@php($storageService=app(\App\Domain\Documents\DocumentStorage::class))
@php($profile=$storageService->active())
@php($connection=$profile?->connection ?? [])
@php($selectedDriver=old('driver',$profile?->driver ?? 'local'))
<section class="panel"><div class="panel-heading"><div><h2>Document storage</h2><p>Encrypted storage with access limited to authorized users.</p></div></div>
<form method="post" action="{{ $base }}/settings/document-storage" class="panel-body form-grid" x-data="{driver:@js($selectedDriver)}" x-cloak>@csrf
<label>Storage location<select name="driver" x-model="driver" aria-label="Storage location"><option value="local">Secure storage (default)</option><option value="s3">Company S3 storage</option></select></label>
<p class="hint">Saving tests a small file's write, read and deletion first. Existing documents stay at their original location; this setting applies to new uploads.</p>
<div class="form-span" x-show="driver==='local'">
<strong>{{ $profile?->driver === 'local' ? 'Secure storage is active' : 'Secure storage, ready to enable' }}</strong>
<p>Click Proceed to enable encrypted document storage.</p>
<p class="hint">Your documents stay private. Only authorized users can view or download them.</p>
</div>
<fieldset class="form-span form-grid storage-location-fields" x-show="driver==='s3'" :disabled="driver!=='s3'" x-cloak>
<label>Bucket name<input name="bucket" aria-label="Bucket name" value="{{ old('bucket',$connection['bucket']??'') }}" maxlength="63" required></label>
<label>Region<input name="region" aria-label="Region" value="{{ old('region',$connection['region']??'us-east-1') }}" maxlength="63" required placeholder="For example us-east-1"></label>
<label>Access key ID<input name="key" aria-label="Access key ID" autocomplete="off" required maxlength="250"></label>
<label>Secret access key<input type="password" name="secret" aria-label="Secret access key" autocomplete="new-password" required maxlength="500"><small>Enter both credentials whenever changing storage. Saved secrets are encrypted and never displayed.</small></label>
<label>S3-compatible endpoint (optional)<input name="endpoint" type="url" aria-label="S3-compatible endpoint" value="{{ old('endpoint',$connection['endpoint']??'') }}" maxlength="250" placeholder="https://your-provider.example"><small>Leave blank for AWS S3. Other providers must support the S3 API over public HTTPS on port 443.</small></label>
<label>Bucket folder prefix (optional)<input name="prefix" aria-label="Bucket folder prefix" value="{{ old('prefix',$connection['prefix']??'hrms') }}" maxlength="100"><small>An optional prefix to organize files in your own bucket.</small></label>
<label class="checkbox-label"><input type="checkbox" name="path_style" value="1" @checked(old('path_style',$connection['path_style']??false))>Use path-style access for AWS S3</label><p class="hint">Custom endpoints always use path-style access. S3-compatible services differ; use the region and credentials supplied by your provider.</p>
</fieldset>
<div class="form-span"><button class="button primary"><x-icon name="check"/><span x-text="driver==='local' ? 'Proceed' : 'Test and connect S3'">Proceed</span></button></div>
</form></section>
<section class="panel"><div class="panel-heading"><h2>Setup guide</h2></div><div class="panel-body storage-setup-guide">
<details open><summary>Secure storage</summary><p>Choose Secure storage and click Proceed. You can then start adding documents.</p><p>Changing storage applies to new uploads. Existing documents remain in their original storage and are still available.</p></details>
<details><summary>Connect your own S3 bucket</summary><ol><li>Create a private bucket with public access blocked.</li><li>Create dedicated credentials with permission to list, read, write and delete files in the intended bucket area.</li><li>Enter your bucket, region and credentials. Add the HTTPS endpoint for another S3-compatible provider.</li><li>Click Test and connect S3. If the check fails, your current storage stays active.</li></ol><p>Keep previous storage and credentials available for existing documents. This does not move or delete files. Only S3-compatible object storage is supported.</p></details>
<details><summary>Need help with an upload?</summary><p>If storage cannot be prepared or an encryption error appears, contact Zentrik support. Your existing files and security keys are preserved.</p><p>If a safety check is pending, the file is saved privately. Downloads become available after the safety check succeeds. An administrator can check service status under Automatic safety checks.</p></details>
</div></section>