<?php
/**
 * Generic outbound webhook, so Slack, Teams, PagerDuty or any HTTPS endpoint receives the
 * same alerts Telegram does, without bespoke code for each.
 *
 * WHERE IT HOOKS IN
 *
 * One place, not the ~35 CSDT_Telegram::send() call sites. CSDT_Alert_Log already sees
 * every alert as it leaves the site (http_api_debug on the Telegram request, so it covers the
 * other CloudScale plugins too and does not depend on which plugin's copy of the shared class
 * loaded). It fires the csdt_alert_captured action with the exact text, and this class
 * listens to it. The cost of that choice, stated in the panel too: an alert reaches the
 * webhook only when it was handed to Telegram, so Telegram has to be set up.
 *
 * SIGNING
 *
 * The body is encoded ONCE, and the HMAC is computed over that string and that same string
 * is what is posted. Nothing re-encodes it in between. A signature over a value re-encoded
 * later fails on the first em dash or slash, because encoders disagree on escaping.
 *
 * @package CloudScale_Cyber_DevTools
 * @since   1.10.958
 */

defined( 'ABSPATH' ) || exit;

/**
 * Outbound webhook delivery for alerts and the weekly report.
 */
class CSDT_Webhook {

	/** Destination URL. https only. */
	const OPTION_URL = 'csdt_webhook_url';

	/** Optional shared secret for the signature header. */
	const OPTION_SECRET = 'csdt_webhook_secret';

	/** 'slack' or 'json'. */
	const OPTION_FORMAT = 'csdt_webhook_format';

	/** Comma-separated event keys from EVENTS. */
	const OPTION_EVENTS = 'csdt_webhook_events';

	/** Signature header. Value is "sha256=" followed by the hex HMAC of the raw body. */
	const SIGNATURE_HEADER = 'X-CSDT-Signature';

	/** Event header, so a receiver can route without parsing the body. */
	const EVENT_HEADER = 'X-CSDT-Event';

	/** Timeout for a send whose result nobody waits for (an alert on a visitor request). */
	const TIMEOUT_BACKGROUND = 2;

	/** Timeout for a send whose result is reported (test button, weekly report). */
	const TIMEOUT_REPORTED = 5;

	/** Set while a delivery is in progress, so a webhook pointed back at Telegram cannot loop. */
	private static $sending = false;

	/**
	 * The events a webhook can be subscribed to.
	 *
	 * @return array<string,string> key => label.
	 */
	public static function events(): array {
		return array(
			'critical'  => __( 'Critical alerts', 'cloudscale-cyber-devtools' ),
			'autoblock' => __( 'Auto-blocks', 'cloudscale-cyber-devtools' ),
			'new_admin' => __( 'New administrator', 'cloudscale-cyber-devtools' ),
			'vuln'      => __( 'Vulnerability found', 'cloudscale-cyber-devtools' ),
			'weekly'    => __( 'Weekly report', 'cloudscale-cyber-devtools' ),
			'test'      => __( 'Test', 'cloudscale-cyber-devtools' ),
		);
	}

	/** Registers the listener on the alert choke point. */
	public static function init(): void {
		add_action( 'csdt_alert_captured', array( __CLASS__, 'on_alert' ), 10, 2 );
	}

	// ── Settings ─────────────────────────────────────────────────────────

	/** The stored URL, or '' when none. */
	public static function url(): string {
		return trim( (string) CSDT_Options::get( self::OPTION_URL ) );
	}

	/** Whether a URL is set. Off by default: nothing is sent until one is saved. */
	public static function is_configured(): bool {
		return '' !== self::url();
	}

	/** The stored format, validated. */
	public static function format(): string {
		return 'json' === (string) CSDT_Options::get( self::OPTION_FORMAT ) ? 'json' : 'slack';
	}

	/**
	 * The subscribed events.
	 *
	 * @return array<int,string>
	 */
	public static function enabled_events(): array {
		return self::parse_events( (string) CSDT_Options::get( self::OPTION_EVENTS ) );
	}

	/**
	 * Parses a stored or posted event list, keeping only known keys ('test' is never stored).
	 *
	 * @param string $raw Comma-separated keys.
	 * @return array<int,string>
	 */
	public static function parse_events( string $raw ): array {
		$known = array_keys( self::events() );
		$out   = array();
		foreach ( explode( ',', $raw ) as $key ) {
			$key = strtolower( trim( $key ) );
			if ( '' !== $key && 'test' !== $key && in_array( $key, $known, true ) && ! in_array( $key, $out, true ) ) {
				$out[] = $key;
			}
		}
		return $out;
	}

	/**
	 * Why a URL cannot be used, or '' when it can.
	 *
	 * The cheap, deterministic checks run first, so the obvious refusals never cost a DNS
	 * lookup and are testable without a network: https only, no credentials in the URL, no
	 * names that only mean something inside a network, no literal private or reserved
	 * addresses. Then WordPress's own wp_http_validate_url(), which resolves the host and
	 * refuses a private address. Then, where it is loaded, the plugin's existing SSRF guard,
	 * which checks EVERY address the host resolves to, IPv6 included. The send itself goes
	 * through wp_safe_remote_post(), which repeats WordPress's check at request time.
	 *
	 * @param string $url Candidate URL.
	 * @return string Empty when acceptable.
	 */
	public static function validate_url( string $url ): string {
		$url = trim( $url );
		if ( '' === $url ) {
			return __( 'Enter a URL.', 'cloudscale-cyber-devtools' );
		}
		if ( strlen( $url ) > 2048 ) {
			return __( 'That URL is too long.', 'cloudscale-cyber-devtools' );
		}
		if ( preg_match( '/[\s\x00-\x1f\x7f]/', $url ) ) {
			return __( 'The URL contains spaces or control characters.', 'cloudscale-cyber-devtools' );
		}
		$parts = wp_parse_url( $url );
		if ( ! is_array( $parts ) || 'https' !== strtolower( (string) ( $parts['scheme'] ?? '' ) ) ) {
			return __( 'The URL must start with https://', 'cloudscale-cyber-devtools' );
		}
		if ( isset( $parts['user'] ) || isset( $parts['pass'] ) ) {
			return __( 'Put credentials in the shared secret, not in the URL.', 'cloudscale-cyber-devtools' );
		}
		$host = strtolower( trim( (string) ( $parts['host'] ?? '' ), '[]' ) );
		if ( '' === $host ) {
			return __( 'The URL has no host name.', 'cloudscale-cyber-devtools' );
		}
		if ( ! self::host_is_public( $host ) ) {
			return __( 'That host is internal to a network. The webhook must be a public HTTPS address.', 'cloudscale-cyber-devtools' );
		}
		if ( function_exists( 'wp_http_validate_url' ) && ! wp_http_validate_url( $url ) ) {
			return __( 'WordPress refused that URL: it does not resolve, or it resolves to a private address.', 'cloudscale-cyber-devtools' );
		}
		if ( is_callable( array( 'CSDT_Thumbnails', 'is_safe_external_url' ) ) && ! CSDT_Thumbnails::is_safe_external_url( $url ) ) {
			return __( 'That host resolves to a private or reserved address.', 'cloudscale-cyber-devtools' );
		}
		return '';
	}

	/**
	 * Whether a host name, before resolution, could be a public internet host.
	 *
	 * @param string $host Lower-case host, brackets stripped.
	 * @return bool
	 */
	public static function host_is_public( string $host ): bool {
		if ( filter_var( $host, FILTER_VALIDATE_IP ) ) {
			return false !== filter_var( $host, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE );
		}
		// A single label ("intranet") resolves only through a local search domain.
		if ( false === strpos( $host, '.' ) ) {
			return false;
		}
		// Numeric forms PHP's IP filter does not read as addresses but resolvers do: 0x7f.1, 2130706433.
		if ( preg_match( '/^[0-9.]+$/', $host ) || preg_match( '/^0x/i', $host ) ) {
			return false;
		}
		foreach ( array( 'localhost', 'local', 'internal', 'intranet', 'lan', 'home.arpa', 'corp', 'localdomain' ) as $suffix ) {
			if ( $host === $suffix || substr( $host, -( strlen( $suffix ) + 1 ) ) === '.' . $suffix ) {
				return false;
			}
		}
		return true;
	}

	// ── Payload ──────────────────────────────────────────────────────────

	/**
	 * The exact body to post. Encoded once; the signature is computed over this string.
	 *
	 * @param string $format 'slack' or 'json'.
	 * @param string $event  Event key.
	 * @param string $title  One-line title.
	 * @param string $text   Plain-text body.
	 * @param string $level  info|warning|critical.
	 * @param string $site   Site URL.
	 * @param int    $ts     Unix time.
	 * @return string JSON.
	 */
	public static function build_body( string $format, string $event, string $title, string $text, string $level, string $site, int $ts ): string {
		if ( 'json' === $format ) {
			$payload = array(
				'event'   => $event,
				'level'   => $level,
				'site'    => $site,
				'title'   => $title,
				'text'    => $text,
				'sent_at' => gmdate( 'c', $ts ),
			);
		} else {
			// Slack's incoming-webhook shape, which Mattermost, Discord's /slack endpoint and
			// Teams' Slack-compatible connectors also accept. Plain text, so no markup in an
			// alert can be interpreted by the receiver as a mention or a link.
			$payload = array( 'text' => ( '' !== $title ? $title . "\n\n" : '' ) . $text );
		}
		return (string) wp_json_encode( $payload, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE );
	}

	/**
	 * Signature header value for a body.
	 *
	 * @param string $body   The exact bytes that will be posted.
	 * @param string $secret Shared secret.
	 * @return string "sha256=<hex>", or '' when there is no secret.
	 */
	public static function signature( string $body, string $secret ): string {
		if ( '' === $secret ) {
			return '';
		}
		return 'sha256=' . hash_hmac( 'sha256', $body, $secret );
	}

	/**
	 * Request arguments for a body. The body in the result is the same string that was signed.
	 *
	 * @param string $body     JSON body.
	 * @param string $secret   Shared secret, may be ''.
	 * @param string $event    Event key.
	 * @param bool   $blocking Whether the caller waits for the answer.
	 * @return array<string,mixed>
	 */
	public static function request_args( string $body, string $secret, string $event, bool $blocking ): array {
		$headers = array(
			'Content-Type'     => 'application/json; charset=utf-8',
			self::EVENT_HEADER => $event,
		);
		$sig = self::signature( $body, $secret );
		if ( '' !== $sig ) {
			$headers[ self::SIGNATURE_HEADER ] = $sig;
		}
		return array(
			'user-agent'  => 'CloudScale-Cyber-DevTools/' . ( defined( 'CSDT_DevTools::VERSION' ) ? CSDT_DevTools::VERSION : '0' ),
			'timeout'     => $blocking ? self::TIMEOUT_REPORTED : self::TIMEOUT_BACKGROUND,
			'blocking'    => $blocking,
			'redirection' => 0,
			'headers'     => $headers,
			'body'        => $body,
		);
	}

	// ── Classification of captured alerts ────────────────────────────────

	/**
	 * Which subscribable events an alert text belongs to.
	 *
	 * Read from the text CSDT_Telegram composes: its header names the source ("CSDT
	 * Auto-Block", "Vulnerable component") and its second line is the level word.
	 *
	 * @param string $body  Alert text as sent.
	 * @param string $level Level as CSDT_Alert_Log read it.
	 * @return array<int,string>
	 */
	public static function classify( string $body, string $level ): array {
		$out = array();
		if ( false !== stripos( $body, 'Auto-Block' ) ) {
			$out[] = 'autoblock';
		}
		if ( false !== stripos( $body, 'New admin' ) ) {
			$out[] = 'new_admin';
		}
		if ( false !== stripos( $body, 'Vulnerable component' ) || false !== stripos( $body, 'software vulnerability' ) || false !== stripos( $body, 'vulnerability finding' ) ) {
			$out[] = 'vuln';
		}
		if ( 'critical' === $level ) {
			$out[] = 'critical';
		}
		return $out;
	}

	/**
	 * The event a captured alert is delivered as, given the subscription, or '' to skip it.
	 *
	 * @param array<int,string> $matched Events the alert belongs to.
	 * @param array<int,string> $enabled Subscribed events.
	 * @return string
	 */
	public static function pick_event( array $matched, array $enabled ): string {
		foreach ( $matched as $event ) {
			if ( in_array( $event, $enabled, true ) ) {
				return $event;
			}
		}
		return '';
	}

	/**
	 * The first meaningful line of an alert, without the severity marker.
	 *
	 * @param string $body Alert text.
	 * @return string
	 */
	public static function title_from( string $body ): string {
		foreach ( preg_split( '/\R/u', $body ) as $line ) {
			$line = trim( (string) preg_replace( '/^[^\p{L}\p{N}]+/u', '', (string) $line ) );
			if ( '' !== $line ) {
				return function_exists( 'mb_substr' ) ? mb_substr( $line, 0, 150 ) : substr( $line, 0, 150 );
			}
		}
		return '';
	}

	/**
	 * Listener for csdt_alert_captured. Never throws; never blocks the request.
	 *
	 * @param string $body  Alert text.
	 * @param string $level Level.
	 */
	public static function on_alert( $body, $level = 'info' ): void {
		try {
			if ( self::$sending || ! is_string( $body ) || '' === trim( $body ) || ! self::is_configured() ) {
				return;
			}
			$event = self::pick_event( self::classify( $body, (string) $level ), self::enabled_events() );
			if ( '' === $event ) {
				return;
			}
			self::send( $event, self::title_from( $body ), $body, (string) $level, false );
		} catch ( \Throwable $e ) {
			return;
		}
	}

	// ── Delivery ─────────────────────────────────────────────────────────

	/**
	 * Posts one event. Refused on a muted copy, like every other alert channel.
	 *
	 * A background send (blocking false) cannot see the HTTP status, only a transport refusal,
	 * so only that is recorded. A reported send records any non-2xx answer too.
	 *
	 * @param string $event    Event key.
	 * @param string $title    Title.
	 * @param string $text     Body text.
	 * @param string $level    Level.
	 * @param bool   $blocking Wait for and report the answer.
	 * @return array{ok:bool,code:int,error:string}
	 */
	public static function send( string $event, string $title, string $text, string $level, bool $blocking ): array {
		if ( ! self::is_configured() ) {
			return array( 'ok' => false, 'code' => 0, 'error' => __( 'No webhook URL is saved.', 'cloudscale-cyber-devtools' ) );
		}
		if ( class_exists( 'CSDT_Telegram' ) && CSDT_Telegram::is_muted() ) {
			return array( 'ok' => false, 'code' => 0, 'error' => __( 'Alerts are muted on this copy of the site.', 'cloudscale-cyber-devtools' ) );
		}
		$body = self::build_body( self::format(), $event, $title, $text, $level, home_url(), time() );
		$args = self::request_args( $body, (string) CSDT_Options::get( self::OPTION_SECRET ), $event, $blocking );

		self::$sending = true;
		try {
			$resp = wp_safe_remote_post( self::url(), $args );
		} finally {
			self::$sending = false;
		}

		$error = '';
		$code  = 0;
		if ( is_wp_error( $resp ) ) {
			$error = CSDT_Error_Text::in_seconds( $resp->get_error_message() );
		} elseif ( $blocking ) {
			$code = (int) wp_remote_retrieve_response_code( $resp );
			if ( $code < 200 || $code > 299 ) {
				/* translators: %d: HTTP status code. */
				$error = sprintf( __( 'The endpoint answered HTTP %d.', 'cloudscale-cyber-devtools' ), $code );
			}
		}
		if ( '' !== $error && is_callable( array( 'CSDT_Alert_Log', 'record_channel_failure' ) ) ) {
			CSDT_Alert_Log::record_channel_failure( 'webhook', $title, $error, $code, $level );
		}
		return array( 'ok' => '' === $error, 'code' => $code, 'error' => $error );
	}

	// ── Admin ────────────────────────────────────────────────────────────

	/** Saves the settings. */
	public static function ajax_save(): void {
		check_ajax_referer( CSDT_DevTools::SMTP_NONCE, 'nonce' );
		if ( ! current_user_can( 'manage_options' ) ) {
			wp_send_json_error( 'Unauthorized', 403 );
		}
		$typed = isset( $_POST['url'] ) ? trim( sanitize_text_field( wp_unslash( $_POST['url'] ) ) ) : '';
		$url   = isset( $_POST['url'] ) ? trim( esc_url_raw( wp_unslash( $_POST['url'] ) ) ) : '';
		// esc_url_raw() returns '' for a scheme it does not allow (javascript:, data:). Saving
		// that '' would quietly turn the webhook off, so a typed value that sanitised to
		// nothing is refused instead.
		if ( '' !== $typed && '' === $url ) {
			wp_send_json_error( __( 'The URL must start with https://', 'cloudscale-cyber-devtools' ) );
		}
		if ( '' !== $url ) {
			$why = self::validate_url( $url );
			if ( '' !== $why ) {
				wp_send_json_error( $why );
			}
		}
		$format = sanitize_key( wp_unslash( $_POST['format'] ?? 'slack' ) );
		$events = self::parse_events( sanitize_text_field( wp_unslash( $_POST['events'] ?? '' ) ) );

		update_option( self::OPTION_URL, $url, false );
		update_option( self::OPTION_FORMAT, 'json' === $format ? 'json' : 'slack', false );
		update_option( self::OPTION_EVENTS, implode( ',', $events ), false );
		// The secret field is write-only: blank keeps the stored one, so the page never has to
		// print it. The separate clear box removes it.
		$secret = sanitize_text_field( wp_unslash( $_POST['secret'] ?? '' ) );
		if ( '1' === sanitize_key( wp_unslash( $_POST['clear_secret'] ?? '' ) ) ) {
			update_option( self::OPTION_SECRET, '', false );
		} elseif ( '' !== $secret ) {
			update_option( self::OPTION_SECRET, $secret, false );
		}
		wp_send_json_success(
			array(
				'msg' => '' === $url
					? __( 'Saved. The webhook is off.', 'cloudscale-cyber-devtools' )
					: __( 'Saved. Use Send test to confirm delivery.', 'cloudscale-cyber-devtools' ),
			)
		);
	}

	/** Sends a test event to the saved URL and reports the answer. */
	public static function ajax_test(): void {
		check_ajax_referer( CSDT_DevTools::SMTP_NONCE, 'nonce' );
		if ( ! current_user_can( 'manage_options' ) ) {
			wp_send_json_error( 'Unauthorized', 403 );
		}
		$r = self::send(
			'test',
			__( 'CloudScale Cyber DevTools webhook test', 'cloudscale-cyber-devtools' ),
			sprintf(
				/* translators: %s: site URL. */
				__( 'Test message from %s. If you can read this, the webhook works.', 'cloudscale-cyber-devtools' ),
				home_url()
			),
			'info',
			true
		);
		if ( $r['ok'] ) {
			/* translators: %d: HTTP status code. */
			wp_send_json_success( array( 'msg' => sprintf( __( 'Delivered, HTTP %d.', 'cloudscale-cyber-devtools' ), $r['code'] ) ) );
		}
		wp_send_json_error( $r['error'] );
	}

	/** Renders the webhook panel on the Alerts tab. */
	public static function render_panel(): void {
		$url        = self::url();
		$format     = self::format();
		$enabled    = self::enabled_events();
		$has_secret = '' !== (string) CSDT_Options::get( self::OPTION_SECRET );
		$tg_ready   = class_exists( 'CSDT_Telegram' ) && CSDT_Telegram::is_configured()
			&& '1' === (string) CSDT_Options::get( 'csdt_notify_telegram_enabled' );
		?>
		<div class="cs-panel" id="cs-panel-webhook">
			<div class="cs-section-header cs-section-header-blue">
				<span>&#128279; <?php esc_html_e( 'Outbound Webhook', 'cloudscale-cyber-devtools' ); ?></span>
				<span class="cs-header-hint"><?php esc_html_e( 'Send alerts to Slack, Teams or any HTTPS endpoint', 'cloudscale-cyber-devtools' ); ?></span>
				<?php
				CSDT_DevTools::render_explain_btn(
					'webhook',
					'Outbound Webhook',
					array(
						array(
							'name' => 'Webhook URL',
							'rec'  => 'Optional, off by default',
							'html' => 'An HTTPS address that accepts a POST with a JSON body. Leave it empty to turn the webhook off. Addresses inside a private network (localhost, 10.x, 192.168.x, <code>.local</code>, <code>.internal</code> and single-word host names) are refused, so the setting cannot be used to make this server call into its own network. Only plain <code>https://</code> is accepted.',
						),
						array(
							'name' => 'Shared secret',
							'rec'  => 'Recommended',
							'html' => 'When set, every request carries <code>' . esc_html( self::SIGNATURE_HEADER ) . ': sha256=&lt;hex&gt;</code>, the HMAC-SHA256 of the raw request body keyed with this secret. Verify it over the exact bytes you received, before parsing the JSON. The field is write-only: leave it blank to keep the saved secret.',
						),
						array(
							'name' => 'Format',
							'rec'  => 'How it works',
							'html' => '<strong>Slack-compatible</strong> posts <code>{"text": "..."}</code>, which Slack, Mattermost and most chat tools accept as an incoming webhook.<br><br><strong>Generic JSON</strong> posts <code>event</code>, <code>level</code>, <code>site</code>, <code>title</code>, <code>text</code> and <code>sent_at</code>, for your own receiver or an automation service. The <code>' . esc_html( self::EVENT_HEADER ) . '</code> header carries the event in both formats.',
						),
						array(
							'name' => 'Events',
							'rec'  => 'How it works',
							'html' => 'Critical alerts, auto-blocks, new administrators and vulnerability findings are mirrored from the alerts this site sends to Telegram, at the moment they are sent. That means <strong>Telegram must be set up</strong> for those four; the webhook adds a destination, it does not replace the alert pipeline. The weekly report is sent to the webhook directly and needs no Telegram.',
						),
						array(
							'name' => 'Send test',
							'rec'  => 'How it works',
							'html' => 'Posts a test event to the saved URL and shows the HTTP status it answered. Save first. Alerts are sent in the background with a ' . (int) self::TIMEOUT_BACKGROUND . ' second timeout so a slow endpoint cannot slow your site; a refused connection is recorded in the alert log below.',
						),
						array(
							'name' => 'Restored copies',
							'rec'  => 'Honest limits',
							'html' => 'A copy of the site with alerts muted sends nothing to the webhook either, the same as Telegram and email.',
						),
					)
				);
				?>
			</div>
			<div class="cs-panel-body">
				<?php if ( ! $tg_ready ) : ?>
				<p class="cs-help" style="color:#92400e;">
					<?php esc_html_e( 'Telegram is not set up, so only the weekly report and tests reach the webhook.', 'cloudscale-cyber-devtools' ); ?>
				</p>
				<?php endif; ?>
				<div style="margin-bottom:10px;">
					<label class="cs-field-label" for="csdt-webhook-url" style="display:block;margin-bottom:3px;"><?php esc_html_e( 'Webhook URL', 'cloudscale-cyber-devtools' ); ?></label>
					<input type="url" id="csdt-webhook-url" value="<?php echo esc_attr( $url ); ?>" placeholder="https://hooks.example.com/..." autocomplete="off" style="width:100%;max-width:520px;padding:4px 8px;height:32px;">
				</div>
				<div style="margin-bottom:10px;">
					<label class="cs-field-label" for="csdt-webhook-secret" style="display:block;margin-bottom:3px;"><?php esc_html_e( 'Shared secret', 'cloudscale-cyber-devtools' ); ?></label>
					<input type="password" id="csdt-webhook-secret" value="" placeholder="<?php echo esc_attr( $has_secret ? __( 'Saved, leave blank to keep', 'cloudscale-cyber-devtools' ) : __( 'Optional', 'cloudscale-cyber-devtools' ) ); ?>" autocomplete="new-password" style="width:100%;max-width:300px;padding:4px 8px;height:32px;">
					<?php if ( $has_secret ) : ?>
					<label style="font-size:12px;margin-left:8px;"><input type="checkbox" id="csdt-webhook-clear-secret"> <?php esc_html_e( 'Remove saved secret', 'cloudscale-cyber-devtools' ); ?></label>
					<?php endif; ?>
				</div>
				<div style="margin-bottom:10px;">
					<label class="cs-field-label" for="csdt-webhook-format" style="display:block;margin-bottom:3px;"><?php esc_html_e( 'Format', 'cloudscale-cyber-devtools' ); ?></label>
					<select id="csdt-webhook-format">
						<option value="slack" <?php selected( $format, 'slack' ); ?>><?php esc_html_e( 'Slack-compatible', 'cloudscale-cyber-devtools' ); ?></option>
						<option value="json" <?php selected( $format, 'json' ); ?>><?php esc_html_e( 'Generic JSON', 'cloudscale-cyber-devtools' ); ?></option>
					</select>
				</div>
				<div style="margin-bottom:12px;">
					<span class="cs-field-label" style="display:block;margin-bottom:3px;"><?php esc_html_e( 'Events', 'cloudscale-cyber-devtools' ); ?></span>
					<?php foreach ( self::events() as $key => $label ) : ?>
						<?php
						if ( 'test' === $key ) {
							continue;
						}
						?>
					<label style="display:inline-flex;align-items:center;gap:5px;margin:0 14px 6px 0;font-size:13px;">
						<input type="checkbox" class="csdt-webhook-event" value="<?php echo esc_attr( $key ); ?>" <?php checked( in_array( $key, $enabled, true ) ); ?>>
						<?php echo esc_html( $label ); ?>
					</label>
					<?php endforeach; ?>
				</div>
				<div style="display:flex;align-items:center;gap:10px;flex-wrap:wrap;">
					<button type="button" class="cs-btn-primary" id="csdt-webhook-save">&#128190; <?php esc_html_e( 'Save Webhook', 'cloudscale-cyber-devtools' ); ?></button>
					<button type="button" class="button" id="csdt-webhook-test" <?php disabled( '' === $url ); ?>><?php esc_html_e( 'Send test', 'cloudscale-cyber-devtools' ); ?></button>
					<?php if ( '' === $url ) : ?>
					<span style="font-size:12px;color:#64748b;"><?php esc_html_e( 'Save a URL to enable Send test.', 'cloudscale-cyber-devtools' ); ?></span>
					<?php endif; ?>
					<span id="csdt-webhook-msg" style="font-size:12px;"></span>
				</div>
			</div>
		</div>
		<?php
	}
}