@php($timezone=$scopeTenant?->timezone ?? config('app.timezone'))
@php($mode=$scopeTenant && $policy->session_limit===null ? 'inherit' : ($policy->session_limit===0 ? 'unlimited' : 'limited'))
<section class="panel"><div class="panel-heading"><div><h2>Access controls</h2><p>IP restrictions are optional. MFA remains optional for everyone.</p></div></div>
<form method="post" action="{{ $actionBase }}" class="panel-body form-grid" x-cloak x-data="{network:@js((string)old('ip_enabled',(int)$policy->ip_enabled)),limit:@js(old('limit_mode',$mode))}">@csrf
<label>Allowed network access<select name="ip_enabled" aria-label="Allowed network access" x-model="network"><option value="0">Any network (default)</option><option value="1">Only approved IP addresses</option></select><small>{{ $scopeTenant ? 'Applies to all company browser accounts.' : 'Applies only to platform administrator browser accounts.' }}</small></label>
<div><strong>Your current IP</strong><p><code>{{ request()->ip() }}</code></p><small>Use your office's public IP. If it changes regularly, keep restrictions disabled. Trusted proxy configuration affects the detected IP.</small></div>
<label class="form-span" x-show="network==='1'">Approved IP addresses<textarea name="allowed_ips" rows="4" maxlength="4000" placeholder="One IP address or network range per line">{{ old('allowed_ips',implode("\n",$policy->allowed_ips ?? [])) }}</textarea><small>IPv4 and IPv6 supported. Example: 203.0.113.10 or 203.0.113.0/24. Up to 50 entries.</small></label>
@unless($policy->ip_enabled)<label class="checkbox-label form-span" x-show="network==='1'" x-cloak><input type="checkbox" name="recovery_saved" value="1" @checked(old('recovery_saved'))>I have saved the access recovery codes for this workspace.</label>@endunless
@if($manageLimits)
<label>{{ $scopeTenant ? 'Company session limit' : 'Global session limit' }}<select name="limit_mode" aria-label="Session limit mode" x-model="limit">@if($scopeTenant)<option value="inherit">Use global default ({{ $globalLimit ?: 'Unlimited' }})</option>@endif<option value="limited">Set a limit</option><option value="unlimited">Unlimited</option></select><small>{{ $scopeTenant ? 'This override can be higher or lower than the global default.' : 'Applies per account to companies without an override, and to platform administrators.' }}</small></label>
<label x-show="limit==='limited'">Maximum active sessions per account<input name="session_limit" type="number" min="1" max="100" value="{{ old('session_limit',$policy->session_limit ?: $limit ?: 3) }}" :disabled="limit!=='limited'"><small>1 to 100 browser sessions. When full, a new login signs out the oldest session.</small></label>
@else
<div class="form-span"><strong>Active session limit: {{ $limit ?: 'Unlimited' }}</strong><p class="hint">Per account. A new login signs out the oldest session when full. Ask Super Admin to change your company's limit.</p></div>
@endif
<p class="hint form-span">A session is a browser profile or installed app login, not a physical computer. Tabs normally share one session. Existing sessions are registered as they next access the app. Changed limits are enforced on the next authenticated request.</p>
<div class="form-span"><button class="button primary"><x-icon name="check"/>Save access settings</button></div>
</form></section>
<section class="panel"><div class="panel-heading"><h2>Recovery</h2></div><div class="panel-body"><p>Create and save recovery codes before enabling IP restrictions. A recovery code plus your administrator password can disable the IP restriction. It does not sign you in or bypass MFA.</p><p class="hint">{{ count($policy->recovery_hashes ?? []) }} unused recovery codes available. Creating new codes replaces all previous codes.</p><form method="post" action="{{ $actionBase }}/recovery-codes">@csrf<button class="button secondary">Create recovery codes</button></form><p><a href="/access-recovery">Open access recovery</a> · Super Admin can also disable a company's restriction. Hosting administrators can use the documented terminal recovery command.</p></div></section>
<section class="panel"><div class="panel-heading"><div><h2>Login sessions</h2><p>Active means the session has not expired or been signed out. It does not prove someone is using the screen right now. Browser and system details are reported by the device.</p></div></div>
<form class="panel-body filter-bar" method="get"><label>Search sessions<input type="search" name="q" value="{{ request('q') }}" maxlength="100" placeholder="Name, email or IP"></label><label>Show sessions<select name="view" aria-label="Show sessions"><option value="active">Active sessions</option><option value="recent" @selected(request('view')==='recent')>Recent logins (90 days)</option></select></label><button class="button primary">Filter sessions</button><a class="button secondary" href="{{ $actionBase }}">Clear</a></form>
<div class="table-scroll"><table data-ui-list="true"><thead><tr><th>Account</th><th>Browser / system</th><th>IP address</th><th>Signed in / last seen ({{ $timezone }})</th><th>Status</th><th>Actions</th></tr></thead><tbody>
@forelse($sessions as $login)
@php($active=!$login->revoked_at && $login->expires_at->isFuture() && $login->user && !$login->user->disabled_at && $login->security_version===(int)$login->user->security_version)
<tr><td><strong>{{ $login->user?->name ?? 'Removed account' }}</strong><br>{{ $login->user?->email }}</td><td>{{ $login->browser }} · {{ $login->system }}<br><small>{{ $login->device }}</small></td><td>{{ $login->ip }}</td><td>{{ $login->started_at->timezone($timezone)->format('d M Y H:i') }}<br><small>Last seen {{ $login->last_seen_at->timezone($timezone)->format('d M Y H:i') }}</small></td><td><span class="badge {{ $active?'green':'gray' }}">{{ $active?'Active':'Ended' }}</span>@if($login->id===$currentId)<br><small>This session</small>@endif @if($login->end_reason)<br><small>{{ \Illuminate\Support\Str::headline($login->end_reason) }}</small>@endif</td><td data-custom-row-actions>@if($active)<form method="post" action="{{ $actionBase }}/sessions/{{ $login->id }}/revoke">@csrf<button class="button secondary">Sign out session</button></form>@else<span class="hint">No action needed</span>@endif</td></tr>
@empty<tr><td colspan="6">No sessions match your filters.</td></tr>@endforelse
</tbody></table></div>{{ $sessions->links() }}</section>