{% extends "base.html" %}
{% block title %}Email Policies · SD RMM{% endblock %}
{% block content %}
{% include "_email_nav.html" %}

<style>
  .ep-head { display:flex; justify-content:space-between; align-items:baseline; flex-wrap:wrap; gap:10px; margin-bottom:12px; }
  .card { background:var(--surface); border:1px solid var(--line); border-radius:var(--r-lg); padding:16px; box-shadow:var(--shadow-1); margin-bottom:14px; }
  .card h2 { font-size:13px; font-weight:700; margin:0 0 12px; text-transform:uppercase; letter-spacing:.4px; color:var(--muted); }
  .addform { display:grid; grid-template-columns:repeat(5,1fr) auto; gap:8px; align-items:end; }
  @media (max-width:860px){ .addform { grid-template-columns:1fr 1fr; } }
  .addform label { font-size:10.5px; text-transform:uppercase; letter-spacing:.4px; color:var(--muted); font-weight:700; display:block; margin-bottom:4px; }
  .addform select, .addform input { width:100%; background:var(--surface-2); border:1px solid var(--line); color:var(--ink); border-radius:8px; padding:8px 10px; font:inherit; }
  table.ep { width:100%; border-collapse:collapse; font-size:13px; }
  table.ep th { text-align:left; color:var(--muted); font-weight:600; font-size:10.5px; text-transform:uppercase; letter-spacing:.4px; padding:7px 8px; border-bottom:1px solid var(--line); }
  table.ep td { padding:7px 8px; border-bottom:1px solid var(--line-soft); }
  .pill { display:inline-block; padding:1px 8px; border-radius:999px; font:700 10.5px/1.6 var(--font-mono); background:var(--surface-3); border:1px solid var(--line); }
  .banner.ok { background:rgba(74,222,128,.1); border:1px solid rgba(74,222,128,.3); color:var(--ok); padding:9px 12px; border-radius:var(--r-md); font-size:12.5px; margin-bottom:12px; }
  .muted { color:var(--muted); } .col-allow h2 { color:var(--ok); } .col-block h2 { color:#fca5a5; }
  .two { display:grid; grid-template-columns:1fr 1fr; gap:14px; } @media (max-width:760px){ .two { grid-template-columns:1fr; } }
  .act { display:inline-block; padding:1px 9px; border-radius:999px; font:700 10.5px/1.7 var(--font-sans); text-transform:capitalize; }
  .act-quarantine { background:rgba(251,191,36,.16); color:#fbbf24; } .act-block { background:rgba(249,115,115,.16); color:#fca5a5; }
  .act-tag { background:rgba(96,165,250,.16); color:#93c5fd; } .act-deliver { background:rgba(74,222,128,.14); color:var(--ok); }
  .sev-pill { display:inline-block; padding:1px 7px; border-radius:999px; font:700 10px/1.6 var(--font-sans); background:var(--surface-3); border:1px solid var(--line); text-transform:lowercase; }
  .base-tag { font:700 9px/1.5 var(--font-sans); text-transform:uppercase; letter-spacing:.4px; color:var(--muted-2); border:1px solid var(--line); border-radius:4px; padding:0 4px; margin-left:6px; }
  .ruleform { display:grid; grid-template-columns:1.6fr 1fr 1fr 1fr .8fr 1fr auto; gap:8px; align-items:end; }
  @media (max-width:860px){ .ruleform { grid-template-columns:1fr 1fr; } }
  .ruleform label { font-size:10.5px; text-transform:uppercase; letter-spacing:.4px; color:var(--muted); font-weight:700; display:block; margin-bottom:4px; }
  .ruleform select, .ruleform input { width:100%; background:var(--surface-2); border:1px solid var(--line); color:var(--ink); border-radius:8px; padding:8px 10px; font:inherit; }
  .off td { opacity:.5; }
</style>

<div class="ep-head">
  <div>
    <h1 class="page-title" style="margin-bottom:2px;">Email Policies</h1>
    <p class="muted" style="margin:0;">Named <strong>policies</strong> decide what happens to a detection (quarantine / block / tag / deliver). <strong>Sender lists</strong> below force-flag or trust specific senders.</p>
  </div>
  <a class="btn btn-ghost" href="/email">&lsaquo; Email Security</a>
</div>

{% if saved %}<div class="banner ok">Saved.</div>{% endif %}

<div class="card" style="display:flex; gap:18px; flex-wrap:wrap; align-items:center; justify-content:space-between; border-left:3px solid {{ '#fbbf24' if remediate else 'var(--line)' }};">
  <div>
    <strong>Live remediation
      <span class="act {{ 'act-quarantine' if remediate else '' }}" style="{{ '' if remediate else 'background:var(--surface-3);color:var(--muted);' }}">{{ 'ON' if remediate else 'OFF' }}</span></strong>
    <div class="muted" style="font-size:12px; margin-top:4px; max-width:62ch;">
      When <strong>ON</strong>, a <em>quarantine</em> or <em>block</em> disposition physically moves the message out of the inbox into an <strong>SD Quarantine</strong> label in the connected mailbox (reversible via Release). When <strong>OFF</strong>, dispositions are recorded only.
      {% if remediate %} Requires the mailbox to be connected with write access (reconnect with the <code>gmail.modify</code> scope).{% endif %}
    </div>
  </div>
  <form method="post" action="/email/remediation/toggle">
    <button class="btn {{ 'btn-ghost' if remediate else 'btn-primary' }}" type="submit"
      {% if not remediate %}onsubmit="return confirm('Enable live remediation? Flagged mail will be moved out of the inbox.');"{% endif %}>{{ 'Disable' if remediate else 'Enable' }}</button>
  </form>
</div>

<div class="card">
  <h2>Policies &mdash; disposition rules</h2>
  <table class="ep">
    <thead><tr><th>Policy</th><th>Applies to</th><th>Min severity</th><th>Action</th><th>Scope</th><th>Priority</th><th>Status</th><th></th></tr></thead>
    <tbody>
      {% for r in rules %}
      <tr class="{{ '' if r.enabled else 'off' }}">
        <td>{{ r.name }}{% if r.is_base %}<span class="base-tag">built-in</span>{% endif %}</td>
        <td class="muted">{{ r.threat_type|capitalize if r.threat_type else 'Any threat' }}</td>
        <td><span class="sev-pill">{{ r.min_severity }}+</span></td>
        <td><span class="act act-{{ r.action }}">{{ r.action }}</span></td>
        <td class="muted">{{ org_name.get(r.org_id, 'All orgs') if r.org_id else 'All orgs' }}</td>
        <td class="muted mono">{{ r.priority }}</td>
        <td>
          <form method="post" action="/email/policies/rules/{{ r.id }}/toggle" style="display:inline;">
            <button class="btn btn-ghost" type="submit">{{ 'Disable' if r.enabled else 'Enable' }}</button></form>
        </td>
        <td><form method="post" action="/email/policies/rules/{{ r.id }}/delete"
              {% if not r.is_base %}onsubmit="return confirm('Delete policy &quot;{{ r.name }}&quot;?');"{% endif %}>
            <button class="btn btn-ghost" type="submit" title="{{ 'Built-in policies can only be disabled' if r.is_base else 'Delete' }}">{{ 'Reset' if r.is_base else 'Delete' }}</button></form></td>
      </tr>
      {% else %}<tr><td colspan="8" class="muted">No policies yet. The standard set seeds on the next service start.</td></tr>{% endfor %}
    </tbody>
  </table>
  <p class="muted" style="font-size:11.5px; margin:10px 0 0;">Lowest priority number wins; an org-specific policy overrides a built-in at the same priority. <strong>Detect-only for now</strong> — the chosen action is recorded as the message's disposition; physically moving mail arrives with mailbox remediation (Step B) / the MX gateway.</p>

  <h2 style="margin-top:18px;">Add a policy</h2>
  <form class="ruleform" method="post" action="/email/policies/rules/add">
    <div><label>Name</label><input type="text" name="name" placeholder="e.g. Exec Team (strict)" required></div>
    <div><label>Applies to</label>
      <select name="threat_type"><option value="">Any threat</option><option value="phishing">Phishing</option><option value="malware">Malware</option><option value="spoofing">Spoofing</option><option value="spam">Spam</option><option value="dlp">Data loss (DLP)</option></select></div>
    <div><label>Min severity</label>
      <select name="min_severity"><option value="warn">Warn+</option><option value="crit">Crit only</option><option value="low">Low+</option></select></div>
    <div><label>Action</label>
      <select name="action"><option value="quarantine">Quarantine</option><option value="block">Block</option><option value="tag">Tag</option><option value="deliver">Deliver</option></select></div>
    <div><label>Priority</label><input type="number" name="priority" value="50"></div>
    <div><label>Org</label>
      <select name="org_id"><option value="">All orgs</option>{% for o in orgs %}<option value="{{ o.id }}">{{ o.name }}</option>{% endfor %}</select></div>
    <div><button class="btn btn-primary" type="submit">Add</button></div>
  </form>
</div>

<h2 style="font-size:13px; font-weight:700; margin:20px 0 10px; text-transform:uppercase; letter-spacing:.4px; color:var(--muted);">Sender lists</h2>
<div class="card">
  <h2>Add to a list</h2>
  <p class="muted" style="margin:-6px 0 12px; font-size:12px;"><strong>Block</strong> force-flags a message; <strong>allow</strong> (trusted senders) suppresses heuristic detections (hard malware/IOC hits are never suppressed). Set a <strong>direction</strong> to build inbound vs outbound ACLs &mdash; inbound matches the sender of arriving mail; <em>outbound</em> entries are stored and enforce once outbound (sent-mail) scanning is enabled.</p>
  <form class="addform" method="post" action="/email/policies/add">
    <div><label>List</label>
      <select name="list_type"><option value="block">Block</option><option value="allow">Allow</option></select></div>
    <div><label>Match</label>
      <select name="match_type"><option value="sender">Sender</option><option value="domain">Domain</option><option value="url">URL</option><option value="keyword">Keyword</option></select></div>
    <div><label>Direction</label>
      <select name="direction"><option value="inbound">Inbound</option><option value="outbound">Outbound</option><option value="any">Any</option></select></div>
    <div style="grid-column:span 2;"><label>Pattern</label>
      <input type="text" name="pattern" placeholder="e.g. evil@bad.com / bad-domain.com / 'wire transfer'" required></div>
    <div><label>Org</label>
      <select name="org_id"><option value="">Global</option>{% for o in orgs %}<option value="{{ o.id }}">{{ o.name }}</option>{% endfor %}</select></div>
    <div><button class="btn btn-primary" type="submit">Add</button></div>
  </form>
</div>

<div class="two">
  <div class="card col-block">
    <h2>Block list ({{ block|length }})</h2>
    {% if block %}
    <table class="ep">
      <thead><tr><th>Match</th><th>Dir</th><th>Pattern</th><th>Scope</th><th></th></tr></thead>
      <tbody>
        {% for e in block %}
        <tr>
          <td><span class="pill">{{ e.match_type }}</span></td>
          <td>{% set d = e.direction or 'any' %}<span class="pill" title="{{ d }}">{% if d=='inbound' %}&#8595; in{% elif d=='outbound' %}&#8593; out{% else %}&#8596; any{% endif %}</span></td>
          <td class="mono">{{ e.pattern }}</td>
          <td class="muted">{{ org_name.get(e.org_id, 'Global') if e.org_id else 'Global' }}</td>
          <td><form method="post" action="/email/policies/{{ e.id }}/delete"><button class="btn btn-ghost" type="submit">Remove</button></form></td>
        </tr>
        {% endfor %}
      </tbody>
    </table>
    {% else %}<p class="muted">No block rules.</p>{% endif %}
  </div>

  <div class="card col-allow">
    <h2>Allow list ({{ allow|length }})</h2>
    {% if allow %}
    <table class="ep">
      <thead><tr><th>Match</th><th>Dir</th><th>Pattern</th><th>Scope</th><th></th></tr></thead>
      <tbody>
        {% for e in allow %}
        <tr>
          <td><span class="pill">{{ e.match_type }}</span></td>
          <td>{% set d = e.direction or 'any' %}<span class="pill" title="{{ d }}">{% if d=='inbound' %}&#8595; in{% elif d=='outbound' %}&#8593; out{% else %}&#8596; any{% endif %}</span></td>
          <td class="mono">{{ e.pattern }}</td>
          <td class="muted">{{ org_name.get(e.org_id, 'Global') if e.org_id else 'Global' }}</td>
          <td><form method="post" action="/email/policies/{{ e.id }}/delete"><button class="btn btn-ghost" type="submit">Remove</button></form></td>
        </tr>
        {% endfor %}
      </tbody>
    </table>
    {% else %}<p class="muted">No allow rules.</p>{% endif %}
  </div>
</div>

{% endblock %}