{% extends "base.html" %}
{% block content %}

<section class="hero">
  <h1>Cisco STIG audit — offline, on-prem, intelligent.</h1>
  <p class="lede">
    Paste a running-config or upload a <code>.cfg</code> file. NetGuard parses it,
    classifies the device, runs the catalog-driven DISA STIG audit, triages every
    manual-review item, and gives you a STIG-Viewer-ready <code>.ckl</code> in
    one click. Nothing leaves this machine.
  </p>
</section>

{% if error %}<div class="error">{{ error }}</div>{% endif %}

{% if not catalog_loaded %}
<div class="warning">
  <strong>STIG catalog not loaded.</strong>
  Build it once with
  <code>python -m netguard --build-stig-catalog stigs --catalog-out stigs/stig_catalog.json</code>.
  The audit will run but no STIG findings will be produced.
</div>
{% endif %}

<form action="{{ url_for('submit_audit') }}" method="post" enctype="multipart/form-data" class="audit-form">
  <label>Paste running-config</label>
  <textarea name="config_text" rows="14"
            placeholder="hostname SW-ACCESS-01&#10;!&#10;version 17.15&#10;..."></textarea>

  <div class="or-row"><span>— or —</span></div>

  <label>Upload one or more <code>.cfg</code> files</label>
  <input type="file" name="config_files" accept=".cfg,.txt,.conf" multiple>
  <div class="hint" style="margin-top:0.25rem;">
    Select multiple files for a batch audit — netguard will run each through the
    full pipeline and produce an aggregate dashboard with one-click ZIP downloads
    of every CKL / annotated .cfg.
  </div>

  <div class="actions">
    <button type="submit" class="primary">Run audit</button>
    <span class="hint">
      Outputs: triaged findings · annotated <code>.cfg</code> · DISA <code>.ckl</code> · CSV
    </span>
  </div>
</form>

<div class="quick-actions">
  <a href="{{ url_for('pull_form') }}" class="btn ghost">⚡ SSH-pull a live device</a>
  <a href="{{ url_for('history') }}" class="btn ghost">🗂 Audit history</a>
  <a href="{{ url_for('catalog_view') }}" class="btn ghost">📚 Catalog refresh</a>
</div>

<section class="catalog-stats">
  <h2>Catalog loaded</h2>
  {% if catalog_loaded %}
    <div class="catalog-row">
      <div class="catalog-num">{{ catalog_total }}</div>
      <div class="catalog-label">STIG rules across {{ catalog_products|length }} Cisco product families</div>
    </div>
    <div class="catalog-row">
      <div class="catalog-num">{{ n_implemented }}</div>
      <div class="catalog-label">auto-checks with PASS / FAIL + Deviation engine</div>
    </div>
    <div class="catalog-products">
      {% for p in catalog_products %}<span class="pill">{{ p }}</span>{% endfor %}
    </div>
    <div class="catalog-path muted">Source: <code>{{ catalog_path }}</code></div>
  {% else %}
    <p class="muted">Build the catalog to see rule counts here.</p>
  {% endif %}
</section>

<section class="checks-listing">
  <h2>What you get on every audit</h2>
  <div class="check-cols">
    <div>
      <h3>Auto-checked controls</h3>
      <p class="muted">{{ n_implemented }} STIG vulns netguard verifies structurally:
        banner, vty timeout, NTP redundancy + auth, SNMPv3, syslog redundancy,
        password encryption, HTTP server disable, login-audit logging.
        Same code covers IOS, IOS-XE, NX-OS via short_id mapping.</p>
    </div>
    <div>
      <h3>Deviation engine (L1)</h3>
      <p class="muted">Every FAIL carries Expected / Actual / At / Patch — the exact
        config commands to paste, with source line numbers. No more
        "V-220544 failed" with no context.</p>
    </div>
    <div>
      <h3>MANUAL triage (L2)</h3>
      <p class="muted">A 25-topic protocol classifier scans every MANUAL rule and
        proposes "likely N/A" with engineering reasoning ("Device runs no BGP;
        routing is via EIGRP AS 65000 on lines 145–158") or "applicable — review
        these lines" with config localization. Drops the review pile 40–60%.</p>
    </div>
    <div>
      <h3>Audit trail outputs</h3>
      <p class="muted">DISA <code>.ckl</code> drops into STIG Viewer.
        Annotated <code>.cfg</code> for the compliance binder.
        CSV for ad-hoc analysis. Every line that maps to a STIG control is documented in place.</p>
    </div>
    <div>
      <h3>802.1x posture</h3>
      <p class="muted">Beyond STIG: detects the AAA / RADIUS prereqs,
        host-mode mismatches, monitor-mode (auth open) ports, missing
        portfast/bpduguard, and VLAN-uplink blackholes that silently break
        IP phones + dot1x clients.</p>
    </div>
    <div>
      <h3>Live device pull <span class="badge-new">CLI</span></h3>
      <p class="muted">
        <code>netguard --pull HOST --audit-after</code> SSHs to a Cisco device,
        pulls running-config + facts, runs the audit end-to-end. Browser-driven
        pull is on the roadmap.
      </p>
    </div>
  </div>
</section>

<section class="footer-note muted">
  <p>InfoRelay NetGuard runs locally on <code>127.0.0.1</code>. Configs never leave this machine.
    No telemetry, no phone-home, no external LLM. Designed for air-gapped DoD environments.</p>
</section>

{% endblock %}