{% extends "base.html" %}
{% block content %}

<section class="hero">
  <h1>SSH-pull a live device</h1>
  <p class="lede">
    netguard connects only to the host you specify, only over SSH, only with the
    credentials you enter on this page. Credentials live in this process for the
    duration of the pull — never written to disk, never sent anywhere else.
  </p>
</section>

{% if error %}<div class="error">{{ error }}</div>{% endif %}

{% if not catalog_loaded %}
<div class="warning">
  <strong>STIG catalog not loaded.</strong>
  Audit will run but STIG findings will be empty until you import a catalog
  on the <a href="{{ url_for('catalog_view') }}">Catalog</a> page.
</div>
{% endif %}

<form action="{{ url_for('pull_submit') }}" method="post" class="audit-form" autocomplete="off">
  <div class="form-grid">
    <div>
      <label>Host (IP or DNS)</label>
      <input type="text" name="host" placeholder="10.1.2.3" required autofocus>
    </div>
    <div>
      <label>SSH port</label>
      <input type="number" name="ssh_port" value="22" min="1" max="65535">
    </div>

    <div>
      <label>Username</label>
      <input type="text" name="user" placeholder="scan" required autocomplete="off">
    </div>
    <div>
      <label>Device type</label>
      <select name="device_type">
        <option value="auto" selected>Auto-detect</option>
        <option value="cisco_ios">cisco_ios</option>
        <option value="cisco_xe">cisco_xe</option>
        <option value="cisco_nxos">cisco_nxos</option>
        <option value="cisco_xr">cisco_xr</option>
      </select>
    </div>

    <div class="full">
      <label>Password</label>
      <input type="password" name="password" required autocomplete="new-password">
    </div>
    <div class="full">
      <label>Enable secret <span class="muted-inline">(optional — leave blank if user is privilege-15)</span></label>
      <input type="password" name="enable_secret" autocomplete="new-password">
    </div>
  </div>

  <div class="actions">
    <button type="submit" class="primary">Pull config + run audit</button>
    <span class="hint">
      One round-trip: SSH → <code>show running-config</code> + <code>show version</code>
      → parse → audit → annotated .cfg + .ckl.
    </span>
  </div>
</form>

<section class="footer-note muted">
  <p>Recommended workflow for DoD environments: dedicated <code>scan</code> user
    with a fixed passcode (not RSA token + interactive 2FA), privilege-15 read-only
    or restricted-command-set so the audit pull is rate-limited and auditable.</p>
</section>

{% endblock %}