wins. Skip
		// entirely if the header is in the global-strip list — user has
		// explicitly told us to drop it everywhere.
		if !stripped["x-frame-options"] && h.Get("X-Frame-Options") == "" {
			h.Set("X-Frame-Options", "SAMEORIGIN")
		}
		if !stripped["x-content-type-options"] && h.Get("X-Content-Type-Options") == "" {
			h.Set("X-Content-Type-Options", "nosniff")
		}
		if !stripped["referrer-policy"] && h.Get("Referrer-Policy") == "" {
			h.Set("Referrer-Policy", "strict-origin-when-cross-origin")
		}
		// v2.30.0: Content-Security-Policy and Permissions-Policy, following
		// the same strip-aware, set-only-if-absent rules as the three above.
		// See security_headers.go for the allowlist and why each origin is on
		// it; CADDYUI_CSP=off disables the policy without a redeploy.
		if csp := cspPolicy(); csp != "" &&
			!stripped["content-security-policy"] && h.Get("Content-Security-Policy") == "" {
			h.Set("Content-Security-Policy", csp)
		}
		if !stripped["permissions-policy"] && h.Get("Permissions-Policy") == "" {
			h.Set("Permissions-Policy", "camera=(), microphone=(), geolocation=(), interest-cohort=()")
		}
		// v2.12.18: previously wrapped w in a stripHeaderWriter so headers
		// set by downstream handlers (templates / 404 / Caddy-static) could
		// also be stripped. Reverted — the wrapper didn't implement
		// http.Flusher / http.Hijacker so streaming responses degraded into
		// browser-side "save as" downloads (no detected Content-Type
		// flushing). The conditional skips above on the three headers this
		// middleware unconditionally sets are enough; downstream handlers
		// don't add X-Frame-Options / etc. on their own.
		next.ServeHTTP(w, r)
	})
}

// adminIPGate returns a middleware that enforces the admin_allowlist setting.
// If the setting is empty, all IPs are allowed. Non-matching IPs get 403.
//
// v2.65.0 (issue #140): the allowlist is matched against the address from
// resolvedClientIP, not the raw connection. It used to compare
// r.RemoteAddr, which behind any reverse proxy is the proxy — so an
// allowlist naming the real visitor locked that visitor out, and the usual
// workaround of naming the proxy instead admitted *everyone* who came
// through it while still reading as "restricted" in the UI.
func (s *Server) adminIPGate(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		raw := s.adminAllowlist()
		if raw == "" {
			next.ServeHTTP(w, r)
			return
		}
		// Parse the allowlist.
		var allowedNets []*net.IPNet
		var allowedIPs []net.IP
		for _, line := range strings.FieldsFunc(raw, func(r rune) bool { return r == ',' || r == '\n' }) {
			cidr := strings.TrimSpace(line)
			if cidr == "" {
				continue
			}
			if strings.Contains(cidr, "/") {
				_, ipnet, err := net.ParseCIDR(cidr)
				if err == nil {
					allowedNets = append(allowedNets, ipnet)
				}
			} else {
				if ip := net.ParseIP(cidr); ip != nil {
					allowedIPs = append(allowedIPs, ip)
				}
			}
		}
		if len(allowedNets) == 0 && len(allowedIPs) == 0 {
			next.ServeHTTP(w, r)
			return
		}
		// The visitor's address, taken from a forwarded header only when the
		// connection came from a trusted proxy.
		clientIP, _ := s.resolvedClientIP(r)
		ip := net.ParseIP(clientIP)
		if ip == nil {
			http.Error(w, "Forbidden", http.StatusForbidden)
			return
		}
		// Check against allowlist.
		for _, allowed := range allowedIPs {
			if allowed.Equal(ip) {
				next.ServeHTTP(w, r)
				return
			}
		}
		for _, ipnet := range allowedNets {
			if ipnet.Contains(ip) {
				next.ServeHTTP(w, r)
				return
			}
		}
		http.Error(w, "403 Forbidden — your IP is not on the admin allowlist", http.StatusForbidden)
	})
}

func (s *Server) requireAuth(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		n, err := models.CountUsers(s.DB)
		if err != nil {
			http.Error(w, err.Error(), http.StatusInternalServerError)
			return
		}
		if n == 0 {
			http.Redirect(w, r, "/setup", http.StatusSeeOther)
			return
		}
		cookie, err := r.Cookie(auth.SessionCookie)
		if err != nil {
			// No session cookie — try bearer token before redirecting.
			if u, tokenScopes := s.bearerTokenUser(r); u != nil {
				// Enforce the token's scope on EVERY route (v2.57.1).
				if msg := apiTokenScopeDenial(tokenScopes, r); msg != "" {
					http.Error(w, msg, http.StatusForbidden)
					return
				}
				ctx := context.WithValue(r.Context(), auth.ContextUserKey, u)
				ctx = context.WithValue(ctx, apiTokenScopeContextKey{}, tokenScopes)
				next.ServeHTTP(w, r.WithContext(ctx))
				return
			}
			http.Redirect(w, r, "/login", http.StatusSeeOther)
			return
		}
		u, err := auth.UserFromSession(s.DB, cookie.Value)
		if err != nil || u == nil {
			auth.ClearSessionCookie(w, r)
			// Session invalid — try bearer token before redirecting.
			if u, tokenScopes := s.bearerTokenUser(r); u != nil {
				// Enforce the token's scope on EVERY route (v2.57.1).
				if msg := apiTokenScopeDenial(tokenScopes, r); msg != "" {
					http.Error(w, msg, http.StatusForbidden)
					return
				}
				ctx := context.WithValue(r.Context(), auth.ContextUserKey, u)
				ctx = context.WithValue(ctx, apiTokenScopeContextKey{}, tokenScopes)
				next.ServeHTTP(w, r.WithContext(ctx))
				return
			}
			http.Redirect(w, r, "/login", http.StatusSeeOther)
			return
		}
		// Enforce the two-factor policy: a user without TOTP goes to the setup
		// page until they enrol.
		//
		// v2.64.1 (issue #138): this used to be two consecutive blocks, one per
		// setting, which differed only in their query parameter and in what
		// they let through — so whether an API call survived the redirect
		// depended on which of two identically-described toggles the admin
		// happened to use. One check now, with the wider exclusion list, and
		// either setting still turns it on (see settingRequire2FA).
		if !u.TOTPEnabled && s.twoFactorRequired() {
			path := r.URL.Path
			// /totp/ covers the setup page and its POST target, so enrolment
			// can actually be completed. /api/ is excluded because a JSON
			// caller has no use for a redirect to an HTML page.
			if !strings.HasPrefix(path, "/totp/") && !strings.HasPrefix(path, "/static/") &&
				!strings.HasPrefix(path, "/api/") && path != "/logout" {
				http.Redirect(w, r, "/totp/setup?required=1", http.StatusSeeOther)
				return
			}
		}
		ctx := context.WithValue(r.Context(), auth.ContextUserKey, u)
		next.ServeHTTP(w, r.WithContext(ctx))
	})
}

// bearerTokenUser checks for an Authorization: Bearer header and resolves
// it to a User via the api_tokens table. Returns (nil, "") if no header is
// present or the token is invalid/expired. Callers that already resolved a
// session user should skip this (session wins over bearer).
func (s *Server) bearerTokenUser(r *http.Request) (*models.User, string) {
	authHeader := r.Header.Get("Authorization")
	if !strings.HasPrefix(authHeader, "Bearer ") {
		return nil, ""
	}
	raw := strings.TrimPrefix(authHeader, "Bearer ")
	if raw == "" {
		return nil, ""
	}
	h := sha256.Sum256([]byte(raw))
	hash := fmt.Sprintf("%x", h)
	tok, err := models.GetAPITokenByHash(s.DB, hash)
	if err != nil || tok == nil {
		return nil, ""
	}
	if tok.Expired() {
		return nil, ""
	}
	u, err := models.GetUserByID(s.DB, tok.UserID)
	if err != nil {
		return nil, ""
	}
	models.TouchAPIToken(s.DB, tok.ID)
	return u, tok.Scopes
}

func (s *Server) currentUser(r *http.Request) *models.User {
	u, _ := r.Context().Value(auth.ContextUserKey).(*models.User)
	return u
}

func currentAPITokenScope(r *http.Request) string {
	scope, _ := r.Context().Value(apiTokenScopeContextKey{}).(string)
	return scope
}

func proxyWriteTokenCanWritePath(path string) bool {
	return path == "/api/v1/proxy-hosts" || strings.HasPrefix(path, "/api/v1/proxy-hosts/")
}

// sessionTTL returns the configured session duration, defaulting to 7 days.
func (s *Server) sessionTTL() time.Duration {
	v, _ := models.GetSetting(s.DB, settingSessionDays)
	if v == "" {
		return 7 * 24 * time.Hour
	}
	days, err := strconv.Atoi(strings.TrimSpace(v))
	if err != nil || days <= 0 || days > 365 {
		return 7 * 24 * time.Hour
	}
	return time.Duration(days) * 24 * time.Hour
}

func (s *Server) render(w http.ResponseWriter, r *http.Request, name string, data map[string]any) {
	if data == nil {
		data = map[string]any{}
	}
	// Always inject app version.
	data["AppVersion"] = s.Version
	// v2.68.3 (issue #150): a save whose copy did not reach every fleet target
	// says so on the page it lands on (withDeployProblems); the pages that
	// receive those redirects render it with {{template "deployError" .}}.
	if _, ok := data["DeployError"]; !ok && r != nil {
		data["DeployError"] = r.URL.Query().Get("deploy_error")
	}
	// v2.62.0 (issue #128): the page's language and the strings the browser-side
	// scripts may need (window.CADDYUI_I18N in layout.html).
	if _, ok := data["Lang"]; !ok {
		u, _ := data["User"].(*models.User)
		if u == nil && r != nil {
			u = s.currentUser(r)
		}
		data["Lang"] = s.requestLocale(r, u)
	}
	if _, ok := data["I18NJS"]; !ok {
		data["I18NJS"] = translations().Subset(data["Lang"].(string), "js.")
	}
	// v2.29.0: CSRF token for every rendered page. CSRFField is the ready-made
	// hidden input each POST form embeds; CSRFToken is the raw value, surfaced
	// as a <meta> tag so the fetch wrapper in app.js can pick it up for JSON
	// calls. Both are empty for anonymous pages, which have no session to
	// protect. Injected here so no page can forget it.
	if _, ok := data["CSRFField"]; !ok {
		data["CSRFField"] = s.csrfField(r)
	}
	if _, ok := data["CSRFToken"]; !ok {
		data["CSRFToken"] = s.csrfTokenForRequest(r)
	}
	// Inject site title for every page so layout.html can use it.
	if _, ok := data["SiteTitle"]; !ok {
		data["SiteTitle"] = mustGetSetting(s.DB, settingSiteTitle)
	}
	// Inject custom favicon URL for every page so layout.html can override the default icon.
	if _, ok := data["FaviconURL"]; !ok {
		data["FaviconURL"] = mustGetSetting(s.DB, settingFaviconURL)
	}
	// Auto-inject server picker data (best-effort; non-fatal if DB unavailable).
	if _, ok := data["Servers"]; !ok {
		if servers, err := models.ListCaddyServers(s.DB); err == nil {
			data["Servers"] = servers
		}
	}
	// v2.38.0: servers held after a failed post-apply check — layout banner.
	if _, ok := data["SyncHolds"]; !ok {
		if servers, ok := data["Servers"].([]models.CaddyServer); ok && len(servers) > 0 {
			data["SyncHolds"] = s.activeSyncHolds(servers)
		}
	}
	// v2.42.1: servers whose last sync failed — layout banner.
	if _, ok := data["SyncErrors"]; !ok {
		if servers, ok := data["Servers"].([]models.CaddyServer); ok && len(servers) > 0 {
			data["SyncErrors"] = s.activeSyncErrors(servers)
		}
	}
	if _, ok := data["CurrentServer"]; !ok {
		if r != nil {
			sid := s.currentServerID(r)
			if srv, err := models.GetCaddyServer(s.DB, sid); err == nil {
				data["CurrentServer"] = srv
			}
		}
	}
	tpl, ok := s.Templates[name]
	if !ok {
		http.Error(w, "template not found: "+name, http.StatusInternalServerError)
		return
	}
	// v2.29.0: render into a buffer so the CSRF hidden input can be stamped
	// into every POST form before anything reaches the client. Buffering also
	// means a mid-template error produces a clean 500 instead of a truncated
	// page followed by an error string, which is what happened when this wrote
	// to the ResponseWriter directly.
	var buf bytes.Buffer
	if err := tpl.ExecuteTemplate(&buf, "layout", data); err != nil {
		log.Printf("template %s: %v", name, err)
		http.Error(w, err.Error(), http.StatusInternalServerError)
		return
	}
	page := buf.Bytes()
	if field, _ := data["CSRFField"].(template.HTML); field != "" {
		page = csrfInjectForms(page, []byte(field))
	}
	w.Header().Set("Content-Type", "text/html; charset=utf-8")
	if _, err := w.Write(page); err != nil {
		log.Printf("template %s: write: %v", name, err)
	}
}

// --- Setup (first-run) ---
func (s *Server) getSetup(w http.ResponseWriter, r *http.Request) {
	n, err := models.CountUsers(s.DB)
	if err != nil {
		http.Error(w, err.Error(), http.StatusInternalServerError)
		return
	}
	if n > 0 {
		http.Redirect(w, r, "/login", http.StatusSeeOther)
		return
	}
	s.render(w, r, "setup.html", nil)
}

func (s *Server) postSetup(w http.ResponseWriter, r *http.Request) {
	// v2.57.1: the user-count check and the insert must be one step. Two
	// simultaneous requests could both see zero users and both create an admin.
	s.setupMu.Lock()
	defer s.setupMu.Unlock()
	n, err := models.CountUsers(s.DB)
	if err != nil {
		http.Error(w, err.Error(), http.StatusInternalServerError)
		return
	}
	if n > 0 {
		http.Redirect(w, r, "/login", http.StatusSeeOther)
		return
	}
	_ = r.ParseForm()
	email := strings.TrimSpace(r.FormValue("email"))
	name := strings.TrimSpace(r.FormValue("name"))
	pw := r.FormValue("password")
	pw2 := r.FormValue("password_confirm")
	if email == "" || pw == "" {
		s.render(w, r, "setup.html", map[string]any{"Error": "Email and password required"})
		return
	}
	if pw != pw2 {
		s.render(w, r, "setup.html", map[string]any{"Error": "Passwords do not match"})
		return
	}
	// The 8-character minimum was only an HTML attribute; enforce it here too.
	if len(pw) < 8 {
		s.render(w, r, "setup.html", map[string]any{"Error": "Password must be at least 8 characters"})
		return
	}
	hash, err := auth.HashPassword(pw)
	if err != nil {
		http.Error(w, err.Error(), http.StatusInternalServerError)
		return
	}
	id, err := models.CreateUser(s.DB, email, hash, name, models.RoleAdmin)
	if err != nil {
		s.render(w, r, "setup.html", map[string]any{"Error": err.Error()})
		return
	}
	tok, exp, err := auth.CreateSessionWithTTL(s.DB, id, s.sessionTTL())
	if err != nil {
		http.Error(w, err.Error(), http.StatusInternalServerError)
		return
	}
	auth.SetSessionCookie(w, r, tok, exp)
	http.Redirect(w, r, "/onboarding", http.StatusSeeOther)
}

// getOnboarding renders the guided first-run journey. It deliberately uses
// live product state instead of a dismissible "completed" flag: returning
// admins can open the page at any time and immediately see which operational
// foundations are configured, without onboarding state drifting away from
// the real Caddy/server/DNS/security configuration.
func (s *Server) getOnboarding(w http.ResponseWriter, r *http.Request) {
	cu := s.currentUser(r)
	if cu == nil {
		http.Redirect(w, r, "/login", http.StatusSeeOther)
		return
	}

	sid := s.currentServerID(r)
	currentServer, _ := models.GetCaddyServer(s.DB, sid)
	serverConnected := currentServer != nil && currentServer.Status == models.CaddyServerStatusOnline
	dnsConfigured := len(s.loadDNSProfiles()) > 0

	var proxyCount int
	_ = s.DB.QueryRow(`SELECT COUNT(*) FROM proxy_hosts WHERE server_id = ?`, sid).Scan(&proxyCount)

	completed := requiredReadinessSteps(serverConnected, proxyCount > 0)

	s.render(w, r, "onboarding.html", map[string]any{
		"User":            cu,
		"CurrentServer":   currentServer,
		"ServerConnected": serverConnected,
		"DNSConfigured":   dnsConfigured,
		"TOTPEnabled":     cu.TOTPEnabled,
		"ProxyCount":      proxyCount,
		"CompletedSteps":  completed,
		"Section":         "onboarding",
	})
}

// --- Login ---

const (
	settingTurnstileSiteKey   = "turnstile_site_key"
	settingTurnstileSecretKey = "turnstile_secret_key"

	// Shared A-record target — the public IP every DNS provider writes as
	// its record content. The key name starts with "cf_" for historical
	// reasons (Cloudflare was the first provider); it's the single source
	// of truth now regardless of which provider is active.
	settingServerIP = "cf_server_ip"

	// Cloudflare-specific.
	settingCFAPIToken = "cf_api_token"
	settingCFProxied  = "cf_proxied"

	// v2.49.0 (issue #98): resolver used for external verification lookups on
	// the deploy/readiness checks. Empty = Cloudflare DoH (default). May be a
	// DoH URL (https://…/dns-query) or a comma-separated list of plain DNS
	// servers (e.g. "192.168.1.10:53") for filtered/split-horizon networks.
	settingDNSVerifyResolver = "dns_verify_resolver"

	// issue #116: DNS servers Caddy's own ACME DNS-01 solver queries when
	// checking TXT-record propagation during certificate issuance/renewal —
	// distinct from settingDNSVerifyResolver, which only affects CaddyUI's
	// deploy/readiness checks. Empty = Caddy's default (the container/system
	// resolver), which fails for split-horizon DNS where the internal
	// resolver can't see the public zone used for ACME validation. A
	// comma-separated list of plain DNS servers, e.g. "1.1.1.1:53".
	settingACMEDNSResolvers = "acme_dns_resolvers"

	// Legacy alias kept so pre-v2.3.0 code paths referencing
	// settingCFServerIP continue to compile. Points at the shared key.
	settingCFServerIP = settingServerIP

	// Porkbun.
	settingPBAPIKey    = "pb_api_key"
	settingPBSecretKey = "pb_secret_key"

	// Namecheap (v2.3.0).
	settingNCAPIUser  = "nc_api_user"
	settingNCAPIKey   = "nc_api_key"
	settingNCClientIP = "nc_client_ip"

	// GoDaddy (v2.3.0).
	settingGDAPIKey    = "gd_api_key"
	settingGDAPISecret = "gd_api_secret"

	// DigitalOcean (v2.3.0).
	settingDOAPIToken = "do_api_token"

	// Hetzner DNS (v2.3.0).
	settingHetznerAPIToken = "hetzner_api_token"
	// v2.45.0: Gandi LiveDNS personal access token (discussion #72).
	settingGandiAPIToken = "gandi_api_token"

	// Amazon Route 53 (v2.23.0). Region defaults to us-east-1 in both the
	// CaddyUI API adapter and the caddy-dns/route53 module. Session token is
	// optional and supports temporary STS credentials.
	settingRoute53AccessKeyID     = "route53_access_key_id"
	settingRoute53SecretAccessKey = "route53_secret_access_key"
	settingRoute53SessionToken    = "route53_session_token"
	settingRoute53Region          = "route53_region"

	// Multiple DNS credential profiles (v2.16.0). JSON array of
	// dnsCredentialProfile. Empty/missing means legacy per-provider
	// settings remain the only credential source.
	settingDNSProfilesJSON = "dns_profiles_json"
)

// dnsProviderCredKeys lists every settings-table key that belongs to a DNS
// provider's credential set. Used by postSettings to walk the new unified
// form section without hardcoding a branch per provider.
//
// Key order mirrors dns.Descriptors() so the Settings page renders cards
// in the same order credentials are saved.
var dnsProviderCredKeys = map[string][]string{
	dns.Cloudflare:   {settingCFAPIToken},
	dns.Porkbun:      {settingPBAPIKey, settingPBSecretKey},
	dns.Namecheap:    {settingNCAPIUser, settingNCAPIKey, settingNCClientIP},
	dns.GoDaddy:      {settingGDAPIKey, settingGDAPISecret},
	dns.DigitalOcean: {settingDOAPIToken},
	dns.Hetzner:      {settingHetznerAPIToken},
	dns.Route53:      {settingRoute53AccessKeyID, settingRoute53SecretAccessKey, settingRoute53SessionToken, settingRoute53Region},
	dns.Gandi:        {settingGandiAPIToken}, // v2.45.0
}

type dnsCredentialProfile struct {
	ID            string            `json:"id"`
	Name          string            `json:"name"`
	ProviderID    string            `json:"provider_id"`
	Credentials   map[string]string `json:"credentials"`
	ZoneAllowlist []string          `json:"zone_allowlist,omitempty"`
}

type dnsProfileView struct {
	ID               string
	Name             string
	ProviderID       string
	ProviderName     string
	TokenSet         bool
	Proxied          bool
	ZoneAllowlistRaw string
}

// zoneAllowlistKey returns the settings-table key where the per-provider
// zone allow-list is stored. Format on disk: comma-separated lowercase base
// domains (e.g. "example.com, other.com"). An empty value means "no
// restriction" — every zone the credentials can see is usable, which is
// the original v2.4.5-and-earlier behaviour.
//
// v2.4.7: introduced so users whose API keys have broad account access
// (especially GoDaddy, where a single key can touch every domain on the
// account) can pin CaddyUI to one or a few zones and guarantee it won't
// ever touch the rest.
func zoneAllowlistKey(providerID string) string {
	return strings.ToLower(strings.TrimSpace(providerID)) + "_zone_allowlist"
}

// parseZoneAllowlist normalises a raw textarea/CSV value into a slice of
// lowercase, trimmed base-domain names with duplicates removed. Accepts
// commas, whitespace, and newlines as separators so the textarea can be
// line-per-domain or CSV with no difference in behaviour.
func parseZoneAllowlist(raw string) []string {
	parts := strings.FieldsFunc(raw, func(r rune) bool {
		return r == ',' || r == '\n' || r == '\r' || r == ' ' || r == '\t' || r == ';'
	})
	seen := map[string]struct{}{}
	out := make([]string, 0, len(parts))
	for _, p := range parts {
		p = strings.TrimSuffix(strings.ToLower(strings.TrimSpace(p)), ".")
		if p == "" {
			continue
		}
		if _, dup := seen[p]; dup {
			continue
		}
		seen[p] = struct{}{}
		out = append(out, p)
	}
	return out
}

// zoneAllowlist returns the configured allow-list for providerID. An empty
// slice means "no restriction" (explicitly or implicitly unset).
func (s *Server) zoneAllowlist(providerID string) []string {
	raw, _ := models.GetSetting(s.DB, zoneAllowlistKey(providerID))
	return parseZoneAllowlist(raw)
}

// zoneAllowed is the single decision point for "is CaddyUI permitted to
// touch this zone on this provider". Every CreateRecord / DeleteRecord
// call path should guard on it — filtering the dropdown alone isn't
// enough, because the dns_zone_name column on a proxy_hosts row could have
// been written before the allow-list was tightened (or via direct DB
// editing / API).
//
// Matching is case-insensitive and trailing-dot tolerant. An empty
// allow-list allows everything.
func (s *Server) zoneAllowed(providerID, zoneName string) bool {
	allow := s.zoneAllowlist(providerID)
	if len(allow) == 0 {
		return true
	}
	zoneName = strings.TrimSuffix(strings.ToLower(strings.TrimSpace(zoneName)), ".")
	if zoneName == "" {
		// Defensive: an unset zone name can't be verified against the
		// allow-list, so refuse. A properly configured proxy host always
		// has dns_zone_name populated when dns_provider is non-empty.
		return false
	}
	for _, z := range allow {
		if z == zoneName {
			return true
		}
	}
	return false
}

// validateZoneMatchesHostname returns "" if the (provider, zoneID, zoneName,
// domains) combination is consistent — either no DNS is configured (provider
// or zoneID empty, in which case the row is opting out of managed DNS), or
// the first hostname in `domains` lives inside `zoneName`. Returns a
// user-facing error message ready to surface on the form when the pairing is
// inconsistent.
//
// Why "first hostname" and not all of them: a single proxy host row can serve
// several hostnames (the comma-separated Domains field), but managed DNS only
// provisions records for the *primary* hostname today. The other entries are
// SAN aliases on the same TLS cert. Validating just the primary keeps the
// check aligned with what dnsCreateRecord actually does.
//
// v2.7.8.
func validateZoneMatchesHostname(provider, zoneID, zoneName string, domains []string) string {
	if strings.TrimSpace(provider) == "" || strings.TrimSpace(zoneID) == "" {
		return "" // no managed DNS configured — nothing to validate
	}
	if len(domains) == 0 {
		return "" // can't validate without a hostname; other validators catch empty-domain saves
	}
	first := strings.TrimSpace(domains[0])
	if first == "" {
		return ""
	}
	if domainInZone(first, zoneName) {
		return ""
	}
	return fmt.Sprintf("Hostname %q doesn't live in DNS zone %q. Pick a zone whose apex matches the hostname (e.g. zone %q for hostname %q), or change the DNS provider to (none) if you don't want CaddyUI to manage the A record.",
		first, zoneName, guessApex(first), first)
}

// guessApex returns a "good enough" suggested zone name for an FQDN — the
// rightmost two labels (e.g. "richardapplegate.io" for
// "api.richardapplegate.io"). Used only inside the v2.7.8 mismatch error
// message; doesn't influence routing decisions. A real public-suffix-aware
// implementation would handle .co.uk etc., but the suggestion is just a hint
// for the user reading the error — they pick the actual zone from the
// dropdown.
func guessApex(fqdn string) string {
	parts := strings.Split(strings.TrimSuffix(strings.ToLower(strings.TrimSpace(fqdn)), "."), ".")
	if len(parts) < 2 {
		return fqdn
	}
	return strings.Join(parts[len(parts)-2:], ".")
}

// domainInZone reports whether fqdn belongs to the DNS zone named zoneName.
// True iff fqdn is the apex (fqdn == zoneName) or a subdomain of zoneName
// (fqdn ends in "." + zoneName). Comparison is case-insensitive and strips a
// trailing dot from either side, matching how Caddy and every DNS provider we
// integrate with normalises FQDNs.
//
// Empty inputs return false — callers must decide whether "no zone configured"
// is an error (it isn't for the create-record path; it is for the form
// validators added in v2.7.8 that reject saving a non-matching pairing).
//
// v2.7.8: introduced so the proxy-host and raw-route save handlers can reject
// "you typed richardapplegate.io but picked the applegatecloud.com zone"
// before the row hits the DB. Without this guard the save would succeed, the
// front-end's amber mismatch warning would be the only feedback, and the
// subsequent dnsCreateRecord call would either fail at the provider API or
// silently put the A record in the wrong zone.
func domainInZone(fqdn, zoneName string) bool {
	f := strings.TrimSuffix(strings.ToLower(strings.TrimSpace(fqdn)), ".")
	z := strings.TrimSuffix(strings.ToLower(strings.TrimSpace(zoneName)), ".")
	if f == "" || z == "" {
		return false
	}
	return f == z || strings.HasSuffix(f, "."+z)
}

// dnsCreds returns the current credential map for a provider, reading from
// the settings table. Pass it straight to dns.Build.
func (s *Server) dnsCreds(providerID string) map[string]string {
	creds := map[string]string{}
	for _, k := range dnsProviderCredKeys[providerID] {
		v, _ := models.GetSetting(s.DB, k)
		creds[k] = v
	}
	// Cloudflare also needs the proxied flag — it lives alongside the
	// token in the settings table but isn't a credential field proper.
	if providerID == dns.Cloudflare {
		creds["cf_proxied"], _ = models.GetSetting(s.DB, settingCFProxied)
	}
	return creds
}

func randomDNSProfileID() string {
	var b [8]byte
	if _, err := rand.Read(b[:]); err != nil {
		return fmt.Sprintf("dnsprof_%d", time.Now().UnixNano())
	}
	return "dnsprof_" + hex.EncodeToString(b[:])
}

func normalizeDNSProfile(p dnsCredentialProfile) dnsCredentialProfile {
	p.ID = strings.TrimSpace(p.ID)
	p.Name = strings.TrimSpace(p.Name)
	p.ProviderID = strings.ToLower(strings.TrimSpace(p.ProviderID))
	if p.Credentials == nil {
		p.Credentials = map[string]string{}
	}
	p.ZoneAllowlist = parseZoneAllowlist(strings.Join(p.ZoneAllowlist, ","))
	return p
}

func (s *Server) loadDNSProfiles() []dnsCredentialProfile {
	raw, _ := models.GetSetting(s.DB, settingDNSProfilesJSON)
	if strings.TrimSpace(raw) == "" {
		return nil
	}
	var stored []dnsCredentialProfile
	if err := json.Unmarshal([]byte(raw), &stored); err != nil {
		log.Printf("settings: decode DNS profiles: %v", err)
		return nil
	}
	out := make([]dnsCredentialProfile, 0, len(stored))
	seen := map[string]struct{}{}
	for _, p := range stored {
		p = normalizeDNSProfile(p)
		if p.ID == "" || p.Name == "" || p.ProviderID == "" {
			continue
		}
		if _, ok := dns.Lookup(p.ProviderID); !ok {
			continue
		}
		if _, dup := seen[p.ID]; dup {
			continue
		}
		seen[p.ID] = struct{}{}
		out = append(out, p)
	}
	return out
}

func (s *Server) saveDNSProfiles(profiles []dnsCredentialProfile) error {
	cleaned := make([]dnsCredentialProfile, 0, len(profiles))
	for _, p := range profiles {
		p = normalizeDNSProfile(p)
		if p.ID == "" || p.Name == "" || p.ProviderID == "" {
			continue
		}
		if _, ok := dns.Lookup(p.ProviderID); !ok {
			continue
		}
		if !dns.CredsComplete(p.ProviderID, p.Credentials) {
			continue
		}
		cleaned = append(cleaned, p)
	}
	body, err := json.Marshal(cleaned)
	if err != nil {
		return err
	}
	return models.SetSetting(s.DB, settingDNSProfilesJSON, string(body))
}

func (s *Server) dnsProfileByID(profileID string) (dnsCredentialProfile, bool) {
	profileID = strings.TrimSpace(profileID)
	if profileID == "" {
		return dnsCredentialProfile{}, false
	}
	for _, p := range s.loadDNSProfiles() {
		if p.ID == profileID {
			return p, true
		}
	}
	return dnsCredentialProfile{}, false
}

func (s *Server) dnsCredsFor(providerID, profileID string) map[string]string {
	providerID = strings.ToLower(strings.TrimSpace(providerID))
	profileID = strings.TrimSpace(profileID)
	if profileID != "" {
		if p, ok := s.dnsProfileByID(profileID); ok && p.ProviderID == providerID {
			creds := map[string]string{}
			for k, v := range p.Credentials {
				creds[k] = v
			}
			return creds
		}
		return map[string]string{}
	}
	return s.dnsCreds(providerID)
}

func (s *Server) dnsClientFor(providerID, profileID string) dns.Provider {
	if strings.TrimSpace(providerID) == "" {
		return nil
	}
	return dns.Build(providerID, s.dnsCredsFor(providerID, profileID))
}

func (s *Server) zoneAllowlistFor(providerID, profileID string) []string {
	providerID = strings.ToLower(strings.TrimSpace(providerID))
	profileID = strings.TrimSpace(profileID)
	if profileID != "" {
		if p, ok := s.dnsProfileByID(profileID); ok && p.ProviderID == providerID {
			return p.ZoneAllowlist
		}
		return []string{"__missing_dns_profile__"}
	}
	return s.zoneAllowlist(providerID)
}

func (s *Server) zoneAllowedFor(providerID, profileID, zoneName string) bool {
	allow := s.zoneAllowlistFor(providerID, profileID)
	if len(allow) == 0 {
		return true
	}
	zoneName = strings.TrimSuffix(strings.ToLower(strings.TrimSpace(zoneName)), ".")
	if zoneName == "" {
		return false
	}
	for _, z := range allow {
		if z == zoneName {
			return true
		}
	}
	return false
}

func (s *Server) normalizeDNSFormSelection(providerID, profileID string) (string, string) {
	providerID = strings.ToLower(strings.TrimSpace(providerID))
	profileID = strings.TrimSpace(profileID)
	if strings.HasPrefix(profileID, "legacy:") {
		return strings.TrimPrefix(profileID, "legacy:"), ""
	}
	if p, ok := s.dnsProfileByID(profileID); ok {
		return p.ProviderID, p.ID
	}
	if _, ok := dns.Lookup(providerID); ok {
		return providerID, ""
	}
	return "", ""
}

func (s *Server) applyDNSFormSelection(p *models.ProxyHost) {
	provider, profileID := s.normalizeDNSFormSelection(p.DNSProvider, p.DNSProfileID)
	p.DNSProvider, p.DNSProfileID = provider, profileID
	if provider == "" {
		p.DNSZoneID, p.DNSZoneName, p.DNSRecordID = "", "", ""
		p.DNSSkipRecord = false
	}
}

func (s *Server) applyRedirectionDNSFormSelection(rh *models.RedirectionHost) {
	provider, profileID := s.normalizeDNSFormSelection(rh.DNSProvider, rh.DNSProfileID)
	rh.DNSProvider, rh.DNSProfileID = provider, profileID
	if provider == "" {
		rh.DNSZoneID, rh.DNSZoneName, rh.DNSRecordID = "", "", ""
		rh.DNSSkipRecord = false
	}
}

func (s *Server) applyRawDNSFormSelection(rr *models.RawRoute) {
	provider, profileID := s.normalizeDNSFormSelection(rr.DNSProvider, rr.DNSProfileID)
	rr.DNSProvider, rr.DNSProfileID = provider, profileID
	if provider == "" {
		rr.DNSZoneID, rr.DNSZoneName, rr.DNSRecordID = "", "", ""
		rr.DNSSkipRecord = false
	}
}

func (s *Server) validateManagedDNSRecordTarget(serverID int64, providerID, zoneID string, skipRecord bool) string {
	if providerID == "" || zoneID == "" || skipRecord || strings.TrimSpace(s.serverIPFor(serverID)) != "" {
		return ""
	}
	return "Managed DNS cannot create a public A record because this Caddy server has no public IP configured. Set its public IP under Settings → DNS, or turn off “Create public A records” to use DNS-01 only."
}

func (s *Server) dnsProfileViews() []dnsProfileView {
	profiles := s.loadDNSProfiles()
	out := make([]dnsProfileView, 0, len(profiles)+1)
	for _, p := range profiles {
		providerName := p.ProviderID
		if d, ok := dns.Lookup(p.ProviderID); ok {
			providerName = d.DisplayName
		}
		out = append(out, dnsProfileView{
			ID:               p.ID,
			Name:             p.Name,
			ProviderID:       p.ProviderID,
			ProviderName:     providerName,
			TokenSet:         strings.TrimSpace(p.Credentials[settingCFAPIToken]) != "",
			Proxied:          p.Credentials[settingCFProxied] == "1",
			ZoneAllowlistRaw: strings.Join(p.ZoneAllowlist, "\n"),
		})
	}
	out = append(out, dnsProfileView{ProviderID: dns.Cloudflare, ProviderName: "Cloudflare"})
	return out
}

func (s *Server) parseDNSProfilesForm(r *http.Request) []dnsCredentialProfile {
	existing := map[string]dnsCredentialProfile{}
	for _, p := range s.loadDNSProfiles() {
		existing[p.ID] = p
	}
	deleted := map[string]struct{}{}
	for _, id := range r.PostForm["dns_profile_delete"] {
		if id = strings.TrimSpace(id); id != "" {
			deleted[id] = struct{}{}
		}
	}
	ids := r.PostForm["dns_profile_id"]
	names := r.PostForm["dns_profile_name"]
	tokens := r.PostForm["dns_profile_token"]
	proxied := r.PostForm["dns_profile_proxied"]
	allows := r.PostForm["dns_profile_zone_allowlist"]
	out := make([]dnsCredentialProfile, 0, len(names))
	for i := range names {
		id := ""
		if i < len(ids) {
			id = strings.TrimSpace(ids[i])
		}
		if _, drop := deleted[id]; drop && id != "" {
			continue
		}
		name := strings.TrimSpace(names[i])
		token := ""
		if i < len(tokens) {
			token = strings.TrimSpace(tokens[i])
		}
		if token == "" && id != "" {
			if prev, ok := existing[id]; ok {
				token = strings.TrimSpace(prev.Credentials[settingCFAPIToken])
			}
		}
		if name == "" && token == "" {
			continue
		}
		if name == "" || token == "" {
			continue
		}
		if id == "" {
			id = randomDNSProfileID()
		}
		proxyFlag := "0"
		if i < len(proxied) && proxied[i] == "1" {
			proxyFlag = "1"
		}
		allowRaw := ""
		if i < len(allows) {
			allowRaw = allows[i]
		}
		out = append(out, dnsCredentialProfile{
			ID:         id,
			Name:       name,
			ProviderID: dns.Cloudflare,
			Credentials: map[string]string{
				settingCFAPIToken: token,
				settingCFProxied:  proxyFlag,
			},
			ZoneAllowlist: parseZoneAllowlist(allowRaw),
		})
	}
	return out
}

// dnsClient returns a ready-to-use Provider for the given ID, or nil if
// credentials aren't configured. Replaces the per-provider cfClient /
// pbClient helpers.
func (s *Server) dnsClient(providerID string) dns.Provider {
	if providerID == "" {
		return nil
	}
	return dns.Build(providerID, s.dnsCreds(providerID))
}

// serverIP returns the legacy global IP. Kept for the backwards-compat
// fallback path — new code should use serverIPFor(serverID) instead.
func (s *Server) serverIP() string {
	ip, _ := models.GetSetting(s.DB, settingServerIP)
	return ip
}

// serverIPFor returns the public IP to use as the A-record target for
// proxy hosts that live on serverID. Reads caddy_servers.public_ip first,
// then falls back to the legacy global setting so pre-v2.4.0 databases
// still resolve to *some* IP while users fill in the per-server column.
func (s *Server) serverIPFor(serverID int64) string {
	if serverID > 0 {
		if srv, err := models.GetCaddyServer(s.DB, serverID); err == nil && strings.TrimSpace(srv.PublicIP) != "" {
			return strings.TrimSpace(srv.PublicIP)
		}
	}
	return s.serverIP()
}

// verifyTurnstile calls the Cloudflare Turnstile siteverify endpoint.
// Returns true when the challenge token is valid. Error-codes and the
// hostname Cloudflare echoes back are logged on failure so an admin
// reading `docker logs caddyui` can tell a wrong-key mistake from a
// domain-not-registered one — matches what verifyRecaptcha does for
// the Google siteverify path. (v2.6.1 — previously a failure looked
// identical to every other "Security check failed" in the UI.)
func verifyTurnstile(secretKey, token, remoteIP string) (bool, error) {
	if token == "" {
		log.Printf("turnstile: reject — no token in form (widget may not have loaded)")
		return false, nil
	}
	if strings.TrimSpace(secretKey) == "" {
		log.Printf("turnstile: reject — secret key is blank in DB (check Settings → CAPTCHA → Turnstile)")
		return false, nil
	}
	resp, err := http.PostForm("https://challenges.cloudflare.com/turnstile/v0/siteverify",
		url.Values{
			"secret":   {secretKey},
			"response": {token},
			"remoteip": {remoteIP},
		})
	if err != nil {
		log.Printf("turnstile: network error talking to Cloudflare: %v", err)
		return false, err
	}
	defer resp.Body.Close()
	var result struct {
		Success    bool     `json:"success"`
		Hostname   string   `json:"hostname"`
		ErrorCodes []string `json:"error-codes"`
	}
	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
		log.Printf("turnstile: decode Cloudflare response: %v", err)
		return false, err
	}
	if !result.Success {
		log.Printf("turnstile: Cloudflare rejected token — error-codes=%v hostname=%q (check Settings → CAPTCHA if this is a keys mismatch)",
			result.ErrorCodes, result.Hostname)
		return false, nil
	}
	return true, nil
}

func (s *Server) getLogin(w http.ResponseWriter, r *http.Request) {
	n, err := models.CountUsers(s.DB)
	if err != nil {
		http.Error(w, err.Error(), http.StatusInternalServerError)
		return
	}
	if n == 0 {
		http.Redirect(w, r, "/setup", http.StatusSeeOther)
		return
	}
	data := captchaTemplateData(loadCaptchaConfig(s.DB))
	if r.URL.Query().Get("reset") == "1" {
		data["Reset"] = true
	}
	if r.URL.Query().Get("invited") == "1" {
		data["Invited"] = true
	}
	// issue #106: offer the SSO button when OIDC is configured; surface any
	// SSO error the callback bounced back with a friendly message.
	if oc := s.oidcConfig(); oc.ready() {
		data["OIDCEnabled"] = true
		data["OIDCButtonLabel"] = oc.ButtonLabel
		// Translate only the built-in fallback, never an administrator's label.
		if strings.TrimSpace(mustGetSetting(s.DB, settingOIDCButtonLabel)) == "" {
			data["OIDCButtonLabel"] = s.tr(r, "login.sso_default")
		}
	}
	if e := r.URL.Query().Get("error"); strings.HasPrefix(e, "sso") {
		key := "login.error.sso_failed"
		switch e {
		case "sso_nouser":
			key = "login.error.sso_no_user"
		case "sso_email":
			key = "login.error.sso_email"
		case "sso_denied":
			key = "login.error.sso_cancelled"
		case "sso_domain":
			// Deliberately does not name the permitted domains: this page is
			// reachable by anyone, and the list is configuration.
			key = "login.error.sso_domain"
		}
		data["Error"] = s.tr(r, key)
	}
	s.render(w, r, "login.html", data)
}

// sanitizeForLog escapes CR/LF in user-controlled strings before they land
// in a log line so an attacker can't smuggle a forged log entry by typing
// `victim@example.com\n[CRITICAL] system compromised` into a form field.
// Replaces newlines with their literal escape sequence so the original
// content is still readable for diagnosis without breaking line boundaries.
// v2.9.225 — addresses CodeQL "Log entries created from user input" finding
// on the forgot-password and invite handlers' log.Printf calls.
func sanitizeForLog(s string) string {
	return strings.NewReplacer("\n", "\\n", "\r", "\\r").Replace(s)
}

// clientIPFromRequest extracts the real client IP, preferring forwarded
// headers when present so installs behind a reverse proxy (the typical
// CaddyUI deployment — it sits behind the very Caddy it manages) record
// the actual visitor IP in activity_log instead of 127.0.0.1. Order:
// X-Real-IP → first entry of X-Forwarded-For → r.RemoteAddr (host portion).
// Returns the raw string with no normalisation; activity log just stores
// it as text for the operator to read. v2.9.210.
func clientIPFromRequest(r *http.Request) string {
	if v := strings.TrimSpace(r.Header.Get("X-Real-Ip")); v != "" {
		return v
	}
	if v := r.Header.Get("X-Forwarded-For"); v != "" {
		// Left-most entry is the original client; rest are intermediate hops.
		if i := strings.Index(v, ","); i >= 0 {
			v = v[:i]
		}
		v = strings.TrimSpace(v)
		if v != "" {
			return v
		}
	}
	host, _, err := net.SplitHostPort(r.RemoteAddr)
	if err != nil {
		return r.RemoteAddr
	}
	return host
}

// peerHost returns the immediate TCP peer's IP (the host portion of
// RemoteAddr, no port).
func peerHost(r *http.Request) string {
	host, _, err := net.SplitHostPort(r.RemoteAddr)
	if err != nil {
		return strings.TrimSpace(r.RemoteAddr)
	}
	return host
}

// peerIsTrustedProxy reports whether the immediate peer may be trusted to have
// set X-Forwarded-For / X-Real-IP. When the admin has configured
// trusted_proxies, only those CIDRs/IPs are trusted. When it is empty we fall
// back to the standard CaddyUI topology — a reverse proxy sharing the host or
// LAN — and trust loopback and private/link-local peers only. A directly
// connected public client is never trusted, so it cannot forge the header.
func (s *Server) peerIsTrustedProxy(peerIP net.IP) bool {
	if peerIP == nil {
		return false
	}
	raw, _ := models.GetSetting(s.DB, settingTrustedProxies)
	if strings.TrimSpace(raw) == "" {
		return peerIP.IsLoopback() || peerIP.IsPrivate() || peerIP.IsLinkLocalUnicast()
	}
	for _, line := range strings.FieldsFunc(raw, func(r rune) bool { return r == ',' || r == '\n' }) {
		entry := strings.TrimSpace(line)
		if entry == "" {
			continue
		}
		if strings.Contains(entry, "/") {
			if _, ipnet, err := net.ParseCIDR(entry); err == nil && ipnet.Contains(peerIP) {
				return true
			}
			continue
		}
		if ip := net.ParseIP(entry); ip != nil && ip.Equal(peerIP) {
			return true
		}
	}
	return false
}

// rateLimitClientIP returns a client IP suitable as a security rate-limit key
// (e.g. the login brute-force limiter). Unlike clientIPFromRequest — which
// trusts forwarding headers unconditionally for activity-log display — this
// only honours X-Real-IP / X-Forwarded-For when the immediate peer is a trusted
// proxy, so a directly connected attacker cannot rotate a forged header to
// reset the lockout counter. When trusted, X-Real-IP (a single proxy-set value)
// wins; otherwise the right-most X-Forwarded-For entry is used, since that is
// the hop appended by the closest trusted proxy and is not client-spoofable.
func (s *Server) rateLimitClientIP(r *http.Request) string {
	ip, _ := s.resolvedClientIP(r)
	return ip
}

// resolvedClientIP returns the visitor's address as CaddyUI should judge it,
// and whether that came from a proxy header rather than the connection.
//
// A forwarded header is believed only when the machine that opened the
// connection is itself a trusted proxy, and the *right-most* entry is taken —
// the one the trusted proxy appended — so a visitor cannot prepend a chosen
// address to X-Forwarded-For and be believed.
//
// v2.65.0 (issue #140): split out of rateLimitClientIP so the admin IP
// allowlist resolves the address the same way the login rate limiter does,
// and so Settings can show the operator which address a request arrived with.
func (s *Server) resolvedClientIP(r *http.Request) (ip string, viaTrustedProxy bool) {
	peer := peerHost(r)
	if s.peerIsTrustedProxy(net.ParseIP(peer)) {
		if v := strings.TrimSpace(r.Header.Get("X-Real-Ip")); v != "" {
			return v, true
		}
		if v := r.Header.Get("X-Forwarded-For"); v != "" {
			parts := strings.Split(v, ",")
			for i := len(parts) - 1; i >= 0; i-- {
				if p := strings.TrimSpace(parts[i]); p != "" {
					return p, true
				}
			}
		}
	}
	return peer, false
}

// loginFailureWindow is how far back failed sign-in attempts are counted.
const loginFailureWindow = 15 * time.Minute

// maxTOTPAttemptsPerToken is how many wrong second-factor codes one pending
// login token allows; maxTOTPFailuresPerAccount is how many wrong codes an
// account may rack up inside loginFailureWindow, across tokens and IPs.
const (
	maxTOTPAttemptsPerToken   = 5
	maxTOTPFailuresPerAccount = 10
)

// totpLockedOut reports whether an account has failed the second factor too
// often recently. Keyed on the account, not the client IP, so it cannot lock out
// everyone behind a shared reverse-proxy address; only someone who already
// knows the password can trip it.
func (s *Server) totpLockedOut(email string) bool {
	var n int
	_ = s.DB.QueryRow(
		`SELECT COUNT(*) FROM activity_log WHERE action = 'login_totp_fail' AND actor = ? AND created_at > ?`,
		email, time.Now().UTC().Add(-loginFailureWindow),
	).Scan(&n)
	return n >= maxTOTPFailuresPerAccount
}

func (s *Server) postLogin(w http.ResponseWriter, r *http.Request) {
	_ = r.ParseForm()

	// v2.5.0: unified captcha (Turnstile OR reCAPTCHA v3, driven by the
	// captcha_provider setting). verifyCaptcha no-ops when disabled, so
	// handlers can call it unconditionally.
	captchaCfg := loadCaptchaConfig(s.DB)
	tplData := captchaTemplateData(captchaCfg)
	renderLoginErr := func(msg string) {
		data := map[string]any{"Error": msg}
		for k, v := range tplData {
			data[k] = v
		}
		s.render(w, r, "login.html", data)
	}
	if ok, err := verifyCaptcha(captchaCfg, r); err != nil || !ok {
		renderLoginErr(s.tr(r, "login.error.security_check"))
		return
	}

	// v2.9.5: brute-force protection — check recent failed login attempts from this IP.
	// v2.9.210: use clientIPFromRequest so installs behind a reverse proxy
	// match by the actual visitor IP, not the proxy's loopback address.
	// v2.52.4: the rate-limit key uses rateLimitClientIP, which only trusts the
	// forwarded IP when the peer is a trusted proxy — a directly connected
	// attacker can no longer forge X-Forwarded-For / X-Real-IP to bypass the
	// lockout. Activity-log display below keeps clientIPFromRequest.
	clientIP := s.rateLimitClientIP(r)
	if maxStr, _ := models.GetSetting(s.DB, settingMaxLoginAttempts); maxStr != "" {
		if maxAttempts, err := strconv.Atoi(strings.TrimSpace(maxStr)); err == nil && maxAttempts > 0 {
			var failCount int
			// Security (v2.57.1): the failure row stores "ip:<addr>" in the
			// target column (see LogActivity below). This query matched the
			// detail column instead, so it always counted 0 and the lockout
			// never fired.
			_ = s.DB.QueryRow(
				`SELECT COUNT(*) FROM activity_log WHERE action = 'login_fail' AND target = ? AND created_at > ?`,
				"ip:"+clientIP,
				time.Now().UTC().Add(-loginFailureWindow),
			).Scan(&failCount)
			if failCount >= maxAttempts {
				renderLoginErr(s.tr(r, "login.error.login_limit"))
				return
			}
		}
	}

	email := strings.TrimSpace(r.FormValue("email"))
	pw := r.FormValue("password")
	u, err := models.GetUserByEmail(s.DB, email)
	if err != nil || !auth.CheckPassword(u.PasswordHash, pw) {
		_ = models.LogActivity(s.DB, 0, email, "login_fail", "ip:"+clientIP, "invalid credentials", false)
		renderLoginErr(s.tr(r, "login.error.invalid_credentials"))
		return
	}
	if u.TOTPEnabled && u.TOTPSecret != "" {
		if s.totpLockedOut(u.Email) {
			renderLoginErr(s.tr(r, "login.error.totp_limit"))
			return
		}
		// Generate a pre-auth token and redirect to TOTP verification.
		b := make([]byte, 16)
		rand.Read(b)
		tok := hex.EncodeToString(b)
		s.pendingTOTP.Store(tok, u.ID)
		// Auto-expire after 5 minutes.
		go func() {
			time.Sleep(5 * time.Minute)
			s.pendingTOTP.Delete(tok)
		}()
		http.Redirect(w, r, "/login/totp?t="+tok, http.StatusSeeOther)
		return
	}
	tok, exp, err := auth.CreateSessionWithTTL(s.DB, u.ID, s.sessionTTL())
	if err != nil {
		http.Error(w, err.Error(), http.StatusInternalServerError)
		return
	}
	auth.SetSessionCookie(w, r, tok, exp)
	// v2.9.210: surface successful logins in the activity feed so admins can
	// see who signed in from where. Detail carries the User-Agent for forensic
	// context (browser fingerprint mismatch on a teammate's account is useful
	// signal during an incident).
	_ = models.LogActivity(s.DB, 0, u.Email, "login_success", "ip:"+clientIP, r.UserAgent(), true)
	http.Redirect(w, r, "/", http.StatusSeeOther)
}

func (s *Server) postLogout(w http.ResponseWriter, r *http.Request) {
	// v2.9.210: capture the actor before deleting the session so the activity
	// row gets the actual user's email rather than empty.
	cu := s.currentUser(r)
	actor := ""
	if cu != nil {
		actor = cu.Email
	}
	if c, err := r.Cookie(auth.SessionCookie); err == nil {
		_ = auth.DeleteSession(s.DB, c.Value)
	}
	auth.ClearSessionCookie(w, r)
	if actor != "" {
		_ = models.LogActivity(s.DB, 0, actor, "logout", "ip:"+clientIPFromRequest(r), "", true)
	}
	http.Redirect(w, r, "/login", http.StatusSeeOther)
}

// --- TOTP / 2FA ---

// getTOTPVerify shows the TOTP code entry page.
func (s *Server) getTOTPVerify(w http.ResponseWriter, r *http.Request) {
	tok := r.URL.Query().Get("t")
	if tok == "" {
		http.Redirect(w, r, "/login", http.StatusSeeOther)
		return
	}
	data := captchaTemplateData(loadCaptchaConfig(s.DB))
	data["Token"] = tok
	s.render(w, r, "totp_verify.html", data)
}

// postTOTPVerify validates the TOTP code and creates a session.
func (s *Server) postTOTPVerify(w http.ResponseWriter, r *http.Request) {
	_ = r.ParseForm()
	tok := r.FormValue("token")
	code := strings.TrimSpace(r.FormValue("code"))

	// v2.5.0: captcha also gates the TOTP step. Rationale: /login and
	// /login/totp are separate endpoints, so a bot that cracks a password
	// without captcha here could still pound TOTP codes (1M combos) if
	// TOTP had no challenge. Cheap to add, meaningfully raises the floor.
	captchaCfg := loadCaptchaConfig(s.DB)
	tplData := captchaTemplateData(captchaCfg)
	renderTOTPErr := func(msg string) {
		data := map[string]any{"Token": tok, "Error": msg}
		for k, v := range tplData {
			data[k] = v
		}
		s.render(w, r, "totp_verify.html", data)
	}

	val, ok := s.pendingTOTP.Load(tok)
	if !ok {
		renderTOTPErr("Session expired. Please log in again.")
		return
	}

	if ok2, err := verifyCaptcha(captchaCfg, r); err != nil || !ok2 {
		// Don't delete the pendingTOTP token on captcha fail — let the
		// user retry with a fresh challenge. Captcha being wrong is an
		// "I am a bot probably" signal, not an "I burned my TOTP slot"
		// one. The 5-min auto-expire still caps abuse.
		renderTOTPErr("Security check failed. Please try again.")
		return
	}

	s.pendingTOTP.Delete(tok)

	userID := val.(int64)
	u, err := models.GetUserByID(s.DB, userID)
	if err != nil {
		http.Redirect(w, r, "/login", http.StatusSeeOther)
		return
	}
	if s.totpLockedOut(u.Email) {
		s.pendingTOTPAttempts.Delete(tok)
		renderTOTPErr("Too many failed verification attempts for this account. Please wait 15 minutes and sign in again.")
		return
	}

	validTOTP := totplib.Validate(code, u.TOTPSecret)
	if !validTOTP {
		// Try as a single-use backup code.
		if u2, _ := models.GetUserByID(s.DB, userID); u2 != nil {
			if ok, _ := models.ConsumeBackupCode(s.DB, userID, u2.BackupCodes, code); ok {
				validTOTP = true
			}
		}
	}
	if !validTOTP {
		// Security (v2.57.1): the token used to be put back after every wrong
		// code with no limit, so a known password bought unlimited guesses at
		// a 6-digit code. A token now allows maxTOTPAttemptsPerToken guesses,
		// and an account that keeps failing is locked out (totpLockedOut) so a
		// fresh password login cannot reset the budget.
		attemptsAny, _ := s.pendingTOTPAttempts.LoadOrStore(tok, new(int32))
		attempts := atomic.AddInt32(attemptsAny.(*int32), 1)
		_ = models.LogActivity(s.DB, 0, u.Email, "login_totp_fail", "ip:"+clientIPFromRequest(r), "invalid TOTP code", false)
		if attempts >= maxTOTPAttemptsPerToken {
			s.pendingTOTPAttempts.Delete(tok) // the token stays deleted
			renderTOTPErr("Too many incorrect codes. Please sign in again.")
			return
		}
		// Put token back so user can retry.
		s.pendingTOTP.Store(tok, userID)
		renderTOTPErr("Invalid code. Try again.")
		return
	}

	sessionTok, exp, err := auth.CreateSessionWithTTL(s.DB, userID, s.sessionTTL())
	if err != nil {
		http.Error(w, err.Error(), http.StatusInternalServerError)
		return
	}
	auth.SetSessionCookie(w, r, sessionTok, exp)
	// v2.9.210: log the second-factor success so the audit trail mirrors
	// the password-only login_success path.
	_ = models.LogActivity(s.DB, 0, u.Email, "login_totp_success", "ip:"+clientIPFromRequest(r), r.UserAgent(), true)
	http.Redirect(w, r, "/", http.StatusSeeOther)
}

// getTOTPSetup shows the TOTP setup page for the current user.
// totpQRDataURI renders an otpauth:// URI as a base64 PNG data URI so the 2FA
// setup page can show the QR code without loading a script from a CDN.
//
// v2.27.0: replaces the cdn.jsdelivr.net/npm/qrcode client-side render, which
// broke when that CDN path started returning 404 (issue #37) and was blocked
// by CORB besides. Rendering server-side also means 2FA setup works on an
// air-gapped install. github.com/boombuler/barcode already ships as an
// indirect dependency of pquerna/otp, so this adds no new module.
//
// The return type is template.URL, not string: html/template's contextual
// autoescaper rejects the data: scheme in a src attribute and substitutes
// "#ZgotmplZ", which renders as a broken image. Marking it safe is correct
// here — the value is built entirely server-side from base64-encoded PNG
// bytes, with no user-controlled input reaching the URL.
//
// Returns "" on error; the template falls back to the manual-entry secret,
// which is always displayed alongside the QR.
func totpQRDataURI(otpauthURI string) template.URL {
	key, err := otplib.NewKeyFromURL(otpauthURI)
	if err != nil {
		return ""
	}
	img, err := key.Image(320, 320)
	if err != nil {
		return ""
	}
	var buf bytes.Buffer
	if err := png.Encode(&buf, img); err != nil {
		return ""
	}
	return template.URL("data:image/png;base64," + base64.StdEncoding.EncodeToString(buf.Bytes()))
}

func (s *Server) getTOTPSetup(w http.ResponseWriter, r *http.Request) {
	u := s.currentUser(r)
	key, err := totplib.Generate(totplib.GenerateOpts{
		Issuer:      "CaddyUI",
		AccountName: u.Email,
	})
	if err != nil {
		http.Error(w, err.Error(), http.StatusInternalServerError)
		return
	}

	// Backup codes passed as a one-time query param after enabling/regenerating.
	backupCodes := strings.Split(r.URL.Query().Get("backup_codes"), ",")
	if len(backupCodes) == 1 && backupCodes[0] == "" {
		backupCodes = nil
	}

	// Count remaining backup codes stored for this user.
	var backupCodeCount int
	if cu := s.currentUser(r); cu != nil && cu.BackupCodes != "" {
		var hashes []string
		if json.Unmarshal([]byte(cu.BackupCodes), &hashes) == nil {
			backupCodeCount = len(hashes)
		}
	}

	pageError := ""
	if r.URL.Query().Get("error") == "password" {
		pageError = "Enter your current password to change two-factor settings."
	}
	s.render(w, r, "totp_setup.html", map[string]any{
		"Error":           pageError,
		"User":            u,
		"Secret":          key.Secret(),
		"OTPAuth":         key.URL(),
		"OTPQRCode":       totpQRDataURI(key.URL()),
		"TOTPEnabled":     u.TOTPEnabled,
		"Required":        r.URL.Query().Get("required") == "1",
		"Enforce":         r.URL.Query().Get("enforce") == "1",
		"BackupCodes":     backupCodes,
		"BackupCodeCount": backupCodeCount,
	})
}

// postTOTPSetup enables or disables TOTP for the current user.
// reauthenticated reports whether password is the signed-in user's current
// password. Used before changing the second factor, so a stolen session alone
// cannot remove it (v2.57.1).
func (s *Server) reauthenticated(u *models.User, password string) bool {
	if u == nil || password == "" {
		return false
	}
	full, err := models.GetUserByID(s.DB, u.ID)
	if err != nil || full == nil {
		return false
	}
	return auth.CheckPassword(full.PasswordHash, password)
}

func (s *Server) postTOTPSetup(w http.ResponseWriter, r *http.Request) {
	u := s.currentUser(r)
	_ = r.ParseForm()
	action := r.FormValue("action")

	if action == "disable" {
		// v2.57.1: re-authenticate. A stolen session could otherwise strip the
		// account's second factor with one click.
		if !s.reauthenticated(u, r.FormValue("current_password")) {
			http.Redirect(w, r, "/totp/setup?error=password", http.StatusSeeOther)
			return
		}
		if err := models.SetUserTOTP(s.DB, u.ID, "", false); err != nil {
			http.Error(w, err.Error(), http.StatusInternalServerError)
			return
		}
		http.Redirect(w, r, "/totp/setup?disabled=1", http.StatusSeeOther)
		return
	}

	// action == "enable": verify the submitted code against the submitted secret.
	secret := r.FormValue("secret")
	code := strings.TrimSpace(r.FormValue("code"))
	if !totplib.Validate(code, secret) {
		otpAuth := "otpauth://totp/CaddyUI:" + u.Email + "?secret=" + secret + "&issuer=CaddyUI"
		s.render(w, r, "totp_setup.html", map[string]any{
			"User":        u,
			"Secret":      secret,
			"OTPAuth":     otpAuth,
			"OTPQRCode":   totpQRDataURI(otpAuth),
			"Error":       "Invalid code — try again.",
			"TOTPEnabled": u.TOTPEnabled,
		})
		return
	}
	if err := models.SetUserTOTP(s.DB, u.ID, secret, true); err != nil {
		http.Error(w, err.Error(), http.StatusInternalServerError)
		return
	}
	// Generate fresh backup codes when TOTP is first enabled.
	if backupCodes, err := models.GenerateBackupCodes(10); err == nil {
		if err := models.SaveBackupCodes(s.DB, u.ID, backupCodes); err == nil {
			// Store codes in session flash or query param for one-time display.
			// Encode as comma-separated for URL safety.
			codesParam := strings.Join(backupCodes, ",")
			http.Redirect(w, r, "/totp/setup?enabled=1&backup_codes="+url.QueryEscape(codesParam), http.StatusSeeOther)
			return
		}
	}
	http.Redirect(w, r, "/totp/setup?enabled=1", http.StatusSeeOther)
}

func (s *Server) postRegenerateBackupCodes(w http.ResponseWriter, r *http.Request) {
	cu := s.currentUser(r)
	if cu == nil || !cu.TOTPEnabled {
		http.Redirect(w, r, "/totp/setup", http.StatusSeeOther)
		return
	}
	if !s.reauthenticated(cu, r.FormValue("current_password")) { // v2.57.1 — see postTOTPSetup
		http.Redirect(w, r, "/totp/setup?error=password", http.StatusSeeOther)
		return
	}
	codes, err := models.GenerateBackupCodes(10)
	if err != nil {
		http.Error(w, "failed to generate codes", http.StatusInternalServerError)
		return
	}
	if err := models.SaveBackupCodes(s.DB, cu.ID, codes); err != nil {
		http.Error(w, err.Error(), http.StatusInternalServerError)
		return
	}
	codesParam := strings.Join(codes, ",")
	http.Redirect(w, r, "/totp/setup?regen=1&backup_codes="+url.QueryEscape(codesParam), http.StatusSeeOther)
}

// --- Dashboard ---

type dashboardRecommendation struct {
	Severity string // "critical" | "warning" | "info"
	Title    string
	Detail   string
	URL      string
	Action   string
	// DismissURL, when set, renders a Dismiss button that POSTs here.
	// v2.64.2 (issue #138): only for recommendations where declining is a
	// legitimate decision rather than something left unfinished.
	DismissURL string
}

type dashboardRecommendationInput struct {
	IsAdmin           bool
	ProxyHosts        []models.ProxyHost
	RedirectionHosts  []models.RedirectionHost
	RawRoutes         []models.RawRoute
	Certificates      []models.Certificate
	Snapshots         []models.ConfigSnapshot
	DNSProfileIDs     map[string]bool
	LastSync          *time.Time
	DownCount         int
	MaintenanceCount  int
	GlobalMaintenance bool
	// v2.64.1 (issue #138): one policy, not two. See twoFactorRequired.
	RequireTOTP       bool
	AdminAllowlistSet bool
	AutoSnapshots     bool
	DismissedUnused   string
	// v2.64.2 (issue #138): admin acknowledged that they do not want a
	// site-wide TOTP requirement.
	DismissedTOTPPolicy bool
	Now                 time.Time
	// v2.39.0: best-known expiry per custom certificate (stored PEM, readable
	// file, or the last live TLS probe) — see customCertificateExpiries.
	// Callers that leave it nil still get stored-PEM expiries.
	CertificateExpiry map[int64]time.Time
}

func buildDashboardRecommendations(in dashboardRecommendationInput) []dashboardRecommendation {
	now := in.Now
	if now.IsZero() {
		now = time.Now()
	}
	var out []dashboardRecommendation
	add := func(severity, title, detail, url, action string) {
		out = append(out, dashboardRecommendation{
			Severity: severity,
			Title:    title,
			Detail:   detail,
			URL:      url,
			Action:   action,
		})
	}
	// addDismissible is add() for a recommendation the admin may legitimately
	// decline. Same append path, so the cap below still applies to it.
	addDismissible := func(severity, title, detail, url, action, dismissURL string) {
		add(severity, title, detail, url, action)
		out[len(out)-1].DismissURL = dismissURL
	}

	if in.GlobalMaintenance {
		add("critical", "Global maintenance mode is active", "Every proxy host is serving the maintenance response until this is turned off and Caddy is synced.", "/settings/general", "Open settings")
	} else if in.MaintenanceCount > 0 {
		add("warning", "Proxy hosts are in maintenance", fmt.Sprintf("%d enabled proxy host(s) are currently serving maintenance responses.", in.MaintenanceCount), "/proxy-hosts?status=maintenance", "Review hosts")
	}
	if in.DownCount > 0 {
		add("critical", "Upstreams are down", fmt.Sprintf("%d enabled proxy host(s) have failing health checks.", in.DownCount), "/proxy-hosts", "View health")
	}

	sslOff := 0
	incompleteDNS := 0
	missingProfiles := 0
	referencedCerts := referencedCertificateIDs(in.ProxyHosts, in.RedirectionHosts, in.RawRoutes)
	for _, h := range in.ProxyHosts {
		if h.Enabled && !h.SSLEnabled {
			sslOff++
		}
		if h.DNSProvider != "" && h.DNSZoneID == "" {
			incompleteDNS++
		}
		if h.DNSProfileID != "" && !in.DNSProfileIDs[h.DNSProfileID] {
			missingProfiles++
		}
	}
	for _, h := range in.RedirectionHosts {
		if h.DNSProvider != "" && h.DNSZoneID == "" {
			incompleteDNS++
		}
		if h.DNSProfileID != "" && !in.DNSProfileIDs[h.DNSProfileID] {
			missingProfiles++
		}
	}
	for _, rr := range in.RawRoutes {
		if rr.DNSProvider != "" && rr.DNSZoneID == "" {
			incompleteDNS++
		}
		if rr.DNSProfileID != "" && !in.DNSProfileIDs[rr.DNSProfileID] {
			missingProfiles++
		}
	}
	if sslOff > 0 {
		add("warning", "Enabled hosts have SSL off", fmt.Sprintf("%d enabled proxy host(s) are reachable without Caddy-managed TLS.", sslOff), "/proxy-hosts", "Review TLS")
	}
	if incompleteDNS > 0 {
		add("warning", "Managed DNS is incomplete", fmt.Sprintf("%d resource(s) have a DNS provider selected but no zone saved yet.", incompleteDNS), "/proxy-hosts", "Review DNS")
	}
	if missingProfiles > 0 {
		add("critical", "DNS profile references are missing", fmt.Sprintf("%d resource(s) reference a deleted or unavailable DNS credential profile.", missingProfiles), "/settings/dns", "Fix profiles")
	}

	expiringSoon := 0
	expired := 0
	var unusedCustomCerts []models.Certificate
	for _, c := range in.Certificates {
		if isUnusedCustomCertificate(c, referencedCerts) {
			unusedCustomCerts = append(unusedCustomCerts, c)
		}
		if !isCustomCertificate(c) {
			continue
		}
		t, known := in.CertificateExpiry[c.ID]
		if !known && c.Source == models.CertSourcePEM {
			if e := parsePEMExpiry(c.CertPEM); e != nil {
				t, known = *e, true
			}
		}
		if !known {
			continue
		}
		if t.Before(now) {
			expired++
		} else if t.Sub(now) < 30*24*time.Hour {
			expiringSoon++
		}
	}
	if expired > 0 {
		add("critical", "Custom certificates are expired", fmt.Sprintf("%d custom certificate(s) are already expired.", expired), "/certificates", "Review certs")
	} else if expiringSoon > 0 {
		add("warning", "Custom certificates expire soon", fmt.Sprintf("%d custom certificate(s) expire within 30 days.", expiringSoon), "/certificates", "Review certs")
	}
	unusedFingerprint := unusedCertificateFingerprint(in.Certificates, referencedCerts)
	if in.IsAdmin && len(unusedCustomCerts) > 0 && unusedFingerprint != in.DismissedUnused {
		add(
			"info",
			"Unused custom certificates",
			fmt.Sprintf("%d certificate(s) are not assigned to any resource: %s.", len(unusedCustomCerts), summarizeCertificateNames(unusedCustomCerts, 3)),
			"/certificates?usage=unused",
			"Show unused",
		)
	}

	resourceCount := len(in.ProxyHosts) + len(in.RedirectionHosts) + len(in.RawRoutes)
	if resourceCount > 0 {
		if in.LastSync == nil {
			add("warning", "No successful sync recorded", "Resources exist, but the activity log has no successful Caddy sync for this server.", "/", "Sync Caddy")
		} else if now.Sub(*in.LastSync) > 7*24*time.Hour {
			add("info", "Last sync is over a week old", fmt.Sprintf("Last successful sync was %s ago.", humanDuration(now.Sub(*in.LastSync))), "/", "Sync Caddy")
		}
	}

	if in.IsAdmin {
		// v2.64.2 (issue #138): deciding against a site-wide TOTP requirement
		// is a legitimate choice, so this one can be acknowledged. The
		// dismissal is cleared the moment the policy is turned on and off
		// again, so it cannot hide a later change of mind.
		if !in.RequireTOTP && !in.DismissedTOTPPolicy {
			addDismissible(
				"warning",
				"Two-factor authentication is not required",
				"Requiring TOTP enrolment for everyone reduces account-takeover risk. Dismiss this if you have decided against it.",
				"/settings/security",
				"Open security",
				"/dashboard/recommendations/two-factor-policy/dismiss",
			)
		}
		if !in.AdminAllowlistSet {
			add("info", "Admin IP allowlist is empty", "Restricting CaddyUI to trusted IPs or CIDRs can reduce exposure for homelab installs.", "/settings/security", "Open security")
		}
		if len(in.Snapshots) == 0 {
			add("warning", "No config snapshots yet", "Take a manual snapshot so there is a known-good Caddy config to restore.", "/snapshots", "Take snapshot")
		} else if !in.AutoSnapshots {
			add("info", "Auto-snapshots are disabled", "Manual snapshots still work, but pre-sync restore points will not be captured automatically.", "/snapshots", "Review snapshots")
		}
	}

	if len(out) > 6 {
		return out[:6]
	}
	return out
}

func humanDuration(d time.Duration) string {
	if d < 0 {
		d = -d
	}
	days := int(d.Hours() / 24)
	if days >= 1 {
		if days == 1 {
			return "1 day"
		}
		return fmt.Sprintf("%d days", days)
	}
	hours := int(d.Hours())
	if hours >= 1 {
		if hours == 1 {
			return "1 hour"
		}
		return fmt.Sprintf("%d hours", hours)
	}
	minutes := int(d.Minutes())
	if minutes <= 1 {
		return "1 minute"
	}
	return fmt.Sprintf("%d minutes", minutes)
}

func (s *Server) dashboard(w http.ResponseWriter, r *http.Request) {
	sid := s.currentServerID(r)
	cu := s.currentUser(r)
	isAdmin := cu != nil && cu.Role == models.RoleAdmin
	var viewerID int64
	if cu != nil {
		viewerID = cu.ID
	}
	peers := s.groupPeerIDs(r)
	hosts, _ := models.ListProxyHosts(s.DB, sid, viewerID, isAdmin, peers)
	redirs, _ := models.ListRedirectionHosts(s.DB, sid, viewerID, isAdmin, peers)
	raws, _ := models.ListRawRoutes(s.DB, sid, viewerID, isAdmin, peers)
	// v2.7.2: cert card count matches what the /certificates page will show —
	// admin sees every cert, user-role sees their uploads + globals.
	// v2.7.4: ...plus any teammate uploads from groups they share.
	certs, _ := models.ListCertificatesForUser(s.DB, sid, viewerID, isAdmin, peers)

	// Most-recent sync timestamp from activity log (best-effort).
	var lastSync *time.Time
	var ls time.Time
	if err := s.DB.QueryRow(
		`SELECT created_at FROM activity_log WHERE server_id = ? AND action = 'sync_applied' ORDER BY id DESC LIMIT 1`, sid,
	).Scan(&ls); err == nil {
		lastSync = &ls
	}

	// Feature A: compute enabled/disabled counts and certs expiring within 30 days.
	var enabledHosts, disabledHosts, expiringSoon int
	for _, h := range hosts {
		if h.Enabled {
			enabledHosts++
		} else {
			disabledHosts++
		}
	}
	now := time.Now()
	for _, c := range certs {
		if t := parsePEMExpiry(c.CertPEM); t != nil {
			if t.Sub(now) < 30*24*time.Hour && t.After(now) {
				expiringSoon++
			}
		}
	}

	// v2.9.2: health summary — count hosts by latest check result.
	var healthyCount, downCount, unknownCount int
	if len(hosts) > 0 {
		var hostIDs []int64
		for _, h := range hosts {
			hostIDs = append(hostIDs, h.ID)
		}
		healthMap, _ := models.LatestProxyHealth(s.DB, hostIDs)
		for _, h := range hosts {
			if !h.Enabled {
				continue // only count enabled hosts
			}
			if chk, ok := healthMap[h.ID]; ok {
				if chk.OK {
					healthyCount++
				} else {
					downCount++
				}
			} else {
				unknownCount++
			}
		}
	}

	// Today's analytics stats are scoped by both visible hostname and the
	// selected fleet server. Hostname-only filtering is insufficient when two
	// nodes serve the same domain: it would merge both nodes back together even
	// after the operator switched environments.
	todayStart := time.Now().UTC().Truncate(24 * time.Hour)
	todayViews, todayVisitors := 0, 0
	var todayBandwidth int64
	hostsForActive := make([]string, 0, len(hosts)+len(redirs)+len(raws))
	for _, h := range hosts {
		hostsForActive = append(hostsForActive, h.DomainList()...)
	}
	for _, rh := range redirs {
		hostsForActive = append(hostsForActive, rh.DomainList()...)
	}
	for _, rr := range raws {
		hostsForActive = append(hostsForActive, rawRouteHosts(rr)...)
	}
	seenTrafficHosts := map[string]struct{}{}
	for _, host := range hostsForActive {
		host = strings.TrimSpace(host)
		if host == "" {
			continue
		}
		hostKey := strings.ToLower(host)
		if _, seen := seenTrafficHosts[hostKey]; seen {
			continue
		}
		seenTrafficHosts[hostKey] = struct{}{}
		if t, err := models.AccessTotalsSince(s.DB, todayStart, host, sid); err == nil {
			todayViews += t.Views
			todayVisitors += t.Visitors
		}
		if bw, err := models.BandwidthSince(s.DB, todayStart, host, sid); err == nil {
			todayBandwidth += bw
		}
	}

	// Count hosts in maintenance mode for the dashboard banner.
	maintenanceCount := 0
	for _, h := range hosts {
		if h.MaintenanceMode {
			maintenanceCount++
		}
	}
	globalMaintenance, _ := models.GetSetting(s.DB, settingGlobalMaintenance)

	// v2.11.16: per-server health summary — one card per Caddy server
	// the user has registered, showing status / host count / last contact.
	// Aggregated cross-server (not just the active picker) so users with
	// 4+ servers don't have to flip the picker to spot a down node.
	type serverHealthRow struct {
		ID            int64
		Name          string
		AdminURL      string
		Status        string // "online" | "offline" | "unknown"
		Version       string
		HostCount     int
		LastContactAt time.Time // zero = never; fmtRel handles that
		IsExternal    bool
		IsActive      bool // matches the active server picker
	}
	var serverHealth []serverHealthRow
	if servers, err := models.ListCaddyServers(s.DB); err == nil && len(servers) > 1 {
		// Only render the widget when there's more than one server — single-
		// server installs don't benefit from a fleet view.
		for _, sr := range servers {
			row := serverHealthRow{
				ID: sr.ID, Name: sr.Name, AdminURL: sr.AdminURL,
				Status: sr.Status, Version: sr.Version,
				IsExternal: sr.Type == models.CaddyServerTypeExternal,
				IsActive:   sr.ID == sid,
			}
			if sr.LastContactAt.Valid {
				row.LastContactAt = sr.LastContactAt.Time
			}
			// Cheap host count — admin sees every host on every server.
			var n int
			_ = s.DB.QueryRow(`SELECT COUNT(*) FROM proxy_hosts WHERE server_id=?`, sr.ID).Scan(&n)
			row.HostCount = n
			serverHealth = append(serverHealth, row)
		}
	}

	// v2.11.12: "Recently edited" widget — pulls the last few CRUD events
	// from the activity log (skips login/sync/snapshot noise) so users
	// landing on the dashboard see at a glance what just changed.
	var recentEdits []models.Activity
	if all, err := models.ListActivity(s.DB, sid, 60); err == nil {
		all = s.activityVisibleTo(s.currentUser(r), all) // v2.57.1
		for _, a := range all {
			if !a.Success {
				continue
			}
			if !isEditAction(a.Action) {
				continue
			}
			recentEdits = append(recentEdits, a)
			if len(recentEdits) >= 8 {
				break
			}
		}
	}

	dnsProfileIDs := map[string]bool{}
	for _, p := range s.loadDNSProfiles() {
		dnsProfileIDs[p.ID] = true
	}
	currentServer, _ := models.GetCaddyServer(s.DB, sid)
	serverReady := currentServer != nil && currentServer.Status == models.CaddyServerStatusOnline
	readinessSteps := requiredReadinessSteps(serverReady, len(hosts) > 0)
	// v2.64.2 (issue #138): the banner clears once the required foundations
	// are in place. It used to also hang on the admin's own TOTP, which is a
	// recommendation, so declining it meant "Continue setup" with nothing
	// left to continue.
	showReadiness := isAdmin && readinessIncomplete(serverReady, len(hosts) > 0)
	snapshots, _ := models.ListSnapshots(s.DB, sid, 1)
	requireTOTP := s.twoFactorRequired()
	adminAllowlistSet := strings.TrimSpace(mustGetSetting(s.DB, settingAdminAllowlist)) != ""
	dismissedUnused := mustGetSetting(s.DB, unusedCertificateDismissalKey(sid))
	recommendations := buildDashboardRecommendations(dashboardRecommendationInput{
		IsAdmin:             isAdmin,
		ProxyHosts:          hosts,
		RedirectionHosts:    redirs,
		RawRoutes:           raws,
		Certificates:        certs,
		Snapshots:           snapshots,
		DNSProfileIDs:       dnsProfileIDs,
		LastSync:            lastSync,
		DownCount:           downCount,
		MaintenanceCount:    maintenanceCount,
		GlobalMaintenance:   globalMaintenance == "1",
		RequireTOTP:         requireTOTP,
		AdminAllowlistSet:   adminAllowlistSet,
		AutoSnapshots:       s.autoSnapshotsEnabled(),
		DismissedUnused:     dismissedUnused,
		DismissedTOTPPolicy: mustGetSetting(s.DB, settingTOTPPolicyDismissed) == "1",
		CertificateExpiry:   s.customCertificateExpiries(certs),
		Now:                 time.Now(),
	})

	s.render(w, r, "dashboard.html", map[string]any{
		"User":                 s.currentUser(r),
		"ProxyHosts":           hosts,
		"RedirectionHosts":     redirs,
		"RawRoutes":            raws,
		"RawCount":             len(raws),
		"CertCount":            len(certs),
		"LastSync":             lastSync,
		"EnabledHosts":         enabledHosts,
		"DisabledHosts":        disabledHosts,
		"ExpiringSoon":         expiringSoon,
		"HealthyCount":         healthyCount,
		"DownCount":            downCount,
		"UnknownCount":         unknownCount,
		"TodayViews":           todayViews,
		"TodayVisitors":        todayVisitors,
		"TodayBandwidth":       todayBandwidth,
		"MaintenanceCount":     maintenanceCount,
		"GlobalMaintenance":    globalMaintenance,
		"EnabledHostCount":     enabledHosts,
		"MaintenanceHostCount": maintenanceCount,
		"RecentEdits":          recentEdits,
		"ServerHealth":         serverHealth,
		"Recommendations":      recommendations,
		"ShowReadiness":        showReadiness,
		"ReadinessSteps":       readinessSteps,
		"Section":              "dashboard",
	})
}

// isEditAction — v2.11.12: returns true when the activity-log action is a
// resource CRUD event the dashboard's "Recently edited" widget should
// surface. Skips login/logout, sync_applied, snapshot_*, profile_*, etc.
func isEditAction(action string) bool {
	prefixes := []string{"proxy_", "redirect_", "raw_", "cert_", "group_", "api_token_"}
	for _, p := range prefixes {
		if strings.HasPrefix(action, p) {
			return true
		}
	}
	return action == "caddyfile_import" || action == "import"
}

// --- Redirection Hosts ---
func (s *Server) listRedirectionHosts(w http.ResponseWriter, r *http.Request) {
	cu := s.currentUser(r)
	isAdmin := cu != nil && cu.Role == models.RoleAdmin
	var viewerID int64
	if cu != nil {
		viewerID = cu.ID
	}
	hosts, err := models.ListRedirectionHosts(s.DB, s.currentServerID(r), viewerID, isAdmin, s.groupPeerIDs(r))
	if err != nil {
		http.Error(w, err.Error(), http.StatusInternalServerError)
		return
	}
	s.render(w, r, "redirection_hosts.html", map[string]any{
		"User":     s.currentUser(r),
		"Hosts":    hosts,
		"Section":  "redirect",
		"ViewerID": viewerID,
	})
}

func (s *Server) newRedirectionHost(w http.ResponseWriter, r *http.Request) {
	certs, _ := s.certListForRequest(r)
	s.render(w, r, "redirection_host_form.html", s.applyDNSViewData(s.currentServerID(r), map[string]any{
		"User":         s.currentUser(r),
		"Host":         &models.RedirectionHost{Enabled: true, PreservePath: true, ForwardHTTPCode: 301, ForwardScheme: "auto", SSLEnabled: true, SSLForced: true},
		"Certificates": certs,
		"Users":        s.adminUserList(r),
		"OtherServers": s.otherManagedServers(r),
		"Section":      "redirect",
	}))
}

func parseRedirectionHostForm(r *http.Request) (*models.RedirectionHost, error) {
	_ = r.ParseForm()
	code, err := strconv.Atoi(r.FormValue("forward_http_code"))
	if err != nil {
		code = 301
	}
	certID, _ := strconv.ParseInt(r.FormValue("certificate_id"), 10, 64)
	// v2.12.2: Managed DNS triple — same shape as proxy hosts and raw routes.
	provider := strings.ToLower(strings.TrimSpace(r.FormValue("dns_provider")))
	profileID := strings.TrimSpace(r.FormValue("dns_profile_id"))
	zoneID := ""
	zoneName := ""
	if provider != "" {
		if _, ok := dns.Lookup(provider); !ok {
			provider = ""
		} else {
			zoneID = strings.TrimSpace(r.FormValue("dns_zone_id"))
			zoneName = strings.TrimSpace(r.FormValue("dns_zone_name"))
			if zoneID == "" {
				provider = ""
				zoneName = ""
			}
			if zoneName == "" {
				zoneName = zoneID
			}
		}
	}
	return &models.RedirectionHost{
		Domains:         strings.TrimSpace(r.FormValue("domains")),
		ForwardScheme:   r.FormValue("forward_scheme"),
		ForwardDomain:   strings.TrimSpace(r.FormValue("forward_domain")),
		ForwardHTTPCode: code,
		PreservePath:    r.FormValue("preserve_path") == "on",
		SSLEnabled:      r.FormValue("ssl_enabled") == "on",
		SSLForced:       r.FormValue("ssl_forced") == "on",
		Enabled:         r.FormValue("enabled") == "on",
		CertificateID:   certID,
		Tags:            strings.TrimSpace(r.FormValue("rh_tags")),
		Notes:           r.FormValue("rh_notes"),
		// v2.9.13: access control + maintenance mode
		AccessList:      strings.TrimSpace(r.FormValue("access_list")),
		MaintenanceMode: r.FormValue("maintenance_mode") == "on",
		MaintenanceMsg:  strings.TrimSpace(r.FormValue("maintenance_msg")),
		// v2.9.20: custom response headers
		CustomRespHeaders: func() string {
			v := strings.TrimSpace(r.FormValue("custom_resp_headers"))
			if v == "" {
				return "{}"
			}
			return v
		}(),
		// v2.9.21: IP blocklist
		IPBlocklist: strings.TrimSpace(r.FormValue("ip_blocklist")),
		// v2.9.24: HSTS
		HSTSMaxAgeSec:         func() int { v, _ := strconv.Atoi(r.FormValue("hsts_max_age_sec")); return v }(),
		HSTSIncludeSubdomains: r.FormValue("hsts_include_subdomains") == "on",
		HSTSPreload:           r.FormValue("hsts_preload") == "on",
		// v2.9.26: advanced config (raw JSON handlers)
		AdvancedConfig: strings.TrimSpace(r.FormValue("rh_advanced_config")),
		// v2.9.33: color label
		Color: strings.TrimSpace(r.FormValue("color")),
		// v2.9.38: maintenance status code
		MaintenanceStatusCode: func() int {
			v, _ := strconv.Atoi(r.FormValue("maintenance_status_code"))
			if v == 0 {
				return 503
			}
			return v
		}(),
		// v2.9.39: sort order
		SortOrder: func() int { v, _ := strconv.Atoi(r.FormValue("sort_order")); return v }(),
		// v2.9.229: path-based redirect rules. Form posts a JSON array via
		// a hidden input populated by the JS in redirection_host_form.html;
		// the dynamic table UI is the user-facing surface. Empty / invalid
		// JSON collapses to "" so the row keeps the legacy whole-host
		// redirect behaviour.
		RedirectRules: func() string {
			v := strings.TrimSpace(r.FormValue("redirect_rules"))
			if v == "" || v == "[]" {
				return ""
			}
			// Probe-parse so we don't store garbage that
			// RedirectRuleList would silently drop on read.
			var probe []models.RedirectRule
			if err := json.Unmarshal([]byte(v), &probe); err != nil {
				return ""
			}
			return v
		}(),
		// v2.9.230: redirect_strip_path_prefix
		RedirectStripPathPrefix: strings.TrimSpace(r.FormValue("redirect_strip_path_prefix")),
		// v2.9.231: redirect_wildcard_subdomain
		RedirectWildcardSubdomain: r.FormValue("redirect_wildcard_subdomain") == "on",
		// v2.9.232: sunset_at — accept ISO date YYYY-MM-DD; empty disables.
		SunsetAt: strings.TrimSpace(r.FormValue("sunset_at")),
		// v2.12.2: Managed DNS — wired to the same picker as proxy hosts.
		DNSProvider:   provider,
		DNSZoneID:     zoneID,
		DNSZoneName:   zoneName,
		DNSProfileID:  profileID,
		DNSSkipRecord: provider != "" && r.FormValue("dns_create_record") != "on",
	}, nil
}

func (s *Server) createRedirectionHost(w http.ResponseWriter, r *http.Request) {
	rh, err := parseRedirectionHostForm(r)
	if err != nil {
		http.Error(w, err.Error(), http.StatusBadRequest)
		return
	}
	s.applyRedirectionDNSFormSelection(rh)
	if errMsg := validateSSLFlags(rh.SSLEnabled, rh.SSLForced, rh.CertificateID); errMsg != "" {
		s.renderRedirectionHostFormError(w, r, rh, errMsg)
		return
	}
	// v2.7.7: same domain-conflict guard as proxy hosts. A redirect that
	// shadows an existing proxy (or vice versa) is a common mis-configuration
	// — Caddy keeps one route per hostname, so the older entry stops working
	// silently. Reject at save time instead.
	if conflict, err := models.DomainsConflict(s.DB, s.currentServerID(r), rh.DomainList(), 0, 0); err != nil {
		s.renderRedirectionHostFormError(w, r, rh, "Could not validate domains: "+err.Error())
		return
	} else if conflict != "" {
		s.renderRedirectionHostFormError(w, r, rh, fmt.Sprintf("Domain %q is already in use by another proxy or redirect on this server. Each domain can only be claimed once — edit the existing entry or remove it before reusing the name.", conflict))
		return
	}
	if errMsg := validateZoneMatchesHostname(rh.DNSProvider, rh.DNSZoneID, rh.DNSZoneName, rh.DomainList()); errMsg != "" {
		s.renderRedirectionHostFormError(w, r, rh, errMsg)
		return
	}
	if errMsg := s.validateManagedDNSRecordTarget(s.currentServerID(r), rh.DNSProvider, rh.DNSZoneID, rh.DNSSkipRecord); errMsg != "" {
		s.renderRedirectionHostFormError(w, r, rh, errMsg)
		return
	}
	deployTo := s.effectiveDeployTargets(s.currentServerID(r), parseDeployTo(r))
	cu := s.currentUser(r)
	var rhOwnerID int64
	if cu != nil && cu.Role != models.RoleAdmin {
		rhOwnerID = cu.ID
	} else if cu != nil && cu.Role == models.RoleAdmin {
		// v2.7.3: admin can assign this redirect to a specific user at create
		// time via the form's Owner <select>. Same safety invariant as proxy
		// hosts — a non-admin never reaches this branch.
		if v := strings.TrimSpace(r.FormValue("owner_id")); v != "" {
			if parsed, err := strconv.ParseInt(v, 10, 64); err == nil && parsed >= 0 {
				rhOwnerID = parsed
			}
		}
	}
	if errMsg := s.validateRedirectionForUser(s.currentUser(r), rh); errMsg != "" { // v2.57.1
		s.renderRedirectionHostFormError(w, r, rh, errMsg)
		return
	}
	if errMsg := s.previewRedirectValidate(s.currentServerID(r), rh); errMsg != "" { // v2.42.1 (issue #74)
		s.renderRedirectionHostFormError(w, r, rh, errMsg)
		return
	}
	id, err := models.CreateRedirectionHost(s.DB, s.currentServerID(r), rhOwnerID, rh)
	if err != nil {
		http.Error(w, err.Error(), http.StatusInternalServerError)
		return
	}
	rh.ID = id
	// v2.12.2: auto-create A record(s) per hostname when Managed DNS is set.
	if rh.DNSProvider != "" && rh.DNSZoneID != "" && !rh.DNSSkipRecord {
		s.dnsCreateRecordForRedirection(s.currentServerID(r), id, rh)
	}
	_ = models.LogActivity(s.DB, s.currentServerID(r), s.currentUserEmail(r), "redirect_create", fmt.Sprintf("redirect:%d", id), rh.Domains, true)
	s.trySyncCaddy(s.currentServerID(r), rh.CertificateID != 0)
	var deployProblems []string
	if len(deployTo) > 0 {
		deployProblems = s.crossDeployRedirectionHost(s.currentUserEmail(r), s.currentServerID(r), rh, deployTo)
	}
	http.Redirect(w, r, withDeployProblems("/redirection-hosts", deployProblems), http.StatusSeeOther)
}

func (s *Server) editRedirectionHost(w http.ResponseWriter, r *http.Request) {
	id, _ := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
	rh, err := models.GetRedirectionHost(s.DB, id)
	if err != nil {
		http.Error(w, err.Error(), http.StatusNotFound)
		return
	}
	cu := s.currentUser(r)
	isAdmin := cu != nil && cu.Role == models.RoleAdmin
	if !isAdmin {
		if !s.canManageOwned(cu, rh.OwnerID) {
			http.Error(w, "forbidden", http.StatusForbidden)
			return
		}
	}
	certs, _ := s.certListForRequest(r)
	s.render(w, r, "redirection_host_form.html", s.applyDNSViewData(s.currentServerID(r), map[string]any{
		"User":         s.currentUser(r),
		"Host":         rh,
		"Certificates": certs,
		"Users":        s.adminUserList(r),
		"OtherServers": s.otherManagedServers(r),
		"Section":      "redirect",
	}))
}

func (s *Server) updateRedirectionHost(w http.ResponseWriter, r *http.Request) {
	id, _ := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
	cu := s.currentUser(r)
	isAdmin := cu != nil && cu.Role == models.RoleAdmin
	// Ownership check before parsing form
	if !isAdmin {
		existing, err := models.GetRedirectionHost(s.DB, id)
		if err != nil || existing == nil || !s.canManageOwned(cu, existing.OwnerID) {
			http.Error(w, "forbidden", http.StatusForbidden)
			return
		}
	}
	rh, err := parseRedirectionHostForm(r)
	if err != nil {
		http.Error(w, err.Error(), http.StatusBadRequest)
		return
	}
	rh.ID = id
	s.applyRedirectionDNSFormSelection(rh)
	if errMsg := validateSSLFlags(rh.SSLEnabled, rh.SSLForced, rh.CertificateID); errMsg != "" {
		s.renderRedirectionHostFormError(w, r, rh, errMsg)
		return
	}
	// v2.7.7: domain-conflict guard. excludeRedirectID=rh.ID keeps a no-op
	// edit (e.g. user toggling SSL on the same redirect) from flagging itself.
	if conflict, err := models.DomainsConflict(s.DB, s.currentServerID(r), rh.DomainList(), 0, rh.ID); err != nil {
		s.renderRedirectionHostFormError(w, r, rh, "Could not validate domains: "+err.Error())
		return
	} else if conflict != "" {
		s.renderRedirectionHostFormError(w, r, rh, fmt.Sprintf("Domain %q is already in use by another proxy or redirect on this server. Each domain can only be claimed once.", conflict))
		return
	}
	if errMsg := validateZoneMatchesHostname(rh.DNSProvider, rh.DNSZoneID, rh.DNSZoneName, rh.DomainList()); errMsg != "" {
		s.renderRedirectionHostFormError(w, r, rh, errMsg)
		return
	}
	if errMsg := s.validateManagedDNSRecordTarget(s.currentServerID(r), rh.DNSProvider, rh.DNSZoneID, rh.DNSSkipRecord); errMsg != "" {
		s.renderRedirectionHostFormError(w, r, rh, errMsg)
		return
	}
	deployTo := s.effectiveDeployTargets(s.currentServerID(r), parseDeployTo(r))
	old, _ := models.GetRedirectionHost(s.DB, id)
	// v2.12.2: preserve existing record IDs across UPDATE so delete-on-change
	// still has them. parseRedirectionHostForm doesn't carry DNSRecordID
	// (the form has no hidden field for it — same as proxy hosts).
	if old != nil {
		rh.DNSRecordID = old.DNSRecordID
	}
	if errMsg := s.validateRedirectionForUser(s.currentUser(r), rh); errMsg != "" { // v2.57.1
		s.renderRedirectionHostFormError(w, r, rh, errMsg)
		return
	}
	if errMsg := s.previewRedirectValidate(s.currentServerID(r), rh); errMsg != "" { // v2.42.1 (issue #74)
		s.renderRedirectionHostFormError(w, r, rh, errMsg)
		return
	}
	if err := models.UpdateRedirectionHost(s.DB, rh); err != nil {
		http.Error(w, err.Error(), http.StatusInternalServerError)
		return
	}
	// v2.12.2: DNS provider / zone changed → drop the old A records, create
	// fresh ones for the new triple. Same pattern as proxy hosts.
	if old != nil {
		oldKey := old.DNSProvider + "|" + old.DNSZoneID
		newKey := rh.DNSProvider + "|" + rh.DNSProfileID + "|" + rh.DNSZoneID
		oldKey = old.DNSProvider + "|" + old.DNSProfileID + "|" + old.DNSZoneID
		domainChanged := !slices.Equal(old.DomainList(), rh.DomainList())
		recordModeChanged := old.DNSSkipRecord != rh.DNSSkipRecord
		if oldKey != newKey || domainChanged || recordModeChanged {
			if old.DNSRecordID != "" {
				s.dnsDeleteRecord(old.DNSProvider, old.DNSProfileID, old.DNSZoneID, old.DNSZoneName, old.DNSRecordID)
				_ = models.UpdateRedirectionHostDNSRecord(s.DB, rh.ID, rh.DNSProvider, rh.DNSZoneID, rh.DNSZoneName, "")
				rh.DNSRecordID = ""
			}
			if rh.DNSProvider != "" && rh.DNSZoneID != "" && !rh.DNSSkipRecord {
				s.dnsCreateRecordForRedirection(s.currentServerID(r), rh.ID, rh)
			}
		} else if rh.DNSProvider != "" && rh.DNSZoneID != "" && !rh.DNSSkipRecord && rh.DNSRecordID == "" {
			// Same provider, but no record yet (first save with DNS chosen on edit).
			s.dnsCreateRecordForRedirection(s.currentServerID(r), rh.ID, rh)
		}
	}
	// v2.7.3: admin-only owner reassignment. Separate from UpdateRedirectionHost
	// so the user-role path (ownership-gated above) can never touch ownership.
	if isAdmin {
		if v := strings.TrimSpace(r.FormValue("owner_id")); v != "" {
			if parsed, err := strconv.ParseInt(v, 10, 64); err == nil && parsed >= 0 {
				_ = models.SetRedirectionHostOwner(s.DB, rh.ID, parsed)
			}
		}
	}
	_ = models.LogActivity(s.DB, s.currentServerID(r), s.currentUserEmail(r), "redirect_update", fmt.Sprintf("redirect:%d", id), rh.Domains, true)
	forceTLS := old != nil && old.CertificateID != rh.CertificateID
	s.trySyncCaddy(s.currentServerID(r), forceTLS)
	var deployProblems []string
	if len(deployTo) > 0 {
		deployProblems = s.crossDeployRedirectionHost(s.currentUserEmail(r), s.currentServerID(r), rh, deployTo)
	}
	http.Redirect(w, r, withDeployProblems("/redirection-hosts", deployProblems), http.StatusSeeOther)
}

func (s *Server) deleteRedirectionHost(w http.ResponseWriter, r *http.Request) {
	id, _ := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
	cu := s.currentUser(r)
	isAdmin := cu != nil && cu.Role == models.RoleAdmin
	old, _ := models.GetRedirectionHost(s.DB, id)
	if !isAdmin {
		if old == nil || !s.canManageOwned(cu, old.OwnerID) {
			http.Error(w, "forbidden", http.StatusForbidden)
			return
		}
	}
	note := s.noteFleetDeletion(models.FleetResourceRedirect, id, "")
	if old != nil {
		note.label = old.Domains
	}
	if err := models.DeleteRedirectionHost(s.DB, id); err != nil {
		http.Error(w, err.Error(), http.StatusInternalServerError)
		return
	}
	// v2.12.2: drop the auto-created A record(s) so the row leaves nothing behind in DNS.
	if old != nil && old.DNSRecordID != "" {
		s.dnsDeleteRecord(old.DNSProvider, old.DNSProfileID, old.DNSZoneID, old.DNSZoneName, old.DNSRecordID)
	}
	_ = models.LogActivity(s.DB, s.currentServerID(r), s.currentUserEmail(r), "redirect_delete", fmt.Sprintf("redirect:%d", id), "", true)
	forceTLS := old != nil && old.CertificateID != 0
	s.trySyncCaddyAfterDelete(s.currentServerID(r), forceTLS)
	s.propagateNotedDeletion(s.currentUserEmail(r), note) // v2.59.0 (issue #120)
	http.Redirect(w, r, "/redirection-hosts", http.StatusSeeOther)
}

// cloneRedirectionHost creates a copy of a redirection host with Enabled=false
// and a "(copy)" suffix on each domain, then redirects to its edit page.
func (s *Server) cloneRedirectionHost(w http.ResponseWriter, r *http.Request) {
	id, err := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
	if err != nil {
		http.NotFound(w, r)
		return
	}
	src, err := models.GetRedirectionHost(s.DB, id)
	if err != nil || src == nil {
		http.NotFound(w, r)
		return
	}
	// Same gap as cloneProxyHost: without this, a non-admin could clone (and
	// thereby read the configuration of) any other tenant's or the admin's
	// redirection host by guessing its ID.
	if !s.canManageOwned(s.currentUser(r), src.OwnerID) {
		http.Error(w, "forbidden", http.StatusForbidden)
		return
	}
	// Append "(copy)" to each domain.
	domains := src.DomainList()
	cloned := make([]string, len(domains))
	for i, d := range domains {
		cloned[i] = d + " (copy)"
	}
	clone := *src
	clone.ID = 0
	clone.Domains = strings.Join(cloned, ",")
	clone.Enabled = false
	clone.MaintenanceMode = false
	clone.CreatedAt = time.Time{}
	clone.UpdatedAt = time.Time{}

	cu := s.currentUser(r)
	var ownerID int64
	if cu != nil {
		ownerID = cu.ID
	}
	newID, err := models.CreateRedirectionHost(s.DB, s.currentServerID(r), ownerID, &clone)
	if err != nil {
		http.Error(w, "clone failed: "+err.Error(), http.StatusInternalServerError)
		return
	}
	http.Redirect(w, r, fmt.Sprintf("/redirection-hosts/%d/edit", newID), http.StatusSeeOther)
}

func (s *Server) reloadCaddy(w http.ResponseWriter, r *http.Request) {
	if err := s.syncCaddy(s.currentServerID(r), true); err != nil {
		http.Error(w, err.Error(), http.StatusBadGateway)
		return
	}
	// v2.12.19: was returning 204 No Content + HX-Trigger header on the
	// assumption HTMX was driving the dashboard's "Sync Caddy" form. The
	// form is a plain <form method="post"> with no hx-* attributes, so
	// some browsers treated the empty Content-Type-less 204 from a form
	// POST as "save the URL's last segment as a file" — the user saw a
	// download named "reload" appear instead of a successful sync. Redirect
	// back to the dashboard (or the referrer if present) so the form-submit
	// completes cleanly without a body the browser has to interpret.
	//
	// v2.27.0: the leftover HX-Trigger header is gone too — htmx is no
	// longer loaded at all, so nothing was ever listening for it.
	dest := r.Header.Get("Referer")
	if dest == "" {
		dest = "/"
	}
	http.Redirect(w, r, dest, http.StatusSeeOther)
}

// --- Import from live Caddy ---

func (s *Server) getImport(w http.ResponseWriter, r *http.Request) {
	result, err := s.caddyForRequest(r).Import()
	data := map[string]any{
		"User":    s.currentUser(r),
		"Section": "import",
	}
	if err != nil {
		data["Error"] = err.Error()
	} else {
		data["Result"] = result
	}
	s.render(w, r, "import.html", data)
}

func (s *Server) postImport(w http.ResponseWriter, r *http.Request) {
	result, err := s.caddyForRequest(r).Import()
	if err != nil {
		http.Error(w, err.Error(), http.StatusBadGateway)
		return
	}
	// Build a set of every hostname already represented in the DB — proxies,
	// redirects, AND raw routes. Re-import would otherwise duplicate raw routes
	// (they don't go through models.DomainsConflict) and re-creating conflicting
	// proxies/redirects would fail at sync when two entries claim the same host.
	// Use admin view (isAdmin=true) to see all existing entries for deduplication.
	taken := map[string]struct{}{}
	if existing, err := models.ListProxyHosts(s.DB, s.currentServerID(r), 0, true, nil); err == nil {
		for _, h := range existing {
			for _, d := range h.DomainList() {
				taken[strings.ToLower(d)] = struct{}{}
			}
		}
	}
	if existing, err := models.ListRedirectionHosts(s.DB, s.currentServerID(r), 0, true, nil); err == nil {
		for _, h := range existing {
			for _, d := range h.DomainList() {
				taken[strings.ToLower(d)] = struct{}{}
			}
		}
	}
	if existing, err := models.ListRawRoutes(s.DB, s.currentServerID(r), 0, true, nil); err == nil {
		for _, rr := range existing {
			for _, d := range rawRouteHosts(rr) {
				taken[strings.ToLower(d)] = struct{}{}
			}
		}
	}
	claim := func(domains []string) bool {
		for _, d := range domains {
			if _, ok := taken[strings.ToLower(d)]; ok {
				return false
			}
		}
		for _, d := range domains {
			taken[strings.ToLower(d)] = struct{}{}
		}
		return true
	}

	// Import always creates global/admin-owned resources (ownerID=0), but the
	// account TRIGGERING the import can be any write-capable role — GHSA-r4wm-rgc5-q834
	// (3rd finding) follow-up: the pulled-in config's ForwardHost/ForwardPort
	// are attacker-controlled from that account's perspective (a non-admin
	// could point Caddy's own admin API at itself via a crafted upstream
	// Caddy config), so the same non-admin upstream guard applies here too.
	// cu, not the resulting ownerID=0, is what the guard checks.
	cu := s.currentUser(r)
	nProxy, nRedir, nRaw := 0, 0, 0
	for i := range result.Proxies {
		p := result.Proxies[i]
		if !claim(p.DomainList()) {
			continue
		}
		if msg := s.validateProxyUpstreamsForUser(cu, &p); msg != "" {
			// The reason (msg) is derived from a route that carries header and
			// API-key values, so it is deliberately not written to the log.
			log.Printf("import: skipped proxy host %q: refused by the non-admin upstream guard", p.Domains)
			continue
		}
		if _, err := models.CreateProxyHost(s.DB, s.currentServerID(r), 0, &p); err == nil {
			nProxy++
		}
	}
	for i := range result.Redirect {
		rd := result.Redirect[i]
		if !claim(rd.DomainList()) {
			continue
		}
		if _, err := models.CreateRedirectionHost(s.DB, s.currentServerID(r), 0, &rd); err == nil {
			nRedir++
		}
	}
	for i := range result.Passthrough {
		rr := result.Passthrough[i]
		if !claim(rawRouteHosts(rr)) {
			continue
		}
		if _, err := models.CreateRawRoute(s.DB, s.currentServerID(r), 0, &rr); err == nil {
			nRaw++
		}
	}
	detail := fmt.Sprintf("proxies=%d redirects=%d passthrough=%d", nProxy, nRedir, nRaw)
	log.Printf("import: %s imported", detail)
	_ = models.LogActivity(s.DB, s.currentServerID(r), s.currentUserEmail(r), "import", "", detail, true)
	// Don't sync to Caddy — user's existing config remains intact until they make a change
	http.Redirect(w, r, "/proxy-hosts", http.StatusSeeOther)
}

// rawRouteHosts pulls the top-level host matchers out of a RawRoute's JSONData.
// Handles both shapes: a single route object or an array of routes.
func rawRouteHosts(rr models.RawRoute) []string {
	var decoded any
	if err := json.Unmarshal([]byte(rr.JSONData), &decoded); err != nil {
		return nil
	}
	var hosts []string
	for _, route := range flattenToRouteMaps(decoded) {
		hosts = append(hosts, hostsFromRoute(route)...)
	}
	return hosts
}

// --- Caddyfile paste import ---
//
// Lets the user paste raw Caddyfile text. We call /adapt to convert each top-level
// site block to a single Caddy JSON route, then create one raw_route per block,
// storing both the JSON and the original Caddyfile snippet. The snippet is what
// the Advanced routes UI displays by default — users see the Caddyfile syntax
// they wrote, not Caddy's internal JSON.

func (s *Server) getCaddyfileImport(w http.ResponseWriter, r *http.Request) {
	s.render(w, r, "caddyfile_import.html", map[string]any{
		"User":    s.currentUser(r),
		"Section": "paste",
	})
}

type caddyfileImportResult struct {
	Head    string // site-address line (e.g. "example.com")
	Snippet string // original Caddyfile block
	Status  string // "created", "skipped", "error"
	// Kind, when Status == "created", is one of "proxy", "redirect", "raw" so
	// the import result table can show the user which list each block landed
	// in. Empty for skipped/error rows. v2.10.8.
	Kind     string
	Message  string // error message or ID info
	RouteIdx int
}

func (s *Server) postCaddyfileImport(w http.ResponseWriter, r *http.Request) {
	_ = r.ParseForm()
	src := strings.TrimSpace(r.FormValue("caddyfile"))
	if src == "" {
		s.render(w, r, "caddyfile_import.html", map[string]any{
			"User":    s.currentUser(r),
			"Section": "paste",
			"Error":   "Paste some Caddyfile text first.",
			"Input":   src,
		})
		return
	}

	// Auto-load snippet definitions from the mounted Caddyfile so users can use
	// `import <name>` without pasting the definition (see withAutoLoadedSnippets).
	fullPaste := s.withAutoLoadedSnippets(src)

	// Adapt the ENTIRE paste as a single unit so cross-block references work:
	// `import <snippet>` must see `(<snippet>) { ... }` defined in the same paste,
	// and global options in `{ ... }` at the top apply to all site blocks below.
	// Adapting block-by-block would fail for any block using `import`.
	adapted, err := s.caddyForRequest(r).Adapt(fullPaste)
	if err != nil {
		hint := ""
		msg := err.Error()
		if strings.Contains(msg, "File to import not found") {
			hint = "This paste uses `import <name>` referring to a snippet that isn't included. " +
				"Paste the snippet definition `(<name>) { ... }` above the site block, or remove the `import` line."
		}
		s.render(w, r, "caddyfile_import.html", map[string]any{
			"User":    s.currentUser(r),
			"Section": "paste",
			"Error":   msg,
			"Hint":    hint,
			"Input":   src,
		})
		return
	}

	// v2.36.1 (issue #64): keep each route's server listen set so a block
	// like `:7070 { … }` lands on its own listener instead of :443/:80.
	adaptedRoutes := extractAdaptedServerRoutes(adapted.Result)
	routes := make([]map[string]any, 0, len(adaptedRoutes))
	routeListen := make([]string, 0, len(adaptedRoutes))
	for _, ar := range adaptedRoutes {
		routes = append(routes, ar.Route)
		routeListen = append(routeListen, models.NormalizeRawRouteListen(ar.Listen))
	}
	// v2.5.8: also pull per-site TLS automation policies (DNS-01 providers,
	// custom issuers) — these were previously dropped, so `tls { dns <p> ... }`
	// in a pasted block never reached Caddy and ACME fell back to HTTP-01.
	autoPolicies := extractAdaptedAutomationPolicies(adapted.Result)
	if len(routes) == 0 {
		s.render(w, r, "caddyfile_import.html", map[string]any{
			"User":    s.currentUser(r),
			"Section": "paste",
			"Error":   "Caddy adapted the text but it produced no HTTP routes. Make sure at least one site block is included.",
			"Input":   src,
		})
		return
	}

	// Build host -> original block map so each adapted route can be paired with
	// the source snippet the user typed. Snippet definitions and global-options
	// blocks have no host line and are ignored here.
	blockByHost := map[string]string{}
	for _, block := range caddy.SplitCaddyfileBlocks(src) {
		head := caddy.HeadOfBlock(block)
		if head == "" || strings.HasPrefix(head, "(") {
			continue
		}
		for _, h := range splitHostHeads(head) {
			blockByHost[h] = block
		}
	}

	// Build a set of every hostname already in the DB so re-pasting the same
	// Caddyfile is a no-op instead of silently creating duplicate raw_routes.
	// Mirrors the dedup logic in postImport — proxies, redirects, raw routes
	// all contribute. Admin view (isAdmin=true) so user-scoped rows are also
	// counted; Caddy resolves routes by host globally regardless of owner.
	taken := map[string]struct{}{}
	if existing, err := models.ListProxyHosts(s.DB, s.currentServerID(r), 0, true, nil); err == nil {
		for _, h := range existing {
			for _, d := range h.DomainList() {
				taken[strings.ToLower(d)] = struct{}{}
			}
		}
	}
	if existing, err := models.ListRedirectionHosts(s.DB, s.currentServerID(r), 0, true, nil); err == nil {
		for _, h := range existing {
			for _, d := range h.DomainList() {
				taken[strings.ToLower(d)] = struct{}{}
			}
		}
	}
	if existing, err := models.ListRawRoutes(s.DB, s.currentServerID(r), 0, true, nil); err == nil {
		for _, rr := range existing {
			for _, d := range rawRouteHosts(rr) {
				taken[strings.ToLower(d)] = struct{}{}
			}
		}
	}

	// v2.10.7: when auto_classify is on (default), each adapted route is
	// run through the same classifier the /import flow uses. Routes that
	// look like a simple host { reverse_proxy ... } become ProxyHost rows;
	// pure redir blocks become RedirectionHost rows; anything more exotic
	// (custom matchers, multiple handles the classifier can't decompose,
	// layer-4 stuff) falls back to RawRoute. Off → everything goes to raw,
	// matching the legacy behaviour.
	autoClassify := r.FormValue("auto_classify") != "off"

	var results []caddyfileImportResult
	created := 0
	cu := s.currentUser(r)
	var ownerID int64
	if cu != nil && cu.Role != models.RoleAdmin {
		ownerID = cu.ID
	}

	for idx, route := range routes {
		hosts := hostsFromRoute(route)
		var blockText string
		for _, h := range hosts {
			if b, ok := blockByHost[h]; ok {
				blockText = b
				break
			}
		}
		label := strings.Join(hosts, ",")
		if label == "" {
			label = fmt.Sprintf("route[%d] (no host match)", idx)
		}
		// Skip if any host on this route is already claimed elsewhere (proxy,
		// redirect, or another raw route). Report as "skipped" so the user can
		// see in the result table which blocks were no-ops vs. created.
		var conflict string
		for _, h := range hosts {
			if _, ok := taken[strings.ToLower(h)]; ok {
				conflict = h
				break
			}
		}
		if conflict != "" {
			results = append(results, caddyfileImportResult{
				Head: label, Snippet: blockText, RouteIdx: idx,
				Status:  "skipped",
				Message: fmt.Sprintf("hostname %q already claimed by an existing proxy, redirect, or raw route", conflict),
			})
			continue
		}
		// v2.10.7: try to classify this single route as proxy / redirect / raw
		// by wrapping it in a one-route synthetic server config and running
		// the same classifier the /import flow uses. The classifier returns
		// at most one entry per category for a single-route input — anything
		// it doesn't recognise falls through to RawRoute below.
		// v2.36.1 (issue #64): proxy hosts and redirects have no notion of a
		// listen port, so a block on a custom port must stay an Advanced route
		// or its port would be silently lost.
		if autoClassify && routeListen[idx] == "" {
			synth := map[string]any{
				"apps": map[string]any{
					"http": map[string]any{
						"servers": map[string]any{
							"_classify": map[string]any{
								"routes": []any{route},
							},
						},
					},
				},
			}
			classified := caddy.ClassifyConfig(synth)
			if len(classified.Proxies) == 1 {
				ph := classified.Proxies[0]
				ph.Enabled = true
				// GHSA-r4wm-rgc5-q834 (3rd finding) follow-up: ph.ForwardHost
				// comes straight from the pasted Caddyfile block, so it needs
				// the same non-admin upstream guard the REST/form create
				// paths already enforce.
				if msg := s.validateProxyUpstreamsForUser(cu, &ph); msg != "" {
					results = append(results, caddyfileImportResult{
						Head: label, Snippet: blockText, RouteIdx: idx,
						Status: "error", Message: msg,
					})
					continue
				}
				id, err := models.CreateProxyHost(s.DB, s.currentServerID(r), ownerID, &ph)
				if err != nil {
					results = append(results, caddyfileImportResult{
						Head: label, Snippet: blockText, RouteIdx: idx,
						Status: "error", Message: "create proxy host: " + err.Error(),
					})
					continue
				}
				for _, h := range hosts {
					taken[strings.ToLower(h)] = struct{}{}
				}
				created++
				results = append(results, caddyfileImportResult{
					Head: label, Snippet: blockText, RouteIdx: idx,
					Status: "created", Kind: "proxy",
					Message: fmt.Sprintf("proxy_host:%d", id),
				})
				continue
			}
			if len(classified.Redirect) == 1 {
				rh := classified.Redirect[0]
				rh.Enabled = true
				id, err := models.CreateRedirectionHost(s.DB, s.currentServerID(r), ownerID, &rh)
				if err != nil {
					results = append(results, caddyfileImportResult{
						Head: label, Snippet: blockText, RouteIdx: idx,
						Status: "error", Message: "create redirection: " + err.Error(),
					})
					continue
				}
				for _, h := range hosts {
					taken[strings.ToLower(h)] = struct{}{}
				}
				created++
				results = append(results, caddyfileImportResult{
					Head: label, Snippet: blockText, RouteIdx: idx,
					Status: "created", Kind: "redirect",
					Message: fmt.Sprintf("redirection:%d", id),
				})
				continue
			}
			// Classifier didn't recognise it as proxy or redirect — fall
			// through to raw_route below.
		}
		blob, err := json.Marshal(route)
		if err != nil {
			results = append(results, caddyfileImportResult{
				Head: label, Snippet: blockText, RouteIdx: idx,
				Status: "error", Message: "serialize route: " + err.Error(),
			})
			continue
		}
		id, err := models.CreateRawRoute(s.DB, s.currentServerID(r), ownerID, &models.RawRoute{
			Label:        label,
			JSONData:     string(blob),
			CaddyfileSrc: blockText,
			Enabled:      true,
			Listen:       routeListen[idx], // v2.36.1 (issue #64)
		})
		if err != nil {
			results = append(results, caddyfileImportResult{
				Head: label, Snippet: blockText, RouteIdx: idx,
				Status: "error", Message: err.Error(),
			})
			continue
		}
		// Reserve hosts of this newly-created route so a later block in the
		// same paste can't shadow it.
		for _, h := range hosts {
			taken[strings.ToLower(h)] = struct{}{}
		}
		created++
		results = append(results, caddyfileImportResult{
			Head: label, Snippet: blockText, RouteIdx: idx,
			Status: "created", Kind: "raw",
			Message: fmt.Sprintf("raw_route:%d", id),
		})
	}

	_ = models.LogActivity(s.DB, s.currentServerID(r), s.currentUserEmail(r), "caddyfile_import", "",
		fmt.Sprintf("routes=%d created=%d", len(routes), created), created > 0)

	if created > 0 {
		// Sync so new routes take effect immediately. Don't force TLS — new
		// raw_routes don't change cert assignments.
		if err := s.syncCaddy(s.currentServerID(r), false); err != nil {
			s.render(w, r, "caddyfile_import.html", map[string]any{
				"User":    s.currentUser(r),
				"Section": "paste",
				"Error":   "Imported to DB but sync to Caddy failed: " + err.Error(),
				"Results": results,
				"Input":   src,
			})
			return
		}
		// v2.5.8: push any per-site TLS automation policies the adapter
		// emitted. Merged into live apps.tls.automation, deduped by subject
		// against existing policies so we never clobber hand-set config.
		// Non-fatal: if this fails, routes are still saved + synced, but
		// users should check Caddy logs since ACME may fall back to HTTP-01.
		if err := s.pushAutomationPolicies(r, autoPolicies); err != nil {
			log.Printf("caddyfile import: automation-policy push failed (%d policies): %v", len(autoPolicies), err)
		}
	}

	// v2.10.8: per-kind tallies for the result banner so users can see at
	// a glance "2 proxies, 1 redirection, 0 advanced" instead of a flat
	// "imported 3 routes". Kind is empty for skipped/error rows so they
	// don't inflate the success counts.
	var nProxy, nRedir, nRaw int
	for _, res := range results {
		switch res.Kind {
		case "proxy":
			nProxy++
		case "redirect":
			nRedir++
		case "raw":
			nRaw++
		}
	}
	s.render(w, r, "caddyfile_import.html", map[string]any{
		"User":         s.currentUser(r),
		"Section":      "paste",
		"Results":      results,
		"Created":      created,
		"CreatedProxy": nProxy,
		"CreatedRedir": nRedir,
		"CreatedRaw":   nRaw,
		"Input":        "",
	})
}

// splitHostHeads splits a Caddyfile site-address line into individual hosts.
// Caddyfile allows multiple addresses separated by commas or whitespace,
// e.g. "example.com, www.example.com" or "example.com www.example.com".
func splitHostHeads(head string) []string {
	var out []string
	for _, part := range strings.FieldsFunc(head, func(r rune) bool {
		return r == ',' || r == ' ' || r == '\t' || r == '\n'
	}) {
		if p := strings.TrimSpace(part); p != "" {
			out = append(out, p)
		}
	}
	return out
}

// hostsFromRoute pulls hostnames out of a Caddy route's match array.
func hostsFromRoute(route map[string]any) []string {
	matches, _ := route["match"].([]any)
	var out []string
	for _, m := range matches {
		mm, _ := m.(map[string]any)
		hs, _ := mm["host"].([]any)
		for _, h := range hs {
			if s, ok := h.(string); ok && s != "" {
				out = append(out, s)
			}
		}
	}
	return out
}

// adaptedServerRoute is one route from an adapted Caddy config together with
// the listen addresses of the server it came from. v2.36.1 (issue #64): the
// Caddyfile adapter emits one server per distinct site address — `:7070 { … }`
// becomes its own server on :7070 — and flattening every server's routes into
// one list silently dropped that port, so the route ended up on CaddyUI's
// :443/:80 servers and nothing ever listened on 7070.
type adaptedServerRoute struct {
	Route  map[string]any
	Listen []string
}

// extractAdaptedServerRoutes pulls every apps.http.servers.*.routes[] entry
// from an adapted Caddy config, tagged with its server's listen addresses.
// Servers are visited in name order so the result is deterministic.
func extractAdaptedServerRoutes(cfg map[string]any) []adaptedServerRoute {
	apps, _ := cfg["apps"].(map[string]any)
	httpApp, _ := apps["http"].(map[string]any)
	servers, _ := httpApp["servers"].(map[string]any)
	names := make([]string, 0, len(servers))
	for name := range servers {
		names = append(names, name)
	}
	sort.Strings(names)
	var out []adaptedServerRoute
	for _, name := range names {
		srv, _ := servers[name].(map[string]any)
		var listen []string
		if raw, ok := srv["listen"].([]any); ok {
			for _, v := range raw {
				if addr, ok := v.(string); ok && strings.TrimSpace(addr) != "" {
					listen = append(listen, strings.TrimSpace(addr))
				}
			}
		}
		routes, _ := srv["routes"].([]any)
		for _, r := range routes {
			if m, ok := r.(map[string]any); ok {
				out = append(out, adaptedServerRoute{Route: m, Listen: listen})
			}
		}
	}
	return out
}

// extractAdaptedRoutes is extractAdaptedServerRoutes without the listen
// addresses, for callers that only want handlers (proxy advanced_config) or a
// preview. Returns a possibly-empty slice.
func extractAdaptedRoutes(cfg map[string]any) []map[string]any {
	var out []map[string]any
	for _, ar := range extractAdaptedServerRoutes(cfg) {
		out = append(out, ar.Route)
	}
	return out
}

// extractAdaptedAutomationPolicies pulls apps.tls.automation.policies[] from an
// adapted Caddy config. These are emitted when a site block carries a per-site
// TLS directive like `tls { dns cloudflare {env.CF_API_TOKEN} }` or `tls { issuer ... }`.
// Without capturing them on paste-import the DNS-01 / custom-issuer config would
// be silently lost, since syncCaddy intentionally leaves apps.tls.automation
// untouched to avoid cancelling in-flight ACME challenges.
func extractAdaptedAutomationPolicies(cfg map[string]any) []map[string]any {
	apps, _ := cfg["apps"].(map[string]any)
	tlsApp, _ := apps["tls"].(map[string]any)
	automation, _ := tlsApp["automation"].(map[string]any)
	policies, _ := automation["policies"].([]any)
	var out []map[string]any
	for _, p := range policies {
		if m, ok := p.(map[string]any); ok {
			out = append(out, m)
		}
	}
	return out
}

// adaptedClientAuthSNIs returns the SNIs of every adapted TLS connection
// policy that asks the client for a certificate.
//
// v2.64.0 (discussion #137): `tls { client_auth ... }` in a site block does
// not adapt to anything inside the route — it becomes a
// tls_connection_policies entry, and route-only importers keep just the
// routes. The block therefore vanished without a word, and the site came up
// looking configured while accepting anyone. Callers use this to say so
// instead, and point at the per-host setting that does reach Caddy.
func adaptedClientAuthSNIs(cfg map[string]any) []string {
	apps, _ := cfg["apps"].(map[string]any)
	httpApp, _ := apps["http"].(map[string]any)
	servers, _ := httpApp["servers"].(map[string]any)
	var out []string
	seen := map[string]bool{}
	for _, srv := range servers {
		m, _ := srv.(map[string]any)
		policies, _ := m["tls_connection_policies"].([]any)
		for _, p := range policies {
			pm, _ := p.(map[string]any)
			if _, ok := pm["client_authentication"]; !ok {
				continue
			}
			match, _ := pm["match"].(map[string]any)
			snis, _ := match["sni"].([]any)
			if len(snis) == 0 {
				// A policy with no SNI match applies to every name the
				// server serves; name it so the message still says something.
				if !seen["(all hostnames)"] {
					seen["(all hostnames)"] = true
					out = append(out, "(all hostnames)")
				}
				continue
			}
			for _, s := range snis {
				if str, ok := s.(string); ok && !seen[str] {
					seen[str] = true
					out = append(out, str)
				}
			}
		}
	}
	sort.Strings(out)
	return out
}

// extractAdaptedLayer4App pulls apps.layer4 from an adapted Caddy config —
// and only that key. v2.56.0 (issue #113): a pasted layer4 Caddyfile block is
// adapted in isolation via buildLayer4App, and the result is trusted only for
// this one subtree; any other top-level key the adapter happens to emit
// (e.g. a stray "admin" or "apps.http" from unrelated pasted syntax) is
// discarded rather than merged into the config CaddyUI pushes.
func extractAdaptedLayer4App(cfg map[string]any) map[string]any {
	apps, _ := cfg["apps"].(map[string]any)
	layer4, _ := apps["layer4"].(map[string]any)
	return layer4
}

// mergeAutomationPolicies makes incoming subject-scoped policies authoritative
// for those subjects while preserving unrelated and catch-all live policies.
// This is reconciliation rather than append-only merging: changing a Managed
// DNS provider/zone must replace the stale policy that previously owned a name.
func mergeAutomationPolicies(existing []any, incoming []map[string]any) []any {
	claimed := map[string]bool{}
	var prepend []any
	for _, p := range incoming {
		subs, _ := p["subjects"].([]any)
		var keptSubs []any
		for _, s := range subs {
			str, ok := s.(string)
			if !ok {
				continue
			}
			if !claimed[str] {
				keptSubs = append(keptSubs, str)
				claimed[str] = true
			}
		}
		if len(keptSubs) == 0 {
			continue
		}
		cp := map[string]any{}
		for k, v := range p {
			cp[k] = v
		}
		cp["subjects"] = keptSubs
		prepend = append(prepend, cp)
	}
	var preserved []any
	for _, policy := range existing {
		m, ok := policy.(map[string]any)
		if !ok {
			preserved = append(preserved, policy)
			continue
		}
		subs, hasSubjects := m["subjects"].([]any)
		if !hasSubjects {
			preserved = append(preserved, policy) // catch-all policy
			continue
		}
		kept := make([]any, 0, len(subs))
		for _, subject := range subs {
			name, ok := subject.(string)
			if !ok || !claimed[name] {
				kept = append(kept, subject)
			}
		}
		if len(kept) == 0 {
			continue
		}
		cp := map[string]any{}
		for k, v := range m {
			cp[k] = v
		}
		cp["subjects"] = kept
		preserved = append(preserved, cp)
	}
	return append(prepend, preserved...)
}

// buildDNSAutomationPolicies scans SSL-enabled hosts that have Managed DNS
// selected and emits an apps.tls.automation.policies[] entry per credential
// profile. This makes DNS-01 an explicit consequence of choosing Managed DNS,
// for ordinary names as well as wildcard SANs.
//
// Reuses the credentials already stored under each provider's settings
// keys for managed DNS, so users don't enter secrets twice. The connected
// Caddy build must include the corresponding caddy-dns provider module.
func (s *Server) buildDNSAutomationPolicies(proxies []models.ProxyHost, redirs []models.RedirectionHost, raws []models.RawRoute, certs []models.Certificate) []map[string]any {
	type bucket struct {
		providerID string
		zoneID     string
		subjects   []string
		seen       map[string]bool
		creds      map[string]string
	}
	byProvider := map[string]*bucket{}

	add := func(domains []string, providerID, profileID, zoneID string, sslOn, enabled bool, certificateID int64) {
		if !enabled || !sslOn || certificateID != 0 || providerID == "" {
			return
		}
		for _, raw := range domains {
			d := models.NormalizeHostname(raw)
			if d == "" {
				continue
			}
			key := providerID + "|" + profileID
			if providerID == dns.Route53 {
				key += "|" + strings.TrimSpace(zoneID)
			}
			b, ok := byProvider[key]
			if !ok {
				if _, found := dns.Lookup(providerID); !found {
					return
				}
				b = &bucket{
					providerID: providerID,
					zoneID:     strings.TrimSpace(zoneID),
					creds:      s.dnsCredsFor(providerID, profileID),
					seen:       map[string]bool{},
				}
				byProvider[key] = b
			}
			if b.seen[d] {
				continue
			}
			b.seen[d] = true
			b.subjects = append(b.subjects, d)
		}
	}
	for _, p := range proxies {
		if p.InternalTLS {
			// v2.46.0: internal-CA hosts are issued by the internal issuer
			// (see buildInternalTLSAutomationPolicies), never DNS-01.
			continue
		}
		add(p.DomainList(), p.DNSProvider, p.DNSProfileID, p.DNSZoneID, p.SSLEnabled, p.Enabled, p.CertificateID)
	}
	for _, rd := range redirs {
		add(rd.DomainList(), rd.DNSProvider, rd.DNSProfileID, rd.DNSZoneID, rd.SSLEnabled, rd.Enabled, rd.CertificateID)
	}
	for _, rr := range raws {
		add(rawRouteHosts(rr), rr.DNSProvider, rr.DNSProfileID, rr.DNSZoneID, true, rr.Enabled, rr.CertificateID)
	}
	for _, cert := range certs {
		if cert.Source == models.CertSourceManaged {
			add(cert.DomainList(), cert.DNSProvider, cert.DNSProfileID, "", true, true, 0)
		}
	}

	// issue #116: optional DNS servers for Caddy's own ACME DNS-01 TXT-record
	// propagation checks (split-horizon DNS). Resolved once and applied to
	// every provider bucket below.
	var resolvers []any
	for _, r := range s.acmeDNSResolvers() {
		resolvers = append(resolvers, r)
	}

	var policies []map[string]any
	for _, b := range byProvider {
		if len(b.subjects) == 0 {
			continue
		}
		cfg := caddyDNSProviderConfig(b.providerID, b.creds, b.zoneID)
		if cfg == nil {
			log.Printf("automation: skipping provider %q — DNS-01 mapping not implemented or credentials missing", b.providerID)
			continue
		}
		// Convert []string → []any for the JSON marshaller.
		subj := make([]any, 0, len(b.subjects))
		for _, s := range b.subjects {
			subj = append(subj, s)
		}
		dnsChallenge := map[string]any{"provider": cfg}
		if len(resolvers) > 0 {
			dnsChallenge["resolvers"] = resolvers
		}
		policies = append(policies, map[string]any{
			"subjects": subj,
			"issuers": []any{map[string]any{
				"module": "acme",
				"challenges": map[string]any{
					"dns": dnsChallenge,
				},
			}},
		})
	}
	return policies
}

// buildInternalTLSAutomationPolicies emits a single apps.tls.automation
// policy that issues certificates from Caddy's internal (self-signed) CA for
// every enabled, SSL-enabled proxy host that opted into InternalTLS and is on
// Auto TLS (no custom certificate). The `internal` issuer is a core Caddy
// module, so — unlike DNS-01 — this needs no special Caddy build. Intended for
// local-network services where a publicly trusted certificate isn't wanted or
// possible. (discussion #91)
func buildInternalTLSAutomationPolicies(proxies []models.ProxyHost) []map[string]any {
	seen := map[string]bool{}
	var subjects []any
	for _, p := range proxies {
		if !p.Enabled || !p.SSLEnabled || !p.InternalTLS || p.CertificateID != 0 {
			continue
		}
		for _, raw := range p.DomainList() {
			d := models.NormalizeHostname(raw)
			if d == "" || seen[d] {
				continue
			}
			seen[d] = true
			subjects = append(subjects, d)
		}
	}
	if len(subjects) == 0 {
		return nil
	}
	return []map[string]any{{
		"subjects": subjects,
		"issuers":  []any{map[string]any{"module": "internal"}},
	}}
}

// buildManagedCertificateRoutes gives standalone managed certificates a host
// matcher so Caddy's Automatic HTTPS machinery is instructed to obtain them.
// Automation-policy subjects alone are filters and do not trigger issuance.
// These 404 fallbacks are appended after real routes, so an actual proxy or
// redirect for the same hostname wins while otherwise-unhandled wildcard
// traffic fails closed.
func buildManagedCertificateRoutes(certs []models.Certificate, fallbackHandle []any) []any {
	if len(fallbackHandle) == 0 {
		fallbackHandle = []any{map[string]any{"handler": "static_response", "status_code": 404}}
	}
	var routes []any
	for _, cert := range certs {
		if cert.Source != models.CertSourceManaged {
			continue
		}
		hosts := cert.DomainList()
		if len(hosts) == 0 {
			continue
		}
		hostValues := make([]any, 0, len(hosts))
		for _, host := range hosts {
			if host = models.NormalizeHostname(host); host != "" {
				hostValues = append(hostValues, host)
			}
		}
		if len(hostValues) == 0 {
			continue
		}
		routes = append(routes, map[string]any{
			"match":    []any{map[string]any{"host": hostValues}},
			"handle":   fallbackHandle, // same answer as any other unknown host (issue #123)
			"terminal": true,
		})
	}
	return routes
}

// caddyDNSProviderConfig maps an internal DNS-provider ID to the matching
// Caddy DNS plugin's JSON config block. Returns nil when the credential
// fields haven't been populated under Settings → DNS providers, OR when
// the internal provider has no caddy-dns plugin mapping yet.
//
// The Caddy build must include the matching `caddy-dns/<provider>` plugin
// (xcaddy or a custom Dockerfile). The default `caddy:2-alpine` image
// has no DNS plugins — Caddy will reject the config with "unknown module"
// at apply time, surfacing as a sync_apply_tls_failed activity log.
func caddyDNSProviderConfig(providerID string, creds map[string]string, zoneID string) map[string]any {
	switch providerID {
	case dns.Cloudflare:
		token := creds["cf_api_token"]
		if token == "" {
			return nil
		}
		return map[string]any{"name": "cloudflare", "api_token": token}
	case dns.Porkbun:
		key, secret := creds["pb_api_key"], creds["pb_secret_key"]
		if key == "" || secret == "" {
			return nil
		}
		return map[string]any{"name": "porkbun", "api_key": key, "api_secret_key": secret}
	case dns.Namecheap:
		user, key, clientIP := creds["nc_api_user"], creds["nc_api_key"], creds["nc_client_ip"]
		if user == "" || key == "" || clientIP == "" {
			return nil
		}
		return map[string]any{"name": "namecheap", "user": user, "api_key": key, "client_ip": clientIP}
	case dns.GoDaddy:
		key, secret := creds["gd_api_key"], creds["gd_api_secret"]
		if key == "" || secret == "" {
			return nil
		}
		return map[string]any{"name": "godaddy", "api_token": key + ":" + secret}
	case dns.DigitalOcean:
		token := creds["do_api_token"]
		if token == "" {
			return nil
		}
		return map[string]any{"name": "digitalocean", "auth_token": token}
	case dns.Hetzner:
		token := creds["hetzner_api_token"]
		if token == "" {
			return nil
		}
		return map[string]any{"name": "hetzner", "api_token": token}
	case dns.Gandi: // v2.45.0 — github.com/caddy-dns/gandi takes the same PAT as CaddyUI
		token := strings.TrimSpace(creds[settingGandiAPIToken])
		if token == "" {
			return nil
		}
		return map[string]any{"name": "gandi", "bearer_token": token}
	case dns.Route53:
		accessKey := strings.TrimSpace(creds[settingRoute53AccessKeyID])
		secretKey := strings.TrimSpace(creds[settingRoute53SecretAccessKey])
		if accessKey == "" || secretKey == "" {
			return nil
		}
		region := strings.TrimSpace(creds[settingRoute53Region])
		if region == "" {
			region = "us-east-1"
		}
		cfg := map[string]any{
			"name":              "route53",
			"access_key_id":     accessKey,
			"secret_access_key": secretKey,
			"region":            region,
		}
		if token := strings.TrimSpace(creds[settingRoute53SessionToken]); token != "" {
			cfg["session_token"] = token
		}
		if zoneID = strings.TrimSpace(zoneID); zoneID != "" {
			cfg["hosted_zone_id"] = zoneID
		}
		return cfg
	}
	return nil
}

// pushAutomationPolicies reads the live apps.tls.automation object, merges the
// given incoming policies in front of existing ones (deduped by subject), and
// POSTs the updated automation object back so Caddy applies the new DNS-01 /
// custom-issuer config without disturbing anything already in place.
func (s *Server) pushAutomationPolicies(r *http.Request, incoming []map[string]any) error {
	if len(incoming) == 0 {
		return nil
	}
	return pushAutomationPoliciesVia(s.caddyForRequest(r), incoming)
}

func applyAutomationPolicies(cfg map[string]any, incoming []map[string]any) {
	if len(incoming) == 0 {
		return
	}
	apps := ensureMap(cfg, "apps")
	tlsApp := ensureMap(apps, "tls")
	automation := ensureMap(tlsApp, "automation")
	existing, _ := automation["policies"].([]any)
	automation["policies"] = mergeAutomationPolicies(existing, incoming)
}

// pushAutomationPoliciesVia — v2.12.0: client-explicit variant of
// pushAutomationPolicies. syncCaddy already swaps s.Caddy to a per-server
// client and operates without an http.Request; this lets that path push
// auto-detected wildcard policies on the same client without re-deriving
// from a request cookie.
func pushAutomationPoliciesVia(cl *caddy.Client, incoming []map[string]any) error {
	if len(incoming) == 0 || cl == nil {
		return nil
	}
	cfg, _, err := cl.FetchConfig()
	if err != nil {
		return fmt.Errorf("fetch config: %w", err)
	}
	apps := ensureMap(cfg, "apps")
	tlsApp, tlsAppExists := apps["tls"].(map[string]any)
	if tlsApp == nil {
		tlsApp = map[string]any{}
	}
	automation, _ := tlsApp["automation"].(map[string]any)
	if automation == nil {
		automation = map[string]any{}
	}
	existing, _ := automation["policies"].([]any)
	automation["policies"] = mergeAutomationPolicies(existing, incoming)
	// A fresh Caddy JSON config commonly has apps.http but no apps.tls.
	// Caddy's admin API can create the final path segment with POST, but it
	// cannot traverse a missing parent, so POST /config/apps/tls/automation
	// fails with "invalid traversal path". Create the TLS app in that case.
	if !tlsAppExists {
		tlsApp["automation"] = automation
		return cl.PutPath("/config/apps/tls", tlsApp)
	}
	return cl.PutPath("/config/apps/tls/automation", automation)
}

// settingTOTPPolicyDismissed records that an admin has acknowledged the
// dashboard's "two-factor authentication is not required" recommendation.
//
// v2.64.2 (issue #138): not requiring site-wide TOTP is a valid decision, and
// a recommendation that cannot be acknowledged is a permanent nag. Cleared
// whenever the policy is switched on, so turning it off later raises the
// recommendation again rather than staying silently dismissed from months ago.
const settingTOTPPolicyDismissed = "dashboard_totp_policy_dismissed"

// twoFactorRequired reports whether every user must enrol TOTP before reaching
// a protected page.
//
// v2.64.1 (issue #138): true when either key is set. The two were separate
// toggles doing the same job; collapsing them to one must not switch the
// policy off for an install that had set only the older of the pair.
func (s *Server) twoFactorRequired() bool {
	return mustGetSetting(s.DB, settingRequireTOTP) == "1" ||
		mustGetSetting(s.DB, settingRequire2FA) == "1"
}

// --- Snapshots ---

// settingAutoSnapshots gates creation of "auto" snapshots (pre-sync, pre-restore).
// Stored in the settings table; default ON ("1"). Users can turn off when they
// don't want a snapshot every sync filling the DB.
const settingAutoSnapshots = "auto_snapshots_enabled"

// settingRequireTOTP forces every user to enrol TOTP before reaching any
// protected page. This is the canonical key for the policy.
const settingRequireTOTP = "require_totp"

// settingRequire2FA is the deprecated twin of settingRequireTOTP.
//
// v2.64.1 (issue #138): CaddyUI shipped two settings for one policy — both
// enforced "enrol TOTP or go to the setup page", and their descriptions on
// Settings › Security said nearly the same thing, so nobody could tell which
// to use. The UI now has one toggle.
//
// The key is kept, and written in lockstep with settingRequireTOTP, for one
// reason: an install that had only this one switched on must not quietly stop
// enforcing two-factor auth, in either direction. Reading honours whichever
// key is set (twoFactorRequired), and saving sets both, so downgrading to a
// release that reads only this key still enforces the policy. Don't add new
// reads of it.
const settingRequire2FA = "require_2fa"

// settingSessionDays is the admin-configured session lifetime in days.
// Default is 7 days when empty or invalid.
const settingSessionDays = "session_duration_days"

// settingCatchAll404HTML holds optional HTML for a global catch-all 404 route
// appended last in the merged Caddy config so it fires only when no
// proxy/redirect/raw route matched.
const settingCatchAll404HTML = "catch_all_404_html"

// settingFallbackStatus is the HTTP status answered for a request that matches
// no proxy host, redirection or Advanced route (v2.60.0, issue #123). Empty =
// 404. Applies to the HTTP and HTTPS servers alike, and to the managed
// wildcard-certificate route, so every kind of unknown host behaves the same.
const settingFallbackStatus = "fallback_status_code"

// defaultFallbackStatus is used when nothing is configured or the stored value
// is not a usable 4xx/5xx code.
const defaultFallbackStatus = 404

// parseFallbackStatus accepts an error status in the 4xx/5xx range. ok is false
// for anything else (including blank, which callers treat as "use the default").
func parseFallbackStatus(raw string) (code int, ok bool) {
	n, err := strconv.Atoi(strings.TrimSpace(raw))
	if err != nil || n < 400 || n > 599 {
		return 0, false
	}
	return n, true
}

// fallbackStatusCode is the configured fallback status, or 404.
func (s *Server) fallbackStatusCode() int {
	raw, _ := models.GetSetting(s.DB, settingFallbackStatus)
	if n, ok := parseFallbackStatus(raw); ok {
		return n
	}
	return defaultFallbackStatus
}

// settingGlobalMaintenance puts ALL proxy hosts into maintenance mode when "1".
// A catch-all 503 route is prepended to the Caddy routes list so every request
// gets a maintenance page regardless of individual host settings.
const settingGlobalMaintenance = "global_maintenance"

// settingAutoSyncHours is the interval (in hours) for automatic periodic Caddy
// re-syncs. 0 or empty = disabled. The background loop checks once per hour
// and re-syncs if the elapsed time since the last sync_applied log entry
// exceeds this value.
const settingAutoSyncHours = "auto_sync_hours"

// settingTrustedProxies holds newline or comma-separated CIDRs/IPs of trusted
// reverse-proxies (e.g. Cloudflare, load balancers). When non-empty, CaddyUI
// injects trusted_proxies into the Caddy HTTP server config so that the real
// client IP is extracted from X-Forwarded-For.
const settingTrustedProxies = "trusted_proxies"

// settingSiteTitle is the custom display name shown in the browser tab title
// and the sidebar logo area. Falls back to "CaddyUI" when empty.
const settingSiteTitle = "site_title"

// settingFaviconURL is an optional URL for a custom favicon. When set, the
// layout <head> will use it instead of the default inline SVG favicon.
const settingFaviconURL = "favicon_url"

// settingAdminAllowlist holds newline or comma-separated IPs/CIDRs that are
// permitted to access the CaddyUI admin panel. When empty, all IPs are allowed.
const settingAdminAllowlist = "admin_allowlist"

// envAdminAllowlist overrides settingAdminAllowlist from the environment.
//
// v2.65.0 (issue #140): an allowlist that turns out not to include you locks
// you out of the only page that could fix it, and the reporter hit exactly
// that. Setting this in docker-compose takes precedence over the stored
// value, so recovery is a compose edit and a restart rather than hand-editing
// SQLite. `CADDYUI_ADMIN_ALLOWLIST=""` is treated as "not set"; use
// `CADDYUI_ADMIN_ALLOWLIST=off` to disable the gate entirely while you get
// back in. The stored setting is left untouched either way, so removing the
// variable restores whatever was configured.
const envAdminAllowlist = "CADDYUI_ADMIN_ALLOWLIST"

// adminAllowlist returns the effective allowlist: the environment override
// when present, otherwise the stored setting. An override of "off"/"none"/
// "any" (any case) returns empty, which adminIPGate treats as "allow all".
func (s *Server) adminAllowlist() string {
	if env := strings.TrimSpace(os.Getenv(envAdminAllowlist)); env != "" {
		switch strings.ToLower(env) {
		case "off", "none", "any", "*":
			return ""
		}
		return env
	}
	raw, _ := models.GetSetting(s.DB, settingAdminAllowlist)
	return raw
}

// adminAllowlistFromEnv reports whether the environment is currently
// overriding the stored allowlist, so Settings can say so rather than showing
// a stored value that is not in force.
func (s *Server) adminAllowlistFromEnv() bool {
	return strings.TrimSpace(os.Getenv(envAdminAllowlist)) != ""
}

// settingGlobalIPBlocklist holds newline or comma-separated IPs/CIDRs blocked
// across every host (v2.50.0, issue #100). Applied as a top-level 403 route on
// the main HTTP(S) servers, ahead of host routing. Empty = nothing blocked.
const settingGlobalIPBlocklist = "global_ip_blocklist"

// settingActivityLogDays specifies how many days to keep activity log entries.
// 0 or empty = keep forever (default).
const settingActivityLogDays = "activity_log_days"

// settingMaxLoginAttempts limits consecutive failed login attempts per IP within
// a 15-minute window. 0 or empty = no limit (default).
const settingMaxLoginAttempts = "max_login_attempts"

func (s *Server) autoSnapshotsEnabled() bool {
	v, err := models.GetSetting(s.DB, settingAutoSnapshots)
	if err != nil || v == "" {
		return true
	}
	return v == "1" || strings.EqualFold(v, "true")
}

func (s *Server) listSnapshots(w http.ResponseWriter, r *http.Request) {
	snaps, err := models.ListSnapshots(s.DB, s.currentServerID(r), 100)
	if err != nil {
		http.Error(w, err.Error(), http.StatusInternalServerError)
		return
	}
	s.render(w, r, "snapshots.html", map[string]any{
		"User":          s.currentUser(r),
		"Snapshots":     snaps,
		"AutoSnapshots": s.autoSnapshotsEnabled(),
		"Section":       "snapshots",
	})
}

func (s *Server) setAutoSnapshots(w http.ResponseWriter, r *http.Request) {
	_ = r.ParseForm()
	on := r.FormValue("enabled") == "1"
	val := "0"
	if on {
		val = "1"
	}
	if err := models.SetSetting(s.DB, settingAutoSnapshots, val); err != nil {
		http.Error(w, err.Error(), http.StatusInternalServerError)
		return
	}
	_ = models.LogActivity(s.DB, s.currentServerID(r), s.currentUserEmail(r), "auto_snapshots_toggled", "", val, true)
	http.Redirect(w, r, "/snapshots", http.StatusSeeOther)
}

func (s *Server) currentUserEmail(r *http.Request) string {
	u := s.currentUser(r)
	if u == nil {
		return "system"
	}
	return u.Email
}

const serverCookie = "caddyui_server"

// currentServerID returns the ID of the server selected via cookie, defaulting
// to 1 (the seeded primary server) if the cookie is absent or invalid.
func (s *Server) currentServerID(r *http.Request) int64 {
	if c, err := r.Cookie(serverCookie); err == nil {
		if id, err := strconv.ParseInt(c.Value, 10, 64); err == nil && id > 0 {
			return id
		}
	}
	return 1
}

// caddyForRequest returns a Caddy client pointed at the currently-selected
// server's admin API. Falls back to the primary client on any lookup error.
// Credentials (if set on the server row) are threaded into the client so
// admins can lock the admin API behind HTTP Basic Auth via a reverse proxy.
func (s *Server) caddyForRequest(r *http.Request) *caddy.Client {
	var cl *caddy.Client
	if srv, err := models.GetCaddyServer(s.DB, s.currentServerID(r)); err == nil {
		cl = caddy.New(srv.AdminURL, srv.AdminUsername, srv.AdminPassword)
	} else {
		cl = s.Caddy
	}
	// v2.57.1: for a non-admin's request, refuse Caddyfile text that reads the
	// Caddy server's environment or files BEFORE it is adapted (see
	// Client.AdaptTextCheck). Copy first — s.Caddy is shared.
	if cl != nil && !isAdminUser(s.currentUser(r)) {
		cp := *cl
		cp.AdaptTextCheck = func(text string) string {
			if why := tenantTextViolation(text); why != "" {
				return "Not allowed for a non-admin account: " + why + ". Ask an administrator."
			}
			return ""
		}
		return &cp
	}
	return cl
}

// caddyForServer returns a Caddy client for an explicit server ID.
func (s *Server) caddyForServer(serverID int64) *caddy.Client {
	if srv, err := models.GetCaddyServer(s.DB, serverID); err == nil {
		return caddy.New(srv.AdminURL, srv.AdminUsername, srv.AdminPassword)
	}
	return s.Caddy
}

func (s *Server) createManualSnapshot(w http.ResponseWriter, r *http.Request) {
	_ = r.ParseForm()
	note := strings.TrimSpace(r.FormValue("note"))
	if note == "" {
		note = "manual snapshot"
	}
	_, raw, err := s.caddyForRequest(r).FetchConfig()
	if err != nil {
		http.Error(w, "fetch caddy config: "+err.Error(), http.StatusBadGateway)
		return
	}
	if raw == "" || raw == "null" {
		http.Error(w, "caddy has no active config to snapshot", http.StatusConflict)
		return
	}
	id, err := models.CreateSnapshot(s.DB, s.currentServerID(r), models.SnapshotSourceManual, note, raw)
	if err != nil {
		http.Error(w, err.Error(), http.StatusInternalServerError)
		return
	}
	_ = models.LogActivity(s.DB, s.currentServerID(r), s.currentUserEmail(r), "snapshot_created",
		fmt.Sprintf("snapshot:%d", id), note, true)
	http.Redirect(w, r, "/snapshots", http.StatusSeeOther)
}

func (s *Server) restoreSnapshot(w http.ResponseWriter, r *http.Request) {
	id, _ := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
	snap, err := models.GetSnapshot(s.DB, id)
	if err != nil {
		http.Error(w, err.Error(), http.StatusNotFound)
		return
	}
	var cfg map[string]any
	if err := json.Unmarshal([]byte(snap.ConfigJSON), &cfg); err != nil {
		http.Error(w, "snapshot is corrupted: "+err.Error(), http.StatusInternalServerError)
		return
	}
	// Validate before loading, even though it was valid at capture time —
	// the running Caddy might be a different version with different requirements.
	caddyCl := s.caddyForRequest(r)
	if err := caddyCl.Validate(cfg); err != nil {
		_ = models.LogActivity(s.DB, s.currentServerID(r), s.currentUserEmail(r), "snapshot_restore_failed",
			fmt.Sprintf("snapshot:%d", id), err.Error(), false)
		http.Error(w, "caddy rejected snapshot: "+err.Error(), http.StatusBadGateway)
		return
	}
	// Snapshot the CURRENT config first so restoring is itself undoable.
	if s.autoSnapshotsEnabled() {
		if _, cur, err := caddyCl.FetchConfig(); err == nil && cur != "" && cur != "null" {
			_, _ = models.CreateSnapshot(s.DB, s.currentServerID(r), models.SnapshotSourceAuto,
				fmt.Sprintf("auto: before restoring snapshot #%d", id), cur)
			_ = models.PruneAutoSnapshots(s.DB, s.currentServerID(r), 20)
		}
	}
	if err := caddyCl.Load(cfg); err != nil {
		_ = models.LogActivity(s.DB, s.currentServerID(r), s.currentUserEmail(r), "snapshot_restore_failed",
			fmt.Sprintf("snapshot:%d", id), err.Error(), false)
		http.Error(w, err.Error(), http.StatusBadGateway)
		return
	}
	_ = models.LogActivity(s.DB, s.currentServerID(r), s.currentUserEmail(r), "snapshot_restored",
		fmt.Sprintf("snapshot:%d", id), snap.Note, true)
	http.Redirect(w, r, "/snapshots", http.StatusSeeOther)
}

func (s *Server) deleteSnapshot(w http.ResponseWriter, r *http.Request) {
	id, _ := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
	if err := models.DeleteSnapshot(s.DB, id); err != nil {
		http.Error(w, err.Error(), http.StatusInternalServerError)
		return
	}
	_ = models.LogActivity(s.DB, s.currentServerID(r), s.currentUserEmail(r), "snapshot_deleted",
		fmt.Sprintf("snapshot:%d", id), "", true)
	http.Redirect(w, r, "/snapshots", http.StatusSeeOther)
}

// downloadSnapshot streams the snapshot's config JSON as a .json file so users
// can keep off-host backups and later re-import via the upload form.
func (s *Server) downloadSnapshot(w http.ResponseWriter, r *http.Request) {
	id, _ := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
	snap, err := models.GetSnapshot(s.DB, id)
	if err != nil {
		http.Error(w, err.Error(), http.StatusNotFound)
		return
	}
	filename := fmt.Sprintf("caddyui-snapshot-%d-%s.json", snap.ID, snap.CreatedAt.UTC().Format("20060102-150405"))
	w.Header().Set("Content-Type", "application/json")
	w.Header().Set("Content-Disposition", fmt.Sprintf(`attachment; filename="%s"`, filename))
	w.Header().Set("X-Content-Type-Options", "nosniff")
	_, _ = w.Write([]byte(snap.ConfigJSON))
}

// DiffLine represents a single line in a unified diff view.
type DiffLine struct {
	Type    string // "same", "add", "remove"
	Content string
	LineA   int // 1-based line number in snapshot (0 if added)
	LineB   int // 1-based line number in live config (0 if removed)
}

// diffLines performs a simple line-by-line diff between two strings.
// It zips the two line slices and marks each position as same/add/remove.
// This is not a full LCS diff but is effective for JSON config comparisons.
func diffLines(a, b string) []DiffLine {
	aLines := strings.Split(a, "\n")
	bLines := strings.Split(b, "\n")
	max := len(aLines)
	if len(bLines) > max {
		max = len(bLines)
	}
	var out []DiffLine
	for i := 0; i < max; i++ {
		la, lb := "", ""
		if i < len(aLines) {
			la = aLines[i]
		}
		if i < len(bLines) {
			lb = bLines[i]
		}
		if la == lb {
			out = append(out, DiffLine{Type: "same", Content: la, LineA: i + 1, LineB: i + 1})
		} else {
			if la != "" {
				out = append(out, DiffLine{Type: "remove", Content: la, LineA: i + 1})
			}
			if lb != "" {
				out = append(out, DiffLine{Type: "add", Content: lb, LineB: i + 1})
			}
		}
	}
	return out
}

// getSnapshotDiff shows a unified diff between a stored snapshot and the
// current live Caddy config. Admin-only: non-admin callers get 403.
func (s *Server) getSnapshotDiff(w http.ResponseWriter, r *http.Request) {
	cu := s.currentUser(r)
	if cu == nil || cu.Role != models.RoleAdmin {
		http.Error(w, "admin access required", http.StatusForbidden)
		return
	}
	id, _ := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
	snap, err := models.GetSnapshot(s.DB, id)
	if err != nil {
		http.Error(w, err.Error(), http.StatusNotFound)
		return
	}

	// Pretty-print the snapshot JSON.
	var snapObj any
	if err := json.Unmarshal([]byte(snap.ConfigJSON), &snapObj); err != nil {
		http.Error(w, "snapshot is corrupted: "+err.Error(), http.StatusInternalServerError)
		return
	}
	snapPretty, err := json.MarshalIndent(snapObj, "", "  ")
	if err != nil {
		http.Error(w, "marshal snapshot: "+err.Error(), http.StatusInternalServerError)
		return
	}
	snapJSON := string(snapPretty)

	// Fetch and pretty-print the live config.
	var liveJSON string
	_, raw, fetchErr := s.caddyForRequest(r).FetchConfig()
	if fetchErr != nil || raw == "" || raw == "null" {
		liveJSON = ""
	} else {
		var liveObj any
		if err := json.Unmarshal([]byte(raw), &liveObj); err == nil {
			if b, err := json.MarshalIndent(liveObj, "", "  "); err == nil {
				liveJSON = string(b)
			} else {
				liveJSON = raw
			}
		} else {
			liveJSON = raw
		}
	}

	hasDiff := snapJSON != liveJSON
	var diffs []DiffLine
	addCount, removeCount := 0, 0
	if hasDiff {
		diffs = diffLines(snapJSON, liveJSON)
		for _, dl := range diffs {
			switch dl.Type {
			case "add":
				addCount++
			case "remove":
				removeCount++
			}
		}
	}

	s.render(w, r, "snapshot_diff.html", map[string]any{
		"User":        cu,
		"Snapshot":    snap,
		"SnapJSON":    snapJSON,
		"LiveJSON":    liveJSON,
		"DiffLines":   diffs,
		"HasDiff":     hasDiff,
		"AddCount":    addCount,
		"RemoveCount": removeCount,
		"Section":     "snapshots",
	})
}

// uploadSnapshot accepts a JSON file (typically a previously-downloaded
// snapshot, or any Caddy /config/ export) and stores it as a manual snapshot.
// The config is validated as JSON here but not run through Caddy — users
// restore explicitly, so we don't want upload to fail just because the running
// Caddy version rejects something.
func (s *Server) uploadSnapshot(w http.ResponseWriter, r *http.Request) {
	if err := r.ParseMultipartForm(8 << 20); err != nil { // 8 MiB
		http.Error(w, "upload too large or malformed: "+err.Error(), http.StatusBadRequest)
		return
	}
	file, header, err := r.FormFile("file")
	if err != nil {
		http.Error(w, "missing 'file' upload", http.StatusBadRequest)
		return
	}
	defer file.Close()
	raw, err := io.ReadAll(io.LimitReader(file, 8<<20))
	if err != nil {
		http.Error(w, "read upload: "+err.Error(), http.StatusBadRequest)
		return
	}
	var anyJSON any
	if err := json.Unmarshal(raw, &anyJSON); err != nil {
		http.Error(w, "file is not valid JSON: "+err.Error(), http.StatusBadRequest)
		return
	}
	note := strings.TrimSpace(r.FormValue("note"))
	if note == "" {
		note = fmt.Sprintf("imported from %s", header.Filename)
	}
	id, err := models.CreateSnapshot(s.DB, s.currentServerID(r), models.SnapshotSourceManual, note, string(raw))
	if err != nil {
		http.Error(w, err.Error(), http.StatusInternalServerError)
		return
	}
	_ = models.LogActivity(s.DB, s.currentServerID(r), s.currentUserEmail(r), "snapshot_uploaded",
		fmt.Sprintf("snapshot:%d", id), header.Filename, true)
	http.Redirect(w, r, "/snapshots", http.StatusSeeOther)
}

// --- Activity log ---

// getDocs renders the in-app tutorial / quick-start guide.
// Everything here is static, so no DB call is needed.
func (s *Server) getDocs(w http.ResponseWriter, r *http.Request) {
	s.render(w, r, "docs.html", map[string]any{
		"User":            s.currentUser(r),
		"Section":         "docs",
		"DatabaseBackend": string(appdb.BackendOf(s.DB)),
	})
}

// getAPIDocs renders the v1 REST API reference page.
func (s *Server) getAPIDocs(w http.ResponseWriter, r *http.Request) {
	s.render(w, r, "api_docs.html", map[string]any{
		"User":    s.currentUser(r),
		"Section": "api_docs",
	})
}

// activityVisibleTo scopes activity-log entries to what the user may see: an
// admin sees all of them; anyone else sees only their own actions. The log
// records every account's edits (other tenants' domains), failed logins with the
// submitted email, and the admin's sign-in IP addresses — none of which a
// customer or read-only account should read (v2.57.1).
func (s *Server) activityVisibleTo(u *models.User, entries []models.Activity) []models.Activity {
	if isAdminUser(u) {
		return entries
	}
	if u == nil {
		return nil
	}
	out := entries[:0:0]
	for _, a := range entries {
		if strings.EqualFold(a.Actor, u.Email) {
			out = append(out, a)
		}
	}
	return out
}

func (s *Server) listActivityLog(w http.ResponseWriter, r *http.Request) {
	search := strings.TrimSpace(r.URL.Query().Get("search"))
	actionFilter := strings.TrimSpace(r.URL.Query().Get("action"))
	entries, err := models.ListActivitySearch(s.DB, s.currentServerID(r), 500, search)
	if err != nil {
		http.Error(w, err.Error(), http.StatusInternalServerError)
		return
	}
	entries = s.activityVisibleTo(s.currentUser(r), entries) // v2.57.1
	if actionFilter != "" {
		filtered := entries[:0]
		for _, a := range entries {
			if strings.Contains(a.Action, actionFilter) {
				filtered = append(filtered, a)
			}
		}
		entries = filtered
	}
	s.render(w, r, "activity.html", map[string]any{
		"User":         s.currentUser(r),
		"Entries":      entries,
		"Section":      "activity",
		"Search":       search,
		"ActionFilter": actionFilter,
	})
}

// csvSafe neutralises spreadsheet formula injection in an exported cell: a
// value that starts with = + - @ (or a tab / carriage return, which Excel also
// treats as a formula lead-in) is prefixed with an apostrophe so it opens as
// text. Values come from places anyone can write — an unauthenticated failed
// login records the submitted email as the actor, and a visitor controls the
// path and User-Agent of every request (v2.57.1).
func csvSafe(v string) string {
	if v != "" && strings.ContainsRune("=+-@\t\r", rune(v[0])) {
		return "'" + v
	}
	return v
}

func (s *Server) exportActivityCSV(w http.ResponseWriter, r *http.Request) {
	cu := s.currentUser(r)
	if cu == nil {
		http.Error(w, "unauthorized", http.StatusUnauthorized)
		return
	}
	sid := s.currentServerID(r)
	search := strings.TrimSpace(r.URL.Query().Get("search"))
	entries, err := models.ListActivitySearch(s.DB, sid, 10000, search)
	if err != nil {
		http.Error(w, err.Error(), http.StatusInternalServerError)
		return
	}
	entries = s.activityVisibleTo(cu, entries) // v2.57.1
	w.Header().Set("Content-Type", "text/csv; charset=utf-8")
	w.Header().Set("Content-Disposition", `attachment; filename="activity.csv"`)
	cw := csv.NewWriter(w)
	_ = cw.Write([]string{"ID", "Actor", "Action", "Target", "Detail", "Success", "Created At"})
	for _, a := range entries {
		succ := "false"
		if a.Success {
			succ = "true"
		}
		_ = cw.Write([]string{
			strconv.FormatInt(a.ID, 10),
			csvSafe(a.Actor),
			csvSafe(a.Action),
			csvSafe(a.Target),
			csvSafe(a.Detail),
			succ,
			a.CreatedAt.Format(time.RFC3339),
		})
	}
	cw.Flush()
}

// --- build helpers ---

// fallbackRoute is the route that answers a request no proxy host, redirection
// or Advanced route matched. The status is configurable (v2.60.0, issue #123). v2.59.4 (issue #123): without one Caddy answers an
// unknown hostname with an EMPTY 200 OK, and CaddyUI generated one only when the
// admin had saved custom 404 HTML, so by default an unknown host got 200 on both
// listeners. It is now always a real 404 — the admin's HTML when configured,
// otherwise Caddy's error handler (which renders CaddyUI's branded 404 page on
// the HTTPS server, where the error routes live).
func (s *Server) fallbackRoute() map[string]any {
	status := s.fallbackStatusCode()
	if html, _ := models.GetSetting(s.DB, settingCatchAll404HTML); strings.TrimSpace(html) != "" {
		return map[string]any{
			"handle": []any{map[string]any{
				"handler":     "static_response",
				"status_code": status,
				"headers": map[string]any{
					"Content-Type": []any{"text/html; charset=utf-8"},
				},
				"body": html,
			}},
			"terminal": true,
		}
	}
	return map[string]any{
		"handle":   []any{map[string]any{"handler": "error", "status_code": status}},
		"terminal": true,
	}
}

// withFallbackRoute appends the fallback as the LAST route. A server that has no
// routes at all is left alone: CaddyUI then owns nothing on that listener, and
// an empty list must keep meaning "do not take over".
func (s *Server) withFallbackRoute(routes []any) []any {
	if len(routes) == 0 {
		return routes
	}
	return append(routes, s.fallbackRoute())
}

func (s *Server) buildMergedRoutes(proxies []models.ProxyHost, redirs []models.RedirectionHost, raws []models.RawRoute) []any {
	routes := []any{}
	for _, p := range proxies {
		if !p.Enabled || len(p.DomainList()) == 0 {
			continue
		}
		// Prepend basicauth authentication handler if enabled.
		var preHandlers []any
		if p.BasicAuthEnabled {
			if baUsers := p.BasicAuthUserList(); len(baUsers) > 0 {
				realm := p.BasicAuthRealm
				if realm == "" {
					realm = "Restricted"
				}
				if h := s.buildBasicAuthHandler(s.Caddy, baUsers, realm); h != nil {
					preHandlers = []any{h}
				}
			}
		}
		var advanced []any
		var advancedOverrides map[string]any
		if strings.TrimSpace(p.AdvancedConfig) != "" && s.isTenantOwner(p.OwnerID) && tenantTextViolation(p.AdvancedConfig) != "" {
			// {$ENV} is substituted by Caddy while ADAPTING, so the value would
			// already be baked into the handlers; refuse before adapting.
			log.Printf("caddy sync: proxy id=%d advanced_config skipped, not allowed for a non-admin owner: %s", p.ID, tenantTextViolation(p.AdvancedConfig))
		} else if strings.TrimSpace(p.AdvancedConfig) != "" {
			h, overrides, err := s.adaptProxyAdvanced(p)
			if err != nil {
				// Don't fail the whole sync — log and push the route without advanced
				// handlers. The form-level validation should have caught bad syntax
				// before save, so this branch is for rare drift cases.
				log.Printf("caddy sync: proxy id=%d advanced_config adapt failed: %v", p.ID, err)
			} else {
				advanced, advancedOverrides = h, overrides
			}
		}
		route := caddy.BuildProxyRoute(p, append(preHandlers, advanced...))
		caddy.MergeReverseProxyOverrides(route, advancedOverrides)
		// v2.57.1: enforcement point for routes owned by a non-admin — see
		// tenant_guard.go. Admin-owned routes pass through untouched.
		if safe, ok := s.sanitizeTenantRoute(p.OwnerID, "proxy host "+p.Domains, route); ok {
			routes = append(routes, safe)
		}
	}
	for _, rd := range redirs {
		if !rd.Enabled || len(rd.DomainList()) == 0 {
			continue
		}
		if safe, ok := s.sanitizeTenantRoute(rd.OwnerID, "redirection "+rd.Domains, caddy.BuildRedirectRoute(rd)); ok {
			routes = append(routes, safe)
		}
	}
	for _, rr := range raws {
		if !rr.Enabled {
			continue
		}
		// v2.36.1 (issue #64): routes bound to their own port(s) are emitted
		// as separate servers by buildRawListenServers, not on srv0.
		if rr.Listen != "" {
			continue
		}
		routes = append(routes, s.tenantSafeRawEntries(rr)...)
	}

	// v2.61.3 (issue #129): exact hostnames before wildcards, so a wildcard host
	// can never take over a more specific host's route (and skip its allowlist).
	routes = sortRoutesBySpecificity(routes)

	// Global maintenance mode: prepend a catch-all 503 before all routes so
	// every incoming request receives the maintenance page regardless of which
	// virtual host it targets. The route has no host matcher (catches all),
	// and it's prepended so it fires before any per-host route.
	if gm, _ := models.GetSetting(s.DB, settingGlobalMaintenance); gm == "1" {
		globalMaintenanceBody := `<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8"><title>Maintenance</title><style>*{box-sizing:border-box}body{font-family:system-ui,sans-serif;background:#f8fafc;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0}.card{background:#fff;border-radius:16px;padding:40px 48px;text-align:center;box-shadow:0 4px 32px rgba(0,0,0,.08);max-width:480px}h1{font-size:1.5rem;color:#1e293b;margin:16px 0 8px}p{color:#64748b;font-size:.95rem;line-height:1.6;margin:0}</style></head><body><div class="card"><svg width="48" height="48" fill="none" stroke="#f59e0b" stroke-width="1.5" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z"/></svg><h1>Down for Maintenance</h1><p>We're making improvements and will be back shortly. Thank you for your patience.</p></div></body></html>`
		routes = append([]any{map[string]any{
			"handle": []any{map[string]any{
				"handler":     "static_response",
				"status_code": 503,
				"headers": map[string]any{
					"Content-Type": []any{"text/html; charset=utf-8"},
					"Retry-After":  []any{"3600"},
				},
				"body": globalMaintenanceBody,
			}},
			"terminal": true,
		}}, routes...)
	}

	return routes
}

func buildCertLoaders(certs []models.Certificate) (loadPEM, loadFiles []any) {
	for _, c := range certs {
		tag := "caddyui-" + strconv.FormatInt(c.ID, 10)
		switch c.Source {
		case models.CertSourcePEM:
			loadPEM = append(loadPEM, map[string]any{
				"certificate": c.CertPEM,
				"key":         c.KeyPEM,
				"tags":        []any{tag},
			})
		case models.CertSourcePath:
			loadFiles = append(loadFiles, map[string]any{
				"certificate": c.CertPath,
				"key":         c.KeyPath,
				"tags":        []any{tag},
			})
		}
	}
	return
}

func buildSkipCertificates(proxies []models.ProxyHost, redirs []models.RedirectionHost, raws []models.RawRoute, certs []models.Certificate) []any {
	set := map[string]struct{}{}
	for _, p := range proxies {
		if p.CertificateID == 0 {
			continue
		}
		for _, d := range p.DomainList() {
			if d = models.NormalizeHostname(d); d != "" {
				set[d] = struct{}{}
			}
		}
	}
	for _, rd := range redirs {
		if rd.CertificateID == 0 {
			continue
		}
		for _, d := range rd.DomainList() {
			if d = models.NormalizeHostname(d); d != "" {
				set[d] = struct{}{}
			}
		}
	}
	// Raw routes don't store their domains as a separate field — the hosts live
	// inside the JSON match[].host[]. Pull them out so Caddy skips ACME for these
	// hostnames when the user bound a custom cert.
	for _, rr := range raws {
		if rr.CertificateID == 0 {
			continue
		}
		var decoded any
		if err := json.Unmarshal([]byte(rr.JSONData), &decoded); err != nil {
			continue
		}
		for _, route := range flattenToRouteMaps(decoded) {
			for _, h := range hostsFromRoute(route) {
				if h = models.NormalizeHostname(h); h != "" {
					set[h] = struct{}{}
				}
			}
		}
	}
	// Auto-selected exact hosts covered by a standalone managed wildcard must
	// remain HTTPS-enabled but must not trigger their own ACME order. Caddy's
	// skip_certificates setting provides exactly that behavior: the wildcard
	// route obtains the wildcard certificate, and the exact route reuses it
	// from Caddy's cache. Never skip wildcard subjects themselves, because
	// those are what command Caddy to obtain the managed certificate.
	addCoveredExact := func(hosts []string, enabled, sslEnabled bool, certificateID int64, internalTLS bool) {
		if !enabled || !sslEnabled || certificateID != 0 {
			return
		}
		// v2.46.0: an internal-CA host gets its own certificate from the
		// `internal` issuer (buildInternalTLSAutomationPolicies), so it is
		// never covered by a wildcard managed (DNS-01) certificate. Skipping
		// it here would tell Caddy not to manage the cert at all, leaving the
		// host with none.
		if internalTLS {
			return
		}
		for _, host := range hosts {
			host = models.NormalizeHostname(host)
			if host == "" || strings.HasPrefix(host, "*.") {
				continue
			}
			for _, cert := range certs {
				if cert.Source != models.CertSourceManaged {
					continue
				}
				covered := false
				for _, certDomain := range cert.DomainList() {
					if strings.HasPrefix(models.NormalizeHostname(certDomain), "*.") && managedCertificateCovers(certDomain, host) {
						covered = true
						break
					}
				}
				if covered {
					set[host] = struct{}{}
					break
				}
			}
		}
	}
	for _, proxy := range proxies {
		addCoveredExact(proxy.DomainList(), proxy.Enabled, proxy.SSLEnabled, proxy.CertificateID, proxy.InternalTLS)
	}
	for _, redirect := range redirs {
		addCoveredExact(redirect.DomainList(), redirect.Enabled, redirect.SSLEnabled, redirect.CertificateID, false)
	}
	for _, raw := range raws {
		addCoveredExact(rawRouteHosts(raw), raw.Enabled, true, raw.CertificateID, false)
	}
	out := make([]any, 0, len(set))
	for d := range set {
		out = append(out, d)
	}
	return out
}

// flattenToRouteMaps accepts the decoded JSON of a raw_route (may be a single
// route object or an array of routes) and returns the route maps found at the
// top level. Nested subroutes are not descended — host matches are expected on
// the top-level route for TLS binding purposes.
func flattenToRouteMaps(v any) []map[string]any {
	switch t := v.(type) {
	case map[string]any:
		return []map[string]any{t}
	case []any:
		var out []map[string]any
		for _, item := range t {
			if m, ok := item.(map[string]any); ok {
				out = append(out, m)
			}
		}
		return out
	}
	return nil
}

// --- deep-copy + in-place merge helpers (operate on the proposed config map) ---

func deepCopyMap(m map[string]any) (map[string]any, error) {
	if m == nil {
		return map[string]any{}, nil
	}
	b, err := json.Marshal(m)
	if err != nil {
		return nil, err
	}
	var out map[string]any
	if err := json.Unmarshal(b, &out); err != nil {
		return nil, err
	}
	if out == nil {
		out = map[string]any{}
	}
	return out, nil
}

func ensureMap(parent map[string]any, key string) map[string]any {
	if v, ok := parent[key].(map[string]any); ok {
		return v
	}
	m := map[string]any{}
	parent[key] = m
	return m
}

func applyRoutes(cfg map[string]any, routes []any) {
	apps := ensureMap(cfg, "apps")
	httpApp := ensureMap(apps, "http")
	servers := ensureMap(httpApp, "servers")
	srv := ensureMap(servers, "srv0")
	srv["routes"] = routes
}

// applyPlainHTTPServer mirrors the Caddyfile adapter's representation of a
// site declared with both http:// and https:// addresses: HTTPS stays on srv0,
// while an explicit :80 server handles hosts whose Force SSL toggle is off.
// Caddy then excludes those hosts from its generated redirect routes without
// relying on the nonexistent automatic_https.skip_redirects JSON field.
func applyPlainHTTPServer(cfg map[string]any, routes []any) {
	apps := ensureMap(cfg, "apps")
	httpApp := ensureMap(apps, "http")
	servers := ensureMap(httpApp, "servers")
	if len(routes) == 0 {
		delete(servers, "caddyui_http")
		return
	}
	servers["caddyui_http"] = map[string]any{
		"listen": []any{":80"},
		"routes": routes,
	}
}

// rawRouteEntries decodes a raw_route's JSON into the route object(s) it
// contributes, applying the per-route wrapping (exploit blocker). A raw_route
// may hold a single route object or an array of routes; arrays are spread so
// we never emit a nested array (which Caddy rejects). Shared by srv0 assembly
// and by the per-port servers of v2.36.1 (issue #64).
// tenantSafeRawEntries is rawRouteEntries with the non-admin enforcement of
// tenant_guard.go applied to each entry (v2.57.1).
func (s *Server) tenantSafeRawEntries(rr models.RawRoute) []any {
	entries := rawRouteEntries(rr)
	if !s.isTenantOwner(rr.OwnerID) {
		return entries
	}
	out := make([]any, 0, len(entries))
	for _, e := range entries {
		if safe, ok := s.sanitizeTenantRoute(rr.OwnerID, "advanced route "+rr.Label, e); ok {
			out = append(out, safe)
		}
	}
	return out
}

func rawRouteEntries(rr models.RawRoute) []any {
	var decoded any
	if err := json.Unmarshal([]byte(rr.JSONData), &decoded); err != nil {
		log.Printf("caddy sync: skipping invalid raw_route id=%d label=%q: %v", rr.ID, rr.Label, err)
		return nil
	}
	wrap := func(route map[string]any) map[string]any {
		if rr.BlockCommonExploits {
			handle, _ := route["handle"].([]any)
			route["handle"] = append([]any{caddy.ExploitBlockerSubroute()}, handle...)
		}
		return route
	}
	var out []any
	switch v := decoded.(type) {
	case []any:
		for _, item := range v {
			if m, ok := item.(map[string]any); ok {
				out = append(out, wrap(m))
			} else {
				out = append(out, item)
			}
		}
	case map[string]any:
		out = append(out, wrap(v))
	default:
		log.Printf("caddy sync: skipping raw_route id=%d label=%q: unexpected JSON shape %T", rr.ID, rr.Label, decoded)
	}
	return out
}

// rawListenServerPrefix names the apps.http.servers entries CaddyUI creates for
// Advanced routes with their own listen addresses (v2.36.1, issue #64). Only
// keys with this prefix are ever removed by the sync; a server the operator
// added by hand under any other name is left alone.
const rawListenServerPrefix = "caddyui_listen_"

// buildRawListenServers groups the enabled Advanced routes that carry a listen
// set into one server per distinct set: `:7070 { … }` pasted twice yields one
// "caddyui_listen_7070" server with both routes. Routes on the standard ports
// (Listen == "") are not included — they live on srv0 / caddyui_http as
// always. Insertion order is preserved so the routes keep the order the
// operator sees in the list.
func (s *Server) buildRawListenServers(raws []models.RawRoute) map[string]map[string]any {
	type group struct {
		addrs  []string
		routes []any
	}
	groups := map[string]*group{}
	for _, rr := range raws {
		if !rr.Enabled || rr.Listen == "" {
			continue
		}
		addrs := rr.ListenAddrs()
		name := models.RawRouteListenServerName(addrs)
		if name == "" {
			continue
		}
		g, ok := groups[name]
		if !ok {
			g = &group{addrs: addrs}
			groups[name] = g
		}
		g.routes = append(g.routes, s.tenantSafeRawEntries(rr)...)
	}
	out := make(map[string]map[string]any, len(groups))
	for name, g := range groups {
		listen := make([]any, 0, len(g.addrs))
		for _, a := range g.addrs {
			listen = append(listen, a)
		}
		routes := g.routes
		if routes == nil {
			routes = []any{}
		}
		out[name] = map[string]any{"listen": listen, "routes": routes}
	}
	return out
}

// applyRawListenServers replaces every caddyui_listen_* server in the proposed
// config with the desired set, so a route whose port changed or that was
// deleted doesn't leave a stale listener behind.
func applyRawListenServers(cfg map[string]any, want map[string]map[string]any) {
	apps := ensureMap(cfg, "apps")
	httpApp := ensureMap(apps, "http")
	servers := ensureMap(httpApp, "servers")
	for name := range servers {
		if strings.HasPrefix(name, rawListenServerPrefix) {
			delete(servers, name)
		}
	}
	for name, srv := range want {
		servers[name] = srv
	}
}

// writeRawListenServersSubtree is the live-config counterpart of
// applyRawListenServers: stale caddyui_listen_* servers are deleted first so a
// port that moved between two names is never bound twice, then the desired
// servers are written in name order (PATCH when the key exists, PUT otherwise).
func (s *Server) writeRawListenServersSubtree(want map[string]map[string]any) error {
	raw, err := s.Caddy.FetchPath("/config/apps/http/servers")
	if err != nil {
		return err
	}
	existing, _ := raw.(map[string]any)
	for name := range existing {
		if !strings.HasPrefix(name, rawListenServerPrefix) {
			continue
		}
		if _, keep := want[name]; keep {
			continue
		}
		if err := s.Caddy.DeletePath("/config/apps/http/servers/" + name); err != nil {
			return err
		}
	}
	names := make([]string, 0, len(want))
	for name := range want {
		names = append(names, name)
	}
	sort.Strings(names)
	for _, name := range names {
		path := "/config/apps/http/servers/" + name
		if _, exists := existing[name]; exists {
			if err := s.Caddy.PatchPath(path, want[name]); err != nil {
				return err
			}
			continue
		}
		if err := s.Caddy.PutPath(path, want[name]); err != nil {
			return err
		}
	}
	return nil
}

// applyListen forces srv0 to listen on :443. Without this, a Caddyfile with no
// site blocks produces a config where srv0.listen is null and Caddy only serves
// on :80 — the :443 port has no listener and HTTPS is unreachable. Setting :443
// explicitly lets us keep the Caddyfile reduced to globals+snippets while the
// DB drives all routes. The :80 HTTP→HTTPS redirect server is synthesised by
// Caddy's automatic_https module from the route hosts, so we don't manage it.
func applyListen(cfg map[string]any) {
	apps := ensureMap(cfg, "apps")
	httpApp := ensureMap(apps, "http")
	servers := ensureMap(httpApp, "servers")
	srv := ensureMap(servers, "srv0")
	srv["listen"] = []any{":443"}
}

// applyProtocols restricts the Caddy HTTP server to h1+h2 when disable_http3
// is set, giving maximum compatibility with older Android clients. When the
// setting is off it removes any previously-written protocols key so Caddy
// reverts to its own default (h1, h2, h3).
func applyProtocols(cfg map[string]any, db *sql.DB) {
	apps, _ := cfg["apps"].(map[string]any)
	if apps == nil {
		return
	}
	httpApp, _ := apps["http"].(map[string]any)
	if httpApp == nil {
		return
	}
	servers, _ := httpApp["servers"].(map[string]any)
	if servers == nil {
		return
	}
	srv, _ := servers["srv0"].(map[string]any)
	if srv == nil {
		return
	}
	if v, _ := models.GetSetting(db, settingDisableHTTP3); v == "1" {
		srv["protocols"] = []any{"h1", "h2"}
	} else {
		delete(srv, "protocols")
	}
}

// applyTrustedProxies injects the trusted_proxies list into the Caddy HTTP
// server config. This allows Caddy to extract the real client IP from
// X-Forwarded-For when requests arrive via a trusted load balancer or CDN.
// No-op when the setting is empty.
func applyTrustedProxies(cfg map[string]any, db *sql.DB, serverID int64) {
	raw, _ := models.GetSetting(db, settingTrustedProxies)
	if raw == "" {
		return
	}
	var ranges []any
	for _, line := range strings.FieldsFunc(raw, func(r rune) bool { return r == ',' || r == '\n' }) {
		if cidr := strings.TrimSpace(line); cidr != "" {
			ranges = append(ranges, cidr)
		}
	}
	if len(ranges) == 0 {
		return
	}
	// Navigate to apps.http.servers.srv0 and set trusted_proxies.
	apps, _ := cfg["apps"].(map[string]any)
	if apps == nil {
		return
	}
	httpApp, _ := apps["http"].(map[string]any)
	if httpApp == nil {
		return
	}
	servers, _ := httpApp["servers"].(map[string]any)
	if servers == nil {
		return
	}
	srv, _ := servers["srv0"].(map[string]any)
	if srv == nil {
		return
	}
	srv["trusted_proxies"] = map[string]any{
		"source": "static",
		"ranges": ranges,
	}
}

func applyCertLoaders(cfg map[string]any, loadPEM, loadFiles []any) {
	apps := ensureMap(cfg, "apps")
	tlsBlock := ensureMap(apps, "tls")
	certsBlock := ensureMap(tlsBlock, "certificates")
	// Mirror writeTLSSubtree: merge caddyui-owned entries with any pre-existing
	// non-caddyui entries so validation reflects exactly what we'll push.
	existingPEM, _ := certsBlock["load_pem"].([]any)
	existingFiles, _ := certsBlock["load_files"].([]any)
	mergedPEM := append(filterNonCaddyUICerts(existingPEM), loadPEM...)
	mergedFiles := append(filterNonCaddyUICerts(existingFiles), loadFiles...)
	if len(mergedPEM) > 0 {
		certsBlock["load_pem"] = mergedPEM
	} else {
		delete(certsBlock, "load_pem")
	}
	if len(mergedFiles) > 0 {
		certsBlock["load_files"] = mergedFiles
	} else {
		delete(certsBlock, "load_files")
	}
	if len(certsBlock) == 0 {
		delete(tlsBlock, "certificates")
	}
	if len(tlsBlock) == 0 {
		delete(apps, "tls")
	}
}

func applySkipCertificates(cfg map[string]any, skipList []any) {
	apps := ensureMap(cfg, "apps")
	httpApp := ensureMap(apps, "http")
	servers := ensureMap(httpApp, "servers")
	srv := ensureMap(servers, "srv0")
	auto := ensureMap(srv, "automatic_https")
	if len(skipList) > 0 {
		auto["skip_certificates"] = skipList
	} else {
		delete(auto, "skip_certificates")
	}
	if len(auto) == 0 {
		delete(srv, "automatic_https")
	}
}

// buildHTTPRoutes returns the complete route set for CaddyUI's explicit :80
// server. Hosts with Force SSL off keep their normal handlers; hosts with
// Force SSL on receive an HTTPS redirect. Owning both cases lets CaddyUI disable
// Caddy's generated redirect listener, avoiding two servers competing for :80.
func (s *Server) buildHTTPRoutes(proxies []models.ProxyHost, redirs []models.RedirectionHost, raws []models.RawRoute) []any {
	httpProxies := make([]models.ProxyHost, 0)
	var forcedDomains []string
	for _, p := range proxies {
		if !p.Enabled {
			continue
		}
		if !p.SSLForced {
			httpProxies = append(httpProxies, p)
		} else {
			forcedDomains = append(forcedDomains, p.DomainList()...)
		}
	}
	httpRedirs := make([]models.RedirectionHost, 0)
	for _, rd := range redirs {
		if !rd.Enabled {
			continue
		}
		if !rd.SSLForced {
			httpRedirs = append(httpRedirs, rd)
		} else {
			forcedDomains = append(forcedDomains, rd.DomainList()...)
		}
	}
	httpRaws := make([]models.RawRoute, 0)
	for _, rr := range raws {
		if !rr.Enabled {
			continue
		}
		if rr.Listen != "" { // v2.36.1 (issue #64): served by its own listener, never on :80
			continue
		}
		// v2.59.3 (issue #121): a route written with explicit http:// addresses
		// is never redirected to HTTPS, even if an older save left Force SSL on.
		if !rr.ForceSSL || rawRouteHTTPOnly(&rr) {
			httpRaws = append(httpRaws, rr)
		} else {
			forcedDomains = append(forcedDomains, rawRouteHosts(rr)...)
		}
	}
	routes := s.buildMergedRoutes(httpProxies, httpRedirs, httpRaws)
	if redirect := buildHTTPSRedirectRoute(forcedDomains); redirect != nil {
		// v2.68.3 (issue #149): after the last host-matched route, but before
		// any catch-all that follows it. Appended at the end, a catch-all
		// Advanced route served on :80 answered every Force SSL host first.
		routes = insertAfterLastHostRoute(routes, redirect)
	}
	// The HTTPS redirect for forced hosts must also beat a wildcard host that
	// is served on :80 (issue #129).
	routes = sortRoutesBySpecificity(routes)
	// The fallback goes after the HTTPS redirect, so a forced-SSL host is
	// redirected rather than answered with the fallback 404 (issue #123).
	return s.withFallbackRoute(routes)
}

// insertAfterLastHostRoute returns routes with route placed just after the
// last route that matches on hostnames, or first when none does, so no
// catch-all after the host routes can shadow it. Caddy's automatic HTTPS puts
// the redirects it adds to an existing :80 server at the same place
// (caddyserver/caddy#3212). Inserted at a host-route position, the redirect
// still takes part in sortRoutesBySpecificity.
func insertAfterLastHostRoute(routes []any, route any) []any {
	at := 0
	for i, r := range routes {
		if _, ok := routeSpecificity(r); ok {
			at = i + 1
		}
	}
	out := make([]any, 0, len(routes)+1)
	out = append(out, routes[:at]...)
	out = append(out, route)
	return append(out, routes[at:]...)
}

func buildHTTPSRedirectRoute(domains []string) map[string]any {
	seen := map[string]bool{}
	hosts := make([]any, 0, len(domains))
	for _, raw := range domains {
		host := strings.ToLower(strings.TrimSpace(raw))
		if host == "" || seen[host] {
			continue
		}
		seen[host] = true
		hosts = append(hosts, host)
	}
	if len(hosts) == 0 {
		return nil
	}
	return map[string]any{
		"match": []any{map[string]any{"host": hosts}},
		"handle": []any{map[string]any{
			"handler":     "static_response",
			"status_code": http.StatusPermanentRedirect,
			"headers": map[string]any{
				"Location": []any{"https://{http.request.host}{http.request.uri}"},
			},
		}},
		"terminal": true,
	}
}

// removeUnsupportedSkipRedirects cleans configs produced by affected CaddyUI
// versions before validation. Caddy's AutoHTTPSConfig has no skip_redirects
// field; per-host plain HTTP is represented by applyPlainHTTPServer instead.
func removeUnsupportedSkipRedirects(cfg map[string]any) {
	apps := ensureMap(cfg, "apps")
	httpApp := ensureMap(apps, "http")
	servers := ensureMap(httpApp, "servers")
	srv := ensureMap(servers, "srv0")
	if auto, ok := srv["automatic_https"].(map[string]any); ok {
		delete(auto, "skip_redirects")
		if len(auto) == 0 {
			delete(srv, "automatic_https")
		}
	}
}

func applyDisableAutomaticHTTPSRedirects(cfg map[string]any, disabled bool) {
	apps := ensureMap(cfg, "apps")
	httpApp := ensureMap(apps, "http")
	servers := ensureMap(httpApp, "servers")
	srv := ensureMap(servers, "srv0")
	auto := ensureMap(srv, "automatic_https")
	if disabled {
		auto["disable_redirects"] = true
	} else {
		delete(auto, "disable_redirects")
	}
	if len(auto) == 0 {
		delete(srv, "automatic_https")
	}
}

// buildSkipAccessLogs collects domains from enabled proxy hosts where
// DisableAccessLog=true. These are written to srv0.logs.skip_hosts so Caddy
// omits access-log entries for those virtual hosts.
func buildSkipAccessLogs(proxies []models.ProxyHost) []any {
	set := map[string]struct{}{}
	for _, p := range proxies {
		if !p.Enabled || !p.DisableAccessLog {
			continue
		}
		for _, d := range p.DomainList() {
			set[d] = struct{}{}
		}
	}
	out := make([]any, 0, len(set))
	for d := range set {
		out = append(out, d)
	}
	return out
}

func applySkipAccessLogs(cfg map[string]any, skipHosts []any) {
	apps := ensureMap(cfg, "apps")
	httpApp := ensureMap(apps, "http")
	servers := ensureMap(httpApp, "servers")
	srv := ensureMap(servers, "srv0")
	if len(skipHosts) > 0 {
		logsM := ensureMap(srv, "logs")
		logsM["skip_hosts"] = skipHosts
	} else {
		if logsM, ok := srv["logs"].(map[string]any); ok {
			delete(logsM, "skip_hosts")
			if len(logsM) == 0 {
				delete(srv, "logs")
			}
		}
	}
}

// applyTLSConnectionPolicies merges per-SNI TLS connection policies into the
// proposed config map used for pre-load validation. Mirrors the subtree-write
// helpers — changes here must match writeTLSConnectionPoliciesSubtree.
func applyTLSConnectionPolicies(cfg map[string]any, policies []any) {
	apps := ensureMap(cfg, "apps")
	httpApp := ensureMap(apps, "http")
	servers := ensureMap(httpApp, "servers")
	srv := ensureMap(servers, "srv0")
	if len(policies) > 0 {
		srv["tls_connection_policies"] = policies
	} else {
		delete(srv, "tls_connection_policies")
	}
}

// filterNonCaddyUICerts returns the subset of cert loader entries that DON'T carry
// a caddyui ownership tag ("caddyui-*"). Used on sync to preserve TLS certs that
// were loaded from the user's Caddyfile or placed via direct /config edits, so
// caddyui only overwrites its own entries.
func filterNonCaddyUICerts(in []any) []any {
	out := make([]any, 0, len(in))
	for _, item := range in {
		entry, ok := item.(map[string]any)
		if !ok {
			out = append(out, item)
			continue
		}
		tags, _ := entry["tags"].([]any)
		owned := false
		for _, t := range tags {
			if s, ok := t.(string); ok && strings.HasPrefix(s, "caddyui-") {
				owned = true
				break
			}
		}
		if !owned {
			out = append(out, entry)
		}
	}
	return out
}

// --- real subtree writes (post-validation) ---

// writeRoutesSubtree replaces the srv0 routes array. Uses PATCH (replace) when routes
// already exist, since POST on an existing array path APPENDS the body as one element
// (which would produce [existing..., [new_routes]] — a nested array Caddy rejects).
// Falls back to POST when routes don't exist yet (PATCH 404s on missing paths).
func (s *Server) writeRoutesSubtree(routes []any) error {
	existing, err := s.Caddy.FetchPath("/config/apps/http/servers/srv0/routes")
	if err != nil {
		return err
	}
	if existing == nil {
		return s.Caddy.PutPath("/config/apps/http/servers/srv0/routes", routes)
	}
	return s.Caddy.PatchPath("/config/apps/http/servers/srv0/routes", routes)
}

// writeListenSubtree ensures srv0.listen is [":443"]. Uses PATCH when the path
// exists (replace semantic) and PUT/POST when it doesn't (first write). Array
// paths cannot use POST-append semantics, same reason writeRoutesSubtree splits.
func (s *Server) writeListenSubtree() error {
	want := []any{":443"}
	existing, err := s.Caddy.FetchPath("/config/apps/http/servers/srv0/listen")
	if err != nil {
		return err
	}
	if cur, ok := existing.([]any); ok && stringListsEqual(cur, want) {
		return nil
	}
	if existing == nil {
		return s.Caddy.PutPath("/config/apps/http/servers/srv0/listen", want)
	}
	return s.Caddy.PatchPath("/config/apps/http/servers/srv0/listen", want)
}

// writeProtocolsSubtree pushes the protocols list (or absence thereof) to
// the live Caddy config. When disable_http3 is on it writes ["h1","h2"];
// when off it deletes the key so Caddy reverts to its default h1+h2+h3.
func (s *Server) writeProtocolsSubtree(db *sql.DB) error {
	const path = "/config/apps/http/servers/srv0/protocols"
	if v, _ := models.GetSetting(db, settingDisableHTTP3); v == "1" {
		want := []any{"h1", "h2"}
		existing, err := s.Caddy.FetchPath(path)
		if err != nil {
			return err
		}
		if cur, ok := existing.([]any); ok && stringListsEqual(cur, want) {
			return nil
		}
		if existing == nil {
			return s.Caddy.PutPath(path, want)
		}
		return s.Caddy.PatchPath(path, want)
	}
	// Setting is off — remove the key if it exists so Caddy uses its default.
	existing, err := s.Caddy.FetchPath(path)
	if err != nil || existing == nil {
		return nil
	}
	return s.Caddy.DeletePath(path)
}

func (s *Server) writeTLSSubtree(loadPEM, loadFiles []any, force bool) error {
	raw, err := s.Caddy.FetchPath("/config/apps/tls")
	if err != nil {
		return err
	}
	tlsMap, _ := raw.(map[string]any)
	if tlsMap == nil {
		tlsMap = map[string]any{}
	}
	certsMap, _ := tlsMap["certificates"].(map[string]any)
	if certsMap == nil {
		certsMap = map[string]any{}
	}

	// Preserve any cert entries that weren't created by caddyui. We tag everything
	// we own with "caddyui-<id>" — other entries (from Caddyfile, manual /config PUTs,
	// etc.) must survive the sync so we don't silently disable user-managed TLS.
	existingPEM, _ := certsMap["load_pem"].([]any)
	existingFiles, _ := certsMap["load_files"].([]any)
	mergedPEM := append(filterNonCaddyUICerts(existingPEM), loadPEM...)
	mergedFiles := append(filterNonCaddyUICerts(existingFiles), loadFiles...)

	// CRITICAL: writing /config/apps/tls reprovisions the entire TLS module, which
	// cancels every in-flight ACME challenge ("context canceled" errors). Skip the
	// write when the effective cert loaders haven't changed — unless the caller
	// forces it, meaning a cert assignment or cert row actually changed and the
	// user expects Caddy to re-evaluate.
	if !force && certsEqual(existingPEM, mergedPEM) && certsEqual(existingFiles, mergedFiles) {
		return nil
	}

	if len(mergedPEM) > 0 {
		certsMap["load_pem"] = mergedPEM
	} else {
		delete(certsMap, "load_pem")
	}
	if len(mergedFiles) > 0 {
		certsMap["load_files"] = mergedFiles
	} else {
		delete(certsMap, "load_files")
	}
	if len(certsMap) > 0 {
		tlsMap["certificates"] = certsMap
	} else {
		delete(tlsMap, "certificates")
	}
	if raw == nil && len(tlsMap) == 0 {
		return nil
	}
	return s.Caddy.PutPath("/config/apps/tls", tlsMap)
}

func (s *Server) writeAutomaticHTTPSSubtree(skipCerts []any, disableRedirects, force bool) error {
	raw, err := s.Caddy.FetchPath("/config/apps/http/servers/srv0/automatic_https")
	if err != nil {
		return err
	}
	autoMap, _ := raw.(map[string]any)
	existed := autoMap != nil
	if autoMap == nil {
		autoMap = map[string]any{}
	}
	existingSkipCerts, _ := autoMap["skip_certificates"].([]any)
	existingDisableRedirects, _ := autoMap["disable_redirects"].(bool)
	// Skip the write when the effective lists are unchanged. Writing otherwise
	// reprovisions the server module and can interrupt in-flight ACME work.
	_, hasInvalidSkipRedirects := autoMap["skip_redirects"]
	if !force && !hasInvalidSkipRedirects && existingDisableRedirects == disableRedirects && stringListsEqual(existingSkipCerts, skipCerts) {
		return nil
	}
	if len(skipCerts) > 0 {
		autoMap["skip_certificates"] = skipCerts
	} else {
		delete(autoMap, "skip_certificates")
	}
	delete(autoMap, "skip_redirects")
	if disableRedirects {
		autoMap["disable_redirects"] = true
	} else {
		delete(autoMap, "disable_redirects")
	}
	if !existed && len(autoMap) == 0 {
		return nil
	}
	return s.Caddy.PutPath("/config/apps/http/servers/srv0/automatic_https", autoMap)
}

// writePlainHTTPServerSubtree owns only the caddyui_http server. Replacing the
// complete server map keeps its :80 listener and route list in sync atomically
// without touching user-managed HTTP servers.
func (s *Server) writePlainHTTPServerSubtree(routes []any) error {
	const path = "/config/apps/http/servers/caddyui_http"
	existing, err := s.Caddy.FetchPath(path)
	if err != nil {
		return err
	}
	if len(routes) == 0 {
		if existing == nil {
			return nil
		}
		return s.Caddy.DeletePath(path)
	}
	want := map[string]any{
		"listen": []any{":80"},
		"routes": routes,
	}
	if existing == nil {
		return s.Caddy.PutPath(path, want)
	}
	return s.Caddy.PatchPath(path, want)
}

// writeTLSConnectionPoliciesSubtree replaces srv0.tls_connection_policies.
// When policies is nil/empty and no existing policies are set this is a no-op.
// When policies is nil/empty but existing policies exist, the key is cleared
// (replaced with an empty array) so stale per-SNI min-version settings don't
// linger after the last host that used them is updated.
func (s *Server) writeTLSConnectionPoliciesSubtree(policies []any) error {
	path := "/config/apps/http/servers/srv0/tls_connection_policies"
	existing, err := s.Caddy.FetchPath(path)
	if err != nil {
		return err
	}
	if len(policies) == 0 {
		if existing == nil {
			return nil // nothing to write or clear
		}
		// Clear stale policies with an empty array (Caddy treats [] as "no policies").
		return s.Caddy.PatchPath(path, []any{})
	}
	if existing == nil {
		return s.Caddy.PutPath(path, policies)
	}
	return s.Caddy.PatchPath(path, policies)
}

// writeAccessLogsSubtree updates srv0.logs.skip_hosts to suppress access-log
// entries for proxy hosts with DisableAccessLog=true.
func (s *Server) writeAccessLogsSubtree(skipHosts []any) error {
	path := "/config/apps/http/servers/srv0/logs"
	raw, err := s.Caddy.FetchPath(path)
	if err != nil {
		return err
	}
	logsMap, _ := raw.(map[string]any)
	existed := logsMap != nil
	if logsMap == nil {
		logsMap = map[string]any{}
	}
	existingSkip, _ := logsMap["skip_hosts"].([]any)
	if stringListsEqual(existingSkip, skipHosts) {
		return nil
	}
	if len(skipHosts) > 0 {
		logsMap["skip_hosts"] = skipHosts
	} else {
		delete(logsMap, "skip_hosts")
	}
	if !existed && len(logsMap) == 0 {
		return nil
	}
	return s.Caddy.PutPath(path, logsMap)
}

// certsEqual compares two cert-loader arrays for semantic equality via JSON normalization.
func certsEqual(a, b []any) bool {
	aj, _ := json.Marshal(a)
	bj, _ := json.Marshal(b)
	return string(aj) == string(bj)
}

// stringListsEqual treats two []any of strings as sets (order-insensitive).
func stringListsEqual(a, b []any) bool {
	if len(a) != len(b) {
		return false
	}
	set := map[string]struct{}{}
	for _, v := range a {
		if s, ok := v.(string); ok {
			set[s] = struct{}{}
		}
	}
	for _, v := range b {
		s, ok := v.(string)
		if !ok {
			return false
		}
		if _, present := set[s]; !present {
			return false
		}
	}
	return true
}

// --- Users ---

func (s *Server) requireAdmin(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		u := s.currentUser(r)
		if u == nil || u.Role != models.RoleAdmin {
			http.Error(w, "admin access required", http.StatusForbidden)
			return
		}
		next.ServeHTTP(w, r)
	})
}

// requireWrite blocks mutating requests for viewer-role users. Reads still
// pass through, so viewers see the UI but can't change anything.
// apiTokenScopeDenial returns why a bearer token with this scope may not make
// request r, or "" when it may. It runs in requireAuth, so it covers every
// route.
//
// Security (v2.57.1): scope used to be enforced only for read_only tokens here
// and for proxy_write tokens inside the requireWrite route group. Routes that
// live outside that group — creating API tokens, creating users, changing
// settings — were therefore reachable with a proxy_write token: a leaked
// CI token limited to proxy hosts could mint itself a full-scope token and an
// admin account.
func apiTokenScopeDenial(scope string, r *http.Request) string {
	// API tokens never manage API tokens: minting or revoking one needs a
	// signed-in browser session, so a leaked token cannot make itself permanent.
	if r.URL.Path == "/api-tokens" || strings.HasPrefix(r.URL.Path, "/api-tokens/") {
		return "API tokens cannot manage API tokens — sign in to the web UI"
	}
	mutating := r.Method != http.MethodGet && r.Method != http.MethodHead && r.Method != http.MethodOptions
	switch scope {
	case models.TokenScopeReadOnly:
		if mutating {
			return "token scope is read-only"
		}
	case models.TokenScopeProxyWrite:
		if mutating && !proxyWriteTokenCanWritePath(r.URL.Path) {
			return "token scope allows proxy-host writes only"
		}
	}
	return ""
}

func (s *Server) requireWrite(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		switch currentAPITokenScope(r) {
		case models.TokenScopeReadOnly:
			http.Error(w, "token scope is read-only", http.StatusForbidden)
			return
		case models.TokenScopeProxyWrite:
			if !proxyWriteTokenCanWritePath(r.URL.Path) {
				http.Error(w, "token scope allows proxy-host writes only", http.StatusForbidden)
				return
			}
		}
		u := s.currentUser(r)
		if u != nil && u.Role == models.RoleView {
			http.Error(w, "read-only account — ask an admin to make changes", http.StatusForbidden)
			return
		}
		next.ServeHTTP(w, r)
	})
}

func (s *Server) listUsers(w http.ResponseWriter, r *http.Request) {
	users, err := models.ListUsers(s.DB)
	if err != nil {
		http.Error(w, err.Error(), http.StatusInternalServerError)
		return
	}
	data := map[string]any{
		"User":    s.currentUser(r),
		"Users":   users,
		"Section": "users",
	}
	if r.URL.Query().Get("invited") == "1" {
		data["Invited"] = true
	}
	if e := r.URL.Query().Get("error"); e != "" {
		data["Error"] = e
	}
	s.render(w, r, "users.html", data)
}

func (s *Server) newUser(w http.ResponseWriter, r *http.Request) {
	data := captchaTemplateData(loadCaptchaConfig(s.DB))
	data["User"] = s.currentUser(r)
	data["Target"] = &models.User{Role: models.RoleView}
	data["Section"] = "users"
	s.render(w, r, "user_form.html", data)
}

func (s *Server) createUser(w http.ResponseWriter, r *http.Request) {
	_ = r.ParseForm()
	email := strings.TrimSpace(r.FormValue("email"))
	name := strings.TrimSpace(r.FormValue("name"))
	pw := r.FormValue("password")
	pw2 := r.FormValue("password_confirm")
	role := r.FormValue("role")
	target := &models.User{Email: email, Name: name, Role: role}

	// v2.5.0: captcha also gates user creation. This endpoint is admin-only
	// (wrapped in requireWrite), but /users/new forms are sometimes the
	// first thing an attacker hits after stealing an admin session cookie
	// — adding the challenge here raises the bar on scripted account
	// creation if credentials leak.
	captchaCfg := loadCaptchaConfig(s.DB)
	tplData := captchaTemplateData(captchaCfg)
	renderErr := func(msg string) {
		data := map[string]any{
			"User":    s.currentUser(r),
			"Target":  target,
			"Section": "users",
			"Error":   msg,
		}
		for k, v := range tplData {
			data[k] = v
		}
		s.render(w, r, "user_form.html", data)
	}
	if ok, err := verifyCaptcha(captchaCfg, r); err != nil || !ok {
		renderErr("Security check failed. Please try again.")
		return
	}
	if email == "" || pw == "" {
		renderErr("Email and password are required")
		return
	}
	if pw != pw2 {
		renderErr("Passwords do not match")
		return
	}
	if len(pw) < 8 {
		renderErr("Password must be at least 8 characters")
		return
	}
	hash, err := auth.HashPassword(pw)
	if err != nil {
		http.Error(w, err.Error(), http.StatusInternalServerError)
		return
	}
	if _, err := models.CreateUser(s.DB, email, hash, name, role); err != nil {
		renderErr(err.Error())
		return
	}
	_ = models.LogActivity(s.DB, s.currentServerID(r), s.currentUserEmail(r), "user_create", email, role, true)
	http.Redirect(w, r, "/users", http.StatusSeeOther)
}

func (s *Server) editUser(w http.ResponseWriter, r *http.Request) {
	id, _ := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
	u, err := models.GetUserByID(s.DB, id)
	if err != nil {
		http.Error(w, err.Error(), http.StatusNotFound)
		return
	}
	s.render(w, r, "user_form.html", map[string]any{
		"User":    s.currentUser(r),
		"Target":  u,
		"Section": "users",
	})
}

func (s *Server) updateUser(w http.ResponseWriter, r *http.Request) {
	id, _ := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
	u, err := models.GetUserByID(s.DB, id)
	if err != nil {
		http.Error(w, err.Error(), http.StatusNotFound)
		return
	}
	_ = r.ParseForm()
	name := strings.TrimSpace(r.FormValue("name"))
	role := r.FormValue("role")
	pw := r.FormValue("password")
	pw2 := r.FormValue("password_confirm")
	renderErr := func(msg string) {
		u.Name = name
		u.Role = role
		s.render(w, r, "user_form.html", map[string]any{
			"User":    s.currentUser(r),
			"Target":  u,
			"Section": "users",
			"Error":   msg,
		})
	}
	// Prevent demoting the last admin — a view-only world locks the UI out of user mgmt.
	if u.Role == models.RoleAdmin && role != models.RoleAdmin {
		n, _ := models.CountAdmins(s.DB)
		if n <= 1 {
			renderErr("Can't demote the last admin — promote another user first")
			return
		}
	}
	if err := models.UpdateUser(s.DB, id, name, role); err != nil {
		renderErr(err.Error())
		return
	}
	if pw != "" {
		if pw != pw2 {
			renderErr("Passwords do not match")
			return
		}
		if len(pw) < 8 {
			renderErr("Password must be at least 8 characters")
			return
		}
		hash, err := auth.HashPassword(pw)
		if err != nil {
			renderErr(err.Error())
			return
		}
		if err := models.UpdateUserPassword(s.DB, id, hash); err != nil {
			renderErr(err.Error())
			return
		}
	}
	_ = models.LogActivity(s.DB, s.currentServerID(r), s.currentUserEmail(r), "user_update", u.Email, role, true)
	http.Redirect(w, r, "/users", http.StatusSeeOther)
}

func (s *Server) deleteUser(w http.ResponseWriter, r *http.Request) {
	id, _ := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
	me := s.currentUser(r)
	if me != nil && me.ID == id {
		http.Error(w, "you can't delete your own account", http.StatusBadRequest)
		return
	}
	u, err := models.GetUserByID(s.DB, id)
	if err != nil {
		http.Error(w, err.Error(), http.StatusNotFound)
		return
	}
	if u.Role == models.RoleAdmin {
		n, _ := models.CountAdmins(s.DB)
		if n <= 1 {
			http.Error(w, "can't delete the last admin", http.StatusBadRequest)
			return
		}
	}
	if err := models.DeleteUser(s.DB, id); err != nil {
		http.Error(w, err.Error(), http.StatusInternalServerError)
		return
	}
	_ = models.LogActivity(s.DB, s.currentServerID(r), s.currentUserEmail(r), "user_delete", u.Email, "", true)
	http.Redirect(w, r, "/users", http.StatusSeeOther)
}

// --- v2.7.4: Groups ---
//
// Admin-only CRUD. A group is just a bag of user-role members; ListGroup-
// scoped List* queries OR members' IDs into the owner filter so teammates
// see each other's rows. No write permission: edit/delete stays per-row
// ownership-gated inside each Update*/Delete* handler.

func (s *Server) listGroups(w http.ResponseWriter, r *http.Request) {
	groups, err := models.ListGroups(s.DB)
	if err != nil {
		http.Error(w, err.Error(), http.StatusInternalServerError)
		return
	}
	s.render(w, r, "groups.html", map[string]any{
		"User":    s.currentUser(r),
		"Groups":  groups,
		"Section": "groups",
	})
}

func (s *Server) newGroup(w http.ResponseWriter, r *http.Request) {
	s.render(w, r, "group_form.html", map[string]any{
		"User":    s.currentUser(r),
		"Group":   &models.Group{},
		"Users":   s.adminUserList(r),
		"Members": map[int64]bool{},
		"Section": "groups",
	})
}

func (s *Server) createGroup(w http.ResponseWriter, r *http.Request) {
	_ = r.ParseForm()
	name := strings.TrimSpace(r.FormValue("name"))
	desc := strings.TrimSpace(r.FormValue("description"))
	renderErr := func(msg string) {
		members := map[int64]bool{}
		for _, v := range r.Form["member_ids"] {
			if id, err := strconv.ParseInt(v, 10, 64); err == nil {
				members[id] = true
			}
		}
		s.render(w, r, "group_form.html", map[string]any{
			"User":    s.currentUser(r),
			"Group":   &models.Group{Name: name, Description: desc},
			"Users":   s.adminUserList(r),
			"Members": members,
			"Section": "groups",
			"Error":   msg,
		})
	}
	if name == "" {
		renderErr("Name is required")
		return
	}
	id, err := models.CreateGroup(s.DB, name, desc)
	if err != nil {
		renderErr(err.Error())
		return
	}
	// Member rows (user-role only — the form only offers those).
	var memberIDs []int64
	for _, v := range r.Form["member_ids"] {
		if uid, err := strconv.ParseInt(v, 10, 64); err == nil {
			memberIDs = append(memberIDs, uid)
		}
	}
	if err := models.SetGroupMembers(s.DB, id, memberIDs); err != nil {
		renderErr(err.Error())
		return
	}
	_ = models.LogActivity(s.DB, s.currentServerID(r), s.currentUserEmail(r), "group_create", name, "", true)
	http.Redirect(w, r, "/groups", http.StatusSeeOther)
}

func (s *Server) editGroup(w http.ResponseWriter, r *http.Request) {
	id, _ := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
	g, err := models.GetGroup(s.DB, id)
	if err != nil || g == nil {
		http.Error(w, "not found", http.StatusNotFound)
		return
	}
	members, _ := models.ListGroupMembers(s.DB, id)
	memberSet := map[int64]bool{}
	for _, m := range members {
		memberSet[m.ID] = true
	}
	s.render(w, r, "group_form.html", map[string]any{
		"User":    s.currentUser(r),
		"Group":   g,
		"Users":   s.adminUserList(r),
		"Members": memberSet,
		"Section": "groups",
	})
}

func (s *Server) updateGroup(w http.ResponseWriter, r *http.Request) {
	id, _ := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
	g, err := models.GetGroup(s.DB, id)
	if err != nil || g == nil {
		http.Error(w, "not found", http.StatusNotFound)
		return
	}
	_ = r.ParseForm()
	name := strings.TrimSpace(r.FormValue("name"))
	desc := strings.TrimSpace(r.FormValue("description"))
	renderErr := func(msg string) {
		members := map[int64]bool{}
		for _, v := range r.Form["member_ids"] {
			if uid, err := strconv.ParseInt(v, 10, 64); err == nil {
				members[uid] = true
			}
		}
		g.Name = name
		g.Description = desc
		s.render(w, r, "group_form.html", map[string]any{
			"User":    s.currentUser(r),
			"Group":   g,
			"Users":   s.adminUserList(r),
			"Members": members,
			"Section": "groups",
			"Error":   msg,
		})
	}
	if name == "" {
		renderErr("Name is required")
		return
	}
	if err := models.UpdateGroup(s.DB, id, name, desc); err != nil {
		renderErr(err.Error())
		return
	}
	var memberIDs []int64
	for _, v := range r.Form["member_ids"] {
		if uid, err := strconv.ParseInt(v, 10, 64); err == nil {
			memberIDs = append(memberIDs, uid)
		}
	}
	if err := models.SetGroupMembers(s.DB, id, memberIDs); err != nil {
		renderErr(err.Error())
		return
	}
	_ = models.LogActivity(s.DB, s.currentServerID(r), s.currentUserEmail(r), "group_update", name, "", true)
	http.Redirect(w, r, "/groups", http.StatusSeeOther)
}

func (s *Server) deleteGroup(w http.ResponseWriter, r *http.Request) {
	id, _ := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
	g, err := models.GetGroup(s.DB, id)
	if err != nil || g == nil {
		http.Error(w, "not found", http.StatusNotFound)
		return
	}
	// ON DELETE CASCADE on user_groups cleans up membership rows for us.
	if err := models.DeleteGroup(s.DB, id); err != nil {
		http.Error(w, err.Error(), http.StatusInternalServerError)
		return
	}
	_ = models.LogActivity(s.DB, s.currentServerID(r), s.currentUserEmail(r), "group_delete", g.Name, "", true)
	http.Redirect(w, r, "/groups", http.StatusSeeOther)
}

// --- Feature F: Notifications (webhook + SMTP email) ---

const (
	settingNotifyWebhookURL    = "notify_webhook_url"
	settingNotifyWebhookSecret = "notify_webhook_secret" // v2.9.12: HMAC-SHA256 signing secret
	settingNotifyDaysBefore    = "notify_days_before"
	defaultNotifyDaysBefore    = 14

	// v2.12.51: ntfy.sh push channel. Free, no account needed for public
	// topics on ntfy.sh; self-hostable for private topics. Most popular
	// notification channel in the homelab community.
	settingNotifyNtfyURL   = "notify_ntfy_url"   // full URL e.g. https://ntfy.sh/cert-alerts
	settingNotifyNtfyToken = "notify_ntfy_token" // optional bearer token for protected/self-hosted topics

	// SMTP settings (stored in the key-value settings table).
	settingSMTPHost       = "smtp_host"
	settingSMTPPort       = "smtp_port"
	settingSMTPUsername   = "smtp_username"
	settingSMTPPassword   = "smtp_password"
	settingSMTPFrom       = "smtp_from"
	settingSMTPTo         = "smtp_to"
	settingSMTPSecurity   = "smtp_security"    // "none" | "starttls" | "tls"
	settingSMTPSkipVerify = "smtp_skip_verify" // "1" to skip TLS cert validation

	// v2.11.15: AI assistant — proxies user prompts to a local Ollama
	// instance. Default URL points at the docker service name "ollama"
	// since most users running CaddyUI on a homelab GPU box co-locate
	// Ollama in the same compose network.
	settingAIEnabled      = "ai_enabled"       // "1" / "0"
	settingAIOllamaURL    = "ai_ollama_url"    // base URL, e.g. http://ollama:11434
	settingAIOllamaModel  = "ai_ollama_model"  // e.g. llama3.2:latest
	settingAISystemPrompt = "ai_system_prompt" // v2.12.10: optional override of the built-in system prompt

	// settingAIRequestTimeoutSec (issue #109) is the per-request deadline for a
	// chat turn, in whole seconds. Empty/invalid falls back to
	// defaultAIRequestTimeoutSec. Slow local-inference rigs (large models, CPU
	// offload) legitimately need minutes, so the admin can raise it up to
	// aiRequestTimeoutMaxSec.
	settingAIRequestTimeoutSec = "ai_request_timeout_sec"

	// v2.12.36: multi-provider AI assistant. Provider selector picks one of
	// the four backends below; only the credentials for the active provider
	// are read on each chat turn.
	settingAIProvider          = "ai_provider"             // "ollama" | "ollama_cloud" | "anthropic" | "openai"; default "ollama"
	settingAIOllamaCloudAPIKey = "ai_ollama_cloud_api_key" // bearer token from ollama.com
	settingAIOllamaCloudModel  = "ai_ollama_cloud_model"   // e.g. gpt-oss:20b, qwen3-coder:480b-cloud
	settingAIAnthropicAPIKey   = "ai_anthropic_api_key"    // sk-ant-...
	settingAIAnthropicModel    = "ai_anthropic_model"      // e.g. claude-haiku-4-5-20251001
	settingAIOpenAIBaseURL     = "ai_openai_base_url"      // OpenAI-compatible endpoint root, defaults to https://api.openai.com/v1
	settingAIOpenAIAPIKey      = "ai_openai_api_key"       // bearer token (works with OpenAI, OpenRouter, Groq, Together, vLLM, LM Studio, etc.)
	settingAIOpenAIModel       = "ai_openai_model"         // e.g. gpt-4o-mini

	// v2.12.14: comma-separated list of response headers stripped from every
	// proxy-host's upstream response. Useful for blanket-removing things like
	// X-Frame-Options or X-Powered-By that an upstream insists on adding.
	// Concatenated with each proxy_host's own strip_response_headers in
	// syncCaddy before BuildProxyRoute fires.
	settingGlobalStripResponseHeaders = "global_strip_response_headers"

	// v2.14.4: when "1", restricts the Caddy HTTP server to h1 + h2 only
	// (removes h3/QUIC). Useful for clients that mishandle HTTP/3, e.g. older
	// Android Bitwarden builds.
	settingDisableHTTP3 = "disable_http3"
)

// sendEmail delivers a plain-text email via the SMTP settings stored in the DB.
// Returns an error if SMTP is not configured or delivery fails.
func sendEmail(db *sql.DB, subject, body string) error {
	host, _ := models.GetSetting(db, settingSMTPHost)
	if host == "" {
		return fmt.Errorf("SMTP not configured (no host)")
	}
	portStr, _ := models.GetSetting(db, settingSMTPPort)
	port := 587
	if p, err := strconv.Atoi(portStr); err == nil && p > 0 {
		port = p
	}
	username, _ := models.GetSetting(db, settingSMTPUsername)
	password, _ := models.GetSetting(db, settingSMTPPassword)
	from, _ := models.GetSetting(db, settingSMTPFrom)
	toStr, _ := models.GetSetting(db, settingSMTPTo)
	security, _ := models.GetSetting(db, settingSMTPSecurity)
	skipVerifyStr, _ := models.GetSetting(db, settingSMTPSkipVerify)
	skipVerify := skipVerifyStr == "1"

	if from == "" {
		from = "caddyui@localhost"
	}
	if toStr == "" {
		return fmt.Errorf("SMTP not configured (no recipient)")
	}
	var recipients []string
	for _, addr := range strings.Split(toStr, ",") {
		if a := strings.TrimSpace(addr); a != "" {
			recipients = append(recipients, a)
		}
	}
	if len(recipients) == 0 {
		return fmt.Errorf("SMTP: no valid recipients")
	}

	serverAddr := fmt.Sprintf("%s:%d", host, port)
	// v2.9.209: strip CR/LF from any value that lands in a header line.
	// Without this, a user-controlled Subject of `hi\r\nBcc: attacker@evil`
	// would smuggle an extra header into the message envelope. Body is left
	// alone — newlines in body are just content, not header boundaries.
	stripCRLF := func(s string) string {
		return strings.NewReplacer("\r", " ", "\n", " ").Replace(s)
	}
	from = stripCRLF(from)
	subject = stripCRLF(subject)
	safeRecipients := make([]string, len(recipients))
	for i, r := range recipients {
		safeRecipients[i] = stripCRLF(r)
	}
	msg := []byte(
		"From: CaddyUI <" + from + ">\r\n" +
			"To: " + strings.Join(safeRecipients, ", ") + "\r\n" +
			"Subject: " + subject + "\r\n" +
			"MIME-Version: 1.0\r\n" +
			"Content-Type: text/plain; charset=utf-8\r\n" +
			"\r\n" +
			body,
	)

	tlsCfg := &tls.Config{ServerName: host, InsecureSkipVerify: skipVerify} //nolint:gosec

	var authCfg smtp.Auth
	if username != "" {
		authCfg = smtp.PlainAuth("", username, password, host)
	}

	switch security {
	case "tls":
		// Implicit TLS (port 465): TLS handshake on connect.
		conn, err := tls.Dial("tcp", serverAddr, tlsCfg)
		if err != nil {
			return fmt.Errorf("SMTP TLS dial: %w", err)
		}
		c, err := smtp.NewClient(conn, host)
		if err != nil {
			return fmt.Errorf("SMTP client: %w", err)
		}
		defer c.Quit()
		if authCfg != nil {
			if err = c.Auth(authCfg); err != nil {
				return fmt.Errorf("SMTP auth: %w", err)
			}
		}
		if err = c.Mail(from); err != nil {
			return fmt.Errorf("SMTP MAIL FROM: %w", err)
		}
		for _, rcpt := range recipients {
			if err = c.Rcpt(rcpt); err != nil {
				return fmt.Errorf("SMTP RCPT TO %s: %w", rcpt, err)
			}
		}
		wc, err := c.Data()
		if err != nil {
			return fmt.Errorf("SMTP DATA: %w", err)
		}
		if _, err = wc.Write(msg); err != nil {
			return fmt.Errorf("SMTP write: %w", err)
		}
		return wc.Close()

	case "none":
		// Plain SMTP, no encryption.
		c, err := smtp.Dial(serverAddr)
		if err != nil {
			return fmt.Errorf("SMTP dial: %w", err)
		}
		defer c.Quit()
		if authCfg != nil {
			if err = c.Auth(authCfg); err != nil {
				return fmt.Errorf("SMTP auth: %w", err)
			}
		}
		if err = c.Mail(from); err != nil {
			return fmt.Errorf("SMTP MAIL FROM: %w", err)
		}
		for _, rcpt := range recipients {
			if err = c.Rcpt(rcpt); err != nil {
				return fmt.Errorf("SMTP RCPT TO %s: %w", rcpt, err)
			}
		}
		wc, err := c.Data()
		if err != nil {
			return fmt.Errorf("SMTP DATA: %w", err)
		}
		if _, err = wc.Write(msg); err != nil {
			return fmt.Errorf("SMTP write: %w", err)
		}
		return wc.Close()

	default:
		// STARTTLS (port 587): plain connect then upgrade.
		// We implement it manually so we can pass our tlsCfg (with optional skip verify).
		c, err := smtp.Dial(serverAddr)
		if err != nil {
			return fmt.Errorf("SMTP dial: %w", err)
		}
		defer c.Quit()
		if ok, _ := c.Extension("STARTTLS"); ok {
			if err = c.StartTLS(tlsCfg); err != nil {
				return fmt.Errorf("SMTP STARTTLS: %w", err)
			}
		}
		if authCfg != nil {
			if err = c.Auth(authCfg); err != nil {
				return fmt.Errorf("SMTP auth: %w", err)
			}
		}
		if err = c.Mail(from); err != nil {
			return fmt.Errorf("SMTP MAIL FROM: %w", err)
		}
		for _, rcpt := range recipients {
			if err = c.Rcpt(rcpt); err != nil {
				return fmt.Errorf("SMTP RCPT TO %s: %w", rcpt, err)
			}
		}
		wc, err := c.Data()
		if err != nil {
			return fmt.Errorf("SMTP DATA: %w", err)
		}
		if _, err = wc.Write(msg); err != nil {
			return fmt.Errorf("SMTP write: %w", err)
		}
		return wc.Close()
	}
}

// sendEmailTo is like sendEmail but sends to a specific address rather than
// the configured notification recipients.
func sendEmailTo(db *sql.DB, to, subject, body string) error {
	host, _ := models.GetSetting(db, settingSMTPHost)
	if host == "" {
		return fmt.Errorf("SMTP not configured (no host)")
	}
	portStr, _ := models.GetSetting(db, settingSMTPPort)
	port := 587
	if p, err := strconv.Atoi(portStr); err == nil && p > 0 {
		port = p
	}
	username, _ := models.GetSetting(db, settingSMTPUsername)
	password, _ := models.GetSetting(db, settingSMTPPassword)
	from, _ := models.GetSetting(db, settingSMTPFrom)
	security, _ := models.GetSetting(db, settingSMTPSecurity)
	skipVerifyStr, _ := models.GetSetting(db, settingSMTPSkipVerify)
	skipVerify := skipVerifyStr == "1"

	if from == "" {
		from = "caddyui@localhost"
	}

	// v2.9.225: same CRLF strip applied to sendEmail (v2.9.209) — the second
	// SMTP code path in sendEmailTo also interpolated user-controlled values
	// straight into header lines, allowing header smuggling via \r\n in
	// `to`/`from`/`subject`. CodeQL flagged it as a separate "Email content
	// injection" finding from the v2.9.209 fix because the sites are distinct.
	stripCRLFTo := func(s string) string {
		return strings.NewReplacer("\r", " ", "\n", " ").Replace(s)
	}
	from = stripCRLFTo(from)
	subject = stripCRLFTo(subject)
	to = stripCRLFTo(to)
	serverAddr := fmt.Sprintf("%s:%d", host, port)
	msg := []byte(
		"From: CaddyUI <" + from + ">\r\n" +
			"To: " + to + "\r\n" +
			"Subject: " + subject + "\r\n" +
			"MIME-Version: 1.0\r\n" +
			"Content-Type: text/plain; charset=utf-8\r\n" +
			"\r\n" +
			body,
	)

	tlsCfg := &tls.Config{ServerName: host, InsecureSkipVerify: skipVerify} //nolint:gosec

	var authCfg smtp.Auth
	if username != "" {
		authCfg = smtp.PlainAuth("", username, password, host)
	}

	switch security {
	case "tls":
		conn, err := tls.Dial("tcp", serverAddr, tlsCfg)
		if err != nil {
			return fmt.Errorf("SMTP TLS dial: %w", err)
		}
		c, err := smtp.NewClient(conn, host)
		if err != nil {
			return fmt.Errorf("SMTP client: %w", err)
		}
		defer c.Quit()
		if authCfg != nil {
			if err = c.Auth(authCfg); err != nil {
				return fmt.Errorf("SMTP auth: %w", err)
			}
		}
		if err = c.Mail(from); err != nil {
			return fmt.Errorf("SMTP MAIL FROM: %w", err)
		}
		if err = c.Rcpt(to); err != nil {
			return fmt.Errorf("SMTP RCPT TO: %w", err)
		}
		wc, err := c.Data()
		if err != nil {
			return fmt.Errorf("SMTP DATA: %w", err)
		}
		_, _ = wc.Write(msg)
		_ = wc.Close()
	default: // "none" or "starttls"
		if err := smtp.SendMail(serverAddr, authCfg, from, []string{to}, msg); err != nil {
			return fmt.Errorf("SMTP SendMail: %w", err)
		}
	}
	return nil
}

// --- Password reset ---

// getForgotPassword renders the "forgot password" form.
func (s *Server) getForgotPassword(w http.ResponseWriter, r *http.Request) {
	s.render(w, r, "forgot_password.html", map[string]any{
		"Section": "",
		"Sent":    r.URL.Query().Get("sent") == "1",
		"Error":   r.URL.Query().Get("error"),
	})
}

// postForgotPassword processes the forgot-password form submission.
// Always shows the "check your email" message even if the address doesn't
// exist (prevents email enumeration).
// publicBaseURL is the origin (scheme://host[:port], no trailing slash) used in
// links that CaddyUI emails out: password reset and invitations.
//
// Order: CADDYUI_PUBLIC_URL, then the origin of the configured OIDC redirect
// URL, then — only as a last resort — this request's own scheme and Host. The
// last resort is what used to be the ONLY source, which let an unauthenticated
// POST /forgot-password with a forged Host header get a working reset link
// pointing at the attacker mailed to the victim. Set CADDYUI_PUBLIC_URL (for
// example https://caddyui.example.com) to close that completely.
func (s *Server) publicBaseURL(r *http.Request) string {
	if base := cleanBaseURL(os.Getenv("CADDYUI_PUBLIC_URL")); base != "" {
		return base
	}
	if v, _ := models.GetSetting(s.DB, settingOIDCRedirectURL); v != "" {
		if base := cleanBaseURL(v); base != "" {
			return base
		}
	}
	scheme := "http"
	if r.TLS != nil || (s.peerIsTrustedProxy(net.ParseIP(peerHost(r))) &&
		strings.EqualFold(strings.TrimSpace(r.Header.Get("X-Forwarded-Proto")), "https")) {
		scheme = "https"
	}
	return scheme + "://" + r.Host
}

// cleanBaseURL reduces a URL to its http(s) origin, or "" when it is not one.
func cleanBaseURL(raw string) string {
	u, err := url.Parse(strings.TrimSpace(raw))
	if err != nil || u.Host == "" || u.User != nil || (u.Scheme != "http" && u.Scheme != "https") {
		return ""
	}
	return u.Scheme + "://" + u.Host
}

func (s *Server) postForgotPassword(w http.ResponseWriter, r *http.Request) {
	email := strings.TrimSpace(strings.ToLower(r.FormValue("email")))
	if email == "" {
		http.Redirect(w, r, "/forgot-password?error=Enter+your+email+address", http.StatusSeeOther)
		return
	}
	// Look up user — don't reveal if email exists.
	u, _ := models.GetUserByEmail(s.DB, email)
	if u != nil {
		// Generate token.
		raw := make([]byte, 32)
		_, _ = rand.Read(raw)
		token := hex.EncodeToString(raw)
		hash := fmt.Sprintf("%x", sha256.Sum256([]byte(token)))
		expires := time.Now().Add(time.Hour).Unix()
		// Store token hash in settings: key=pw_reset_<hash>, value=<userID>:<expires>
		_ = models.SetSetting(s.DB, "pw_reset_"+hash, fmt.Sprintf("%d:%d", u.ID, expires))
		// Security (v2.57.1): the link's origin is a configured value, never the
		// request's Host header — this endpoint is unauthenticated, so a forged
		// Host would otherwise be mailed to the victim as a working reset link.
		resetURL := fmt.Sprintf("%s/reset-password?token=%s", s.publicBaseURL(r), token)
		body := fmt.Sprintf(
			"Hello %s,\n\nA password reset was requested for your CaddyUI account.\n\n"+
				"Click the link below to set a new password (expires in 1 hour):\n\n"+
				"%s\n\n"+
				"If you did not request this, you can safely ignore this email.\n\n"+
				"— CaddyUI", u.Name, resetURL)
		if err := sendEmailTo(s.DB, email, "CaddyUI password reset", body); err != nil {
			log.Printf("forgot-password: sendEmail to %s: %v", sanitizeForLog(email), err)
		}
	}
	http.Redirect(w, r, "/forgot-password?sent=1", http.StatusSeeOther)
}

// getResetPassword renders the new-password form for a valid reset token.
func (s *Server) getResetPassword(w http.ResponseWriter, r *http.Request) {
	token := strings.TrimSpace(r.URL.Query().Get("token"))
	if token == "" {
		http.Redirect(w, r, "/forgot-password?error=Invalid+reset+link", http.StatusSeeOther)
		return
	}
	hash := fmt.Sprintf("%x", sha256.Sum256([]byte(token)))
	val, _ := models.GetSetting(s.DB, "pw_reset_"+hash)
	if val == "" || !validResetToken(val) {
		s.render(w, r, "reset_password.html", map[string]any{"Section": "", "Invalid": true})
		return
	}
	s.render(w, r, "reset_password.html", map[string]any{
		"Section": "",
		"Token":   token,
		"Error":   r.URL.Query().Get("error"),
	})
}

// postResetPassword validates the token and sets the new password.
func (s *Server) postResetPassword(w http.ResponseWriter, r *http.Request) {
	token := strings.TrimSpace(r.FormValue("token"))
	newPwd := r.FormValue("password")
	confirmPwd := r.FormValue("confirm_password")

	if token == "" {
		http.Redirect(w, r, "/forgot-password?error=Invalid+token", http.StatusSeeOther)
		return
	}
	if len(newPwd) < 8 {
		http.Redirect(w, r, "/reset-password?token="+url.QueryEscape(token)+"&error=Password+must+be+at+least+8+characters", http.StatusSeeOther)
		return
	}
	if newPwd != confirmPwd {
		http.Redirect(w, r, "/reset-password?token="+url.QueryEscape(token)+"&error=Passwords+do+not+match", http.StatusSeeOther)
		return
	}

	hash := fmt.Sprintf("%x", sha256.Sum256([]byte(token)))
	val, _ := models.GetSetting(s.DB, "pw_reset_"+hash)
	if val == "" || !validResetToken(val) {
		s.render(w, r, "reset_password.html", map[string]any{"Section": "", "Invalid": true})
		return
	}

	// Parse userID from stored value.
	parts := strings.SplitN(val, ":", 2)
	userID, err := strconv.ParseInt(parts[0], 10, 64)
	if err != nil {
		s.render(w, r, "reset_password.html", map[string]any{"Section": "", "Invalid": true})
		return
	}

	// Hash new password.
	pwHash, err := auth.HashPassword(newPwd)
	if err != nil {
		http.Error(w, "internal error", http.StatusInternalServerError)
		return
	}
	if err := models.UpdateUserPassword(s.DB, userID, pwHash); err != nil {
		http.Error(w, "failed to update password", http.StatusInternalServerError)
		return
	}
	// Consume the token.
	_ = models.SetSetting(s.DB, "pw_reset_"+hash, "")
	http.Redirect(w, r, "/login?reset=1", http.StatusSeeOther)
}

// postInviteUser creates a stub user account and sends an invite email.
func (s *Server) postInviteUser(w http.ResponseWriter, r *http.Request) {
	email := strings.TrimSpace(strings.ToLower(r.FormValue("invite_email")))
	role := r.FormValue("invite_role")
	if email == "" {
		http.Redirect(w, r, "/users?error=Email+required", http.StatusSeeOther)
		return
	}
	if role != models.RoleAdmin && role != models.RoleUser && role != models.RoleView {
		role = models.RoleUser
	}
	// Check not already registered.
	if u, _ := models.GetUserByEmail(s.DB, email); u != nil {
		http.Redirect(w, r, "/users?error=User+already+exists", http.StatusSeeOther)
		return
	}
	// Create disabled stub user with empty password hash.
	userID, err := models.CreateUser(s.DB, email, "", email, role)
	if err != nil {
		http.Error(w, "create user: "+err.Error(), http.StatusInternalServerError)
		return
	}
	// Generate invite token.
	raw := make([]byte, 32)
	_, _ = rand.Read(raw)
	token := hex.EncodeToString(raw)
	hash := fmt.Sprintf("%x", sha256.Sum256([]byte(token)))
	expires := time.Now().Add(7 * 24 * time.Hour).Unix()
	_ = models.SetSetting(s.DB, "invite_"+hash, fmt.Sprintf("%d:%d", userID, expires))

	acceptURL := fmt.Sprintf("%s/accept-invite?token=%s", s.publicBaseURL(r), token) // v2.57.1: see postForgotPassword
	body := fmt.Sprintf(
		"You've been invited to CaddyUI.\n\n"+
			"Click the link below to set your password and activate your account (link expires in 7 days):\n\n"+
			"%s\n\n"+
			"— CaddyUI", acceptURL)
	if err := sendEmailTo(s.DB, email, "You're invited to CaddyUI", body); err != nil {
		log.Printf("invite: sendEmail to %s: %v", sanitizeForLog(email), err)
	}
	http.Redirect(w, r, "/users?invited=1", http.StatusSeeOther)
}

// getAcceptInvite renders the accept-invite form.
func (s *Server) getAcceptInvite(w http.ResponseWriter, r *http.Request) {
	token := strings.TrimSpace(r.URL.Query().Get("token"))
	if token == "" {
		http.Redirect(w, r, "/login", http.StatusSeeOther)
		return
	}
	hash := fmt.Sprintf("%x", sha256.Sum256([]byte(token)))
	val, _ := models.GetSetting(s.DB, "invite_"+hash)
	if val == "" || !validResetToken(val) {
		s.render(w, r, "accept_invite.html", map[string]any{"Section": "", "Invalid": true})
		return
	}
	s.render(w, r, "accept_invite.html", map[string]any{
		"Section": "",
		"Token":   token,
		"Error":   r.URL.Query().Get("error"),
	})
}

// postAcceptInvite validates the invite token and activates the account.
func (s *Server) postAcceptInvite(w http.ResponseWriter, r *http.Request) {
	token := strings.TrimSpace(r.FormValue("token"))
	newPwd := r.FormValue("password")
	confirmPwd := r.FormValue("confirm_password")
	if token == "" {
		http.Redirect(w, r, "/login", http.StatusSeeOther)
		return
	}
	if len(newPwd) < 8 {
		http.Redirect(w, r, "/accept-invite?token="+url.QueryEscape(token)+"&error=Password+must+be+at+least+8+characters", http.StatusSeeOther)
		return
	}
	if newPwd != confirmPwd {
		http.Redirect(w, r, "/accept-invite?token="+url.QueryEscape(token)+"&error=Passwords+do+not+match", http.StatusSeeOther)
		return
	}
	hash := fmt.Sprintf("%x", sha256.Sum256([]byte(token)))
	val, _ := models.GetSetting(s.DB, "invite_"+hash)
	if val == "" || !validResetToken(val) {
		s.render(w, r, "accept_invite.html", map[string]any{"Section": "", "Invalid": true})
		return
	}
	parts := strings.SplitN(val, ":", 2)
	userID, err := strconv.ParseInt(parts[0], 10, 64)
	if err != nil {
		http.Error(w, "invalid token", http.StatusBadRequest)
		return
	}
	pwHash, err := auth.HashPassword(newPwd)
	if err != nil {
		http.Error(w, "internal error", http.StatusInternalServerError)
		return
	}
	if err := models.UpdateUserPassword(s.DB, userID, pwHash); err != nil {
		http.Error(w, "update password: "+err.Error(), http.StatusInternalServerError)
		return
	}
	_ = models.SetSetting(s.DB, "invite_"+hash, "")
	http.Redirect(w, r, "/login?invited=1", http.StatusSeeOther)
}

// exportProxyHost returns a proxy host's configuration as a JSON file download.
func (s *Server) exportProxyHost(w http.ResponseWriter, r *http.Request) {
	id, err := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
	if err != nil {
		http.NotFound(w, r)
		return
	}
	ph, err := models.GetProxyHost(s.DB, id)
	if err != nil || ph == nil {
		http.NotFound(w, r)
		return
	}
	// Security (v2.57.1): the export carries the host's upstream basic-auth,
	// API key and cookie secrets, so it needs the same ownership check as every
	// other single-host handler. It had none — any signed-in account could
	// export any tenant's host by ID.
	if !s.canManageOwned(s.currentUser(r), ph.OwnerID) {
		http.Error(w, "forbidden", http.StatusForbidden)
		return
	}
	// Strip runtime fields before export.
	ph.ID = 0
	ph.OwnerID = sql.NullInt64{}
	ph.OwnerEmail = ""
	ph.DNSRecordID = ""
	ph.CreatedAt = time.Time{}
	ph.UpdatedAt = time.Time{}

	data, err := json.MarshalIndent(ph, "", "  ")
	if err != nil {
		http.Error(w, err.Error(), http.StatusInternalServerError)
		return
	}
	fname := strings.ReplaceAll(strings.SplitN(ph.Domains, ",", 2)[0], "*", "_")
	w.Header().Set("Content-Type", "application/json")
	w.Header().Set("Content-Disposition", fmt.Sprintf(`attachment; filename="%s.json"`, strings.TrimSpace(fname)))
	_, _ = w.Write(data)
}

// exportProxyHostCaddyfile — v2.12.50: download a single proxy host as a
// Caddyfile snippet (just the one site block, no banner). Useful for
// hand-off to other Caddy deployments or pasting into a colleague's
// Caddyfile without the rest of the server's config tagging along.
//
// Same RBAC visibility as the JSON variant — anyone who can view the
// host (admin, owner, or group peer) can export it.
func (s *Server) exportProxyHostCaddyfile(w http.ResponseWriter, r *http.Request) {
	id, err := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
	if err != nil {
		http.NotFound(w, r)
		return
	}
	ph, err := models.GetProxyHost(s.DB, id)
	if err != nil || ph == nil {
		http.NotFound(w, r)
		return
	}
	if !s.canManageOwned(s.currentUser(r), ph.OwnerID) { // v2.57.1 — see exportProxyHost
		http.Error(w, "forbidden", http.StatusForbidden)
		return
	}
	body := caddy.RenderProxyHostCaddyfileWithCertificate(*ph, s.certificateForCaddyfile(ph.CertificateID))
	fname := strings.ReplaceAll(strings.SplitN(ph.Domains, ",", 2)[0], "*", "_")
	fname = strings.TrimSpace(fname)
	if fname == "" {
		fname = fmt.Sprintf("proxy-host-%d", id)
	}
	w.Header().Set("Content-Type", "text/caddyfile; charset=utf-8")
	w.Header().Set("Content-Disposition", fmt.Sprintf(`attachment; filename="%s.caddyfile"`, fname))
	_, _ = w.Write([]byte(body))
}

// exportAllProxyHosts downloads all proxy hosts for the current server as a JSON array.
// Admin exports the full list; non-admin exports only their own hosts.
func (s *Server) exportAllProxyHosts(w http.ResponseWriter, r *http.Request) {
	cu := s.currentUser(r)
	if cu == nil {
		http.Error(w, "unauthorized", http.StatusUnauthorized)
		return
	}
	isAdmin := cu.Role == models.RoleAdmin
	var viewerID int64
	if !isAdmin {
		viewerID = cu.ID
	}
	sid := s.currentServerID(r)
	hosts, err := models.ListProxyHosts(s.DB, sid, viewerID, isAdmin, s.groupPeerIDs(r))
	if err != nil {
		http.Error(w, err.Error(), http.StatusInternalServerError)
		return
	}
	ts := time.Now().Format("20060102-150405")
	w.Header().Set("Content-Type", "application/json")
	w.Header().Set("Content-Disposition", fmt.Sprintf(`attachment; filename="proxy-hosts-%s.json"`, ts))
	enc := json.NewEncoder(w)
	enc.SetIndent("", "  ")
	_ = enc.Encode(hosts)
}

// exportServerCaddyfile — v2.12.49: download every enabled proxy host,
// redirection, and raw route for the current server as a single Caddyfile
// snapshot. Inverse of the existing /caddyfile-import paste flow. Admin
// gets the full server config; non-admin gets only their own resources
// (same scoping the JSON exports use).
func (s *Server) exportServerCaddyfile(w http.ResponseWriter, r *http.Request) {
	cu := s.currentUser(r)
	if cu == nil {
		http.Error(w, "unauthorized", http.StatusUnauthorized)
		return
	}
	isAdmin := cu.Role == models.RoleAdmin
	var viewerID int64
	if !isAdmin {
		viewerID = cu.ID
	}
	sid := s.currentServerID(r)
	peerIDs := s.groupPeerIDs(r)

	hosts, err := models.ListProxyHosts(s.DB, sid, viewerID, isAdmin, peerIDs)
	if err != nil {
		http.Error(w, "list proxy hosts: "+err.Error(), http.StatusInternalServerError)
		return
	}
	redirects, err := models.ListRedirectionHosts(s.DB, sid, viewerID, isAdmin, peerIDs)
	if err != nil {
		http.Error(w, "list redirections: "+err.Error(), http.StatusInternalServerError)
		return
	}
	raws, err := models.ListRawRoutes(s.DB, sid, viewerID, isAdmin, peerIDs)
	if err != nil {
		http.Error(w, "list raw routes: "+err.Error(), http.StatusInternalServerError)
		return
	}

	serverName := ""
	if srv, _ := models.GetCaddyServer(s.DB, sid); srv != nil {
		serverName = srv.Name
	}

	certs, _ := models.ListCertificates(s.DB, sid)
	body := caddy.RenderServerCaddyfile(serverName, hosts, redirects, raws, certs)
	ts := time.Now().Format("20060102-150405")
	fname := "Caddyfile"
	if serverName != "" {
		fname = fmt.Sprintf("Caddyfile-%s-%s", strings.ReplaceAll(serverName, " ", "_"), ts)
	} else {
		fname = fmt.Sprintf("Caddyfile-%s", ts)
	}
	w.Header().Set("Content-Type", "text/caddyfile; charset=utf-8")
	w.Header().Set("Content-Disposition", fmt.Sprintf(`attachment; filename=%q`, fname))
	_, _ = w.Write([]byte(body))
}

// importProxyHost creates a new proxy host from an uploaded JSON file.
func (s *Server) importProxyHost(w http.ResponseWriter, r *http.Request) {
	r.ParseMultipartForm(1 << 20) // 1 MiB
	f, _, err := r.FormFile("config_file")
	if err != nil {
		http.Error(w, "no file: "+err.Error(), http.StatusBadRequest)
		return
	}
	defer f.Close()
	data, err := io.ReadAll(io.LimitReader(f, 1<<20))
	if err != nil {
		http.Error(w, "read: "+err.Error(), http.StatusBadRequest)
		return
	}
	var ph models.ProxyHost
	if err := json.Unmarshal(data, &ph); err != nil {
		http.Error(w, "invalid JSON: "+err.Error(), http.StatusBadRequest)
		return
	}
	// Force safe defaults.
	ph.ID = 0
	ph.Enabled = false
	// v2.57.1: the file is attacker-controlled. Runtime/DNS state belongs to
	// the rows CaddyUI creates itself — an uploaded DNS record ID made a later
	// delete of this host delete THAT record at the provider with the admin's
	// credentials — and a certificate ID must not point at another tenant's.
	ph.DNSProvider, ph.DNSProfileID, ph.DNSZoneID, ph.DNSZoneName, ph.DNSRecordID = "", "", "", "", ""
	ph.DNSSkipRecord = true
	ph.CFDNSRecordID, ph.CFZoneID, ph.PBDNSRecordID, ph.PBDomain = "", "", "", ""
	ph.CertificateID = 0
	ph.OwnerID, ph.OwnerEmail = sql.NullInt64{}, ""
	cu := s.currentUser(r)
	var ownerID int64
	if cu != nil {
		ownerID = cu.ID
	}
	// GHSA-r4wm-rgc5-q834 (3rd finding) follow-up: this handler builds a
	// ProxyHost straight from attacker-controlled uploaded JSON, including
	// ForwardHost/ForwardPort/ExtraUpstreams/UpstreamHostOverride, so it
	// needs the same non-admin upstream guard the REST and form create paths
	// already enforce.
	if msg := s.validateProxyUpstreamsForUser(cu, &ph); msg != "" {
		http.Error(w, msg, http.StatusForbidden)
		return
	}
	if conflict, err := models.DomainsConflict(s.DB, s.currentServerID(r), ph.DomainList(), 0, 0); err != nil {
		http.Error(w, "could not validate domains: "+err.Error(), http.StatusInternalServerError)
		return
	} else if conflict != "" {
		http.Error(w, fmt.Sprintf("domain %q is already in use by another proxy or redirect on this server", conflict), http.StatusConflict)
		return
	}
	newID, err := models.CreateProxyHost(s.DB, s.currentServerID(r), ownerID, &ph)
	if err != nil {
		http.Error(w, "create: "+err.Error(), http.StatusInternalServerError)
		return
	}
	http.Redirect(w, r, fmt.Sprintf("/proxy-hosts/%d/edit", newID), http.StatusSeeOther)
}

// validResetToken checks the token value (format: "userID:expiresUnix") is still valid.
func validResetToken(val string) bool {
	parts := strings.SplitN(val, ":", 2)
	if len(parts) != 2 {
		return false
	}
	exp, err := strconv.ParseInt(parts[1], 10, 64)
	if err != nil {
		return false
	}
	return time.Now().Unix() < exp
}

// --- API Tokens ---

func (s *Server) listAPITokens(w http.ResponseWriter, r *http.Request) {
	cu := s.currentUser(r)
	isAdmin := cu != nil && cu.Role == models.RoleAdmin
	tokens, err := models.ListAPITokens(s.DB, cu.ID, isAdmin)
	if err != nil {
		http.Error(w, err.Error(), http.StatusInternalServerError)
		return
	}
	createdToken := r.URL.Query().Get("created")
	s.render(w, r, "api_tokens.html", map[string]any{
		"User":         cu,
		"Tokens":       tokens,
		"IsAdmin":      isAdmin,
		"Section":      "api_tokens",
		"CreatedToken": createdToken,
	})
}

func (s *Server) createAPIToken(w http.ResponseWriter, r *http.Request) {
	cu := s.currentUser(r)
	if cu == nil {
		http.Error(w, "unauthorized", http.StatusUnauthorized)
		return
	}
	_ = r.ParseForm()
	name := strings.TrimSpace(r.FormValue("name"))
	if name == "" {
		name = "My token"
	}
	// Generate 32 random bytes → base64url → prefix "cadu_"
	rawBytes := make([]byte, 32)
	if _, err := rand.Read(rawBytes); err != nil {
		http.Error(w, "could not generate token", http.StatusInternalServerError)
		return
	}
	rawToken := "cadu_" + base64.RawURLEncoding.EncodeToString(rawBytes)
	h := sha256.Sum256([]byte(rawToken))
	hash := fmt.Sprintf("%x", h)
	// Optional expiry
	var expiresAt *time.Time
	if exp := strings.TrimSpace(r.FormValue("expires_at")); exp != "" {
		t, err := time.ParseInLocation("2006-01-02", exp, time.UTC)
		if err == nil {
			expiresAt = &t
		}
	}
	scopes := strings.TrimSpace(r.FormValue("scopes"))
	switch scopes {
	case models.TokenScopeReadOnly, models.TokenScopeProxyWrite:
		// valid
	default:
		scopes = models.TokenScopeFull
	}
	_, err := models.CreateAPIToken(s.DB, cu.ID, name, hash, scopes, expiresAt)
	if err != nil {
		http.Error(w, err.Error(), http.StatusInternalServerError)
		return
	}
	_ = models.LogActivity(s.DB, s.currentServerID(r), cu.Email, "api_token_create", "token", name, true)
	// Show the token once via a query param on redirect to the list page
	// (only used once, HTTPS only).
	http.Redirect(w, r, "/api-tokens?created="+url.QueryEscape(rawToken), http.StatusSeeOther)
}

func (s *Server) revokeAPIToken(w http.ResponseWriter, r *http.Request) {
	cu := s.currentUser(r)
	if cu == nil {
		http.Error(w, "unauthorized", http.StatusUnauthorized)
		return
	}
	id, _ := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
	// Admin can revoke any token; user can only revoke their own.
	ownerID := cu.ID
	if cu.Role == models.RoleAdmin {
		ownerID = 0 // skip ownership check
	}
	if err := models.DeleteAPIToken(s.DB, id, ownerID); err != nil {
		http.Error(w, err.Error(), http.StatusInternalServerError)
		return
	}
	_ = models.LogActivity(s.DB, s.currentServerID(r), cu.Email, "api_token_revoke", fmt.Sprintf("token:%d", id), "", true)
	http.Redirect(w, r, "/api-tokens", http.StatusSeeOther)
}

// getLiveTraffic renders the live traffic feed page.
// liveTrafficEvents is models.RecentAccessEvents scoped to what the user may
// see: an admin sees everything; anyone else sees only the events of the hosts
// they can see in the host list — the same rule /analytics applies. Live
// traffic and its event stream used to show every host's requests (path, client
// IP, status) to every role (v2.57.1).
func (s *Server) liveTrafficEvents(u *models.User, since int64, limit int, serverID int64) ([]models.AccessEvent, error) {
	if isAdminUser(u) {
		return models.RecentAccessEvents(s.DB, since, limit, serverID)
	}
	allowed, err := s.scopedHostsForAnalytics(u, serverID)
	if err != nil {
		return nil, err
	}
	if len(allowed) == 0 {
		return nil, nil
	}
	// Filtering happens after the query, so read a wider window than the
	// caller's limit and cut back down.
	events, err := models.RecentAccessEvents(s.DB, since, limit*20, serverID)
	if err != nil {
		return nil, err
	}
	out := events[:0:0]
	for _, e := range events {
		if eventHostAllowed(e.Host, allowed) {
			out = append(out, e)
			if len(out) == limit {
				break
			}
		}
	}
	return out, nil
}

// eventHostAllowed reports whether host is one of the allowed hosts; a leading
// "*." entry matches any host under that suffix, as hostMatchClause does.
func eventHostAllowed(host string, allowed []string) bool {
	host = strings.ToLower(strings.TrimSpace(host))
	for _, a := range allowed {
		a = strings.ToLower(strings.TrimSpace(a))
		if a == "" {
			continue
		}
		if a == host {
			return true
		}
		if len(a) > 2 && strings.HasPrefix(a, "*.") && strings.HasSuffix(host, a[1:]) {
			return true
		}
	}
	return false
}

func (s *Server) getLiveTraffic(w http.ResponseWriter, r *http.Request) {
	u := s.currentUser(r)
	serverID := s.currentServerID(r)
	if r.URL.Query().Has("server") {
		raw := strings.TrimSpace(r.URL.Query().Get("server"))
		if raw == "" || raw == "0" || raw == "all" {
			serverID = 0
		} else if parsed, err := strconv.ParseInt(raw, 10, 64); err == nil && parsed > 0 {
			serverID = parsed
		}
	}
	// Seed with last 50 events for initial load.
	events, err := s.liveTrafficEvents(u, 0, 50, serverID)
	if err != nil {
		log.Printf("live-traffic: query: %v", err)
	}
	s.render(w, r, "live_traffic.html", map[string]any{
		"User": u, "Events": events,
		"AllServers":       func() []models.CaddyServer { servers, _ := models.ListCaddyServers(s.DB); return servers }(),
		"SelectedServerID": serverID, "Section": "live_traffic",
	})
}

// liveTrafficStream is an SSE endpoint that pushes new access events as they
// arrive. The client sends a ?since=<id> query param (the highest ID it has
// seen); the server polls every 2s and emits any rows with id > since as a
// JSON array in the SSE "data" field. The client advances its cursor.
func (s *Server) liveTrafficStream(w http.ResponseWriter, r *http.Request) {
	w.Header().Set("Content-Type", "text/event-stream")
	w.Header().Set("Cache-Control", "no-cache")
	w.Header().Set("X-Accel-Buffering", "no") // disable nginx buffering
	w.Header().Set("Connection", "keep-alive")
	flusher, ok := w.(http.Flusher)
	if !ok {
		http.Error(w, "SSE not supported", http.StatusInternalServerError)
		return
	}

	var cursor int64
	if raw := r.URL.Query().Get("since"); raw != "" {
		if n, err := strconv.ParseInt(raw, 10, 64); err == nil {
			cursor = n
		}
	}
	var serverID int64
	if raw := strings.TrimSpace(r.URL.Query().Get("server")); raw != "" && raw != "0" && raw != "all" {
		serverID, _ = strconv.ParseInt(raw, 10, 64)
	}

	ticker := time.NewTicker(2 * time.Second)
	defer ticker.Stop()
	ctx := r.Context()
	for {
		select {
		case <-ctx.Done():
			return
		case <-ticker.C:
			events, err := s.liveTrafficEvents(s.currentUser(r), cursor, 100, serverID)
			if err != nil {
				log.Printf("live-traffic SSE: %v", err)
				continue
			}
			if len(events) == 0 {
				// heartbeat
				fmt.Fprintf(w, ": ping\n\n")
				flusher.Flush()
				continue
			}
			// Advance cursor to highest ID seen.
			for _, e := range events {
				if e.ID > cursor {
					cursor = e.ID
				}
			}
			// Events come newest-first; reverse so the client appends in order.
			for i, j := 0, len(events)-1; i < j; i, j = i+1, j-1 {
				events[i], events[j] = events[j], events[i]
			}
			type wireEvent struct {
				ID         int64  `json:"id"`
				TS         string `json:"ts"`
				ServerID   int64  `json:"server_id"`
				ServerName string `json:"server_name"`
				Host       string `json:"host"`
				Path       string `json:"path"`
				Method     string `json:"method"`
				Status     int    `json:"status"`
				ClientIP   string `json:"client_ip"`
				DurationMs int64  `json:"duration_ms"`
				BytesOut   int64  `json:"bytes_out"`
			}
			wire := make([]wireEvent, len(events))
			for i, e := range events {
				wire[i] = wireEvent{
					ID:         e.ID,
					TS:         e.TS.Format(time.RFC3339),
					ServerID:   e.ServerID,
					ServerName: e.ServerName,
					Host:       e.Host,
					Path:       e.Path,
					Method:     e.Method,
					Status:     e.Status,
					ClientIP:   e.ClientIP,
					DurationMs: e.DurationMs,
					BytesOut:   e.BytesOut,
				}
			}
			data, _ := json.Marshal(wire)
			fmt.Fprintf(w, "data: %s\n\n", data)
			flusher.Flush()
		}
	}
}

// getProfile renders the logged-in user's profile page (name + password change).
func (s *Server) getProfile(w http.ResponseWriter, r *http.Request) {
	cu := s.currentUser(r)
	if cu == nil {
		http.Redirect(w, r, "/login", http.StatusFound)
		return
	}
	s.render(w, r, "profile.html", map[string]any{
		"User":    cu,
		"Flash":   r.URL.Query().Get("flash"),
		"Error":   r.URL.Query().Get("error"),
		"Locales": translations().Locales(), // v2.62.0 (issue #128)
	})
}

// postProfile handles name update and password change on the profile page.
func (s *Server) postProfile(w http.ResponseWriter, r *http.Request) {
	cu := s.currentUser(r)
	if cu == nil {
		http.Redirect(w, r, "/login", http.StatusFound)
		return
	}
	action := r.FormValue("action")
	switch action {
	case "update_locale": // v2.62.0 (issue #128)
		loc := strings.TrimSpace(r.FormValue("locale"))
		if loc != "" && !translations().Has(loc) {
			http.Redirect(w, r, "/profile?error="+url.QueryEscape(s.tr(r, "profile.msg.unknown_language")), http.StatusFound)
			return
		}
		if err := models.UpdateUserLocale(s.DB, cu.ID, loc); err != nil {
			http.Redirect(w, r, "/profile?error="+url.QueryEscape(s.tr(r, "profile.msg.save_language_failed")), http.StatusFound)
			return
		}
		lang := loc
		if lang == "" {
			lang = s.requestLocale(r, nil)
		}
		http.Redirect(w, r, "/profile?flash="+url.QueryEscape(translations().T(lang, "profile.language.saved")), http.StatusFound)
		return
	case "update_name":
		name := strings.TrimSpace(r.FormValue("name"))
		if name == "" {
			http.Redirect(w, r, "/profile?error="+url.QueryEscape(s.tr(r, "profile.msg.name_empty")), http.StatusFound)
			return
		}
		if _, err := s.DB.Exec(`UPDATE users SET name=? WHERE id=?`, name, cu.ID); err != nil {
			log.Printf("profile update_name: %v", err)
			http.Redirect(w, r, "/profile?error="+url.QueryEscape(s.tr(r, "profile.msg.name_failed")), http.StatusFound)
			return
		}
		_ = models.LogActivity(s.DB, s.currentServerID(r), cu.Email, "profile_update_name", "", "", true)
		http.Redirect(w, r, "/profile?flash="+url.QueryEscape(s.tr(r, "profile.msg.name_updated")), http.StatusFound)
	case "change_password":
		currentPw := r.FormValue("current_password")
		newPw := r.FormValue("new_password")
		confirmPw := r.FormValue("confirm_password")
		if newPw != confirmPw {
			http.Redirect(w, r, "/profile?error="+url.QueryEscape(s.tr(r, "profile.msg.password_mismatch")), http.StatusFound)
			return
		}
		if len(newPw) < 8 {
			http.Redirect(w, r, "/profile?error="+url.QueryEscape(s.tr(r, "profile.msg.password_short")), http.StatusFound)
			return
		}
		u, err := models.GetUserByEmail(s.DB, cu.Email)
		if err != nil || !auth.CheckPassword(u.PasswordHash, currentPw) {
			http.Redirect(w, r, "/profile?error="+url.QueryEscape(s.tr(r, "profile.msg.password_wrong")), http.StatusFound)
			return
		}
		hash, err := auth.HashPassword(newPw)
		if err != nil {
			http.Redirect(w, r, "/profile?error="+url.QueryEscape(s.tr(r, "profile.msg.password_hash_failed")), http.StatusFound)
			return
		}
		if _, err := s.DB.Exec(`UPDATE users SET password_hash=? WHERE id=?`, hash, cu.ID); err != nil {
			log.Printf("profile change_password: %v", err)
			http.Redirect(w, r, "/profile?error="+url.QueryEscape(s.tr(r, "profile.msg.password_failed")), http.StatusFound)
			return
		}
		// v2.57.1: sign every OTHER device out; this browser keeps its session.
		if c, err := r.Cookie(auth.SessionCookie); err == nil {
			_ = auth.DeleteOtherSessions(s.DB, cu.ID, c.Value)
		}
		_ = models.LogActivity(s.DB, s.currentServerID(r), cu.Email, "profile_change_password", "", "", true)
		http.Redirect(w, r, "/profile?flash="+url.QueryEscape(s.tr(r, "profile.msg.password_changed")), http.StatusFound)
	default:
		http.Redirect(w, r, "/profile", http.StatusFound)
	}
}

// getCaddyConfig fetches the live Caddy JSON config and renders it in a
// read-only prettified code block. Available to all authenticated users.
func (s *Server) getCaddyConfig(w http.ResponseWriter, r *http.Request) {
	_, rawJSON, err := s.caddyForRequest(r).FetchConfig()
	if err != nil {
		s.render(w, r, "caddy_config.html", map[string]any{
			"User":    s.currentUser(r),
			"Section": "caddy_config",
			"Error":   "Could not fetch Caddy config: " + err.Error(),
		})
		return
	}
	// Pretty-print the JSON for readability.
	var v any
	if err := json.Unmarshal([]byte(rawJSON), &v); err == nil {
		if b, err := json.MarshalIndent(v, "", "  "); err == nil {
			rawJSON = string(b)
		}
	}
	s.render(w, r, "caddy_config.html", map[string]any{
		"User":       s.currentUser(r),
		"Section":    "caddy_config",
		"ConfigJSON": rawJSON,
	})
}