@extends('layouts.admin')
@section('title','Security operations') @section('heading','Security operations')
@section('content')
<div class="section-head"><div><h2>API sessions and abuse controls</h2><p>Privacy-preserving rate-limit evidence and explicit session revocation.</p></div><a class="btn" href="{{ route('admin.access.audit') }}">Audit chain</a></div>
<form class="filter"><input name="q" value="{{ $filters['q']??'' }}" placeholder="Account name or email"><select name="role"><option value="">All roles</option>@foreach(['customer','driver','vendor','admin'] as $role)<option @selected(($filters['role']??'')===$role)>{{ $role }}</option>@endforeach</select><select name="abuse_hours">@foreach([1,6,24,72,168] as $value)<option value="{{ $value }}" @selected($hours===$value)>Last {{ $value }} hour(s)</option>@endforeach</select><button class="btn">Apply</button></form>
<section class="section"><h2>API sessions</h2><div class="table-wrap"><table><thead><tr><th>Account</th><th>Session label</th><th>Created</th><th>Last used</th><th>Revoke</th></tr></thead><tbody>@forelse($sessions as $session)<tr><td>{{ $session->tokenable?->name }}<br><small>{{ $session->tokenable?->email }} · {{ $session->tokenable?->role }}</small></td><td>{{ $session->name }}</td><td>{{ $session->created_at?->format('d M Y H:i') }}</td><td>{{ $session->last_used_at?->format('d M Y H:i') ?: 'Never' }}</td><td><form method="post" action="{{ route('admin.security.sessions.revoke',$session) }}">@csrf<input name="reason" required minlength="8" maxlength="500" placeholder="Required audit reason"><button class="btn">Revoke</button></form></td></tr>@empty<tr><td colspan="5" class="empty">No API sessions match.</td></tr>@endforelse</tbody></table></div>{{ $sessions->links() }}</section>
<section class="section"><h2>Active push devices</h2><div class="table-wrap"><table><thead><tr><th>Account</th><th>Device</th><th>Platform</th><th>Last seen</th><th>Revoke</th></tr></thead><tbody>@forelse($devices as $device)<tr><td>{{ $device->user?->name }}<br><small>{{ $device->user?->email }}</small></td><td>{{ $device->device_name ?: 'Unnamed device' }}</td><td>{{ strtoupper($device->platform) }}</td><td>{{ $device->last_seen_at?->format('d M Y H:i') ?: 'Never' }}</td><td><form method="post" action="{{ route('admin.security.devices.revoke',$device->public_id) }}">@csrf<input name="reason" required minlength="8" maxlength="500" placeholder="Required audit reason"><button class="btn">Revoke</button></form></td></tr>@empty<tr><td colspan="5">No active push devices.</td></tr>@endforelse</tbody></table></div></section>
<section class="section"><h2>Rate-limit evidence</h2><p>Network and user-agent values are one-way HMAC hashes; plaintext identifiers are not retained.</p><div class="table-wrap"><table><thead><tr><th>Endpoint</th><th>Account</th><th>Network fingerprint</th><th>Count</th><th>Last seen</th></tr></thead><tbody>@forelse($abuse as $event)<tr><td>{{ $event->method }} {{ $event->path }}<br><small>{{ $event->route_name ?: 'unnamed route' }}</small></td><td>{{ $event->user?->email ?: 'Anonymous' }}</td><td><code>{{ substr($event->ip_hash,0,12) }}…</code></td><td>{{ $event->occurrences }}</td><td>{{ $event->last_seen_at->format('d M Y H:i:s') }}</td></tr>@empty<tr><td colspan="5">No throttled requests in this window.</td></tr>@endforelse</tbody></table></div></section>
@endsection