SettingsPage.cpp

Go to the documentation of this file.

/*
 * BastionGuard™
 * Copyright (C) 2025–2026 Calogero Scarnà
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, version 3.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 *
 * BastionGuard™ is a trademark of Calogero Scarnà.
 * The BastionGuard™ name and branding are not licensed under the GPL.
 */
 
#include "Resource.hpp"
#include "SettingsPage.hpp"
#include "SafeProcess.hpp"
#include "DistroUtils.hpp"
#include "Utils.hpp"
#include "pac/PacManager.hpp"
#include "SettingsStore.hpp"
#include "firewall/FirewallChoiceDialog.hpp"
#include "Backend.hpp"
#include <iostream>
#include <filesystem>
#include <cstdlib>
#include <chrono>
#include <sys/wait.h>
#include <ctime>
#include <unistd.h>
#include <gtkmm/listview.h>
#include <gtkmm/entry.h>
#include <gtkmm/alertdialog.h>
#include <gtkmm/scrolledwindow.h>
#include <gtkmm/searchentry.h>
#include <gtkmm/singleselection.h>
#include <gtkmm/signallistitemfactory.h>
#include <giomm/liststore.h>
#include <glibmm/miscutils.h>
#include <glibmm/shell.h>
#include <gtkmm/filechooserdialog.h>
#include <gtkmm/messagedialog.h>
#include <glibmm/miscutils.h>
#include <gtkmm/filterlistmodel.h>
#include <fstream>
#include <regex>
#include <pwd.h>
#include <arpa/inet.h>   // inet_pton per validazione IP/CIDR nel bypass proxy
#include <unistd.h>
#include <sys/stat.h>
#include <glibmm/i18n.h>
#include <array>
#include <memory>
#include <fcntl.h>
#include <sys/stat.h>
#include <gtkmm/grid.h>
#include <gtkmm/spinbutton.h>
#include <gtkmm/window.h>
#include <sstream>
#include <iomanip>
 
namespace fs = std::filesystem;
using json = nlohmann::json;
 
namespace {
    static bool run_cmd(const std::vector<std::string>& argv,
                        std::string* out_stdout = nullptr,
                        bool silence_stderr = true)
    {
        const auto result = bg_process::run(argv, !silence_stderr);
        if (out_stdout) *out_stdout = result.output;
        return result.ok();
    }
 
    static bool pkexec_servicectl(const std::vector<std::string>& args,
                                std::string* out_stdout = nullptr)
    {
        std::vector<std::string> argv;
        argv.reserve(args.size() + 3);
        argv.push_back("pkexec");
        argv.push_back("/usr/libexec/bastionguard/bastionguard-service");
        argv.push_back("--system");
        argv.insert(argv.end(), args.begin(), args.end());
 
        return run_cmd(argv, out_stdout, false);
    }
}
 
 
struct MailSignatureConfig {
    std::string display_name;
    std::string job_title;
    std::string company;
    std::string phone;
    std::string website;
    std::string logo_path;
};
 
struct MailRelayProfile {
    std::string id;
    std::string label;
 
    std::vector<std::string> match_from;
    std::vector<std::string> match_from_domain;
 
    std::string smtp_host;
    int smtp_port = 587;
    bool starttls = true;
    bool implicit_tls = false;
 
    std::string username;
    std::string password;
 
    MailSignatureConfig signature;
};
 
struct MailSecurityConfig {
    int version = 2;
    bool enabled = false;
    bool scan_outgoing = true;
    bool inject_signature = false;
 
    std::string local_host = "127.0.0.1";
    int local_port = 2525;
    int local_tls_port = 2465;
    int local_submission_port = 2587;
 
    bool advertise_starttls = true;
    bool enable_implicit_tls_listener = true;
 
    std::string default_profile_id;
    std::vector<MailRelayProfile> profiles;
};
 
static std::string mail_json_path_user();
static std::string iso_today_yyyy_mm_dd();
 
static std::string mail_json_path_user() {
    return Glib::get_home_dir() + "/.config/BastionGuard/mail.json";
}
 
static std::vector<std::string> split_semicolon_list(const std::string& input) {
    std::vector<std::string> out;
    std::string cur;
 
    auto push_trimmed = [&](std::string s) {
        auto l = s.find_first_not_of(" \t\r\n");
        auto r = s.find_last_not_of(" \t\r\n");
        if (l == std::string::npos) return;
        s = s.substr(l, r - l + 1);
        if (!s.empty()) out.push_back(s);
    };
 
    for (char c : input) {
        if (c == ';') {
            push_trimmed(cur);
            cur.clear();
        } else {
            cur += c;
        }
    }
    push_trimmed(cur);
    return out;
}
 
static std::string join_semicolon_list(const std::vector<std::string>& items) {
    std::ostringstream oss;
    for (size_t i = 0; i < items.size(); ++i) {
        if (i) oss << "; ";
        oss << items[i];
    }
    return oss.str();
}
 
static std::string make_profile_id(const std::string& label) {
    std::string out;
    for (unsigned char c : label) {
        if (std::isalnum(c)) out += (char)std::tolower(c);
        else if (c == ' ' || c == '-' || c == '_') out += '-';
    }
 
    while (out.find("--") != std::string::npos)
        out = std::regex_replace(out, std::regex("--"), "-");
 
    if (!out.empty() && out.front() == '-') out.erase(out.begin());
    if (!out.empty() && out.back() == '-') out.pop_back();
    if (out.empty()) out = "profile";
    return out;
}
 
static void ensure_mail_json_exists() {
    const std::string path = mail_json_path_user();
 
    try {
        std::filesystem::create_directories(std::filesystem::path(path).parent_path());
    } catch (...) {}
 
    if (std::filesystem::exists(path)) return;
 
    json j;
    j["version"] = 2;
    j["enabled"] = false;
    j["scan_outgoing"] = true;
    j["inject_signature"] = false;
    j["local_smtp_host"] = "127.0.0.1";
    j["local_smtp_port"] = 2525;
    j["default_profile_id"] = "default";
 
    j["profiles"] = json::array({
        {
            {"id", "default"},
            {"label", "Default"},
            {"match_from", json::array()},
            {"match_from_domain", json::array()},
            {"smtp_host", ""},
            {"smtp_port", 587},
            {"starttls", true},
            {"implicit_tls", false},
            {"username", ""},
            {"password", ""},
            {"signature", {
                {"display_name", ""},
                {"job_title", ""},
                {"company", ""},
                {"phone", ""},
                {"website", ""},
                {"logo_path", ""}
            }}
        }
    });
 
    std::ofstream out(path, std::ios::binary | std::ios::trunc);
    if (out.good()) out << j.dump(2);
}
 
 
static bool run_privhelper_and_capture(const std::vector<std::string>& args,
                                       std::string& stdout_out,
                                       std::string& stderr_out,
                                       int& exit_status)
{
    try {
        std::vector<std::string> argv;
        argv.push_back("pkexec");
        argv.push_back("/usr/bin/bastionguard-emailproxy");
        argv.insert(argv.end(), args.begin(), args.end());
 
        auto proc = Gio::Subprocess::create(
            argv,
            Gio::Subprocess::Flags::STDOUT_PIPE |
            Gio::Subprocess::Flags::STDERR_PIPE
        );
 
        auto result = proc->communicate_utf8("");
        stdout_out = result.first;
        stderr_out = result.second;
 
        if (proc->get_if_exited())
            exit_status = proc->get_exit_status();
        else
            exit_status = -1;
 
        return proc->get_if_exited() && exit_status == 0;
    } catch (const std::exception& e) {
        stdout_out.clear();
        stderr_out = e.what();
        exit_status = -1;
        return false;
    }
}
 
static bool write_mail_config_temp_json(const MailSecurityConfig& cfg, std::string& out_path) {
    try {
        auto tmpdir = Glib::get_tmp_dir();
        out_path = Glib::build_filename(tmpdir, "bastionguard-mail-config.json");
 
        json j;
        j["version"] = cfg.version;
        j["enabled"] = cfg.enabled;
        j["scan_outgoing"] = cfg.scan_outgoing;
        j["inject_signature"] = cfg.inject_signature;
        j["local_smtp_host"] = cfg.local_host;
        j["local_smtp_port"] = cfg.local_port;
        j["local_smtp_tls_port"] = cfg.local_tls_port;
        j["advertise_starttls"] = cfg.advertise_starttls;
        j["enable_implicit_tls_listener"] = cfg.enable_implicit_tls_listener;
        j["default_profile_id"] = cfg.default_profile_id;
 
        j["profiles"] = json::array();
        for (const auto& p : cfg.profiles) {
            json jp;
            jp["id"] = p.id;
            jp["label"] = p.label;
            jp["match_from"] = p.match_from;
            jp["match_from_domain"] = p.match_from_domain;
            jp["smtp_host"] = p.smtp_host;
            jp["smtp_port"] = p.smtp_port;
            jp["starttls"] = p.starttls;
            jp["implicit_tls"] = p.implicit_tls;
            jp["username"] = p.username;
            jp["password"] = p.password;
 
            jp["signature"] = {
                {"display_name", p.signature.display_name},
                {"job_title", p.signature.job_title},
                {"company", p.signature.company},
                {"phone", p.signature.phone},
                {"website", p.signature.website},
                {"logo_path", "/usr/share/BastionGuard/data/logo.png"}
            };
 
            j["profiles"].push_back(jp);
        }
 
        std::ofstream out(out_path, std::ios::binary | std::ios::trunc);
        if (!out.good())
            return false;
 
        out << j.dump(2);
        return out.good();
    } catch (...) {
        return false;
    }
}
 
static void append_to_textbuffer(const Glib::RefPtr<Gtk::TextBuffer>& buffer,
                                 const Glib::ustring& text)
{
    buffer->insert(buffer->end(), text);
    auto mark = buffer->create_mark(buffer->end());
}
 
static MailSecurityConfig load_mail_security_config() {
    ensure_mail_json_exists();
 
    MailSecurityConfig cfg;
    const std::string path = mail_json_path_user();
 
    try {
        std::ifstream in(path, std::ios::binary);
        if (!in.good()) return cfg;
 
        json j;
        in >> j;
 
        cfg.version          = j.value("version", 2);
        cfg.enabled          = j.value("enabled", false);
        cfg.scan_outgoing    = j.value("scan_outgoing", true);
        cfg.inject_signature = j.value("inject_signature", false);
        cfg.local_host       = j.value("local_smtp_host", std::string("127.0.0.1"));
        cfg.local_port             = j.value("local_smtp_port", 2525);
        cfg.local_tls_port         = j.value("local_smtp_tls_port", 2465);
        cfg.local_submission_port  = j.value("local_submission_port", 2587);
        cfg.advertise_starttls         = j.value("advertise_starttls", true);
        cfg.enable_implicit_tls_listener = j.value("enable_implicit_tls_listener", true);
        cfg.default_profile_id = j.value("default_profile_id", std::string("default"));
 
        if (j.contains("profiles") && j["profiles"].is_array()) {
            for (const auto& p : j["profiles"]) {
                if (!p.is_object()) continue;
 
                MailRelayProfile prof;
                prof.id           = p.value("id", std::string());
                prof.label        = p.value("label", std::string("Profile"));
                prof.smtp_host    = p.value("smtp_host", std::string());
                prof.smtp_port    = p.value("smtp_port", 587);
                prof.starttls     = p.value("starttls", true);
                prof.implicit_tls = p.value("implicit_tls", false);
                prof.username     = p.value("username", std::string());
                prof.password     = p.value("password", std::string());
 
                if (p.contains("match_from") && p["match_from"].is_array()) {
                    for (const auto& v : p["match_from"])
                        if (v.is_string()) prof.match_from.push_back(v.get<std::string>());
                }
 
                if (p.contains("match_from_domain") && p["match_from_domain"].is_array()) {
                    for (const auto& v : p["match_from_domain"])
                        if (v.is_string()) prof.match_from_domain.push_back(v.get<std::string>());
                }
 
                if (p.contains("signature") && p["signature"].is_object()) {
                    const auto& s = p["signature"];
                    prof.signature.display_name = s.value("display_name", std::string());
                    prof.signature.job_title    = s.value("job_title", std::string());
                    prof.signature.company      = s.value("company", std::string());
                    prof.signature.phone        = s.value("phone", std::string());
                    prof.signature.website      = s.value("website", std::string());
                    prof.signature.logo_path    = s.value("logo_path", std::string());
                }
 
                if (prof.id.empty())
                    prof.id = make_profile_id(prof.label);
 
                cfg.profiles.push_back(std::move(prof));
            }
        }
 
        if (cfg.profiles.empty()) {
            MailRelayProfile p;
            p.id = "default";
            p.label = "Default";
            cfg.profiles.push_back(std::move(p));
            cfg.default_profile_id = "default";
        }
    } catch (...) {
    }
 
    return cfg;
}
 
static bool save_mail_security_config(const MailSecurityConfig& cfg) {
    ensure_mail_json_exists();
    const std::string path = mail_json_path_user();
 
    try {
        json j;
        j["version"] = 2;
        j["updated_at"] = iso_today_yyyy_mm_dd();
        j["enabled"] = cfg.enabled;
        j["scan_outgoing"] = cfg.scan_outgoing;
        j["inject_signature"] = cfg.inject_signature;
        j["local_smtp_host"] = cfg.local_host;
        j["local_smtp_port"] = cfg.local_port;
        j["local_smtp_tls_port"]         = cfg.local_tls_port;
        j["local_submission_port"]        = cfg.local_submission_port;
        j["advertise_starttls"]           = cfg.advertise_starttls;
        j["enable_implicit_tls_listener"] = cfg.enable_implicit_tls_listener;
        j["default_profile_id"] = cfg.default_profile_id;
        j["profiles"] = json::array();
 
        for (const auto& p : cfg.profiles) {
            json jp;
            jp["id"] = p.id;
            jp["label"] = p.label;
            jp["match_from"] = p.match_from;
            jp["match_from_domain"] = p.match_from_domain;
            jp["smtp_host"] = p.smtp_host;
            jp["smtp_port"] = p.smtp_port;
            jp["starttls"] = p.starttls;
            jp["implicit_tls"] = p.implicit_tls;
            jp["username"] = p.username;
            jp["password"] = p.password;
            jp["signature"] = {
                {"display_name", p.signature.display_name},
                {"job_title", p.signature.job_title},
                {"company", p.signature.company},
                {"phone", p.signature.phone},
                {"website", p.signature.website},
                {"logo_path", p.signature.logo_path}
            };
            j["profiles"].push_back(std::move(jp));
        }
 
        const std::string tmp = path + ".tmp";
        {
            std::ofstream out(tmp, std::ios::binary | std::ios::trunc);
            if (!out.good()) return false;
            out << j.dump(2);
            out.flush();
            if (!out.good()) return false;
        }
 
        std::error_code ec;
        std::filesystem::rename(tmp, path, ec);
        if (ec) {
            std::filesystem::remove(path, ec);
            ec.clear();
            std::filesystem::rename(tmp, path, ec);
            if (ec) {
                std::filesystem::remove(tmp, ec);
                return false;
            }
        }
 
        return true;
    } catch (...) {
        return false;
    }
}
 
static std::string build_email_signature_preview_html(const MailSignatureConfig& sig) {
    std::ostringstream html;
 
    html << "<table cellpadding=\"0\" cellspacing=\"0\" border=\"0\" "
         << "style=\"font-family:Arial,Helvetica,sans-serif;font-size:14px;color:#212529;\">"
         << "<tr>";
 
    if (!sig.logo_path.empty()) {
        html << "<td style=\"vertical-align:top;padding-right:12px;\">"
             << "<img src=\"file://" << sig.logo_path << "\" alt=\"logo\" width=\"72\" "
             << "style=\"display:block;border:0;\">"
             << "</td>";
    }
 
    html << "<td style=\"vertical-align:top;\">";
 
    if (!sig.display_name.empty()) {
        html << "<div style=\"font-size:16px;font-weight:700;color:#0d6efd;\">"
             << sig.display_name << "</div>";
    }
 
    {
        std::string roleLine;
        if (!sig.job_title.empty()) roleLine += sig.job_title;
        if (!sig.job_title.empty() && !sig.company.empty()) roleLine += " · ";
        if (!sig.company.empty()) roleLine += sig.company;
 
        if (!roleLine.empty()) {
            html << "<div style=\"font-size:13px;color:#6c757d;\">"
                 << roleLine << "</div>";
        }
    }
 
    html << "<div style=\"margin-top:8px;\">";
 
    if (!sig.website.empty()) {
        html << "<a href=\"" << sig.website << "\" "
             << "style=\"color:#0d6efd;text-decoration:none;\">"
             << sig.website << "</a><br>";
    }
 
    if (!sig.phone.empty()) {
        html << "<span style=\"color:#212529;\">" << sig.phone << "</span><br>";
    }
 
    html << "<span style=\"color:#6c757d;\">Protected by BastionGuard</span>";
    html << "</div>";
    html << "</td></tr></table>";
 
    return html.str();
}
 
static bool is_clamav_signature_file(const std::filesystem::path& p)
{
    if (!p.has_extension()) return false;
 
    std::string ext = p.extension().string();
    std::transform(ext.begin(), ext.end(), ext.begin(),
                   [](unsigned char c){ return std::tolower(c); });
 
    // Estensioni comuni DB/firme ClamAV
    static const std::set<std::string> exts = {
        ".ndb", ".hdb", ".hsb", ".ldb", ".sdb", ".fp", ".mdb", ".pdb",
        ".wdb", ".cbc", ".cdb", ".cat"
    };
 
    if (exts.find(ext) == exts.end())
        return false;
 
    // scarta file nascosti
    const auto name = p.filename().string();
    if (!name.empty() && name[0] == '.') return false;
 
    return true;
}
 
static Gtk::Window* create_log_popup(Gtk::Widget* owner, const Glib::RefPtr<Gtk::TextBuffer>& buffer)
{
    auto* win = new Gtk::Window();
    win->set_title(_("Installazione navigazione sicura"));
    win->set_default_size(760, 420);
    win->set_modal(true);
    win->set_resizable(true);
 
    if (owner) {
        if (auto* root = owner->get_root()) {
            if (auto* parent = dynamic_cast<Gtk::Window*>(root)) {
                win->set_transient_for(*parent);
            }
        }
    }
 
    auto* outer = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 12);
    outer->set_margin_top(12);
    outer->set_margin_bottom(12);
    outer->set_margin_start(12);
    outer->set_margin_end(12);
 
    auto* title = Gtk::make_managed<Gtk::Label>(_("Log installazione"));
    title->set_halign(Gtk::Align::START);
    title->add_css_class("title-4");
    outer->append(*title);
 
    auto* text = Gtk::make_managed<Gtk::TextView>();
    text->set_buffer(buffer);
    text->set_editable(false);
    text->set_cursor_visible(false);
    text->set_monospace(true);
    text->set_wrap_mode(Gtk::WrapMode::WORD_CHAR);
    text->set_vexpand(true);
    text->set_hexpand(true);
 
    auto* scroll = Gtk::make_managed<Gtk::ScrolledWindow>();
    scroll->set_policy(Gtk::PolicyType::AUTOMATIC, Gtk::PolicyType::AUTOMATIC);
    scroll->set_min_content_height(320);
    scroll->set_child(*text);
    outer->append(*scroll);
 
    auto* btnClose = Gtk::make_managed<Gtk::Button>(_("Chiudi"));
    btnClose->set_halign(Gtk::Align::END);
    btnClose->signal_clicked().connect([win]() {
        win->hide();
        delete win;
    });
    outer->append(*btnClose);
 
    win->set_child(*outer);
    win->present();
    return win;
}
 
static std::vector<std::filesystem::path> list_clamav_signatures(const std::filesystem::path& dir)
{
    std::vector<std::filesystem::path> out;
    std::error_code ec;
 
    if (!std::filesystem::exists(dir, ec) || !std::filesystem::is_directory(dir, ec))
        return out;
 
    for (const auto& entry : std::filesystem::directory_iterator(dir, ec))
    {
        if (ec) break;
        if (!entry.is_regular_file(ec)) continue;
 
        const auto& p = entry.path();
        if (is_clamav_signature_file(p))
            out.push_back(p);
    }
 
    std::sort(out.begin(), out.end(),
              [](const auto& a, const auto& b){
                  return a.filename().string() < b.filename().string();
              });
 
    return out;
}
 
static std::string payments_json_path_user() {
    return Glib::get_home_dir() + "/.config/BastionGuard/payments.json";
}
 
 
struct TbSmtpEntry {
    std::string id;
    std::string hostname;
    int port = 587;
    std::string username;
    int try_ssl = 0;
    std::string description;
};
 
struct TbIdentityEntry {
    std::string email;
    std::string smtp_server;
};
 
static bool tb_parse_pref_line(const std::string& line,
                                std::string& key, std::string& value) {
    const std::string prefix = "user_pref(\"";
    if (line.rfind(prefix, 0) != 0) return false;
 
    auto ks = prefix.size();
    auto ke = line.find('"', ks);
    if (ke == std::string::npos) return false;
    key = line.substr(ks, ke - ks);
 
    auto vs = line.find(',', ke);
    if (vs == std::string::npos) return false;
    ++vs;
    while (vs < line.size() && line[vs] == ' ') ++vs;
 
    auto ve = line.rfind(')');
    if (ve == std::string::npos || ve <= vs) return false;
    value = line.substr(vs, ve - vs);
 
 
    if (value.size() >= 2 && value.front() == '"' && value.back() == '"')
        value = value.substr(1, value.size() - 2);
 
    return true;
}
 
static std::map<std::string, std::map<std::string,std::string>>
tb_parse_ini_file(const std::string& path) {
    std::map<std::string, std::map<std::string,std::string>> sections;
    std::ifstream f(path);
    if (!f.is_open()) return sections;
 
    std::string line, sec;
    while (std::getline(f, line)) {
        // trim
        auto s = line.find_first_not_of(" \t\r\n");
        if (s == std::string::npos || line[s] == ';' || line[s] == '#') continue;
        line = line.substr(s);
        auto e = line.find_last_not_of(" \t\r\n");
        if (e != std::string::npos) line = line.substr(0, e + 1);
 
        if (line.front() == '[' && line.back() == ']') {
            sec = line.substr(1, line.size() - 2);
            continue;
        }
        auto eq = line.find('=');
        if (eq == std::string::npos || sec.empty()) continue;
        sections[sec][line.substr(0, eq)] = line.substr(eq + 1);
    }
    return sections;
}
 
static std::string tb_find_default_profile() {
    const std::string base = Glib::get_home_dir() + "/.thunderbird";
 
    {
        auto installs = tb_parse_ini_file(base + "/installs.ini");
        for (const auto& [sec, kv] : installs) {
            auto it = kv.find("Default");
            if (it == kv.end()) continue;
            std::string path = it->second;
            if (!path.empty() && path.front() != '/')
                path = base + "/" + path;
            if (std::filesystem::exists(path + "/prefs.js"))
                return path;
        }
    }
 
    auto sections = tb_parse_ini_file(base + "/profiles.ini");
 
    std::string best_default_release;
    std::string best_default_flag;
    std::string best_any;
 
    for (const auto& [sec, kv] : sections) {
        if (sec.rfind("Profile", 0) != 0) continue;
        auto it_path = kv.find("Path");
        if (it_path == kv.end()) continue;
 
        std::string path = it_path->second;
        auto it_rel = kv.find("IsRelative");
        bool rel = (it_rel == kv.end() || it_rel->second != "0");
        if (rel) path = base + "/" + path;
 
        if (!std::filesystem::exists(path + "/prefs.js")) continue;
 
        // Default=1
        auto it_def = kv.find("Default");
        if (it_def != kv.end() && it_def->second == "1" && best_default_flag.empty())
            best_default_flag = path;
 
        // suffisso .default-release
        const std::string suffix = ".default-release";
        if (path.size() >= suffix.size() &&
            path.compare(path.size() - suffix.size(), suffix.size(), suffix) == 0 &&
            best_default_release.empty())
            best_default_release = path;
 
        if (best_any.empty()) best_any = path;
    }
 
    if (!best_default_flag.empty())   return best_default_flag;
    if (!best_default_release.empty()) return best_default_release;
    return best_any;
}
 
static std::vector<MailRelayProfile> tb_import_profiles(std::string& err_out) {
    std::vector<MailRelayProfile> result;
    err_out.clear();
 
    const std::string profile_dir = tb_find_default_profile();
    if (profile_dir.empty()) {
        err_out = _("Profilo Thunderbird non trovato");
        return result;
    }
 
    const std::string prefs_path = profile_dir + "/prefs.js";
    std::ifstream in(prefs_path);
    if (!in.is_open()) {
        err_out = _("prefs.js non trovato: ") + prefs_path;
        return result;
    }
 
    std::map<std::string, TbSmtpEntry>    smtp_map;
    std::map<std::string, TbIdentityEntry> identity_map;
 
    std::string line;
    while (std::getline(in, line)) {
        std::string key, value;
        if (!tb_parse_pref_line(line, key, value)) continue;
 
        if (key.rfind("mail.smtpserver.", 0) == 0) {
            auto rest = key.substr(16);
            auto dot  = rest.find('.');
            if (dot == std::string::npos) continue;
            auto sid   = rest.substr(0, dot);
            auto field = rest.substr(dot + 1);
            auto& s = smtp_map[sid];
            s.id = sid;
            if (field == "hostname")    s.hostname    = value;
            else if (field == "port")   s.port        = std::atoi(value.c_str());
            else if (field == "username") s.username  = value;
            else if (field == "try_ssl")  s.try_ssl   = std::atoi(value.c_str());
            else if (field == "description") s.description = value;
        }
        else if (key.rfind("mail.identity.", 0) == 0) {
            auto rest = key.substr(14);
            auto dot  = rest.find('.');
            if (dot == std::string::npos) continue;
            auto iid   = rest.substr(0, dot);
            auto field = rest.substr(dot + 1);
            auto& id = identity_map[iid];
            if (field == "useremail")   id.email       = value;
            else if (field == "smtpServer") id.smtp_server = value;
        }
    }
 
    std::map<std::string, MailRelayProfile> built;
 
    for (const auto& [iid, ident] : identity_map) {
        if (ident.email.empty() || ident.smtp_server.empty()) continue;
        auto it = smtp_map.find(ident.smtp_server);
        if (it == smtp_map.end()) continue;
 
        const auto& s = it->second;
        auto& p = built[s.id];
 
        if (p.id.empty()) {
            p.id         = s.id;
            p.label      = s.description.empty() ? s.hostname : s.description;
            p.smtp_host  = s.hostname;
            p.smtp_port  = (s.port > 0 ? s.port : 587);
            p.username   = s.username;
            p.password   = "";
            p.starttls      = (s.try_ssl == 2);
            p.implicit_tls  = (s.try_ssl == 3);
        }
 
        std::string email_lc = ident.email;
        std::transform(email_lc.begin(), email_lc.end(), email_lc.begin(), ::tolower);
        if (std::find(p.match_from.begin(), p.match_from.end(), email_lc) == p.match_from.end())
            p.match_from.push_back(email_lc);
 
        auto at = email_lc.find('@');
        if (at != std::string::npos) {
            std::string dom = email_lc.substr(at + 1);
            if (std::find(p.match_from_domain.begin(), p.match_from_domain.end(), dom)
                    == p.match_from_domain.end())
                p.match_from_domain.push_back(dom);
        }
    }
 
    for (auto& [id, p] : built)
        result.push_back(std::move(p));
 
    if (result.empty())
        err_out = _("Nessun server SMTP trovato in Thunderbird");
 
    return result;
}
 
static std::string iso_today_yyyy_mm_dd() {
    std::time_t t = std::time(nullptr);
    std::tm tm{};
    localtime_r(&t, &tm);
    std::ostringstream oss;
    oss << std::put_time(&tm, "%Y-%m-%d");
    return oss.str();
}
 
static std::string normalize_domain_or_url(const std::string& in_raw) {
    std::string in = in_raw;
    auto l = in.find_first_not_of(" \t\r\n");
    auto r = in.find_last_not_of(" \t\r\n");
    if (l == std::string::npos) return {};
    in = in.substr(l, r - l + 1);
    std::string s = in;
    auto pos = s.find("://");
    if (pos != std::string::npos) s.erase(0, pos + 3);
    pos = s.find('/');
    if (pos != std::string::npos) s.erase(pos);
 
    pos = s.find('@');
    if (pos != std::string::npos) s = s.substr(pos + 1);
 
    pos = s.find(':');
    if (pos != std::string::npos) s.erase(pos);
 
    if (s.rfind("www.", 0) == 0) s.erase(0, 4);
 
    std::transform(s.begin(), s.end(), s.begin(),
                   [](unsigned char c){ return std::tolower(c); });
 
    static const std::regex re(R"(^[a-z0-9][a-z0-9.-]*[a-z0-9]$)");
    if (!std::regex_match(s, re)) return {};
 
    if (s.find('.') == std::string::npos) return {};
 
    return s;
}
 
static void ensure_payments_json_exists() {
    const std::string path = payments_json_path_user();
    try {
        fs::create_directories(fs::path(path).parent_path());
    } catch (...) {}
 
    if (fs::exists(path)) return;
 
    json j;
    j["version"] = 1;
    j["updated_at"] = iso_today_yyyy_mm_dd();
    j["enabled"] = false;
    j["list"] = json::array({
        "paypal.com",
        "stripe.com",
        "adyen.com",
        "klarna.com",
        "checkout.com",
        "worldpay.com",
        "braintreepayments.com",
        "braintreegateway.com",
        "amazonpay.com",
        "pay.google.com",
        "pay.apple.com",
        "amazon.com"
    });
 
    std::ofstream out(path, std::ios::binary | std::ios::trunc);
    if (out.good()) out << j.dump(2);
}
 
static std::vector<std::string> load_payments_domains() {
    ensure_payments_json_exists();
 
    const std::string path = payments_json_path_user();
    std::vector<std::string> out;
 
    try {
        std::ifstream in(path, std::ios::binary);
        if (!in.good()) return out;
 
        json j;
        in >> j;
 
        if (j.contains("list") && j["list"].is_array()) {
            for (const auto& v : j["list"]) {
                if (!v.is_string()) continue;
                std::string d = normalize_domain_or_url(v.get<std::string>());
                if (!d.empty()) out.push_back(d);
            }
        }
 
        std::sort(out.begin(), out.end());
        out.erase(std::unique(out.begin(), out.end()), out.end());
 
    } catch (...) {
    }
 
    return out;
}
 
static bool save_payments_domains(const std::vector<std::string>& domains_in, bool enabled_flag) {
    ensure_payments_json_exists();
 
    const std::string path = payments_json_path_user();
 
    std::vector<std::string> domains;
    domains.reserve(domains_in.size());
    for (const auto& s : domains_in) {
        auto d = normalize_domain_or_url(s);
        if (!d.empty()) domains.push_back(d);
    }
    std::sort(domains.begin(), domains.end());
    domains.erase(std::unique(domains.begin(), domains.end()), domains.end());
 
    try {
        json j;
 
        {
            std::ifstream in(path, std::ios::binary);
            if (in.good()) {
                try { in >> j; } catch (...) { j = json::object(); }
            }
        }
 
        if (!j.is_object()) j = json::object();
 
        j["version"] = 1;
        j["updated_at"] = iso_today_yyyy_mm_dd();
        j["enabled"] = enabled_flag;
        j["list"] = json::array();
        for (const auto& d : domains) j["list"].push_back(d);
 
        const std::string tmp = path + ".tmp";
        {
            std::ofstream out(tmp, std::ios::binary | std::ios::trunc);
            if (!out.good()) return false;
            out << j.dump(2);
            out.flush();
            if (!out.good()) return false;
        }
 
        std::error_code ec;
        fs::rename(tmp, path, ec);
        if (ec) {
            fs::remove(path, ec);
            ec.clear();
            fs::rename(tmp, path, ec);
            if (ec) {
                fs::remove(tmp, ec);
                return false;
            }
        }
 
        return true;
    } catch (...) {
        return false;
    }
}
 
static bool update_payments_enabled_only(bool enabled_flag) {
    ensure_payments_json_exists();
 
    const std::string path = payments_json_path_user();
    try {
        json j;
        {
            std::ifstream in(path, std::ios::binary);
            if (!in.good()) return false;
            in >> j;
        }
        if (!j.is_object()) j = json::object();
 
        j["version"] = 1;
        j["updated_at"] = iso_today_yyyy_mm_dd();
        j["enabled"] = enabled_flag;
 
        if (!j.contains("list") || !j["list"].is_array())
            j["list"] = json::array();
 
        const std::string tmp = path + ".tmp";
        {
            std::ofstream out(tmp, std::ios::binary | std::ios::trunc);
            if (!out.good()) return false;
            out << j.dump(2);
            out.flush();
            if (!out.good()) return false;
        }
 
        std::error_code ec;
        fs::rename(tmp, path, ec);
        if (ec) {
            fs::remove(path, ec);
            ec.clear();
            fs::rename(tmp, path, ec);
            if (ec) {
                fs::remove(tmp, ec);
                return false;
            }
        }
 
        return true;
    } catch (...) {
        return false;
    }
}
 
 
 
static std::string elev_cmd(const std::string& inner) {
    if (std::filesystem::exists("/usr/bin/pkexec")) return std::string("pkexec ") + inner;
    return std::string("sudo ") + inner;
}
 
static bool write_temp_script_and_elevate(const std::string& script_contents, std::string* out_log = nullptr, int* exit_code = nullptr) {
    char tmpl[] = "/tmp/BastionGuard_tmp_XXXXXX";
    int fd = mkstemp(tmpl);
    if (fd < 0) {
        if (out_log) *out_log = _("Impossibile creare file temporaneo");
        return false;
    }
    std::string tmpname = tmpl;
    // write
    ssize_t written = write(fd, script_contents.c_str(), script_contents.size());
    close(fd);
    if (written < 0) {
        if (out_log) *out_log = _("Errore scrittura temporanea");
        std::filesystem::remove(tmpname);
        return false;
    }
    ::chmod(tmpname.c_str(), 0755);
 
    const std::string runner = std::filesystem::exists("/usr/bin/pkexec") ? "pkexec" : "sudo";
    const auto result = bg_process::run({runner, tmpname}, true);
    std::string out = result.output;
    const int rc = result.exit_code;
    const bool ok = result.ok();
 
    // pulizia
    std::filesystem::remove(tmpname);
 
    if (out_log) *out_log = out;
    if (exit_code) *exit_code = rc;
    return ok;
}
 
std::pair<int,int> read_webports_conf()
{
    constexpr int default_http_port = 81;
    constexpr int default_https_port = 444;
 
    auto valid_port = [](int port) {
        return port > 0 && port < 65536;
    };
 
    std::vector<std::string> paths = {
        "/etc/BastionGuard/webports.conf",
        "/tmp/BastionGuard_webports.conf"
    };
 
    for (const auto& p : paths) {
        std::ifstream f(p);
        if (!f.is_open())
            continue;
 
        std::stringstream buffer;
        buffer << f.rdbuf();
        const std::string content = buffer.str();
 
        int http_port = default_http_port;
        int https_port = default_https_port;
        std::istringstream iss(content);
 
        if ((iss >> http_port >> https_port) &&
            valid_port(http_port) && valid_port(https_port)) {
            std::cout << _("[settings] 📖 Letto webports.conf: ")
                      << http_port << " " << https_port << std::endl;
            return {http_port, https_port};
        }
 
        // Evita che un file scritto male venga interpretato come una singola porta HTTP.
        // La coppia supportata resta 81/444.
        std::cerr << _("[settings] ⚠️ webports.conf malformato, uso default 81/444: ")
                  << content << std::endl;
        return {default_http_port, default_https_port};
    }
 
    std::cout << _("[settings] ⚠️ Nessun webports.conf trovato, uso default 81/444\n");
    return {default_http_port, default_https_port};
}
 
namespace fs = std::filesystem;
 
bool copy_with_pkexec(const std::string &src, const std::string &dst)
{
    if (!fs::exists(src)) {
        std::cerr << _("[copy_with_pkexec] File sorgente non trovato: ") << src << std::endl;
        return false;
    }
 
    return bg_process::run({"pkexec", "/usr/bin/install", "-D", "-m", "0644", src, dst}).ok();
}
 
bool restart_service(const std::string &svc)
{
    return bg_process::run({"pkexec", "/usr/libexec/bastionguard/bastionguard-service",
                            "--system", "restart", svc}).ok();
}
 
bool update_ports_in_file(const std::string &file, int http_port, int https_port)
{
    if (!fs::exists(file)) {
        std::cerr << _("[update_ports_in_file] File non trovato: ") << file << std::endl;
        return false;
    }
 
    std::ifstream fin(file);
    if (!fin.is_open()) {
        std::cerr << _("[update_ports_in_file] Impossibile aprire il file: ") << file << std::endl;
        return false;
    }
 
    std::stringstream buffer;
    buffer << fin.rdbuf();
    fin.close();
    std::string content = buffer.str();
 
    std::regex http_regex(R"((Listen\s+)80\b)");
    std::regex https_regex(R"((Listen\s+)443\b)");
    std::regex star_http(R"((\*|127\.0\.0\.1|\‍[::1\‍])?:80\b)");
    std::regex star_https(R"((\*|127\.0\.0\.1|\‍[::1\‍])?:443\b)");
 
    content = std::regex_replace(content, http_regex, "Listen " + std::to_string(http_port));
    content = std::regex_replace(content, https_regex, "Listen " + std::to_string(https_port));
    content = std::regex_replace(content, star_http, "$1:" + std::to_string(http_port));
    content = std::regex_replace(content, star_https, "$1:" + std::to_string(https_port));
 
    std::string tmpfile = "/tmp/BastionGuard-vhost.conf";
    std::ofstream fout(tmpfile);
    if (!fout.is_open()) {
        std::cerr << _("[update_ports_in_file] Impossibile scrivere il file temporaneo") << std::endl;
        return false;
    }
    fout << content;
    fout.close();
 
    return bg_process::run({"pkexec", "/usr/bin/install", "-m", "0644", tmpfile, file}).ok();
}
 
 
 
std::string detect_distro()
{
    std::string distro = "auto";
    std::string id;
 
 
    {
        const auto lsb = bg_process::run({"lsb_release", "-si"});
        std::string result = lsb.ok() ? lsb.output : std::string{};
 
        result.erase(std::remove(result.begin(), result.end(), '\n'), result.end());
        result.erase(std::remove(result.begin(), result.end(), '\r'), result.end());
 
        if (!result.empty() && result.find("n/a") == std::string::npos) {
            id = result;
        } else {
            std::cout << _("[detect_distro] lsb_release non fornisce info, fallback su /etc/os-release\n");
        }
    }
 
 
    if (id.empty() && std::filesystem::exists("/etc/os-release")) {
        std::ifstream file("/etc/os-release");
        std::string line;
        while (std::getline(file, line)) {
            if (line.rfind("ID=", 0) == 0)
                id = line.substr(3);
        }
        if (!id.empty() && id.front() == '"' && id.back() == '"')
            id = id.substr(1, id.size() - 2);
    }
 
 
    if (id.empty()) {
        if (std::filesystem::exists("/etc/arch-release")) id = "arch";
        else if (std::filesystem::exists("/etc/debian_version")) id = "debian";
        else if (std::filesystem::exists("/etc/redhat-release")) id = "fedora";
        else if (std::filesystem::exists("/etc/gentoo-release")) id = "gentoo";
        else if (std::filesystem::exists("/etc/slackware-version")) id = "slackware";
        else if (std::filesystem::exists("/usr/local/etc/rc.conf")) id = "bsd";
    }
 
    // Normalizza minuscolo
    std::transform(id.begin(), id.end(), id.begin(), ::tolower);
 
 
    if (id.find("debian") != std::string::npos || id.find("ubuntu") != std::string::npos || id.find("mint") != std::string::npos)
        distro = "debian";
    else if (id.find("fedora") != std::string::npos || id.find("rhel") != std::string::npos ||
             id.find("centos") != std::string::npos || id.find("alma") != std::string::npos || id.find("rocky") != std::string::npos)
        distro = "fedora";
    else if (id.find("arch") != std::string::npos || id.find("manjaro") != std::string::npos || id.find("endeavour") != std::string::npos)
        distro = "arch";
    else if (id.find("suse") != std::string::npos)
        distro = "opensuse";
    else if (id.find("gentoo") != std::string::npos)
        distro = "gentoo";
    else if (id.find("slackware") != std::string::npos)
        distro = "slackware";
    else if (id.find("bsd") != std::string::npos)
        distro = "bsd";
 
    std::cout << _("[detect_distro] Distribuzione rilevata: ") << distro << std::endl;
    return distro;
}
 
 
static std::string detect_webserver() {
    using namespace std;
 
    auto is_active = [](const std::string& svc) -> bool {
        return bg_process::run({"/usr/libexec/bastionguard/bastionguard-service",
                                "--system", "is-active", svc}).ok();
    };
 
    auto cmd_exists = [](const std::string& cmd) -> bool {
        return bg_process::run({"which", "--", cmd}).ok();
    };
 
    if (is_active("apache2") || is_active("httpd") || cmd_exists("apache2") || cmd_exists("httpd")) {
        std::cout << _("[detect_webserver] Apache rilevato") << std::endl;
        return "apache";
    }
 
    if (is_active("nginx") || cmd_exists("nginx")) {
        std::cout << _("[detect_webserver] Nginx rilevato") << std::endl;
        return "nginx";
    }
 
    if (is_active("lshttpd") || is_active("lsws") || cmd_exists("lsws") || cmd_exists("lshttpd")) {
        std::cout << _("[detect_webserver] LiteSpeed rilevato") << std::endl;
        return "litespeed";
    }
 
    {
        const auto processes = bg_process::run({"ps", "-eo", "comm"});
        const std::string& out = processes.output;
        if (out.find("apache2") != std::string::npos || out.find("httpd") != std::string::npos) return "apache";
        if (out.find("nginx") != std::string::npos) return "nginx";
        if (out.find("lshttpd") != std::string::npos || out.find("lsws") != std::string::npos) return "litespeed";
    }
 
    std::cout << _("[detect_webserver] Nessun server rilevato") << std::endl;
    return "unknown";
}
 
 
std::pair<int, int> read_current_ports(const std::string& )
{
    int http_port = 81;
    int https_port = 444;
    const std::string portfile = "/etc/BastionGuard/webports.conf";
 
    std::ifstream f(portfile);
    if (f.is_open()) {
        int p1 = 0, p2 = 0;
        f >> p1 >> p2;
 
        if (p1 > 0 && p1 < 65536) http_port = p1;
        if (p2 > 0 && p2 < 65536) https_port = p2;
 
        std::cout << _("[settings] Porte lette da ") << portfile
                  << " → HTTP=" << http_port
                  << " HTTPS=" << https_port << std::endl;
    } else {
        std::cerr << _("[settings] ⚠ Impossibile aprire ") << portfile
                  << _(" — uso valori di default (80/443)\n");
    }
 
    return {http_port, https_port};
}
 
 
 
bool update_webserver_ports(const std::string& websrv, int http_port, int https_port)
{
    (void)websrv;
    namespace fs = std::filesystem;
 
    const std::string tmpfile = "/tmp/BastionGuard_webports.conf";
    const std::string targetfile = "/etc/BastionGuard/webports.conf";
 
    try {
 
        std::ofstream fout(tmpfile);
        if (!fout.is_open()) {
            std::cerr << _("[settings] ❌ Impossibile creare file temporaneo: ") << tmpfile << std::endl;
            return false;
        }
 
        fout << http_port << " " << https_port << "\n";
        fout.close();
 
        const int ret = bg_process::run({"pkexec", "/usr/bin/install", "-D", "-m", "0644",
                                          tmpfile, targetfile}).exit_code;
 
        if (ret == 0) {
            std::cout << _("[settings] ✅ Porte BastionGuard salvate in ") << targetfile
                      << " → HTTP interno=" << http_port
                      << ", HTTPS interno=" << https_port << std::endl;
            return true;
        } else {
            std::cerr << _("[settings] ❌ Errore durante l'installazione via pkexec.\n");
            return false;
        }
    } catch (const std::exception& e) {
        std::cerr << _("[settings] ⚠ Eccezione durante update_webserver_ports: ") << e.what() << std::endl;
        return false;
    }
}
 
 
 
static bool updatingToggle = false;
 
static std::map<std::string, bool> toggleControlled;
 
namespace {
 
std::string choose_clamd_conf_target() {
    const std::vector<std::string> candidates = {
        "/etc/clamd/clamd.conf",
        "/etc/clamav/clamd.conf",
        "/etc/clamd.d/clamd.conf",
        "/etc/clamd.conf"
    };
 
    for (const auto& p : candidates) {
        if (std::filesystem::exists(p)) return p;
    }
 
    for (const auto& p : candidates) {
        std::filesystem::path dir = std::filesystem::path(p).parent_path();
        if (dir.empty() || std::filesystem::exists(dir)) return p;
    }
 
    return "/etc/clamav/clamd.conf";
}
 
bool atomic_install_with_pkexec(const std::string& tmp_src, const std::string& target) {
    if (fs::exists(target)) {
        const std::string backup = target + ".bak." + std::to_string(std::time(nullptr));
        if (!bg_process::run({"pkexec", "/usr/bin/cp", "-a", "--", target, backup}).ok())
            return false;
    }
    return bg_process::run({"pkexec", "/usr/bin/install", "-D", "-m", "0644",
                            tmp_src, target}).ok();
}
 
} // namespace
 
 
namespace {
    bool isServiceActive(const std::string& service, bool user = false) {
        return bg_process::run({"/usr/libexec/bastionguard/bastionguard-service",
                                user ? "--user" : "--system", "is-active", service}).ok();
    }
}
 
 
 
    bool isClamonaccRunning() {
        return isServiceActive("clamonacc.service") ||
               isServiceActive("clamav-clamonacc.service");
    }
 
 
SettingsPage::~SettingsPage() {
    // Invalida i lambda asincroni in volo: faranno early-return
    // invece di dereferenziare `this` dopo la distruzione.
    if (alive_) alive_->store(false, std::memory_order_release);
}
 
 
SettingsPage::SettingsPage(ClamdConfig& config)
 
: Gtk::Box(Gtk::Orientation::VERTICAL, 12),
  clamdConfig(config),
  clamonaccSwitch(),
  quarantineLabel(_("Percorso quarantena: ") + Backend::getQuarantinePath()),
  quarantineButton(_("Seleziona cartella quarantena")),
  realtimeLabel(_("Antivirus real time: Disabilitato")),
  toggleAllSwitch(),
  toggleAllLabel(_("Abilita tutte le opzioni")),
  antiransomSwitch(),
  antiransomStatus(_("Protezione disattivata"))
{
    sambaStore = Gtk::ListStore::create(sambaCols);
    sambaView.set_model(sambaStore);
    sambaView.append_column(_("Directory Samba"), sambaCols.col_path);
 
    set_margin(12);
    stack.set_hexpand(true);
    stack.set_vexpand(true);
    stack.set_transition_type(Gtk::StackTransitionType::SLIDE_LEFT_RIGHT);
    stack.set_transition_duration(300);
 
    stack_switcher.set_stack(stack);
    stack_switcher.set_hexpand(true);
    stack_switcher.set_halign(Gtk::Align::FILL);
 
    append(stack_switcher);
    append(stack);
 
    auto page_base = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 12);
 
    page_base->append(realtimeLabel);
    auto realtimeBox = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::HORIZONTAL, 5);
    realtimeBox->set_hexpand(true);
    realtimeBox->set_halign(Gtk::Align::CENTER);
    realtimeBox->append(clamonaccSwitch);
    page_base->append(*realtimeBox);
 
    bool clamonacc_enabled = isClamonaccRunning();
    clamonaccSwitch.set_active(clamonacc_enabled);
    realtimeLabel.set_text(clamonacc_enabled ?
        _("Antivirus real time: Abilitato") :
        _("Antivirus real time: Disabilitato"));
 
    clamonaccSwitch.property_active().signal_changed().connect(
        sigc::mem_fun(*this, &SettingsPage::onRealtimeToggled)
    );
 
    page_base->append(quarantineLabel);
    page_base->append(quarantineButton);
    quarantineButton.signal_clicked().connect(
        sigc::mem_fun(*this, &SettingsPage::onQuarantineClicked)
    );
 
    auto framePaths = Gtk::make_managed<Gtk::Frame>(_("Cartelle monitorate (clamonacc)"));
    auto vboxPaths = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 5);
    vboxPaths->append(listbox_paths);
 
    auto hboxButtons = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::HORIZONTAL, 5);
    hboxButtons->append(btn_addPath);
    hboxButtons->append(btn_removePath);
 
    vboxPaths->append(*hboxButtons);
    framePaths->set_child(*vboxPaths);
    page_base->append(*framePaths);
 
    for (auto& f : clamdConfig.getOnAccessPaths()) {
        auto row = Gtk::make_managed<Gtk::Label>(f);
        listbox_paths.append(*row);
        row->show();
    }
 
    btn_addPath.signal_clicked().connect(sigc::mem_fun(*this, &SettingsPage::onAddPath));
    btn_removePath.signal_clicked().connect(sigc::mem_fun(*this, &SettingsPage::onRemovePath));
    btn_addPath.set_child(*Gtk::make_managed<Gtk::Label>(_("Aggiungi cartella")));
    btn_removePath.set_child(*Gtk::make_managed<Gtk::Label>(_("Rimuovi cartella")));
 
 
    page_order_.push_back(page_base);
    stack.add(*page_base, "base", _("Base"));
 
 
    auto page_adv = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 12);
    auto frameScan = Gtk::make_managed<Gtk::Frame>(_("Opzioni di scansione"));
 
    auto scrolled = Gtk::make_managed<Gtk::ScrolledWindow>();
    scrolled->set_policy(Gtk::PolicyType::AUTOMATIC, Gtk::PolicyType::AUTOMATIC);
    scrolled->set_expand(true);
 
    auto flowScan = Gtk::make_managed<Gtk::FlowBox>();
    flowScan->set_valign(Gtk::Align::START);
    flowScan->set_max_children_per_line(4);
    flowScan->set_selection_mode(Gtk::SelectionMode::NONE);
 
    auto scanOptions = clamdConfig.getScanOptions();
    for (auto& [opt, enabled] : scanOptions) {
        auto cb = Gtk::make_managed<Gtk::CheckButton>(opt);
        cb->set_active(enabled);
        checkOptions[opt] = cb;
        toggleControlled[opt] = false;
 
        flowScan->append(*cb);
        cb->show();
 
        cb->signal_toggled().connect([this, opt]() {
            if (updatingToggle) return;
            toggleControlled[opt] = false;
        });
    }
 
    scrolled->set_child(*flowScan);
    frameScan->set_child(*scrolled);
 
   auto lblWarning = Gtk::make_managed<Gtk::Label>(
    _("⚠️ Attenzione: modificare queste opzioni avanzate solo se si è sicuri.\n"
      "Un uso improprio può compromettere la protezione.")
    );
    lblWarning->set_wrap(true);
    lblWarning->set_margin_bottom(10);
    lblWarning->set_halign(Gtk::Align::FILL);
    lblWarning->set_justify(Gtk::Justification::CENTER);
 
    lblWarning->get_style_context()->add_class("alert-warning");
 
    page_adv->append(*lblWarning);
 
    page_adv->append(*frameScan);
 
    auto hboxToggleAll = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::HORIZONTAL, 5);
    hboxToggleAll->append(toggleAllLabel);
    hboxToggleAll->append(toggleAllSwitch);
    page_adv->append(*hboxToggleAll);
 
    toggleAllSwitch.property_active().signal_changed().connect([this]() {
        if (updatingToggle) return;
        updatingToggle = true;
 
        bool enabled = toggleAllSwitch.get_active();
        for (auto& [opt, cb] : checkOptions) {
            if (enabled && !cb->get_active()) {
                cb->set_active(true);
                toggleControlled[opt] = true;
            } else if (!enabled && toggleControlled[opt]) {
                cb->set_active(false);
                toggleControlled[opt] = false;
            }
        }
 
        updatingToggle = false;
        toggleAllLabel.set_text(enabled ?
            _("Tutte le opzioni avanzate abilitate (toggle)") :
            _("Abilita tutte le opzioni avanzate"));
    });
 
    page_adv->append(btn_save);
    btn_save.signal_clicked().connect(sigc::mem_fun(*this, &SettingsPage::onSave));
    btn_save.set_child(*Gtk::make_managed<Gtk::Label>(_("Salva configurazione")));
    auto frameCustomDB = Gtk::make_managed<Gtk::Frame>(_("Database firme personalizzato"));
 
    auto boxCustomDB = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 10);
    boxCustomDB->set_margin(10);
 
 
    page_order_.push_back(page_adv);
    stack.add(*page_adv, "advanced", _("Avanzate"));
 
 
    build_antiransom_tab();
    build_antiransom_advanced_tab();
    loadAdvancedConfig();
    build_antiphish_tab();
    build_whitelist_tab();
    build_secure_payments_tab();
    build_proxy_bypass_tab();
    build_user_services_tab();
    build_email_security_tab();
    build_system_services_tab();
    build_clamav_db_tab();
    build_options_tab();
 
 
}
 
 
void SettingsPage::onQuarantineClicked() {
    auto dialog = new Gtk::FileChooserDialog(_("Seleziona una cartella quarantena"),
                                             Gtk::FileChooser::Action::SELECT_FOLDER);
    dialog->add_button(_("_Annulla"), Gtk::ResponseType::CANCEL);
    dialog->add_button(_("_Seleziona"), Gtk::ResponseType::OK);
    dialog->set_modal(true);
    dialog->get_style_context()->add_class("app-dialog");
 
    dialog->signal_response().connect([this, dialog](int response) {
        if (response == Gtk::ResponseType::OK) {
            std::string folder = dialog->get_file()->get_path();
            Backend::setQuarantinePath(folder);
            quarantineLabel.set_text(_("Percorso quarantena: ") + folder);
        }
        dialog->hide();
        delete dialog;
    });
    dialog->show();
}
 
void SettingsPage::onAddPath() {
    auto dialog = new Gtk::FileChooserDialog(_("Seleziona una cartella"),
                                             Gtk::FileChooser::Action::SELECT_FOLDER);
    dialog->add_button(_("_Annulla"), Gtk::ResponseType::CANCEL);
    dialog->add_button(_("_Seleziona"), Gtk::ResponseType::OK);
    dialog->set_modal(true);
 
    dialog->signal_response().connect([this, dialog](int response) {
        if (response == Gtk::ResponseType::OK) {
            auto folder = dialog->get_file()->get_path();
            auto row = Gtk::make_managed<Gtk::Label>(folder);
            listbox_paths.append(*row);
            row->show();
            clamdConfig.addOnAccessPath(folder);
        }
        dialog->hide();
        delete dialog;
    });
    dialog->show();
}
 
void SettingsPage::onRemovePath() {
    if (auto row = listbox_paths.get_selected_row()) {
        if (auto child = row->get_child()) {
            if (auto label = dynamic_cast<Gtk::Label*>(child)) {
                clamdConfig.removeOnAccessPath(label->get_text());
            }
        }
        listbox_paths.remove(*row);
    }
}
 
void SettingsPage::onSave() {
    for (auto& [opt, cb] : checkOptions) {
        clamdConfig.setScanOption(opt, cb->get_active());
    }
    const std::string target = choose_clamd_conf_target();
    const std::string tmp_path = "/tmp/BastionGuard-clamd.conf.tmp";
    if (!clamdConfig.save(tmp_path)) {
        std::cerr << "❌ " << _("Errore: impossibile scrivere il file temporaneo di configurazione")
                  << " " << tmp_path << "\n";
        return;
    }
 
    if (atomic_install_with_pkexec(tmp_path, target)) {
        std::cout << "✔ " << _("Configurazione salvata su") << " " << target << "\n";
    } else {
        std::cerr << "❌ " << _("Errore: impossibile salvare configurazione!")
                  << " (" << target << ")\n";
    }
 
    if (!Backend::installClamdIfMissing()) {
        std::cerr << "⚠ " << _("Errore: impossibile installare clamd automaticamente.") << "\n";
    }
}
 
 
void SettingsPage::onRealtimeToggled() {
    realtimeLabel.set_text(clamonaccSwitch.get_active() ?
        _("Antivirus real time: Abilitato") :
        _("Antivirus real time: Disabilitato"));
}
 
 
void SettingsPage::build_antiransom_tab() {
    auto page_ransom = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 12);
 
    auto hboxRan = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::HORIZONTAL, 8);
    auto lblRan = Gtk::make_managed<Gtk::Label>(_("Protezione Anti-Ransomware"));
    hboxRan->append(*lblRan);
    hboxRan->append(antiransomSwitch);
    page_ransom->append(*hboxRan);
 
    bool running = isServiceActive("BastionGuard-ransomware-scanner.service", true);
    antiransomSwitch.set_active(running);
    antiransomStatus.set_text(running
        ? _("Protezione Anti-Ransomware: Attiva")
        : _("Protezione Anti-Ransomware: Disattivata (servizio non attivo)"));
    page_ransom->append(antiransomStatus);
 
    antiransomSwitch.property_active().signal_changed().connect(
        sigc::mem_fun(*this, &SettingsPage::onAntiransomToggled)
    );
 
    rulesStore = Gtk::ListStore::create(ruleCols);
    rulesView.set_model(rulesStore);
    rulesView.append_column(_("Regole YARA in uso"), ruleCols.name);
 
    auto scrolled = Gtk::make_managed<Gtk::ScrolledWindow>();
    scrolled->set_policy(Gtk::PolicyType::AUTOMATIC, Gtk::PolicyType::AUTOMATIC);
    scrolled->set_expand(true);
    scrolled->set_child(rulesView);
    scrolled->set_min_content_height(100);
    page_ransom->append(*scrolled);
 
    loadYaraRules();
 
    auto btn_updateYara = Gtk::make_managed<Gtk::Button>(_("Aggiorna regole YARA"));
    page_ransom->append(*btn_updateYara);
 
    btn_updateYara->signal_clicked().connect([this]() {
    antiransomStatus.set_text(_("⏳ Aggiornamento regole YARA in corso..."));
 
    auto alive = alive_;
    std::thread([this, alive]() {
        bool ok = Backend::instance().updateYaraRules();
        if (!alive->load()) return;
 
        Glib::signal_idle().connect_once([this, alive, ok]() {
            BastionGuard::if_alive(alive, [this, ok]() {
                if (ok) {
                    antiransomStatus.set_text(_("✔ Regole YARA aggiornate con successo"));
                    refreshAntiransomRules();
                } else {
                    antiransomStatus.set_text(_("❌ Errore durante l'aggiornamento delle regole YARA"));
                }
            });
        });
           }).detach();
    });
 
 
    auto btn_updateSanesec = Gtk::make_managed<Gtk::Button>(_("Aggiorna Sanesecurity DB"));
    page_ransom->append(*btn_updateSanesec);
 
    btn_updateSanesec->signal_clicked().connect([this]() {
    antiransomStatus.set_text(_("⏳ Aggiornamento Sanesecurity DB in corso..."));
 
    auto alive = alive_;
    std::thread([this, alive]() {
        bool ok = Backend::instance().updateSanesecurityDB();
        if (!alive->load()) return;
 
        Glib::signal_idle().connect_once([this, alive, ok]() {
            BastionGuard::if_alive(alive, [this, ok]() {
                if (ok) {
                    antiransomStatus.set_text(_("✔ Sanesecurity DB aggiornato con successo"));
                } else {
                    antiransomStatus.set_text(_("❌ Errore durante l'aggiornamento del Sanesecurity DB"));
                }
            });
        });
          }).detach();
    });
 
 
    bool use_rules, use_db;
    int interval;
    std::vector<std::string> scan_dirs;
    loadScannerConfig(use_rules, use_db, interval, scan_dirs);
 
    auto chk_rules = Gtk::make_managed<Gtk::CheckButton>(_("Usa regole YARA"));
    chk_rules->set_active(use_rules);
    page_ransom->append(*chk_rules);
 
    auto chk_db = Gtk::make_managed<Gtk::CheckButton>(_("Usa DB Sanesecurity"));
    chk_db->set_active(use_db);
    page_ransom->append(*chk_db);
 
    auto lblDirs = Gtk::make_managed<Gtk::Label>(_("Cartelle da scansionare:"));
    page_ransom->append(*lblDirs);
 
    auto list_dirs = Gtk::make_managed<Gtk::ListBox>();
    for (auto& d : scan_dirs) {
        auto row = Gtk::make_managed<Gtk::Label>(d);
        row->set_visible(true);
        list_dirs->append(*row);
    }
    page_ransom->append(*list_dirs);
 
    auto btn_addDir = Gtk::make_managed<Gtk::Button>(_("Aggiungi cartella"));
    auto btn_rmDir = Gtk::make_managed<Gtk::Button>(_("Rimuovi cartella"));
    auto hboxDirs = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::HORIZONTAL, 5);
    hboxDirs->append(*btn_addDir);
    hboxDirs->append(*btn_rmDir);
    page_ransom->append(*hboxDirs);
 
    btn_addDir->signal_clicked().connect([list_dirs]() {
        auto dialog = new Gtk::FileChooserDialog(_("Seleziona cartella da scansionare"),
                                                 Gtk::FileChooser::Action::SELECT_FOLDER);
        dialog->add_button(_("_Annulla"), Gtk::ResponseType::CANCEL);
        dialog->add_button(_("_Seleziona"), Gtk::ResponseType::OK);
        dialog->signal_response().connect([dialog, list_dirs](int response) {
            if (response == Gtk::ResponseType::OK) {
                auto folder = dialog->get_file()->get_path();
                auto row = Gtk::make_managed<Gtk::Label>(folder);
                row->set_visible(true);
                list_dirs->append(*row);
            }
            dialog->hide();
            delete dialog;
        });
        dialog->show();
    });
 
    btn_rmDir->signal_clicked().connect([list_dirs]() {
        if (auto row = list_dirs->get_selected_row()) {
            list_dirs->remove(*row);
        }
    });
 
    auto spin_interval = Gtk::make_managed<Gtk::SpinButton>();
    spin_interval->set_range(1, 120);
    spin_interval->set_value(interval);
    spin_interval->set_increments(1, 5);
    auto hboxInt = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::HORIZONTAL, 5);
    hboxInt->append(*Gtk::make_managed<Gtk::Label>(_("Intervallo scansione (min):")));
    hboxInt->append(*spin_interval);
    page_ransom->append(*hboxInt);
 
    auto btn_saveConf = Gtk::make_managed<Gtk::Button>(_("Salva configurazione scanner"));
    page_ransom->append(*btn_saveConf);
    btn_saveConf->signal_clicked().connect([this, chk_rules, chk_db, spin_interval, list_dirs]() {
        std::vector<std::string> dirs;
        // Recupera le directory di scansione principali
        for (auto row : list_dirs->get_children()) {
            if (auto lbl = dynamic_cast<Gtk::Label*>(row))
                dirs.push_back(lbl->get_text());
        }
 
        saveScannerConfig(
            chk_rules->get_active(),
            chk_db->get_active(),
            spin_interval->get_value_as_int(),
            dirs
        );
 
    });
 
    page_order_.push_back(page_ransom);
    stack.add(*page_ransom, "anti-ransomware", _("Anti-Ransomware"));
}
 
 
 
 
void SettingsPage::onAntiransomToggled() {
    if (antiransomSwitch.get_active()) {
        if (!isServiceActive("BastionGuard-ransomware-scanner.service", true)) {
            antiransomStatus.set_text(_("⏳ Avvio servizio Anti-Ransomware..."));
            if ((bg_process::run({"/usr/libexec/bastionguard/bastionguard-service", "--user", "start", "BastionGuard-ransomware-scanner.service"}).exit_code) != 0) {
                antiransomStatus.set_text(_("❌ Impossibile avviare il servizio Anti-Ransomware"));
                antiransomSwitch.set_active(false);
                return;
            }
        }
        Backend::instance().start_antiransom();
        antiransomStatus.set_text(_("Protezione Anti-Ransomware: Attiva"));
    } else {
        if (isServiceActive("BastionGuard-ransomware-scanner.service", true)) {
            antiransomStatus.set_text(_("⏳ Arresto servizio Anti-Ransomware..."));
            if ((bg_process::run({"/usr/libexec/bastionguard/bastionguard-service", "--user", "stop", "BastionGuard-ransomware-scanner.service"}).exit_code) != 0) {
                antiransomStatus.set_text(_("❌ Impossibile fermare il servizio Anti-Ransomware"));
                antiransomSwitch.set_active(true);
                return;
            }
        }
        Backend::instance().stop_antiransom();
        antiransomStatus.set_text(_("Protezione Anti-Ransomware: Disattivata"));
    }
}
 
 
 
 
void SettingsPage::refreshAntiransomRules() {
    if (!rulesStore) {
        std::cerr << _("⚠ refreshAntiransomRules chiamata ma rulesStore non è inizializzato\n");
        return;
    }
    loadYaraRules();
}
 
 
void SettingsPage::loadYaraRules() {
    if (!rulesStore) {
        std::cerr << _("⚠ rulesStore non inizializzato\n");
        return;
    }
 
    rulesStore->clear();
 
    namespace fs = std::filesystem;
    std::string dir = "/usr/share/BastionGuard/data/yara";
 
    if (!fs::exists(dir)) {
        std::cerr << _("⚠ Nessuna cartella YARA trovata in ") << dir << "\n";
        return;
    }
 
    std::regex ruleRegex(R"(^\s*rule\s+([A-Za-z0-9_]+))");
    std::smatch match;
    int total_rules = 0;
 
    std::error_code ec_it;
    for (auto& entry : fs::directory_iterator(dir, ec_it)) {
        if (ec_it) {
            std::cerr << _("⚠ Impossibile leggere la cartella YARA: ") << dir << "\n";
            break;
        }
        if (!entry.is_regular_file())
            continue;
 
        std::string ext = entry.path().extension().string();
        std::transform(ext.begin(), ext.end(), ext.begin(), ::tolower);
        if (ext != ".yar" && ext != ".yara")
            continue;
 
        std::ifstream f(entry.path());
        if (!f.is_open()) {
            std::cerr << _("⚠ Impossibile aprire ") << entry.path() << "\n";
            continue;
        }
 
        std::string line;
        while (std::getline(f, line)) {
            if (std::regex_search(line, match, ruleRegex)) {
                auto row = *(rulesStore->append());
                row[ruleCols.name] = match[1].str();
                total_rules++;
            }
        }
    }
 
    if (total_rules > 0) {
        std::cout << "✔ " << total_rules << _(" regole YARA caricate da ") << dir << "\n";
    } else {
        std::cout << _("⚠ Nessuna regola YARA trovata in ") << dir << "\n";
    }
}
 
 
void SettingsPage::loadScannerConfig(bool& use_rules, bool& use_db,
                                     int& interval, std::vector<std::string>& dirs)
{
    use_rules = true;
    use_db = false;
    interval = 60;
    dirs.clear();
 
    std::string conf_path = resource("config/scanner.conf");
 
    std::ifstream f(conf_path);
    if (!f.is_open()) {
        std::cerr << _("⚠️ Config non trovata → uso default (/home)\n");
        dirs.push_back("/home");
        return;
    }
 
    std::string line;
 
    while (std::getline(f, line)) {
        if (line.empty() || line[0] == '#')
            continue;
 
        std::string lower = line;
        std::transform(lower.begin(), lower.end(), lower.begin(), ::tolower);
 
        if (lower.find("enable_yara=") == 0) {
            std::string val = lower.substr(12);
            use_rules = (val == "1" || val == "true" || val == "yes");
        }
        else if (lower.find("enable_sanesecurity=") == 0) {
            std::string val = lower.substr(20);
            use_db = (val == "1" || val == "true" || val == "yes");
        }
        else if (lower.find("scan_interval=") == 0) {
            std::string val = lower.substr(14);
            try { interval = std::stoi(val); }
            catch (...) { interval = 60; }
        }
        else if (lower.find("scan_path=") == 0) {
            std::string paths = line.substr(10);
            size_t start = 0, end;
            while ((end = paths.find(';', start)) != std::string::npos) {
                dirs.push_back(paths.substr(start, end - start));
                start = end + 1;
            }
            if (start < paths.size())
                dirs.push_back(paths.substr(start));
        }
    }
 
    if (dirs.empty())
        dirs.push_back("/home");
 
    std::cout << _("✔ Config caricata da ") << conf_path
              << " (interval=" << interval << ")\n";
}
 
 
 
void SettingsPage::saveScannerConfig(bool use_rules, bool use_db,
                                     int interval, const std::vector<std::string>& dirs)
{
    namespace fs = std::filesystem;
    std::string save_path;
    bool use_local = false;
 
    if (fs::exists("config"))
        save_path = "config/scanner.conf";
    else
        save_path = std::string(DATA_DIR) + "/config/scanner.conf";
 
    std::string tmp_path = use_local ? save_path : "/tmp/BastionGuard-scanner.conf.tmp";
 
    std::ofstream f(tmp_path, std::ios::trunc);
    if (!f.is_open()) {
        std::cerr << "❌ Impossibile scrivere config in " << tmp_path << "\n";
        return;
    }
 
    f << "# ===============================\n";
    f << _("# Configurazione BastionGuard Ransomware Scanner\n");
    f << "# ===============================\n\n";
    f << "enable_yara=" << (use_rules ? "1" : "0") << "\n";
    f << "enable_sanesecurity=" << (use_db ? "1" : "0") << "\n";
    f << "scan_interval=" << interval << "\n";
    f << "scan_path=";
    for (size_t i = 0; i < dirs.size(); ++i) {
        f << dirs[i];
        if (i + 1 < dirs.size()) f << ";";
    }
    f << "\n";
 
    f.close();
 
    if (!use_local) {
        if (bg_process::run({"pkexec", "/usr/bin/install", "-D", "-m", "0644",
                             tmp_path, save_path}).ok())
            std::cout << _("✔ Config aggiornata in: ") << save_path << "\n";
        else
            std::cerr << _("❌ Errore: impossibile aggiornare config in ") << save_path << "\n";
    } else {
        std::cout << _("✔ Config aggiornata in: ") << save_path << "\n";
    }
}
 
 
 
 
 
void SettingsPage::build_antiphish_tab() {
    auto page_phish = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 12);
 
    auto hbox = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::HORIZONTAL, 8);
    auto lbl = Gtk::make_managed<Gtk::Label>(_("Protezione Anti-Phishing"));
    hbox->append(*lbl);
    hbox->append(antiphishSwitch);
    page_phish->append(*hbox);
 
    bool running = isServiceActive("BastionGuard-phishing-scanner.service");
    antiphishSwitch.set_active(running);
    antiphishStatus.set_text(running
        ? _("Protezione Anti-Phishing: Attiva (servizio di sistema)")
        : _("Protezione Anti-Phishing: Disattivata (servizio non attivo)"));
    page_phish->append(antiphishStatus);
 
    antiphishSwitch.property_active().signal_changed().connect(
        sigc::mem_fun(*this, &SettingsPage::onAntiphishToggled)
    );
    auto hbox_auto = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::HORIZONTAL, 8);
    auto lbl_auto = Gtk::make_managed<Gtk::Label>(
    _("Aggiorna automaticamente la blacklist ogni 2 ore"));
    hbox_auto->append(*lbl_auto);
 
    auto chk_auto_update = Gtk::make_managed<Gtk::CheckButton>();
    chk_auto_update->set_active(Backend::instance().isPhishAutoUpdateEnabled());
    chk_auto_update->set_halign(Gtk::Align::END);
    hbox_auto->append(*chk_auto_update);
 
    chk_auto_update->signal_toggled().connect([this, chk_auto_update]() {
    bool enable = chk_auto_update->get_active();
    antiphishStatus.set_text(enable
        ? _("⏳ Attivazione aggiornamento automatico...")
        : _("⏳ Disattivazione aggiornamento automatico..."));
 
    auto alive = alive_;
    std::thread([this, alive, enable]() {
        bool ok = Backend::instance().enablePhishAutoUpdate(enable);
        if (!alive->load()) return;
        Glib::signal_idle().connect_once([this, alive, enable, ok]() {
            BastionGuard::if_alive(alive, [this, enable, ok]() {
                if (ok) {
                    antiphishStatus.set_text(enable
                        ? _("✔ Aggiornamento automatico abilitato (ogni 2 ore)")
                        : _("ℹ️ Aggiornamento automatico disabilitato"));
                } else {
                    antiphishStatus.set_text(_("❌ Errore nella modifica del timer automatico"));
                }
            });
        });
    }).detach();
    });
 
    page_phish->append(*hbox_auto);
    auto hbox_safe = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::HORIZONTAL, 8);
    auto lbl_safe = Gtk::make_managed<Gtk::Label>(_("Usa Google Safe Browsing (verifica aggiuntiva)"));
    auto hbox_key = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::HORIZONTAL, 8);
    auto lbl_key = Gtk::make_managed<Gtk::Label>(_("Chiave API Google Safe Browsing:"));
    lbl_key->set_halign(Gtk::Align::START);
 
    googleSafeKeyEntry.set_placeholder_text(_("Inserisci la tua API key..."));
    googleSafeKeyEntry.set_hexpand(true);
    googleSafeKeyEntry.set_visibility(false);
    googleSafeKeyEntry.set_text(Backend::instance().getGoogleSafeApiKey());
    auto btn_save_key = Gtk::make_managed<Gtk::Button>(_("Salva"));
    btn_save_key->signal_clicked().connect([this]() {
    std::string key = googleSafeKeyEntry.get_text();
    Backend::instance().setGoogleSafeApiKey(key);
    Backend::instance().saveGoogleSafeConfig();
    antiphishStatus.set_text("✔ " + std::string(_("Chiave Google Safe salvata")));
    });
    auto btn_toggle_key = Gtk::make_managed<Gtk::Button>(_("Mostra"));
    btn_toggle_key->set_data("visible", new bool(false), [](void* p){ delete static_cast<bool*>(p); });
    btn_toggle_key->signal_clicked().connect(
    sigc::track_obj([this, btn_toggle_key]() {
        bool* visible = static_cast<bool*>(btn_toggle_key->get_data("visible"));
        *visible = !*visible;
 
        googleSafeKeyEntry.set_visibility(*visible);
        btn_toggle_key->set_label(*visible ? _("Nascondi") : _("Mostra"));
    }, *btn_toggle_key)
    );
 
    auto btn_test_key = Gtk::make_managed<Gtk::Button>(_("Verifica"));
    btn_test_key->signal_clicked().connect([this]() {
    antiphishStatus.set_text("⏳ " + std::string(_("Verifica chiave Google Safe...")));
    std::thread([this, alive = alive_]() {
        bool valid = Backend::instance().testGoogleSafeKey();
        if (!alive->load()) return;
        Glib::signal_idle().connect_once([this, alive, valid]() {
            BastionGuard::if_alive(alive, [this, valid]() {
                if (valid)
                    antiphishStatus.set_text("✔ " + std::string(_("Chiave Google Safe valida")));
                else
                    antiphishStatus.set_text("❌ " + std::string(_("Chiave Google Safe non valida")));
            });
        });
    }).detach();
    });
 
 
 
    hbox_key->append(*lbl_key);
    hbox_key->append(googleSafeKeyEntry);
    hbox_key->append(*btn_toggle_key);
    hbox_key->append(*btn_save_key);
    hbox_key->append(*btn_test_key);
    page_phish->append(*hbox_key);
 
    googleSafeSwitch.set_active(Backend::instance().isGoogleSafeEnabled());
 
    hbox_safe->append(*lbl_safe);
    hbox_safe->append(googleSafeSwitch);
    page_phish->append(*hbox_safe);
 
    googleSafeSwitch.property_active().signal_changed().connect([this]() {
        bool enabled = googleSafeSwitch.get_active();
        Backend::instance().setGoogleSafeEnabled(enabled);
 
        antiphishStatus.set_text(enabled
            ? _("✔ Google Safe Browsing abilitato")
            : _("ℹ️ Google Safe Browsing disabilitato"));
    });
 
    phishStore = Gtk::ListStore::create(phishCols);
    phishView.set_model(phishStore);
    phishView.append_column(_("Blacklist caricate"), phishCols.source);
 
    auto scrolled = Gtk::make_managed<Gtk::ScrolledWindow>();
    scrolled->set_policy(Gtk::PolicyType::AUTOMATIC, Gtk::PolicyType::AUTOMATIC);
    scrolled->set_expand(true);
    scrolled->set_child(phishView);
    page_phish->append(*scrolled);
    loadPhishLists();
 
    auto btn_update = Gtk::make_managed<Gtk::Button>(_("Aggiorna blacklist"));
    page_phish->append(*btn_update);
    btn_update->signal_clicked().connect([this]() {
    antiphishStatus.set_text("⏳ " + std::string(_("Aggiornamento blacklist...")));
 
    std::thread([this, alive = alive_]() {
        bool ok = Backend::instance().updatePhishLists();
        if (!alive->load()) return;
 
        Glib::signal_idle().connect_once([this, alive, ok]() {
            BastionGuard::if_alive(alive, [this, ok]() {
                if (ok) {
                    antiphishStatus.set_text("✔ " + std::string(_("Blacklist aggiornata")));
 
                    refreshPhishLists();
                    if (isServiceActive("BastionGuard-phishing-scanner.service")) {
                        antiphishStatus.set_text(_("♻ Riavvio servizio Anti-Phishing..."));
                        int r1 = (bg_process::run({"pkexec", "/usr/libexec/bastionguard/bastionguard-service", "--system", "restart", "BastionGuard-phishing-scanner.service"}).exit_code);
                        if (r1 == 0) {
                            antiphishStatus.set_text(_("✔ Servizio Anti-Phishing riavviato con nuova blacklist"));
                        } else {
                            antiphishStatus.set_text(_("⚠ Errore durante il riavvio del servizio Anti-Phishing"));
                        }
                    }
 
                } else {
                    antiphishStatus.set_text("❌ " + std::string(_("Errore aggiornamento blacklist")));
                }
            });
        });
    }).detach();
});
 
 
    auto lblInfo = Gtk::make_managed<Gtk::Label>(
        "ℹ️ " + std::string(_("La lista completa aggiornata si trova in: phishing/blacklist.txt"))
    );
    lblInfo->set_wrap(true);
    page_phish->append(*lblInfo);
    auto frameFirewall = Gtk::make_managed<Gtk::Frame>();
    frameFirewall->set_hexpand(true);
 
    auto boxFirewall = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 10);
    boxFirewall->set_margin(12);
    boxFirewall->set_hexpand(true);
    auto lblFwTitle = Gtk::make_managed<Gtk::Label>(
        _("Blocco IP automatico (Firewall)")
    );
    lblFwTitle->set_halign(Gtk::Align::START);
    lblFwTitle->add_css_class("card-title");
    auto lblFwToggle = Gtk::make_managed<Gtk::Label>(
        _("Abilita blocco IP automatico")
    );
    lblFwToggle->set_halign(Gtk::Align::START);
 
    auto swFirewall = Gtk::make_managed<Gtk::Switch>();
    swFirewall->set_active(Backend::instance().isFirewallEnabled());
 
    auto hboxFwToggle = Gtk::make_managed<Gtk::CenterBox>();
    hboxFwToggle->set_start_widget(*lblFwToggle);
    hboxFwToggle->set_end_widget(*swFirewall);
    auto lblFwDesc = Gtk::make_managed<Gtk::Label>(
        _("Blocca automaticamente gli IP malevoli rilevati dal modulo Anti-Phishing\n"
        "utilizzando il firewall di sistema (UFW / firewalld).")
    );
    lblFwDesc->set_wrap(true);
    lblFwDesc->set_halign(Gtk::Align::START);
    lblFwDesc->add_css_class("card-description");
    auto lblFwStatus = Gtk::make_managed<Gtk::Label>();
    lblFwStatus->set_halign(Gtk::Align::START);
    auto updateFwStatus = [lblFwStatus]() {
        auto& backend = Backend::instance();
 
        if (!backend.isFirewallEnabled()) {
            lblFwStatus->set_text(_("Firewall IP: Disattivato"));
            lblFwStatus->remove_css_class("status-ok");
            lblFwStatus->add_css_class("status-muted");
            return;
        }
 
        switch (backend.getFirewallType()) {
            case FirewallType::UFW:
                lblFwStatus->set_text(_("Firewall IP attivo: UFW"));
                break;
            case FirewallType::FIREWALLD:
                lblFwStatus->set_text(_("Firewall IP attivo: firewalld"));
                break;
            default:
                lblFwStatus->set_text(_("Firewall IP attivo"));
                break;
        }
 
        lblFwStatus->remove_css_class("status-muted");
        lblFwStatus->add_css_class("status-ok");
    };
 
    updateFwStatus();
 
    auto btnFirewall = Gtk::make_managed<Gtk::Button>(
        _("Configura blocco IP firewall")
    );
    btnFirewall->set_halign(Gtk::Align::END);
    btnFirewall->add_css_class("suggested-action");
 
    btnFirewall->signal_clicked().connect(
    [this, updateFwStatus]() {
 
        auto dialog = std::make_unique<FirewallChoiceDialog>();
 
        if (auto *win = dynamic_cast<Gtk::Window*>(get_root()))
            dialog->set_transient_for(*win);
 
        dialog->set_modal(true);
 
        dialog->signal_firewall_selected.connect(
            [updateFwStatus](FirewallType type) {
 
                auto& backend = Backend::instance();
 
                backend.setFirewallType(type);
                backend.setFirewallEnabled(true);
 
                backend.applyFirewallFromPhishingBlacklist();
 
                updateFwStatus();
            }
        );
 
        dialog->present();
        dialog.release();
    });
 
    swFirewall->property_active().signal_changed().connect(
        [this, swFirewall, updateFwStatus]() {
            bool enabled = swFirewall->get_active();
            Backend::instance().setFirewallEnabled(enabled);
 
            antiphishStatus.set_text(
                enabled
                ? _("✔ Blocco IP firewall abilitato")
                : _("ℹ️ Blocco IP firewall disabilitato")
            );
 
            updateFwStatus();
        }
    );
 
    boxFirewall->append(*lblFwTitle);
    boxFirewall->append(*hboxFwToggle);
    boxFirewall->append(*lblFwDesc);
    boxFirewall->append(*lblFwStatus);
    boxFirewall->append(*btnFirewall);
 
    frameFirewall->set_child(*boxFirewall);
    page_phish->append(*frameFirewall);
 
 
    page_order_.push_back(page_phish);
    stack.add(*page_phish, "anti-phishing", _("Anti-Phishing"));
}
 
 
 
void SettingsPage::onAntiphishToggled() {
    if (antiphishSwitch.get_active()) {
        if (!isServiceActive("BastionGuard-phishing-scanner.service")) {
            antiphishStatus.set_text(_("⏳ Avvio servizio Anti-Phishing..."));
            if ((bg_process::run({"pkexec", "/usr/libexec/bastionguard/bastionguard-service", "--system", "start", "BastionGuard-phishing-scanner.service"}).exit_code) != 0) {
                antiphishStatus.set_text(_("❌ Impossibile avviare il servizio Anti-Phishing"));
                antiphishSwitch.set_active(false);
                return;
            }
        }
        Backend::instance().start_antiphish();
        antiphishStatus.set_text(_("Protezione Anti-Phishing: Attiva"));
    } else {
        if (isServiceActive("BastionGuard-phishing-scanner.service")) {
            antiphishStatus.set_text(_("⏳ Arresto servizio Anti-Phishing..."));
            if ((bg_process::run({"pkexec", "/usr/libexec/bastionguard/bastionguard-service", "--system", "stop", "BastionGuard-phishing-scanner.service"}).exit_code) != 0) {
                antiphishStatus.set_text(_("❌ Impossibile fermare il servizio Anti-Phishing"));
                antiphishSwitch.set_active(true);
                return;
            }
        }
        Backend::instance().stop_antiphish();
        antiphishStatus.set_text(_("Protezione Anti-Phishing: Disattivata"));
    }
}
 
void SettingsPage::refreshPhishLists() {
    if (!phishStore) {
        std::cerr << _("⚠ refreshPhishLists chiamata ma phishStore non è inizializzato\n");
        return;
    }
    loadPhishLists();
}
 
void SettingsPage::loadPhishLists() {
    if (!phishStore) {
        std::cerr << _("⚠ phishStore non inizializzato\n");
        return;
    }
 
    phishStore->clear();
    std::string reducePath = resource("phishing/blacklist-reduce.txt");
    std::ifstream freduce(reducePath);
    if (freduce.is_open()) {
        std::string line;
        int count = 0;
        while (std::getline(freduce, line)) {
            if (!line.empty()) {
                auto row = *(phishStore->append());
                row[phishCols.source] = line;
                count++;
            }
        }
        freduce.close();
 
        if (count == 0) {
            auto row = *(phishStore->append());
            row[phishCols.source] = "⚠ " + std::string(_("Blacklist ridotta vuota in ")) + reducePath;
        } else {
            auto row = *(phishStore->append());
            row[phishCols.source] = "✔ " + std::string(_("Caricate ")) + std::to_string(count) +
                                    " " + std::string(_("righe da blacklist ridotta"));
        }
    } else {
        auto row = *(phishStore->append());
        row[phishCols.source] = "⚠ " + std::string(_("Nessuna blacklist ridotta trovata in ")) + reducePath;
    }
    std::string fullPath = resource("phishing/blacklist.txt");
    if (std::filesystem::exists(fullPath)) {
        auto row = *(phishStore->append());
        row[phishCols.source] = "✔ " + std::string(_("Lista completa in ")) + fullPath;
    } else {
        auto row = *(phishStore->append());
        row[phishCols.source] = "⚠ " + std::string(_("Lista completa non trovata in ")) + fullPath;
    }
}
 
 
 
 
 
static std::string normalize_locale(std::string s) {
    auto p = s.find('.'); if (p != std::string::npos) s = s.substr(0, p);
    p = s.find('@'); if (p != std::string::npos) s = s.substr(0, p);
    for (auto& c : s) if (c == '-') c = '_';
    return s;
}
 
void SettingsPage::build_options_tab() {
    auto page_opts = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 12);
 
    auto frame = Gtk::make_managed<Gtk::Frame>();
    frame->get_style_context()->add_class("card");
 
    auto inner = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 10);
    inner->set_margin_top(8);
    inner->set_margin_bottom(8);
    inner->set_margin_start(8);
    inner->set_margin_end(8);
    auto lblLang = Gtk::make_managed<Gtk::Label>(_("Lingua dell'applicazione"));
    lblLang->set_halign(Gtk::Align::START);
    inner->append(*lblLang);
    auto rowLang = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::HORIZONTAL, 8);
    auto lblSel  = Gtk::make_managed<Gtk::Label>(_("Seleziona lingua"));
    lblSel->set_halign(Gtk::Align::START);
 
    combo_language_.set_hexpand(true);
    rowLang->append(*lblSel);
    rowLang->append(combo_language_);
    inner->append(*rowLang);
    combo_language_.append("it_IT", "Italiano");
    combo_language_.append("en_US", "English");
    combo_language_.append("ar_SA", "العربية");
    combo_language_.append("de_DE", "Deutsch");
    combo_language_.append("es_ES", "Español");
    combo_language_.append("fr_FR", "Français");
    combo_language_.append("ja_JP", "日本語");
    combo_language_.append("nl_NL", "Nederlands");
    combo_language_.append("pl_PL", "Polski");
    combo_language_.append("pt_PT", "Português");
    combo_language_.append("ru_RU", "Русский");
    std::string currentLang;
    if (const char* v = std::getenv("LC_ALL"); v && *v) currentLang = normalize_locale(v);
    else if (const char* v = std::getenv("LC_MESSAGES"); v && *v) currentLang = normalize_locale(v);
    else if (const char* v = std::getenv("LANG"); v && *v) currentLang = normalize_locale(v);
    if (currentLang.empty()) currentLang = "it_IT";
 
    combo_language_.set_active_id(currentLang);
    if (combo_language_.get_active_id() != currentLang) {
        combo_language_.set_active_id("en_US");
        if (combo_language_.get_active_id() != "en_US")
            combo_language_.set_active(0);
    }
 
    btn_apply_language_.set_label(_("Applica"));
    btn_apply_language_.set_hexpand(false);
    inner->append(btn_apply_language_);
 
    btn_apply_language_.signal_clicked().connect([this]() {
    std::string lang = combo_language_.get_active_id();
    if (lang.empty()) lang = "en_US";
 
    std::string lang_full = lang + ".UTF-8";
    std::string lang_short = lang.substr(0, 2);
 
    std::string config_dir = Glib::get_home_dir() + "/.config/BastionGuard";
    std::filesystem::create_directories(config_dir);
    std::ofstream f(config_dir + "/lang.conf", std::ios::trunc);
    if (f.is_open()) {
        f << "LANG=" << lang_full << "\n";
        f << "LC_ALL=" << lang_full << "\n";
        f << "LANGUAGE=" << lang << ":" << lang_short << "\n";
        f.close();
        std::cout << _("✔ Lingua salvata in ") << config_dir << "/lang.conf\n";
    } else {
        std::cerr << _("❌ Impossibile salvare ") << config_dir << "/lang.conf\n";
    }
 
    auto dialog = Gtk::make_managed<Gtk::Window>();
    dialog->set_modal(true);
    dialog->set_default_size(280, 120);
    dialog->set_title(_("Riavvio dei servizi in corso..."));
 
    auto box = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 12);
    box->set_margin(20);
 
    auto spinner = Gtk::make_managed<Gtk::Spinner>();
    spinner->set_hexpand(true);
    spinner->set_vexpand(true);
    spinner->start();
 
    auto label = Gtk::make_managed<Gtk::Label>(
        _("Attendere qualche secondo, l'app verrà riavviata automaticamente."));
    label->set_wrap(true);
    label->set_justify(Gtk::Justification::CENTER);
 
    box->append(*spinner);
    box->append(*label);
    dialog->set_child(*box);
    dialog->show();
    auto alive = alive_;
    std::thread([alive, dialog]() {
    const char* alert_service           = "BastionGuard-ransomware-alert.service";
    const char* scanner_service         = "BastionGuard-phishing-scanner.service";
    const char* ransomware_service      = "BastionGuard-ransomware-scanner.service";
    const char* alert_realtime_service  = "BastionGuard-ransomware-realtime-alert.service";
 
    const auto restart_user = [](const char* service) {
        return bg_process::run({"/usr/libexec/bastionguard/bastionguard-service",
                                "--user", "restart", service}).ok();
    };
    for (const auto* unit : {alert_service, alert_realtime_service, ransomware_service}) {
        if (!restart_user(unit))
            std::cerr << _("[BastionGuard] Impossibile riavviare ") << unit << std::endl;
    }
    // Do not fall back to pkill -f or nohup with service-derived patterns.
    if (!bg_process::run({"pkexec", "/usr/libexec/bastionguard/bastionguard-service",
                          "--system", "restart", scanner_service}).ok())
        std::cerr << _("[BastionGuard] Riavvio servizio di sistema fallito") << std::endl;
 
    std::this_thread::sleep_for(std::chrono::milliseconds(800));
 
    Glib::signal_idle().connect_once([alive, dialog]() {
        if (alive && alive->load(std::memory_order_acquire))
            dialog->close();
    });
 
    char self_path[1024];
    ssize_t n = readlink("/proc/self/exe", self_path, sizeof(self_path) - 1);
    if (n > 0) {
        self_path[n] = '\0';
        execl(self_path, self_path, nullptr);
        std::cerr << _("❌ Impossibile rilanciare l’app (execl fallito)") << "\n";
    } else {
        std::cerr << _("❌ Impossibile determinare il percorso dell’eseguibile") << "\n";
    }
        }).detach();
 
    });
 
 
    frame->set_child(*inner);
    page_opts->append(*frame);
 
 
    {
        auto frameTheme = Gtk::make_managed<Gtk::Frame>();
        frameTheme->get_style_context()->add_class("card");
 
        auto innerTheme = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 10);
        innerTheme->set_margin_top(8);
        innerTheme->set_margin_bottom(8);
        innerTheme->set_margin_start(8);
        innerTheme->set_margin_end(8);
 
        auto lblTheme = Gtk::make_managed<Gtk::Label>(_("Tema dell'interfaccia"));
        lblTheme->set_halign(Gtk::Align::START);
        innerTheme->append(*lblTheme);
 
        auto rowTheme = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::HORIZONTAL, 8);
 
        auto lblThemeSel = Gtk::make_managed<Gtk::Label>(_("Seleziona tema"));
        lblThemeSel->set_halign(Gtk::Align::START);
 
        auto* combo_theme = Gtk::make_managed<Gtk::ComboBoxText>();
        combo_theme->set_hexpand(true);
        combo_theme->append("light", _("☀  Chiaro (Light)"));
        combo_theme->append("dark",  _("🌙  Scuro (Dark)"));
 
        {
            std::string themeCfg = Glib::get_home_dir() + "/.config/BastionGuard/theme.conf";
            std::ifstream tf(themeCfg);
            std::string saved;
            if (tf >> saved && (saved == "light" || saved == "dark"))
                combo_theme->set_active_id(saved);
            else
                combo_theme->set_active_id("light");
        }
 
        rowTheme->append(*lblThemeSel);
        rowTheme->append(*combo_theme);
        innerTheme->append(*rowTheme);
 
        auto lblPreview = Gtk::make_managed<Gtk::Label>("");
        lblPreview->set_halign(Gtk::Align::START);
        lblPreview->get_style_context()->add_class("dim-label");
        innerTheme->append(*lblPreview);
 
        auto updatePreview = [lblPreview](const std::string& id) {
            if (id == "dark")
                lblPreview->set_text(_("Tema scuro: sfondo #1a1d23, testo chiaro."));
            else
                lblPreview->set_text(_("Tema chiaro: sfondo #f8f9fa, testo scuro."));
        };
        updatePreview(combo_theme->get_active_id());
        combo_theme->signal_changed().connect([combo_theme, updatePreview]() {
            updatePreview(combo_theme->get_active_id());
        });
 
        auto* btn_apply_theme = Gtk::make_managed<Gtk::Button>(_("Applica tema"));
        btn_apply_theme->set_hexpand(false);
        innerTheme->append(*btn_apply_theme);
 
        btn_apply_theme->signal_clicked().connect([this, combo_theme]() {
            const std::string themeId = combo_theme->get_active_id();
            if (themeId.empty()) return;
 
 
            std::string cfgDir = Glib::get_home_dir() + "/.config/BastionGuard";
            std::filesystem::create_directories(cfgDir);
            std::ofstream tf(cfgDir + "/theme.conf", std::ios::trunc);
            tf << themeId;
            tf.close();
 
 
            std::string cssFile;
            if (themeId == "dark")
                cssFile = Glib::build_filename(DATA_DIR, "BastionGuard-dark.css");
            else
                cssFile = Glib::build_filename(DATA_DIR, "BastionGuard.css");
 
            if (!std::filesystem::exists(cssFile)) {
                char self_path[1024] = {};
                ssize_t n = readlink("/proc/self/exe", self_path, sizeof(self_path) - 1);
                if (n > 0) {
                    std::string exeDir = std::filesystem::path(self_path).parent_path().string();
                    std::string candidate = exeDir + "/" +
                        (themeId == "dark" ? "BastionGuard-dark.css" : "BastionGuard.css");
                    if (std::filesystem::exists(candidate))
                        cssFile = candidate;
                }
            }
 
            if (!std::filesystem::exists(cssFile)) {
                Gtk::Window* pw = dynamic_cast<Gtk::Window*>(get_root());
                Utils::show_message(pw,
                    _("File CSS non trovato:\n") + cssFile,
                    Gtk::MessageType::ERROR);
                return;
            }
 
            try {
                auto provider = Gtk::CssProvider::create();
                provider->load_from_path(cssFile);
                Gtk::StyleContext::add_provider_for_display(
                    Gdk::Display::get_default(),
                    provider,
                    GTK_STYLE_PROVIDER_PRIORITY_USER);
 
                std::cout << "[BastionGuard] Tema applicato: " << cssFile << std::endl;
 
                Gtk::Window* pw = dynamic_cast<Gtk::Window*>(get_root());
                Utils::show_message(pw,
                    _("Tema applicato con successo.\n"
                      "Per un'applicazione completa riavvia BastionGuard."),
                    Gtk::MessageType::INFO);
 
            } catch (const Glib::Error& e) {
                std::cerr << "[BastionGuard] Errore CSS: " << e.what() << std::endl;
                Gtk::Window* pw = dynamic_cast<Gtk::Window*>(get_root());
                Utils::show_message(pw,
                    (Glib::ustring(_("Errore nel caricamento del tema:\n")) + e.what()).raw(),
                    Gtk::MessageType::ERROR);
            }
        });
 
        frameTheme->set_child(*innerTheme);
        page_opts->append(*frameTheme);
    }
 
    auto frameWeb = Gtk::make_managed<Gtk::Frame>();
    frameWeb->get_style_context()->add_class("card");
 
    auto innerWeb = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 10);
    innerWeb->set_margin(10);
 
    auto lblSystem = Gtk::make_managed<Gtk::Label>(_("Sistema operativo / Distro"));
    lblSystem->set_halign(Gtk::Align::START);
    innerWeb->append(*lblSystem);
 
    combo_os_.append("auto", _("Rilevamento automatico"));
    combo_os_.append("debian", "Debian / Ubuntu / Mint");
    combo_os_.append("fedora", "Fedora / RHEL / CentOS / Alma / Rocky");
    combo_os_.append("arch", "Arch / Manjaro / Endeavour");
    combo_os_.append("opensuse", "openSUSE / SLE");
    combo_os_.append("gentoo", "Gentoo");
    combo_os_.append("slackware", "Slackware");
    combo_os_.append("bsd", "FreeBSD / OpenBSD / NetBSD");
    combo_os_.set_active_id(detect_distro());
    innerWeb->append(combo_os_);
 
    auto gridPorts = Gtk::make_managed<Gtk::Grid>();
    gridPorts->set_row_spacing(6);
    gridPorts->set_column_spacing(6);
 
    auto lblHttp = Gtk::make_managed<Gtk::Label>("Porta HTTP:");
    lblHttp->set_halign(Gtk::Align::START);
    auto [saved_http, saved_https] = read_webports_conf();
    entry_http_port_.set_placeholder_text("81");
    entry_http_port_.set_width_chars(6);
    entry_http_port_.set_max_width_chars(6);
    entry_http_port_.set_text(std::to_string(saved_http));
 
    auto lblHttps = Gtk::make_managed<Gtk::Label>("Porta HTTPS:");
    lblHttps->set_halign(Gtk::Align::START);
    entry_https_port_.set_placeholder_text("444");
    entry_https_port_.set_width_chars(6);
    entry_https_port_.set_max_width_chars(6);
    entry_https_port_.set_text(std::to_string(saved_https));
 
    gridPorts->attach(*lblHttp, 0, 0, 1, 1);
    gridPorts->attach(entry_http_port_, 1, 0, 1, 1);
    gridPorts->attach(*lblHttps, 0, 1, 1, 1);
    gridPorts->attach(entry_https_port_, 1, 1, 1, 1);
    innerWeb->append(*gridPorts);
 
    btn_apply_webconfig_.set_label(_("Applica configurazione web"));
    innerWeb->append(btn_apply_webconfig_);
 
    auto write_temp_script_and_elevate = [](const std::string& script_contents, std::string* out_log = nullptr) -> bool {
        char tmpl[] = "/tmp/BastionGuard_tmp_XXXXXX";
        int fd = mkstemp(tmpl);
        if (fd < 0) return false;
 
        std::string tmpname = tmpl;
        FILE* f = fdopen(fd, "w");
        if (!f) { close(fd); return false; }
        fputs(script_contents.c_str(), f);
        fclose(f);
        chmod(tmpname.c_str(), 0755);
 
        const std::string runner = std::filesystem::exists("/usr/bin/pkexec") ? "pkexec" : "sudo";
        std::map<std::string, std::string> env;
        for (const char* key : {"DISPLAY", "XAUTHORITY", "DBUS_SESSION_BUS_ADDRESS"}) {
            if (const char* val = std::getenv(key)) env.emplace(key, val);
        }
        const auto result = bg_process::run({runner, tmpname}, true, 8U * 1024U * 1024U, env);
        const std::string& output = result.output;
        std::filesystem::remove(tmpname);
        if (out_log) *out_log = output;
        return result.ok();
    };
 
    auto replace_placeholders = [](const std::string& src, const std::string& dest,
                                int http_port, int https_port) -> bool {
        std::ifstream in(src);
        std::ofstream out(dest);
        if (!in.is_open() || !out.is_open()) return false;
        std::string line;
        while (std::getline(in, line)) {
            line = std::regex_replace(line, std::regex("\\{\\{HTTP_PORT\\}\\}"), std::to_string(http_port));
            line = std::regex_replace(line, std::regex("\\{\\{HTTPS_PORT\\}\\}"), std::to_string(https_port));
            out << line << "\n";
        }
        return true;
    };
 
    btn_apply_webconfig_.signal_clicked().connect([this, replace_placeholders, write_temp_script_and_elevate]() {
        namespace fs = std::filesystem;
 
        Gtk::Window* parent = dynamic_cast<Gtk::Window*>(get_root());
        auto show_message = [parent](const Glib::ustring& msg, Gtk::MessageType type, const Glib::ustring& /*title*/) {
            Utils::show_message(parent, msg.raw(), type);
        };
 
        std::string distro = combo_os_.get_active_id();
        if (distro.empty() || distro == "auto")
            distro = detect_distro();
 
        std::cout << _("[BastionGuard] Distro rilevata: ") << distro << std::endl;
 
        int http_port = 81, https_port = 444;
        try {
            http_port = std::stoi(entry_http_port_.get_text());
            https_port = std::stoi(entry_https_port_.get_text());
        } catch (...) {
            show_message(_("Le porte devono essere numeriche valide."),
                        Gtk::MessageType::ERROR, _("BastionGuard - Errore"));
            return;
        }
 
        if (http_port <= 0 || http_port >= 65536 ||
            https_port <= 0 || https_port >= 65536) {
            show_message(_("Le porte devono essere comprese tra 1 e 65535."),
                        Gtk::MessageType::ERROR, _("BastionGuard - Errore"));
            return;
        }
 
        std::string template_path = Glib::build_filename(DATA_DIR, "vhosts/nginx.conf");
        std::string tmpfile = "/tmp/BastionGuard_nginx.conf";
        if (!replace_placeholders(template_path, tmpfile, http_port, https_port)) {
            show_message(_("Errore durante la sostituzione delle porte nel template."),
                        Gtk::MessageType::ERROR, _("BastionGuard - Errore"));
            return;
        }
 
        std::string nginx_default_src;
        if (distro == "arch" || distro == "manjaro" || distro == "endeavour") {
            nginx_default_src = Glib::build_filename(DATA_DIR, "vhosts/nginx-config-arch.conf");
        } else {
            nginx_default_src = Glib::build_filename(DATA_DIR, "vhosts/nginx-default.conf");
        }
        std::string target_conf, site_avail, site_enable;
        if (distro == "arch" || distro == "manjaro" || distro == "endeavour") {
            site_avail = "/etc/nginx/sites-available/default";
            site_enable = "/etc/nginx/sites-enabled/default";
            target_conf = site_avail;
        } else {
            target_conf = fs::exists("/etc/nginx/conf.d")
                            ? "/etc/nginx/conf.d/BastionGuard.conf"
                            : "/etc/nginx/sites-enabled/BastionGuard.conf";
        }
 
        std::ostringstream script;
        script << "#!/bin/sh\nset -e\n";
        script << _("echo '[BastionGuard] Applicazione configurazione NGINX...'\n");
        script << "mkdir -p /etc/BastionGuard\n";
        script << "echo \"" << http_port << " " << https_port << "\" > /etc/BastionGuard/webports.conf\n";
 
        if (distro == "arch" || distro == "manjaro" || distro == "endeavour") {
            script << "mkdir -p /etc/nginx/sites-available /etc/nginx/sites-enabled\n";
            script << "echo '[BastionGuard] Installo configurazione Arch...'\n";
            script << "install -m 0644 " << nginx_default_src << " " << site_avail << "\n";
            script << "ln -sf " << site_avail << " " << site_enable << "\n";
        } else {
            script << _("echo '[BastionGuard] Verifica configurazione esistente...'\n");
            script << "if ! grep -q 'BastionGuard Local Web Server' /etc/nginx/nginx.conf 2>/dev/null; then\n";
            script << "  echo '[BastionGuard] Inserisco blocco mancante in nginx.conf...'\n";
            script << "  cp /etc/nginx/nginx.conf /etc/nginx/nginx.conf.bak\n";
            script << "  cat " << nginx_default_src << " >> /etc/nginx/nginx.conf\n";
            script << "else\n";
            script << _("  echo '[BastionGuard] Configurazione già presente, aggiornamento non necessario.'\n");
            script << "fi\n";
            script << "install -m 0644 " << tmpfile << " " << target_conf << "\n";
        }
 
        script << "nginx -t && /usr/libexec/bastionguard/bastionguard-service --system restart nginx.service\n";
 
        std::string out;
        if (!write_temp_script_and_elevate(script.str(), &out)) {
            std::cerr << _("[BastionGuard] Fallito:\n") << out << std::endl;
            show_message(_("Errore durante l’applicazione della configurazione:\n") + out,
                        Gtk::MessageType::ERROR, _("BastionGuard - Errore"));
            return;
        }
 
        show_message(_("Configurazione NGINX aggiornata e servizio riavviato."),
                    Gtk::MessageType::INFO, _("BastionGuard - Esito"));
    });
 
    frameWeb->set_child(*innerWeb);
    page_opts->append(*frameWeb);
 
    page_order_.push_back(page_opts);
    stack.add(*page_opts, "options", _("Opzioni"));
}
 
void SettingsPage::build_whitelist_tab() {
    auto page = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 12);
 
    auto lblTitle = Gtk::make_managed<Gtk::Label>(_("Gestione Whitelist / Blacklist Anti-Phishing"));
    lblTitle->set_halign(Gtk::Align::START);
    lblTitle->set_margin_bottom(6);
    page->append(*lblTitle);
 
 
    const std::string baseDir = Glib::get_home_dir() + "/.local/share/BastionGuard/phishing";
    std::filesystem::create_directories(baseDir);
 
    const std::string wlUserPath = baseDir + "/whitelist.txt";
    const std::string wlSysPath  = "/usr/share/BastionGuard/data/phishing/whitelist.txt";
 
    const std::string blUserPath = baseDir + "/blacklist_custom.txt";
    const std::string blSysPath  = "/usr/share/BastionGuard/data/phishing/blacklist_custom.txt";
 
    const std::string dnsmasqConfPath = "/etc/dnsmasq.d/bastionguard-blacklist.conf";
    const std::string tmpDnsmasqConf  = "/tmp/bastionguard-blacklist.conf";
 
 
    auto searchEntry = Gtk::make_managed<Gtk::SearchEntry>();
    searchEntry->set_placeholder_text(_("Cerca in whitelist/blacklist..."));
    page->append(*searchEntry);
 
 
    auto wlStoreView = Gio::ListStore<Gtk::StringObject>::create();
    auto blStoreView = Gio::ListStore<Gtk::StringObject>::create();
 
 
    auto wlSelection = Gtk::SingleSelection::create(wlStoreView);
    auto blSelection = Gtk::SingleSelection::create(blStoreView);
 
 
    auto factory = Gtk::SignalListItemFactory::create();
    factory->signal_setup().connect([](const Glib::RefPtr<Gtk::ListItem>& item) {
        auto lbl = Gtk::make_managed<Gtk::Label>();
        lbl->set_xalign(0);
        lbl->set_margin(4);
        item->set_child(*lbl);
    });
    factory->signal_bind().connect([](const Glib::RefPtr<Gtk::ListItem>& item) {
        auto obj = std::dynamic_pointer_cast<Gtk::StringObject>(item->get_item());
        if (auto lbl = dynamic_cast<Gtk::Label*>(item->get_child()))
            lbl->set_text(obj ? obj->get_string() : "");
    });
 
 
    auto wlLabel = Gtk::make_managed<Gtk::Label>(_("Whitelist (consenti)"));
    wlLabel->set_halign(Gtk::Align::START);
    page->append(*wlLabel);
 
    Gtk::ListView wlListView(wlSelection, factory);
    wlListView.set_vexpand(true);
    wlListView.add_css_class("whitelist-view");
 
    auto wlScrolled = Gtk::make_managed<Gtk::ScrolledWindow>();
    wlScrolled->set_policy(Gtk::PolicyType::AUTOMATIC, Gtk::PolicyType::AUTOMATIC);
    wlScrolled->set_expand(true);
    wlScrolled->set_child(wlListView);
    page->append(*wlScrolled);
 
    auto wlEntry = Gtk::make_managed<Gtk::Entry>();
    wlEntry->set_placeholder_text(_("Aggiungi a whitelist (dominio o IPv4)"));
    wlEntry->set_hexpand(true);
 
    auto wlAdd    = Gtk::make_managed<Gtk::Button>(_("Aggiungi"));
    auto wlRemove = Gtk::make_managed<Gtk::Button>(_("Rimuovi selezionato"));
 
    auto wlRow = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::HORIZONTAL, 6);
    wlRow->append(*wlEntry);
    wlRow->append(*wlAdd);
    wlRow->append(*wlRemove);
    page->append(*wlRow);
 
 
    auto blLabel = Gtk::make_managed<Gtk::Label>(_("Blacklist custom (blocca via dnsmasq)"));
    blLabel->set_halign(Gtk::Align::START);
    blLabel->set_margin_top(8);
    page->append(*blLabel);
 
    Gtk::ListView blListView(blSelection, factory);
    blListView.set_vexpand(true);
    blListView.add_css_class("whitelist-view");
 
    auto blScrolled = Gtk::make_managed<Gtk::ScrolledWindow>();
    blScrolled->set_policy(Gtk::PolicyType::AUTOMATIC, Gtk::PolicyType::AUTOMATIC);
    blScrolled->set_expand(true);
    blScrolled->set_child(blListView);
    page->append(*blScrolled);
 
    auto blEntry = Gtk::make_managed<Gtk::Entry>();
    blEntry->set_placeholder_text(_("Aggiungi a blacklist (dominio o IPv4)"));
    blEntry->set_hexpand(true);
 
    auto blAdd    = Gtk::make_managed<Gtk::Button>(_("Aggiungi"));
    auto blRemove = Gtk::make_managed<Gtk::Button>(_("Rimuovi selezionato"));
 
    auto blRow = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::HORIZONTAL, 6);
    blRow->append(*blEntry);
    blRow->append(*blAdd);
    blRow->append(*blRemove);
    page->append(*blRow);
 
 
    auto btnReload = Gtk::make_managed<Gtk::Button>(_("Ricarica"));
    auto btnSave   = Gtk::make_managed<Gtk::Button>(_("Salva modifiche"));
 
    auto bottom = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::HORIZONTAL, 6);
    bottom->append(*btnReload);
    bottom->append(*btnSave);
    page->append(*bottom);
 
 
    auto wlAll = std::make_shared<std::vector<std::string>>();
    auto blAll = std::make_shared<std::vector<std::string>>();
 
    // Utils
    auto trim = [](std::string s) {
        auto notSpace = [](unsigned char c){ return !std::isspace(c); };
        s.erase(s.begin(), std::find_if(s.begin(), s.end(), notSpace));
        s.erase(std::find_if(s.rbegin(), s.rend(), notSpace).base(), s.end());
        return s;
    };
    auto toLower = [](std::string s) {
        std::transform(s.begin(), s.end(), s.begin(),
                       [](unsigned char c){ return (unsigned char)std::tolower(c); });
        return s;
    };
    auto isIPv4 = [](const std::string& s) -> bool {
        static const std::regex re(
            R"(^(25[0-5]|2[0-4]\d|1?\d?\d)(\.(25[0-5]|2[0-4]\d|1?\d?\d)){3}$)"
        );
        return std::regex_match(s, re);
    };
    auto isDomain = [](const std::string& s) -> bool {
        static const std::regex re(
            R"(^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$)",
            std::regex::icase
        );
        if (!std::regex_match(s, re)) return false;
        if (s.find("..") != std::string::npos) return false;
        return true;
    };
 
    auto loadFileToVector = [](const std::string& userPath,
                               const std::string& sysPath,
                               std::vector<std::string>& out) {
        out.clear();
 
        auto load = [&](const std::string& path) -> bool {
            std::ifstream f(path);
            if (!f.is_open()) return false;
            std::string line;
            while (std::getline(f, line)) {
                if (!line.empty()) out.push_back(line);
            }
            return true;
        };
 
        if (!load(userPath)) load(sysPath);
 
 
        std::vector<std::string> dedup;
        dedup.reserve(out.size());
        for (auto& s : out) {
            if (std::find(dedup.begin(), dedup.end(), s) == dedup.end())
                dedup.push_back(s);
        }
        out.swap(dedup);
    };
 
    auto applyFilter = [=]() {
        const std::string qraw = Glib::ustring(searchEntry->get_text()).raw();
        const Glib::ustring q = Glib::ustring(qraw).lowercase();
 
        wlStoreView->remove_all();
        for (const auto& s : *wlAll) {
            if (q.empty() || Glib::ustring(s).lowercase().find(q) != Glib::ustring::npos)
                wlStoreView->append(Gtk::StringObject::create(s));
        }
 
        blStoreView->remove_all();
        for (const auto& s : *blAll) {
            if (q.empty() || Glib::ustring(s).lowercase().find(q) != Glib::ustring::npos)
                blStoreView->append(Gtk::StringObject::create(s));
        }
    };
 
    auto loadAll = [=]() {
        loadFileToVector(wlUserPath, wlSysPath, *wlAll);
        loadFileToVector(blUserPath, blSysPath, *blAll);
        applyFilter();
    };
 
    auto existsInVec = [](const std::vector<std::string>& v, const std::string& x) -> bool {
        return std::find(v.begin(), v.end(), x) != v.end();
    };
 
    auto removeFromVec = [](std::vector<std::string>& v, const std::string& x) {
        v.erase(std::remove(v.begin(), v.end(), x), v.end());
    };
 
 
    loadAll();
 
 
    searchEntry->signal_search_changed().connect([applyFilter]() {
        applyFilter();
    });
 
 
    wlAdd->signal_clicked().connect([=]() {
        std::string v = trim(wlEntry->get_text());
        if (v.empty()) return;
 
        std::string norm = isIPv4(v) ? v : toLower(v);
        if (!isIPv4(norm) && !isDomain(norm)) {
            auto dlg = Gtk::AlertDialog::create(_("Valore non valido"));
            dlg->set_detail(_("Inserisci un dominio valido o un IPv4 valido."));
            dlg->show();
            return;
        }
        if (existsInVec(*wlAll, norm)) {
            auto dlg = Gtk::AlertDialog::create(_("Già presente"));
            dlg->set_detail(_("Questo elemento è già nella whitelist."));
            dlg->show();
            wlEntry->set_text("");
            return;
        }
 
        wlAll->push_back(norm);
        wlEntry->set_text("");
        applyFilter();
    });
 
 
    wlRemove->signal_clicked().connect([=]() {
        guint pos = wlSelection->get_selected();
        if (pos == GTK_INVALID_LIST_POSITION) return;
 
        auto obj = std::dynamic_pointer_cast<Gtk::StringObject>(wlStoreView->get_object(pos));
        if (!obj) return;
 
        removeFromVec(*wlAll, obj->get_string());
        applyFilter();
    });
 
 
    blAdd->signal_clicked().connect([=]() {
        std::string v = trim(blEntry->get_text());
        if (v.empty()) return;
 
        std::string norm = isIPv4(v) ? v : toLower(v);
        if (!isIPv4(norm) && !isDomain(norm)) {
            auto dlg = Gtk::AlertDialog::create(_("Valore non valido"));
            dlg->set_detail(_("Inserisci un dominio valido o un IPv4 valido."));
            dlg->show();
            return;
        }
        if (existsInVec(*blAll, norm)) {
            auto dlg = Gtk::AlertDialog::create(_("Già presente"));
            dlg->set_detail(_("Questo elemento è già nella blacklist."));
            dlg->show();
            blEntry->set_text("");
            return;
        }
 
        blAll->push_back(norm);
        blEntry->set_text("");
        applyFilter();
    });
 
 
    blRemove->signal_clicked().connect([=]() {
        guint pos = blSelection->get_selected();
        if (pos == GTK_INVALID_LIST_POSITION) return;
 
        auto obj = std::dynamic_pointer_cast<Gtk::StringObject>(blStoreView->get_object(pos));
        if (!obj) return;
 
        removeFromVec(*blAll, obj->get_string());
        applyFilter();
    });
 
 
    btnReload->signal_clicked().connect([=]() { loadAll(); });
 
 
    btnSave->signal_clicked().connect([=]() {
 
        {
            std::ofstream f(wlUserPath, std::ios::trunc);
            if (!f.is_open()) {
                auto dlg = Gtk::AlertDialog::create(_("Errore"));
                dlg->set_detail(_("Impossibile salvare la whitelist utente."));
                dlg->show();
                return;
            }
            for (const auto& s : *wlAll) f << s << "\n";
        }
 
        {
            std::ofstream f(blUserPath, std::ios::trunc);
            if (!f.is_open()) {
                auto dlg = Gtk::AlertDialog::create(_("Errore"));
                dlg->set_detail(_("Impossibile salvare la blacklist utente."));
                dlg->show();
                return;
            }
            for (const auto& s : *blAll) f << s << "\n";
        }
 
        {
            std::ofstream f(tmpDnsmasqConf, std::ios::trunc);
            if (!f.is_open()) {
                auto dlg = Gtk::AlertDialog::create(_("Errore"));
                dlg->set_detail(_("Impossibile creare file temporaneo per dnsmasq."));
                dlg->show();
                return;
            }
 
            f << "# Generated by BastionGuard\n";
            for (const auto& item : *blAll) {
                if (!isIPv4(item)) {
                    f << "address=/" << item << "/127.0.0.2\n";
                } else {
                    f << "# IP entry (not used by dnsmasq address=): " << item << "\n";
                }
            }
        }
 
        const bool saved =
            bg_process::run({"pkexec", "/usr/bin/install", "-D", "-m", "0644", wlUserPath, wlSysPath}).ok() &&
            bg_process::run({"pkexec", "/usr/bin/install", "-D", "-m", "0644", blUserPath, blSysPath}).ok() &&
            bg_process::run({"pkexec", "/usr/bin/install", "-D", "-m", "0644", tmpDnsmasqConf, dnsmasqConfPath}).ok() &&
            bg_process::run({"pkexec", "/usr/libexec/bastionguard/bastionguard-service",
                             "--system", "reload", "dnsmasq.service"}).ok();
        if (!saved) {
            auto dlg = Gtk::AlertDialog::create(_("Errore"));
            dlg->set_detail(_("Impossibile installare i file o ricaricare dnsmasq."));
            dlg->show();
            return;
        }
 
        auto dlg = Gtk::AlertDialog::create(_("Salvataggio completato"));
        dlg->set_detail(_("Whitelist/Blacklist salvate. Config dnsmasq aggiornata (127.0.0.2) e servizio ricaricato."));
        dlg->show();
 
        std::thread([=]() {
            Backend::instance().updatePhishLists();
            if (BastionGuard::Platform::cef_available()) {
                (bg_process::run({"/usr/libexec/bastionguard/bastionguard-service", "--user", "restart", "BastionGuard-cef"}).exit_code);
            }
        }).detach();
    });
 
    page_order_.push_back(page);
    stack.add(*page, "advanced-anti-phishing", _("Anti-Phishing avanzate"));
}
 
 
 
void SettingsPage::build_antiransom_advanced_tab() {
    auto page_adv = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 12);
    page_adv->set_margin(12);
 
    // ===== Allowlist SHA256 =====
    auto frameAllow = Gtk::make_managed<Gtk::Frame>(_("Allowlist SHA256 Anti-ransomware"));
    auto vboxAllow = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 6);
    vboxAllow->set_margin(6);
 
    allowStore = Gtk::ListStore::create(allowCols);
    allowView.set_model(allowStore);
    allowView.append_column(_("SHA256"), allowCols.col_hash);
    allowView.append_column(_("Regola (opzionale)"), allowCols.col_rule);
 
    auto scrolled = Gtk::make_managed<Gtk::ScrolledWindow>();
    scrolled->set_policy(Gtk::PolicyType::AUTOMATIC, Gtk::PolicyType::AUTOMATIC);
    scrolled->set_expand(true);
    scrolled->set_child(allowView);
    vboxAllow->append(*scrolled);
 
    auto btnAdd = Gtk::make_managed<Gtk::Button>(_("Aggiungi"));
    auto btnDel = Gtk::make_managed<Gtk::Button>(_("Rimuovi"));
    auto btnBox = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::HORIZONTAL, 6);
    btnBox->append(*btnAdd);
    btnBox->append(*btnDel);
    vboxAllow->append(*btnBox);
    frameAllow->set_child(*vboxAllow);
    page_adv->append(*frameAllow);
 
    loadAllowlistUI();
 
    btnAdd->signal_clicked().connect([this]() {
        auto dialog = std::make_shared<Gtk::Dialog>();
        dialog->set_title(_("Aggiungi SHA256"));
        dialog->set_modal(true);
        dialog->set_default_size(360, 180);
        dialog->add_css_class("sha-dialog");
 
        auto shaEntry = Gtk::make_managed<Gtk::Entry>();
        auto ruleEntry = Gtk::make_managed<Gtk::Entry>();
        shaEntry->set_placeholder_text("SHA256...");
        ruleEntry->set_placeholder_text("Regola (facoltativa)");
 
        shaEntry->set_margin_bottom(6);
        ruleEntry->set_margin_bottom(6);
 
        auto content = dialog->get_content_area();
        content->set_margin(12);
        content->set_spacing(8);
        content->append(*shaEntry);
        content->append(*ruleEntry);
 
        dialog->add_button(_("_Annulla"), Gtk::ResponseType::CANCEL);
        dialog->add_button(_("_Aggiungi"), Gtk::ResponseType::OK);
 
        dialog->signal_show().connect([shaEntry]() {
            shaEntry->grab_focus();
        });
 
        dialog->signal_response().connect([this, dialog, shaEntry, ruleEntry](int response) {
            if (response == Gtk::ResponseType::OK) {
                auto sha = shaEntry->get_text();
                sha.erase(0, sha.find_first_not_of(" \t\n\r"));
                sha.erase(sha.find_last_not_of(" \t\n\r") + 1);
 
                if (!sha.empty()) {
                    auto row = *(allowStore->append());
                    row[allowCols.col_hash] = sha;
                    row[allowCols.col_rule] = ruleEntry->get_text();
                }
            }
            dialog->close();
        });
 
        dialog->set_visible(true);
    });
 
    btnDel->signal_clicked().connect([this]() {
        if (auto sel = allowView.get_selection()) {
            if (auto iter = sel->get_selected())
                allowStore->erase(iter);
        }
    });
 
    auto frameFilters = Gtk::make_managed<Gtk::Frame>(_("Filtri Anti-Falsi Positivi"));
    auto grid = Gtk::make_managed<Gtk::Grid>();
    grid->set_row_spacing(6);
    grid->set_column_spacing(6);
    grid->set_margin(6);
 
    chkSuspOnly = Gtk::make_managed<Gtk::CheckButton>(_("Analizza solo file sospetti"));
    auto lblIgnPaths = Gtk::make_managed<Gtk::Label>(_("Percorsi da ignorare"));
    txtIgnPaths = Gtk::make_managed<Gtk::Entry>();
    txtIgnPaths->set_placeholder_text("/home/*/.cache;/var/cache;/tmp;...");
    txtIgnPaths->add_css_class("home-entry");
 
    auto lblCompany = Gtk::make_managed<Gtk::Label>(_("Percorsi aziendali sicuri"));
    txtCompany = Gtk::make_managed<Gtk::Entry>();
    txtCompany->set_placeholder_text("/srv/company;/mnt/share;/opt/apps;...");
    txtCompany->add_css_class("company-entry");
 
    auto lblIgnExt = Gtk::make_managed<Gtk::Label>(_("Estensioni da ignorare"));
    txtIgnExt = Gtk::make_managed<Gtk::Entry>();
    txtIgnExt->set_placeholder_text(".jpg;.png;.pdf;...");
    txtIgnExt->add_css_class("whitelist-entry");
 
    auto lblSuspExt = Gtk::make_managed<Gtk::Label>(_("Estensioni sospette"));
    txtSuspExt = Gtk::make_managed<Gtk::Entry>();
    txtSuspExt->set_placeholder_text(".exe;.dll;.js;.sh;...");
    txtSuspExt->add_css_class("danger-entry");
 
    grid->attach(*chkSuspOnly, 0, 0, 2, 1);
    grid->attach(*lblIgnPaths, 0, 1, 1, 1);
    grid->attach(*txtIgnPaths, 1, 1, 1, 1);
    grid->attach(*lblCompany, 0, 2, 1, 1);
    grid->attach(*txtCompany, 1, 2, 1, 1);
    grid->attach(*lblIgnExt, 0, 3, 1, 1);
    grid->attach(*txtIgnExt, 1, 3, 1, 1);
    grid->attach(*lblSuspExt, 0, 4, 1, 1);
    grid->attach(*txtSuspExt, 1, 4, 1, 1);
 
    frameFilters->set_child(*grid);
    page_adv->append(*frameFilters);
 
    // === Pulsante Salva impostazioni ===
    auto btnSave = Gtk::make_managed<Gtk::Button>(_("Salva impostazioni avanzate"));
    page_adv->append(*btnSave);
 
    btnSave->signal_clicked().connect([this]() {
        saveAllowlistUI();
        saveAdvancedConfig(
            chkSuspOnly->get_active(),
            txtIgnPaths->get_text(),
            txtIgnExt->get_text(),
            txtSuspExt->get_text()
        );
 
 
        antiransomStatus.set_text(_("✔ Impostazioni avanzate salvate"));
    });
 
    loadAdvancedConfig();
    page_order_.push_back(page_adv);
    stack.add(*page_adv, "advanced-anti-ransomware", _("Anti-Ransomware avanzate"));
}
 
void SettingsPage::build_secure_payments_tab() {
    ensure_payments_json_exists();
 
    auto page_pay = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 12);
    page_pay->set_margin(12);
 
    auto framePay = Gtk::make_managed<Gtk::Frame>();
 
    auto innerPay = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 10);
    innerPay->set_margin_top(10);
    innerPay->set_margin_bottom(10);
    innerPay->set_margin_start(10);
    innerPay->set_margin_end(10);
 
    auto run_cmd_capture = [](const std::vector<std::string>& argv,
                              std::string* stdout_out = nullptr,
                              std::string* stderr_out = nullptr) -> bool
    {
        try {
            auto proc = Gio::Subprocess::create(
                argv,
                Gio::Subprocess::Flags::STDOUT_PIPE |
                Gio::Subprocess::Flags::STDERR_PIPE
            );
 
            auto [stdout_str, stderr_str] = proc->communicate_utf8("");
            if (stdout_out) *stdout_out = stdout_str.raw();
            if (stderr_out) *stderr_out = stderr_str.raw();
 
            return proc->get_successful();
        } catch (const std::exception& ex) {
            if (stderr_out) *stderr_out = ex.what();
            return false;
        } catch (...) {
            if (stderr_out) *stderr_out = "Eccezione sconosciuta";
            return false;
        }
    };
 
    auto resolve_ca_path = []() -> std::string
    {
        const auto user_ca = Glib::build_filename(
            Glib::get_home_dir(),
            ".local", "share", "BastionGuard", "certs", "intercept-ca.crt.pem");
 
        if (std::filesystem::exists(user_ca))
            return user_ca;
 
        const std::string system_ca = "/etc/BastionGuard/certs/intercept-ca.crt.pem";
        if (std::filesystem::exists(system_ca))
            return system_ca;
 
        return {};
    };
 
    auto show_alert = [this](const Glib::RefPtr<Gtk::AlertDialog>& dlg) {
        if (auto* root = this->get_root()) {
            if (auto* win = dynamic_cast<Gtk::Window*>(root)) {
                dlg->show(*win);
                return;
            }
        }
        dlg->show();
    };
 
    auto lblPayTitle = Gtk::make_managed<Gtk::Label>(_("Pagamenti Sicuri (CEF)"));
    lblPayTitle->set_halign(Gtk::Align::START);
    lblPayTitle->add_css_class("card-title");
    innerPay->append(*lblPayTitle);
 
 
    auto lblPayDesc = Gtk::make_managed<Gtk::Label>(
        _("Questa opzione apre in sandbox CEF delle pagine tipiche di pagamento "
          "(checkout, gateway, 3D Secure)\n\n"
          "Consigliato per acquisti online e inserimento dati carta.")
    );
    lblPayDesc->set_wrap(true);
    lblPayDesc->set_halign(Gtk::Align::START);
    lblPayDesc->add_css_class("card-description");
    innerPay->append(*lblPayDesc);
 
    auto lblPayInfo = Gtk::make_managed<Gtk::Label>(
        _("ℹ️ I pagamenti sicuri utilizzano un browser isolato (CEF sandbox) "
          "per ridurre il rischio di furto di credenziali e dati di pagamento.\n"
          "Questa modalità non modifica il funzionamento del sito e non salva "
          "alcuna informazione sensibile.")
    );
    lblPayInfo->set_wrap(true);
    lblPayInfo->set_halign(Gtk::Align::START);
    lblPayInfo->add_css_class("alert-info");
    innerPay->append(*lblPayInfo);
 
    auto lblPayToggle = Gtk::make_managed<Gtk::Label>(_("Abilita pagamenti sicuri"));
    lblPayToggle->set_halign(Gtk::Align::START);
 
    auto swPay = Gtk::make_managed<Gtk::Switch>();
    swPay->set_halign(Gtk::Align::END);
    swPay->set_active(SettingsStore::get_secure_payments_enabled());
 
    auto rowPay = Gtk::make_managed<Gtk::CenterBox>();
    rowPay->set_start_widget(*lblPayToggle);
    rowPay->set_end_widget(*swPay);
    innerPay->append(*rowPay);
 
    auto lblPayStatus = Gtk::make_managed<Gtk::Label>();
    lblPayStatus->set_halign(Gtk::Align::START);
    innerPay->append(*lblPayStatus);
 
    auto refreshPayStatus = [lblPayStatus, swPay]() {
        lblPayStatus->set_text(
            swPay->get_active()
                ? _("✔ Pagamenti sicuri: abilitati")
                : _("ℹ️ Pagamenti sicuri: disabilitati")
        );
        lblPayStatus->remove_css_class("status-ok");
        lblPayStatus->remove_css_class("status-muted");
        lblPayStatus->add_css_class(swPay->get_active() ? "status-ok" : "status-muted");
    };
    refreshPayStatus();
 
    auto lblList = Gtk::make_managed<Gtk::Label>(_("Domini/URL per Pagamenti Sicuri"));
    lblList->set_halign(Gtk::Align::START);
    innerPay->append(*lblList);
 
    auto store = Gio::ListStore<Gtk::StringObject>::create();
    auto selection = Gtk::SingleSelection::create(store);
 
    auto factory = Gtk::SignalListItemFactory::create();
    factory->signal_setup().connect([](const Glib::RefPtr<Gtk::ListItem>& item) {
        auto lbl = Gtk::make_managed<Gtk::Label>();
        lbl->set_xalign(0.0);
        lbl->set_margin(6);
        item->set_child(*lbl);
    });
    factory->signal_bind().connect([](const Glib::RefPtr<Gtk::ListItem>& item) {
        auto obj = std::dynamic_pointer_cast<Gtk::StringObject>(item->get_item());
        if (auto lbl = dynamic_cast<Gtk::Label*>(item->get_child()))
            lbl->set_text(obj ? obj->get_string() : "");
    });
 
    auto listView = Gtk::make_managed<Gtk::ListView>(selection, factory);
    listView->set_vexpand(true);
    listView->set_can_focus(true);
    listView->add_css_class("whitelist-view");
 
    auto scrolled = Gtk::make_managed<Gtk::ScrolledWindow>();
    scrolled->set_policy(Gtk::PolicyType::AUTOMATIC, Gtk::PolicyType::AUTOMATIC);
    scrolled->set_expand(true);
    scrolled->set_min_content_height(160);
    scrolled->set_child(*listView);
    innerPay->append(*scrolled);
 
    auto reload_from_file = [store]() {
        store->remove_all();
        auto domains = load_payments_domains();
        for (const auto& d : domains)
            store->append(Gtk::StringObject::create(d));
    };
    reload_from_file();
 
    auto entry = Gtk::make_managed<Gtk::Entry>();
    entry->set_placeholder_text(_("Inserisci dominio o URL (es. paypal.com oppure https://checkout.stripe.com)"));
    entry->set_hexpand(true);
    entry->add_css_class("whitelist-entry");
 
    auto btnAdd    = Gtk::make_managed<Gtk::Button>(_("Aggiungi"));
    auto btnRemove = Gtk::make_managed<Gtk::Button>(_("Rimuovi selezionato"));
    auto btnSave   = Gtk::make_managed<Gtk::Button>(_("Salva"));
    auto btnReload = Gtk::make_managed<Gtk::Button>(_("Ripristina"));
 
    auto rowBtns = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::HORIZONTAL, 6);
    rowBtns->append(*entry);
    rowBtns->append(*btnAdd);
    rowBtns->append(*btnRemove);
    rowBtns->append(*btnReload);
    rowBtns->append(*btnSave);
    innerPay->append(*rowBtns);
 
    btnAdd->signal_clicked().connect([store, entry, show_alert]() {
        std::string in = entry->get_text();
        std::string dom = normalize_domain_or_url(in);
        if (dom.empty()) {
            auto dlg = Gtk::AlertDialog::create(_("Valore non valido"));
            dlg->set_detail(_("Inserisci un dominio o URL valido."));
            show_alert(dlg);
            return;
        }
 
        for (guint i = 0; i < store->get_n_items(); ++i) {
            auto obj = std::dynamic_pointer_cast<Gtk::StringObject>(store->get_object(i));
            if (obj && obj->get_string() == dom) {
                entry->set_text("");
                return;
            }
        }
 
        store->append(Gtk::StringObject::create(dom));
        entry->set_text("");
    });
 
    btnRemove->signal_clicked().connect([selection, store]() {
        guint pos = selection->get_selected();
        if (pos != GTK_INVALID_LIST_POSITION)
            store->remove(pos);
    });
 
    btnReload->signal_clicked().connect([reload_from_file]() {
        reload_from_file();
    });
 
    btnSave->signal_clicked().connect([store, swPay, lblPayStatus, show_alert]() {
        std::vector<std::string> domains;
        domains.reserve(store->get_n_items());
 
        for (guint i = 0; i < store->get_n_items(); ++i) {
            auto obj = std::dynamic_pointer_cast<Gtk::StringObject>(store->get_object(i));
            if (obj) domains.push_back(obj->get_string());
        }
 
        const bool enabled_flag = swPay->get_active();
 
        if (!save_payments_domains(domains, enabled_flag)) {
            auto dlg = Gtk::AlertDialog::create(_("Errore"));
            dlg->set_detail(_("Impossibile salvare payments.json."));
            show_alert(dlg);
            return;
        }
 
        lblPayStatus->set_text(_("✔ Lista pagamenti salvata"));
        lblPayStatus->remove_css_class("status-muted");
        lblPayStatus->add_css_class("status-ok");
 
        if (BastionGuard::Platform::cef_available()) {
            std::thread([]() {
                (bg_process::run({"/usr/libexec/bastionguard/bastionguard-service", "--user", "restart", "BastionGuard-cef.service"}).exit_code);
            }).detach();
        }
    });
 
    swPay->property_active().signal_changed().connect([swPay, refreshPayStatus]() {
        const bool enabled = swPay->get_active();
        SettingsStore::set_secure_payments_enabled(enabled);
        update_payments_enabled_only(enabled);
        refreshPayStatus();
    });
 
    auto btnInstallSafeNav = Gtk::make_managed<Gtk::Button>(_("Installazione navigazione sicura"));
    btnInstallSafeNav->add_css_class("btn-warning");
    innerPay->append(*btnInstallSafeNav);
 
    auto installLogBuffer = Gtk::TextBuffer::create();
 
        btnInstallSafeNav->signal_clicked().connect(
        [this, btnInstallSafeNav, installLogBuffer, lblPayStatus, run_cmd_capture, resolve_ca_path, show_alert]() {
            if (!BastionGuard::Platform::cef_available()) {
                lblPayStatus->set_text(_("CEF e installazione CA non disponibili su questa build o distribuzione."));
                return;
            }
            btnInstallSafeNav->set_sensitive(false);
            installLogBuffer->set_text(_("Avvio installazione navigazione sicura...\n"));
 
            Gtk::Window* log_popup = create_log_popup(this, installLogBuffer);
 
            std::thread([this, alive = alive_, btnInstallSafeNav, installLogBuffer, lblPayStatus, run_cmd_capture, resolve_ca_path, show_alert, log_popup]() {
                std::string final_log;
                bool install_ok = false;
                bool restart_ok = false;
 
                const std::string ca_src = resolve_ca_path();
                const std::string helper = "/usr/share/BastionGuard/data/scripts/install-ca-system.sh";
 
                if (ca_src.empty()) {
                    final_log += "[BastionGuard] CA non trovata nella home utente né in /etc.\n";
                } else if (!std::filesystem::exists(helper)) {
                    final_log += std::string("[BastionGuard] Helper non trovato: ") + helper + "\n";
                } else {
                    final_log += "[BastionGuard] Uso certificato: " + ca_src + "\n";
                    final_log += "[BastionGuard] Eseguo install-ca-system.sh con pkexec...\n\n";
 
                    std::string out1, err1;
                    install_ok = run_cmd_capture({"pkexec", helper, ca_src}, &out1, &err1);
 
                    if (!out1.empty()) final_log += out1;
                    if (!err1.empty()) {
                        if (!final_log.empty() && final_log.back() != '\n') final_log += "\n";
                        final_log += err1;
                    }
 
                    if (!install_ok) {
                        final_log += "\n[BastionGuard] pkexec fallito, tentativo fallback con sudo --non-interactive...\n";
                        std::string out2, err2;
                        install_ok = run_cmd_capture({"sudo", "--non-interactive", helper, ca_src}, &out2, &err2);
 
                        if (!out2.empty()) final_log += out2;
                        if (!err2.empty()) {
                            if (!final_log.empty() && final_log.back() != '\n') final_log += "\n";
                            final_log += err2;
                        }
                    }
 
                    if (install_ok) {
                        final_log += "\n[BastionGuard] Installazione completata. Riavvio BastionGuard-cef.service (user)...\n";
                        std::string out3, err3;
                        restart_ok = run_cmd_capture(
                            {"/usr/libexec/bastionguard/bastionguard-service", "--user", "restart", "BastionGuard-cef.service"},
                            &out3, &err3
                        );
 
                        if (!out3.empty()) final_log += out3;
                        if (!err3.empty()) {
                            if (!final_log.empty() && final_log.back() != '\n') final_log += "\n";
                            final_log += err3;
                        }
 
                        if (restart_ok)
                            final_log += "\n[BastionGuard] ✅ BastionGuard-cef.service riavviato correttamente.\n";
                        else
                            final_log += "\n[BastionGuard] ⚠️ Impossibile riavviare BastionGuard-cef.service in modalità user.\n";
                    } else {
                        final_log += "\n[BastionGuard] ❌ Installazione navigazione sicura fallita.\n";
                    }
                }
 
                // Se la pagina è già stata distrutta, non schedulare la UI callback.
                if (!alive->load()) return;
 
                Glib::MainContext::get_default()->invoke(
                    [this, alive, btnInstallSafeNav, installLogBuffer, lblPayStatus, final_log, install_ok, restart_ok, show_alert, log_popup]() -> bool {
                        if (!alive->load()) return false;  // pagina morta
                        installLogBuffer->set_text(final_log);
                        btnInstallSafeNav->set_sensitive(true);
 
                        if (log_popup)
                            log_popup->present();
 
                        if (install_ok) {
                            lblPayStatus->set_text(_("✔ Navigazione sicura installata"));
                            lblPayStatus->remove_css_class("status-muted");
                            lblPayStatus->add_css_class("status-ok");
 
                            auto dlg = Gtk::AlertDialog::create(_("Installazione completata"));
                            if (restart_ok) {
                                dlg->set_detail(_("La navigazione sicura è stata installata correttamente.\n\nChiudi il browser e riaprilo."));
                            } else {
                                dlg->set_detail(_("La navigazione sicura è stata installata, ma il riavvio del servizio BastionGuard-cef non è riuscito.\n\nChiudi il browser e riaprilo."));
                            }
                            show_alert(dlg);
                        } else {
                            lblPayStatus->set_text(_("❌ Installazione navigazione sicura fallita"));
                            lblPayStatus->remove_css_class("status-ok");
                            lblPayStatus->add_css_class("status-muted");
 
                            auto dlg = Gtk::AlertDialog::create(_("Errore"));
                            dlg->set_detail(_("Impossibile completare l'installazione della navigazione sicura. Controlla il log nella finestra aperta."));
                            show_alert(dlg);
                        }
 
                        return false;
                    }
                );
            }).detach();
        }
    );
 
    const bool cef_available = BastionGuard::Platform::cef_available();
 
    if (!cef_available) {
        swPay->set_active(false);
        swPay->set_sensitive(false);
        entry->set_sensitive(false);
        btnAdd->set_sensitive(false);
        btnRemove->set_sensitive(false);
        btnReload->set_sensitive(false);
        btnSave->set_sensitive(false);
        btnInstallSafeNav->set_sensitive(false);
        SettingsStore::set_secure_payments_enabled(false);
        update_payments_enabled_only(false);
        lblPayStatus->set_text(_("⊘ CEF disabilitato su Fedora/RHEL/Alma/Rocky o escluso dalla build."));
        lblPayStatus->remove_css_class("status-ok");
        lblPayStatus->add_css_class("status-muted");
    }
 
    framePay->set_child(*innerPay);
    page_pay->append(*framePay);
 
    page_order_.push_back(page_pay);
    stack.add(*page_pay, "secure-payments", _("Pagamenti Sicuri"));
}
 
 
static std::vector<std::string> load_proxy_bypass_domains() {
    const std::string path = Glib::build_filename(
        Glib::get_home_dir(), ".config", "BastionGuard", "proxy_bypass.json");
    std::vector<std::string> result;
    if (!std::filesystem::exists(path)) return result;
    try {
        std::ifstream f(path);
        nlohmann::json j; f >> j;
        if (j.contains("list") && j["list"].is_array())
            for (const auto& item : j["list"])
                if (item.is_string()) {
                    std::string d = item.get<std::string>();
                    if (!d.empty()) result.push_back(d);
                }
    } catch (...) {}
    return result;
}
 
static bool save_proxy_bypass_domains(const std::vector<std::string>& domains) {
    const std::string dir  = Glib::build_filename(
        Glib::get_home_dir(), ".config", "BastionGuard");
    const std::string path = Glib::build_filename(dir, "proxy_bypass.json");
    try {
        std::filesystem::create_directories(dir);
        nlohmann::json j;
        j["version"]     = 1;
        j["description"] = "Domini che bypassano completamente il proxy BastionGuard. "
                           "Tunnel TCP puro trasparente — nessuna intercettazione TLS. "
                           "Usare per siti che attivano 2FA o CAPTCHA in presenza del proxy.";
        j["list"] = nlohmann::json::array();
        for (const auto& d : domains) j["list"].push_back(d);
        const std::string tmp = path + ".tmp";
        std::ofstream out(tmp, std::ios::trunc);
        if (!out.is_open()) return false;
        out << j.dump(2); out.flush(); out.close();
        std::error_code ec;
        std::filesystem::rename(tmp, path, ec);
        return !ec;
    } catch (...) { return false; }
}
 
// =============================================================================
//  classify_bypass_entry
//
//  Classifica una entry inserita dall'utente nel campo "Bypass Proxy".
//  Sono accettati 4 formati:
//    - dominio DNS:    "banca.it", "checkout.esempio.com"
//    - IPv4 letterale: "93.55.84.43"
//    - IPv6 letterale: "2001:4860:4860::8888"
//    - CIDR:           "93.55.84.0/24", "2a01:4f8::/29"
//
//  Ritorna: "domain", "ipv4", "ipv6", "cidr", oppure "" se invalido.
// =============================================================================
enum class BypassKind { Invalid, Domain, IPv4, IPv6, CIDR };
 
static BypassKind classify_bypass_entry(const std::string& s_in) {
    if (s_in.empty()) return BypassKind::Invalid;
 
    // Strip eventuali bracket IPv6: [::1] → ::1
    std::string s = s_in;
    if (s.size() >= 2 && s.front() == '[' && s.back() == ']')
        s = s.substr(1, s.size() - 2);
 
    // Caso CIDR: c'è uno slash, tipo "1.2.3.0/24" o "2a01::/32"
    auto slash = s.find('/');
    if (slash != std::string::npos) {
        const std::string addr = s.substr(0, slash);
        const std::string mask = s.substr(slash + 1);
        if (addr.empty() || mask.empty()) return BypassKind::Invalid;
 
        // mask numerica
        for (char c : mask) if (!std::isdigit(static_cast<unsigned char>(c)))
            return BypassKind::Invalid;
        const int m = std::atoi(mask.c_str());
 
        in_addr v4{};
        in6_addr v6{};
        if (::inet_pton(AF_INET, addr.c_str(), &v4) == 1) {
            if (m < 0 || m > 32) return BypassKind::Invalid;
            return BypassKind::CIDR;
        }
        if (::inet_pton(AF_INET6, addr.c_str(), &v6) == 1) {
            if (m < 0 || m > 128) return BypassKind::Invalid;
            return BypassKind::CIDR;
        }
        return BypassKind::Invalid;
    }
 
    // Caso IPv4/IPv6 letterale
    {
        in_addr  v4{};
        in6_addr v6{};
        if (::inet_pton(AF_INET,  s.c_str(), &v4) == 1) return BypassKind::IPv4;
        if (::inet_pton(AF_INET6, s.c_str(), &v6) == 1) return BypassKind::IPv6;
    }
 
    // Caso dominio DNS: deve avere almeno un punto, solo caratteri DNS validi.
    if (s.find('.') == std::string::npos) return BypassKind::Invalid;
    for (char c : s) {
        const unsigned char uc = static_cast<unsigned char>(c);
        if (!(std::isalnum(uc) || c == '.' || c == '-' || c == '_'))
            return BypassKind::Invalid;
    }
    if (s.front() == '.' || s.back() == '.' || s.front() == '-')
        return BypassKind::Invalid;
 
    return BypassKind::Domain;
}
 
void SettingsPage::build_proxy_bypass_tab() {
    auto page  = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 12);
    page->set_margin(12);
    auto frame = Gtk::make_managed<Gtk::Frame>();
    auto inner = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 10);
    inner->set_margin(10);
 
    auto lblTitle = Gtk::make_managed<Gtk::Label>(_("🔓 Bypass Proxy"));
    lblTitle->set_halign(Gtk::Align::START);
    lblTitle->add_css_class("card-title");
    inner->append(*lblTitle);
 
    auto lblDesc = Gtk::make_managed<Gtk::Label>(
        _("Domini, indirizzi IP e range CIDR in questa lista bypassano completamente il proxy BastionGuard.\n"
          "Il traffico viene inoltrato in tunnel TCP puro trasparente: nessuna\n"
          "intercettazione TLS, nessuna sostituzione certificati.\n\n"
          "Formati accettati:\n"
          "  • dominio:   banca.it, checkout.esempio.com\n"
          "  • IPv4:      1.1.1.1\n"
          "  • IPv6:      2001:db8::1\n"
          "  • CIDR:      1.1.1.0/24, 2a01:4f8::/29\n\n"
          "Usare per siti che attivano 2FA o CAPTCHA quando rilevano la presenza del proxy.")
    );
    lblDesc->set_wrap(true);
    lblDesc->set_halign(Gtk::Align::START);
    lblDesc->add_css_class("card-description");
    inner->append(*lblDesc);
 
    auto lblInfo = Gtk::make_managed<Gtk::Label>(
        _("ℹ️ Anche le banche presenti in banks.json vengono bypassate se inserite qui.\n"
          "Rimuoverle dal bypass per ripristinare la protezione sandbox.")
    );
    lblInfo->set_wrap(true);
    lblInfo->set_halign(Gtk::Align::START);
    lblInfo->add_css_class("alert-info");
    inner->append(*lblInfo);
 
    auto lblList = Gtk::make_managed<Gtk::Label>(_("Domini in bypass:"));
    lblList->set_halign(Gtk::Align::START);
    inner->append(*lblList);
 
    auto store     = Gio::ListStore<Gtk::StringObject>::create();
    auto selection = Gtk::SingleSelection::create(store);
 
    auto factory = Gtk::SignalListItemFactory::create();
    factory->signal_setup().connect([](const Glib::RefPtr<Gtk::ListItem>& item) {
        auto lbl = Gtk::make_managed<Gtk::Label>();
        lbl->set_xalign(0.0);
        lbl->set_margin(6);
        item->set_child(*lbl);
    });
    factory->signal_bind().connect([](const Glib::RefPtr<Gtk::ListItem>& item) {
        auto obj = std::dynamic_pointer_cast<Gtk::StringObject>(item->get_item());
        if (auto lbl = dynamic_cast<Gtk::Label*>(item->get_child()))
            lbl->set_text(obj ? obj->get_string() : "");
    });
 
    auto listView = Gtk::make_managed<Gtk::ListView>(selection, factory);
    listView->set_vexpand(true);
    listView->set_can_focus(true);
    listView->add_css_class("whitelist-view");
 
    auto scrolled = Gtk::make_managed<Gtk::ScrolledWindow>();
    scrolled->set_policy(Gtk::PolicyType::AUTOMATIC, Gtk::PolicyType::AUTOMATIC);
    scrolled->set_expand(true);
    scrolled->set_min_content_height(160);
    scrolled->set_child(*listView);
    inner->append(*scrolled);
 
    auto reload_from_file = [store]() {
        store->remove_all();
        for (const auto& d : load_proxy_bypass_domains())
            store->append(Gtk::StringObject::create(d));
    };
    reload_from_file();
 
    auto entry = Gtk::make_managed<Gtk::Entry>();
    entry->set_placeholder_text(_("dominio (banca.it), IP (1.1.1.1) o CIDR (1.1.1.0/24)"));
    entry->set_hexpand(true);
    entry->add_css_class("whitelist-entry");
 
    auto btnAdd    = Gtk::make_managed<Gtk::Button>(_("Aggiungi"));
    auto btnRemove = Gtk::make_managed<Gtk::Button>(_("Rimuovi"));
    auto btnReload = Gtk::make_managed<Gtk::Button>(_("Ripristina"));
    auto btnSave   = Gtk::make_managed<Gtk::Button>(_("Salva"));
    btnSave->add_css_class("btn-primary");
 
    auto lblStatus = Gtk::make_managed<Gtk::Label>();
    lblStatus->set_halign(Gtk::Align::START);
 
    auto rowBtns = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::HORIZONTAL, 6);
    rowBtns->append(*entry);
    rowBtns->append(*btnAdd);
    rowBtns->append(*btnRemove);
    rowBtns->append(*btnReload);
    rowBtns->append(*btnSave);
    inner->append(*rowBtns);
    inner->append(*lblStatus);
 
    auto show_alert_bypass = [this](const Glib::RefPtr<Gtk::AlertDialog>& dlg) {
        if (auto* root = this->get_root())
            if (auto* win = dynamic_cast<Gtk::Window*>(root)) {
                dlg->show(*win); return;
            }
        dlg->show();
    };
 
    btnAdd->signal_clicked().connect([store, entry, lblStatus, show_alert_bypass]() {
        std::string s = entry->get_text();
 
        // Strip schema https:// http:// se presente
        auto p = s.find("://");
        if (p != std::string::npos) s = s.substr(p + 3);
 
        // Per IPv6 con bracket eventuali "[::1]:443" → strip della porta DOPO ]
        // Per dominio/IPv4 strip del path "/foo" e della porta ":443"
        if (!s.empty() && s.front() == '[') {
            auto rb = s.find(']');
            if (rb != std::string::npos) {
                // tieni "[...]" pulito, scarta tutto dopo ]
                s = s.substr(0, rb + 1);
            }
        } else {
            // Path
            auto sl = s.find('/');
            // Una "/" può essere parte di un CIDR (es. "1.2.3.0/24"). Per
            // capire se è path o CIDR: dopo lo / ci sono solo digit?
            if (sl != std::string::npos) {
                std::string after = s.substr(sl + 1);
                bool only_digits = !after.empty();
                for (char c : after)
                    if (!std::isdigit(static_cast<unsigned char>(c))) { only_digits = false; break; }
                if (!only_digits) s = s.substr(0, sl);
            }
            // Porta ":443" — solo se NON è un IPv6 (che ha tanti ":")
            if (std::count(s.begin(), s.end(), ':') == 1) {
                auto col = s.find(':');
                s = s.substr(0, col);
            }
        }
 
        // Trim whitespace
        while (!s.empty() && std::isspace(static_cast<unsigned char>(s.front()))) s.erase(s.begin());
        while (!s.empty() && std::isspace(static_cast<unsigned char>(s.back())))  s.pop_back();
 
        // I domini DNS sono case-insensitive, gli IPv6 letterali sì (per-RFC),
        // gli IPv4 e i CIDR contengono solo digit/. quindi il tolower non li tocca.
        std::transform(s.begin(), s.end(), s.begin(),
            [](unsigned char c){ return static_cast<char>(std::tolower(c)); });
 
        const BypassKind kind = classify_bypass_entry(s);
        if (kind == BypassKind::Invalid) {
            auto dlg = Gtk::AlertDialog::create(_("Valore non valido"));
            dlg->set_detail(_("Formato non riconosciuto.\n\n"
                              "Esempi accettati:\n"
                              "  • banca.it\n"
                              "  • checkout.esempio.com\n"
                              "  • 93.55.84.43\n"
                              "  • 2001:db8::1\n"
                              "  • 93.55.84.0/24"));
            show_alert_bypass(dlg);
            return;
        }
 
        // Anti-duplicati
        for (guint i = 0; i < store->get_n_items(); ++i) {
            auto obj = std::dynamic_pointer_cast<Gtk::StringObject>(store->get_object(i));
            if (obj && obj->get_string() == s) { entry->set_text(""); return; }
        }
        store->append(Gtk::StringObject::create(s));
        entry->set_text("");
 
        const char* kind_name = "?";
        switch (kind) {
            case BypassKind::Domain: kind_name = "dominio"; break;
            case BypassKind::IPv4:   kind_name = "IPv4";    break;
            case BypassKind::IPv6:   kind_name = "IPv6";    break;
            case BypassKind::CIDR:   kind_name = "CIDR";    break;
            case BypassKind::Invalid: break;
        }
        char buf[256];
        std::snprintf(buf, sizeof(buf),
            _("➕ %s aggiunto — clicca Salva per applicare."), kind_name);
        lblStatus->set_text(buf);
        lblStatus->remove_css_class("status-ok");
        lblStatus->add_css_class("status-muted");
    });
 
    btnRemove->signal_clicked().connect([selection, store, lblStatus]() {
        guint pos = selection->get_selected();
        if (pos != GTK_INVALID_LIST_POSITION) {
            store->remove(pos);
            lblStatus->set_text(_("🗑 Dominio rimosso — clicca Salva per applicare."));
            lblStatus->remove_css_class("status-ok");
            lblStatus->add_css_class("status-muted");
        }
    });
 
    btnReload->signal_clicked().connect([reload_from_file, lblStatus]() {
        reload_from_file();
        lblStatus->set_text(_("↩️ Lista ripristinata dal file."));
        lblStatus->remove_css_class("status-ok");
        lblStatus->add_css_class("status-muted");
    });
 
    btnSave->signal_clicked().connect([store, lblStatus, show_alert_bypass]() {
        std::vector<std::string> domains;
        domains.reserve(store->get_n_items());
        for (guint i = 0; i < store->get_n_items(); ++i) {
            auto obj = std::dynamic_pointer_cast<Gtk::StringObject>(store->get_object(i));
            if (obj) domains.push_back(obj->get_string());
        }
        if (!save_proxy_bypass_domains(domains)) {
            auto dlg = Gtk::AlertDialog::create(_("Errore"));
            dlg->set_detail(_("Impossibile salvare proxy_bypass.json."));
            show_alert_bypass(dlg);
            return;
        }
        lblStatus->set_text(_("✔ proxy_bypass.json salvato"));
        lblStatus->remove_css_class("status-muted");
        lblStatus->add_css_class("status-ok");
        // Riavvia il servizio CEF solo nelle build/distribuzioni che lo supportano.
        if (BastionGuard::Platform::cef_available()) {
            std::thread([]() {
                (bg_process::run({"/usr/libexec/bastionguard/bastionguard-service", "--user", "restart", "BastionGuard-cef.service"}).exit_code);
            }).detach();
        }
    });
 
    frame->set_child(*inner);
    page->append(*frame);
    page_order_.push_back(page);
    stack.add(*page, "proxy-bypass", _("Bypass Proxy"));
}
 
 
 
void SettingsPage::build_user_services_tab()
{
    auto page = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 12);
    page->set_margin(12);
 
    auto frame = Gtk::make_managed<Gtk::Frame>();
    auto inner = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 10);
    inner->set_margin(10);
 
    auto title = Gtk::make_managed<Gtk::Label>(_("Servizi utente"));
    title->set_halign(Gtk::Align::START);
    title->add_css_class("card-title");
    inner->append(*title);
 
    auto desc = Gtk::make_managed<Gtk::Label>(
        _("Questi servizi vengono gestiti dal backend init rilevato.\n"
          "Abilitare = avvio automatico al login. Disabilitare = non parte automaticamente.")
    );
    desc->set_wrap(true);
    desc->set_halign(Gtk::Align::START);
    desc->add_css_class("card-description");
    inner->append(*desc);
 
    auto info = Gtk::make_managed<Gtk::Label>(
        _("Nota: puoi avviarli manualmente con: /usr/libexec/bastionguard/bastionguard-service --user start <unit>")
    );
    info->set_wrap(true);
    info->add_css_class("alert-info");
    inner->append(*info);
 
    std::vector<std::tuple<std::string, Glib::ustring, Glib::ustring>> user_services = {
        {"BastionGuard-privacyd.service",      _("Privacy Guard"),               _("Blocco microfono e webcam quando non in uso")},
        {"BastionGuard-ransomware-alert.service", _("Ransomware Alert"),         _("Notifiche su possibili attività ransomware")},
        {"BastionGuard-ransomware-realtime-alert.service", _("Ransomware Realtime Alert"), _("Avvisi in tempo reale su comportamenti sospetti")},
        {"BastionGuard-ransomware-scanner.service", _("Ransomware Scanner"),     _("Scansione periodica alla ricerca di comportamenti malevoli")},
        {"BastionGuard-useragent.service",     _("User-Agent Randomizer"),       _("Modifica user-agent per aumentare anonimato")},
        {"BastionGuard-pacd.service",          _("PAC Daemon"),                  _("Gestione automatica di proxy PAC sicuri")},
        {"BastionGuard-mailproxy.service",     _("Mail Proxy"),                  _("Proxy SMTP locale per protezione email in uscita")}
    };
 
    if (BastionGuard::Platform::cef_available()) {
        user_services.emplace_back(
            "BastionGuard-cef.service",
            _("CEF Sandbox Service"),
            _("Supporto in background per pagamenti sicuri con CEF")
        );
    }
 
    build_services_section(*inner, user_services, false);
 
    frame->set_child(*inner);
    page->append(*frame);
 
    page_order_.push_back(page);
    stack.add(*page, "user-services", _("Servizi Utente"));
}
 
void SettingsPage::build_system_services_tab()
{
    auto page = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 12);
    page->set_margin(12);
 
    auto frame = Gtk::make_managed<Gtk::Frame>();
    auto inner = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 10);
    inner->set_margin(10);
 
    auto title = Gtk::make_managed<Gtk::Label>(_("Servizi di Sistema (pkexec)"));
    title->set_halign(Gtk::Align::START);
    title->add_css_class("card-title");
    inner->append(*title);
 
    auto desc = Gtk::make_managed<Gtk::Label>(
        _("Questi servizi richiedono privilegi amministrativi.\n"
          "Vengono gestiti con: pkexec /usr/libexec/bastionguard/bastionguard-service --system ...")
    );
    desc->set_wrap(true);
    desc->set_halign(Gtk::Align::START);
    desc->add_css_class("card-description");
    inner->append(*desc);
 
    auto warn = Gtk::make_managed<Gtk::Label>(
        _("Durante l’attivazione/disattivazione potrebbe essere richiesta la password.")
    );
    warn->set_wrap(true);
    warn->add_css_class("alert-warning");
    inner->append(*warn);
 
    const std::vector<std::tuple<std::string, Glib::ustring, Glib::ustring>> system_services = {
        {"BastionGuard-phishing-scanner.service",      _("Phishing Scanner (System)"),          _("Scansione anti-phishing a livello di sistema")},
        {"BastionGuard-ransomware-realtime.service",   _("Ransomware Realtime (System)"), _("Monitor realtime ransomware a livello di sistema")},
        {"BastionGuard-usbd.service",          _("USB Protection (System)"),              _("Monitoraggio e blocco dispositivi USB sospetti")},
    };
 
    build_services_section(*inner, system_services, true);
 
    frame->set_child(*inner);
    page->append(*frame);
 
    page_order_.push_back(page);
    stack.add(*page, "system-services", _("Servizi Sistema"));
}
 
 
void SettingsPage::build_services_section(
    Gtk::Box& parent,
    const std::vector<std::tuple<std::string, Glib::ustring, Glib::ustring>>& services,
    bool system_units)
{
    auto grid = Gtk::make_managed<Gtk::Grid>();
    grid->set_column_spacing(28);
    grid->set_row_spacing(18);
    grid->set_margin_top(12);
    grid->set_margin_start(8);
    grid->set_margin_end(8);
 
    struct RowBinding {
        Gtk::Switch* sw;
        std::string name;
    };
    auto bindings = std::make_shared<std::vector<RowBinding>>();
    bindings->reserve(services.size());
 
    int col = 0;
    int row = 0;
 
    for (const auto& svc : services)
    {
        const std::string name = std::get<0>(svc);
        const Glib::ustring label = std::get<1>(svc);
        const Glib::ustring description = std::get<2>(svc);
 
        auto service_box = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 4);
        service_box->set_hexpand(true);
 
        auto lbl_name = Gtk::make_managed<Gtk::Label>(label);
        lbl_name->set_halign(Gtk::Align::START);
        lbl_name->add_css_class("service-name");
 
        auto lbl_desc = Gtk::make_managed<Gtk::Label>(description);
        lbl_desc->set_halign(Gtk::Align::START);
        lbl_desc->set_wrap(true);
        lbl_desc->set_wrap_mode(Pango::WrapMode::WORD_CHAR);
        lbl_desc->set_ellipsize(Pango::EllipsizeMode::END);
        lbl_desc->set_max_width_chars(42);
        lbl_desc->set_hexpand(true);
        lbl_desc->add_css_class("service-desc");
 
        service_box->append(*lbl_name);
        service_box->append(*lbl_desc);
 
        auto sw = Gtk::make_managed<Gtk::Switch>();
        sw->set_halign(Gtk::Align::END);
        sw->set_valign(Gtk::Align::CENTER);
        sw->set_hexpand(false);
 
        bool enabled = system_units ? is_system_service_enabled(name)
                                    : is_user_service_enabled(name);
        sw->set_active(enabled);
 
        auto row_container = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::HORIZONTAL, 16);
        row_container->set_hexpand(true);
        row_container->add_css_class("service-row");
        row_container->append(*service_box);
        row_container->append(*sw);
 
        grid->attach(*row_container, col, row, 1, 1);
 
        bindings->push_back({sw, name});
 
        // Cambio stato
        sw->property_active().signal_changed().connect(
            [this, name, sw, system_units]()
            {
                bool want_enabled = sw->get_active();
 
                bool success = false;
                if (system_units)
                    success = want_enabled ? enable_system_service(name) : disable_system_service(name);
                else
                    success = want_enabled ? enable_user_service(name) : disable_user_service(name);
 
                if (!success)
                {
                    sw->set_active(!want_enabled);
 
                    show_service_error_dialog(
                        want_enabled ? _("Impossibile abilitare il servizio")
                                     : _("Impossibile disabilitare il servizio"),
                        name
                    );
                }
            });
 
        col++;
        if (col >= 2)
        {
            col = 0;
            row++;
        }
    }
 
    parent.append(*grid);
 
    auto btn_refresh = Gtk::make_managed<Gtk::Button>(_("Aggiorna stato servizi"));
    btn_refresh->set_halign(Gtk::Align::END);
    btn_refresh->signal_clicked().connect(
        [this, bindings, system_units]()
        {
            for (auto& b : *bindings)
            {
                bool enabled = system_units ? is_system_service_enabled(b.name)
                                            : is_user_service_enabled(b.name);
                b.sw->set_active(enabled);
            }
        });
 
    parent.append(*btn_refresh);
}
 
 
 
bool SettingsPage::pkexec_servicectl(const std::vector<std::string>& args,
                                   std::string* out_stdout)
{
    std::vector<std::string> argv;
    argv.reserve(args.size() + 3);
    argv.push_back("pkexec");
    argv.push_back("/usr/libexec/bastionguard/bastionguard-service");
    argv.push_back("--system");
    argv.insert(argv.end(), args.begin(), args.end());
 
    return run_cmd(argv, out_stdout, false);
}
 
 
bool SettingsPage::is_user_service_enabled(const std::string& service_name)
{
    try
    {
        auto proc = Gio::Subprocess::create(
            {"/usr/libexec/bastionguard/bastionguard-service", "--user", "is-enabled", service_name},
            Gio::Subprocess::Flags::STDOUT_PIPE |
            Gio::Subprocess::Flags::STDERR_PIPE
        );
 
        proc->wait();
        auto [stdout_str, stderr_str] = proc->communicate_utf8("");
 
        if (!proc->get_successful())
            return false;
 
        std::string result = stdout_str.raw();
        result.erase(std::remove(result.begin(), result.end(), '\n'), result.end());
        result.erase(std::remove(result.begin(), result.end(), '\r'), result.end());
 
        return result == "enabled";
    }
    catch (...)
    {
        return false;
    }
}
 
bool SettingsPage::enable_user_service(const std::string& service_name)
{
    if (!run_cmd({"/usr/libexec/bastionguard/bastionguard-service", "--user", "enable", "--now", service_name}))
        return false;
 
    run_cmd({"/usr/libexec/bastionguard/bastionguard-service", "--user", "start", service_name});
    return true;
}
 
bool SettingsPage::disable_user_service(const std::string& service_name)
{
    run_cmd({"/usr/libexec/bastionguard/bastionguard-service", "--user", "stop", service_name});
    return run_cmd({"/usr/libexec/bastionguard/bastionguard-service", "--user", "disable", "--now", service_name});
}
 
 
bool SettingsPage::is_system_service_enabled(const std::string& unit_name)
{
    try
    {
        auto proc = Gio::Subprocess::create(
            {"/usr/libexec/bastionguard/bastionguard-service", "--system", "is-enabled", unit_name},
            Gio::Subprocess::Flags::STDOUT_PIPE |
            Gio::Subprocess::Flags::STDERR_PIPE
        );
 
        proc->wait();
        auto [stdout_str, stderr_str] = proc->communicate_utf8("");
 
        if (!proc->get_successful())
            return false;
 
        std::string result = stdout_str.raw();
        result.erase(std::remove(result.begin(), result.end(), '\n'), result.end());
        result.erase(std::remove(result.begin(), result.end(), '\r'), result.end());
 
        return result == "enabled";
    }
    catch (...)
    {
        return false;
    }
}
 
bool SettingsPage::enable_system_service(const std::string& unit_name)
{
    if (!pkexec_servicectl({"enable", "--now", unit_name}, nullptr))
        return false;
 
    pkexec_servicectl({"start", unit_name}, nullptr);
    return true;
}
 
bool SettingsPage::disable_system_service(const std::string& unit_name)
{
    pkexec_servicectl({"stop", unit_name}, nullptr);
    return pkexec_servicectl({"disable", "--now", unit_name}, nullptr);
}
 
 
void show_service_error_dialog(const Glib::ustring& msg, const std::string& service)
{
    auto dlg = Gtk::AlertDialog::create(msg);
    dlg->set_detail(Glib::ustring::compose(_("Servizio: %1\n\n"
                                             "Verifica i permessi o prova ad eseguire il comando da terminale."), service));
    dlg->show();
}
 
void SettingsPage::loadAllowlistUI() {
    allowStore->clear();
    std::ifstream f("config/allowlist.txt");
    if (!f.is_open()) return;
    std::string line;
    while (std::getline(f, line)) {
        if (line.empty() || line[0] == '#') continue;
        std::string sha, rule;
        auto semi = line.find(';');
        if (semi == std::string::npos) sha = line;
        else { sha = line.substr(0, semi); rule = line.substr(semi + 1); }
        auto row = *(allowStore->append());
        row[allowCols.col_hash] = Glib::ustring(sha);
        row[allowCols.col_rule] = Glib::ustring(rule);
    }
}
 
 
 
void SettingsPage::saveAllowlistUI() {
    std::string confPath = Glib::get_home_dir() + "/.config/BastionGuard/allowlist.txt";
 
    std::filesystem::create_directories(Glib::get_home_dir() + "/.config/BastionGuard");
 
    std::ofstream out(confPath, std::ios::trunc);
    if (!out.is_open()) {
        std::cerr << _("[SettingsPage] ❌ Impossibile scrivere ") << confPath << std::endl;
        return;
    }
 
    for (const auto& row : allowStore->children()) {
        Glib::ustring sha = row[allowCols.col_hash];
        Glib::ustring rule = row[allowCols.col_rule];
 
        if (sha.raw().empty())
            continue;
 
        out << sha.raw();
        if (!rule.raw().empty())
            out << ";" << rule.raw();
        out << "\n";
    }
 
    out.flush();
    out.close();
 
    std::cout << _("[SettingsPage] ✅ Allowlist salvata in ") << confPath << std::endl;
}
 
 
 
void SettingsPage::saveAdvancedConfig(bool suspicious_only,
                                      const Glib::ustring& ignore_paths,
                                      const Glib::ustring& ignore_ext,
                                      const Glib::ustring& suspicious_ext)
{
    namespace fs = std::filesystem;
    try {
        const char* real_user = getenv("SUDO_USER");
        if (!real_user || !*real_user)
            real_user = getenv("USER");
 
        struct passwd* pw = getpwnam(real_user ? real_user : "root");
        std::string home_dir = pw ? pw->pw_dir : Glib::get_home_dir();
 
        std::string conf_dir = home_dir + "/.config/BastionGuard";
        std::string conf_file = conf_dir + "/scanner.conf";
        fs::create_directories(conf_dir);
 
        std::map<std::string, std::string> kv;
        std::vector<std::string> comments;
        if (fs::exists(conf_file)) {
            std::ifstream in(conf_file);
            std::string line;
            std::regex re("^\\s*([^#=]+?)\\s*=\\s*(.*?)\\s*$");
            std::smatch m;
            while (std::getline(in, line)) {
                if (line.empty() || line[0] == '#') {
                    comments.push_back(line);
                    continue;
                }
                if (std::regex_match(line, m, re))
                    kv[m[1]] = m[2];
            }
        }
 
        kv["suspicious_only"] = suspicious_only ? "1" : "0";
        kv["ignore_paths"] = ignore_paths.raw();
        kv["ignore_ext"] = ignore_ext.raw();
        kv["suspicious_ext"] = suspicious_ext.raw();
 
        std::ofstream out(conf_file, std::ios::trunc);
        if (!out.is_open()) {
            std::cerr << _("[SettingsPage] ❌ Impossibile scrivere ") << conf_file << std::endl;
            return;
        }
 
        out << _("# --- BastionGuard Anti-Ransomware Config ---\n");
        for (const auto& c : comments)
            if (!c.empty()) out << c << "\n";
 
        for (const auto& [k, v] : kv)
            out << k << "=" << v << "\n";
 
        out.close();
 
        if (pw) chown(conf_file.c_str(), pw->pw_uid, pw->pw_gid);
        chmod(conf_file.c_str(), 0644);
 
        std::cout << _("[SettingsPage] ✅ Config salvata in ") << conf_file << std::endl;
 
        loadAdvancedConfig();
 
        Gtk::Window* parent = dynamic_cast<Gtk::Window*>(get_root());
        Utils::show_message(parent,
            _("Configurazione salvata correttamente."),
            Gtk::MessageType::INFO,
            _("Le impostazioni aggiornate sono state caricate e applicate.\n"
              "Non serve riavviare il programma."));
 
    } catch (const std::exception& ex) {
        std::cerr << _("[SettingsPage] ⚠ Errore in saveAdvancedConfig: ") << ex.what() << std::endl;
    }
}
 
void SettingsPage::loadAdvancedConfig() {
    try {
        std::string conf_file = Glib::get_home_dir() + "/.config/BastionGuard/scanner.conf";
        if (!std::filesystem::exists(conf_file))
            return;
 
        std::ifstream in(conf_file);
        if (!in.is_open()) return;
 
        std::string line;
        std::regex re("^\\s*([^#=]+?)\\s*=\\s*(.*?)\\s*$");
        std::smatch m;
 
        bool susp = false;
        Glib::ustring ign_paths, ign_ext, susp_ext;
 
        while (std::getline(in, line)) {
            if (line.empty() || line[0] == '#') continue;
            if (std::regex_match(line, m, re)) {
                std::string key = m[1], val = m[2];
                if (key == "suspicious_only") susp = (val == "1" || val == "true");
                else if (key == "ignore_paths") ign_paths = val;
                else if (key == "ignore_ext") ign_ext = val;
                else if (key == "suspicious_ext") susp_ext = val;
            }
        }
 
        if (chkSuspOnly) chkSuspOnly->set_active(susp);
        if (txtIgnPaths) txtIgnPaths->set_text(ign_paths);
        if (txtIgnExt) txtIgnExt->set_text(ign_ext);
        if (txtSuspExt) txtSuspExt->set_text(susp_ext);
 
        std::cout << _("[SettingsPage] 🔄 Configurazione caricata da ") << conf_file << std::endl;
 
    } catch (const std::exception& ex) {
        std::cerr << _("[SettingsPage] ⚠ Errore caricando configurazione: ") << ex.what() << std::endl;
    }
}
 
bool SettingsPage::run_cmd(const std::vector<std::string>& argv,
                           std::string* out_stdout,
                           bool silence_stderr)
{
    try
    {
        Gio::Subprocess::Flags flags = Gio::Subprocess::Flags::NONE;
 
        if (out_stdout)
            flags |= Gio::Subprocess::Flags::STDOUT_PIPE;
 
        if (silence_stderr)
            flags |= Gio::Subprocess::Flags::STDERR_SILENCE;
        else
            flags |= Gio::Subprocess::Flags::STDERR_PIPE;
 
        auto proc = Gio::Subprocess::create(argv, flags);
        proc->wait();
 
        if (out_stdout)
        {
            auto [stdout_str, stderr_str] = proc->communicate_utf8("");
            *out_stdout = stdout_str.raw();
        }
 
        return proc->get_successful();
    }
    catch (...)
    {
        return false;
    }
}
 
 
void SettingsPage::show_service_error_dialog(
    const Glib::ustring& message,
    const std::string& service_name)
{
    auto dlg = Gtk::AlertDialog::create(message);
    dlg->set_detail(
        Glib::ustring::compose(
            _("Servizio: %1\n\n"
              "Possibili cause:\n"
              "• Il file .service non esiste\n"
              "• Il gestore servizi utente non è disponibile\n"
              "• Problemi di permessi o path\n"
              "• Errore di sintassi nel file di servizio"),
            service_name
        )
    );
    dlg->show();
}
 
void SettingsPage::refresh_clamav_db_list(Gtk::Box* listBox)
{
    if (!listBox) return;
 
    auto children = listBox->get_children();
    for (auto* w : children)
        listBox->remove(*w);
 
    const std::filesystem::path clamdb = "/var/lib/clamav";
    auto sigs = list_clamav_signatures(clamdb);
 
    if (clamdb_count_label_) {
        clamdb_count_label_->set_text(
            Glib::ustring::compose(_("Firme trovate: %1"), sigs.size())
        );
    }
 
    if (sigs.empty())
    {
        auto lbl = Gtk::make_managed<Gtk::Label>(
            _("Nessuna firma trovata in /var/lib/clamav")
        );
        lbl->set_xalign(0.0);
        lbl->add_css_class("alert-warning");
        listBox->append(*lbl);
        return;
    }
 
    for (const auto& p : sigs)
    {
        auto lbl = Gtk::make_managed<Gtk::Label>(p.filename().string());
        lbl->set_xalign(0.0);
        lbl->add_css_class("readonly-path");
        listBox->append(*lbl);
    }
}
 
void SettingsPage::build_clamav_db_tab()
{
    auto page_db = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 12);
    page_db->set_margin(12);
 
    auto frame = Gtk::make_managed<Gtk::Frame>(_("Database firme ClamAV"));
    auto inner = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 10);
    inner->set_margin(10);
 
    auto lblInfo = Gtk::make_managed<Gtk::Label>(
        _("Questa sezione mostra le firme presenti nel database ClamAV.\n"
          "Le firme personalizzate installate in /var/lib/clamav verranno caricate automaticamente da clamd.")
    );
    lblInfo->set_wrap(true);
    lblInfo->set_halign(Gtk::Align::FILL);
    lblInfo->add_css_class("alert-info");
    inner->append(*lblInfo);
 
    auto lblPathTitle = Gtk::make_managed<Gtk::Label>(_("Percorso database:"));
    lblPathTitle->set_halign(Gtk::Align::START);
    inner->append(*lblPathTitle);
 
    auto lblPath = Gtk::make_managed<Gtk::Label>("/var/lib/clamav");
    lblPath->set_xalign(0.0);
    lblPath->add_css_class("readonly-path");
    inner->append(*lblPath);
 
    auto rowTop = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::HORIZONTAL, 8);
 
    auto lblCount = Gtk::make_managed<Gtk::Label>();
    lblCount->set_halign(Gtk::Align::START);
    lblCount->add_css_class("status-muted");
    clamdb_count_label_ = lblCount;
 
    auto btnRefresh = Gtk::make_managed<Gtk::Button>(_("Aggiorna"));
    btnRefresh->set_halign(Gtk::Align::END);
    btnRefresh->add_css_class("suggested-action");
 
    rowTop->append(*lblCount);
    rowTop->append(*btnRefresh);
    inner->append(*rowTop);
 
    auto scrolled = Gtk::make_managed<Gtk::ScrolledWindow>();
    scrolled->set_policy(Gtk::PolicyType::AUTOMATIC, Gtk::PolicyType::AUTOMATIC);
    scrolled->set_expand(true);
    scrolled->set_min_content_height(220);
 
    auto listBox = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 6);
    listBox->set_margin_start(6);
    scrolled->set_child(*listBox);
 
 
    inner->append(*scrolled);
 
    refresh_clamav_db_list(listBox);
    btnRefresh->signal_clicked().connect([this, listBox]() {
        refresh_clamav_db_list(listBox);
    });
 
    frame->set_child(*inner);
    page_db->append(*frame);
 
    page_order_.push_back(page_db);
    stack.add(*page_db, "clamav-db", _("DB ClamAV"));
}
 
void SettingsPage::build_email_security_tab() {
    auto cfg = load_mail_security_config();
 
    auto page = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 0);
    page->set_hexpand(true);
    page->set_vexpand(true);
 
    auto scrolled = Gtk::make_managed<Gtk::ScrolledWindow>();
    scrolled->set_policy(Gtk::PolicyType::NEVER, Gtk::PolicyType::AUTOMATIC);
    scrolled->set_hexpand(true);
    scrolled->set_vexpand(true);
 
    auto outer = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 0);
    outer->set_margin_top(28);
    outer->set_margin_bottom(28);
    outer->set_margin_start(24);
    outer->set_margin_end(24);
    outer->set_hexpand(true);
    outer->set_vexpand(true);
 
    auto center = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 12);
    center->set_halign(Gtk::Align::CENTER);
    center->set_valign(Gtk::Align::START);
    center->set_hexpand(true);
    center->set_size_request(820, -1);
 
    auto frame = Gtk::make_managed<Gtk::Frame>();
    frame->set_hexpand(true);
 
    auto inner = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 12);
    inner->set_margin_top(20);
    inner->set_margin_bottom(20);
    inner->set_margin_start(20);
    inner->set_margin_end(20);
 
    auto title = Gtk::make_managed<Gtk::Label>(_("Protezione Email"));
    title->set_halign(Gtk::Align::START);
    title->set_xalign(0.0f);
    title->add_css_class("card-title");
    inner->append(*title);
 
    auto tabs_switcher = Gtk::make_managed<Gtk::StackSwitcher>();
    auto tabs = Gtk::make_managed<Gtk::Stack>();
    tabs->set_hexpand(true);
    tabs->set_vexpand(true);
    tabs->set_transition_type(Gtk::StackTransitionType::SLIDE_LEFT_RIGHT);
    tabs->set_transition_duration(250);
    tabs_switcher->set_stack(*tabs);
    tabs_switcher->set_halign(Gtk::Align::FILL);
    tabs_switcher->set_hexpand(true);
 
    auto profiles = std::make_shared<std::vector<MailRelayProfile>>(cfg.profiles);
    auto selected_profile = std::make_shared<int>(0);
    auto ui_updating = std::make_shared<bool>(false);
 
    if (profiles->empty()) {
        MailRelayProfile p;
        p.id = "";
        p.label = "";
        p.signature.logo_path = "/usr/share/BastionGuard/data/logo.png";
        profiles->push_back(p);
    }
 
    auto mkLabel = [](const Glib::ustring& text) {
        auto lbl = Gtk::make_managed<Gtk::Label>(text);
        lbl->set_halign(Gtk::Align::START);
        lbl->set_xalign(0.0f);
        return lbl;
    };
 
    auto make_switch_row = [](const Glib::ustring& txt, Gtk::Switch& sw) {
        auto row = Gtk::make_managed<Gtk::CenterBox>();
        auto lbl = Gtk::make_managed<Gtk::Label>(txt);
        lbl->set_halign(Gtk::Align::START);
        lbl->set_xalign(0.0f);
        row->set_start_widget(*lbl);
        row->set_end_widget(sw);
        return row;
    };
 
    auto tab_general = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 12);
    tab_general->set_margin_top(12);
    tab_general->set_margin_bottom(12);
    tab_general->set_margin_start(12);
    tab_general->set_margin_end(12);
 
    auto swEnable = Gtk::make_managed<Gtk::Switch>();
    swEnable->set_active(cfg.enabled);
 
    auto swScan = Gtk::make_managed<Gtk::Switch>();
    swScan->set_active(cfg.scan_outgoing);
 
    auto swSig = Gtk::make_managed<Gtk::Switch>();
    swSig->set_active(cfg.inject_signature);
 
    auto swAdvertiseStartTls = Gtk::make_managed<Gtk::Switch>();
    swAdvertiseStartTls->set_active(cfg.advertise_starttls);
 
    auto swImplicitTlsListener = Gtk::make_managed<Gtk::Switch>();
    swImplicitTlsListener->set_active(cfg.enable_implicit_tls_listener);
 
    tab_general->append(*make_switch_row(_("Abilita protezione email"), *swEnable));
    tab_general->append(*make_switch_row(_("Scansiona email in uscita"), *swScan));
    tab_general->append(*make_switch_row(_("Inserisci firma automatica"), *swSig));
    tab_general->append(*make_switch_row(_("Pubblica STARTTLS"), *swAdvertiseStartTls));
    tab_general->append(*make_switch_row(_("Abilita listener TLS implicito"), *swImplicitTlsListener));
 
 
    auto tab_signature = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 12);
    tab_signature->set_margin_top(12);
    tab_signature->set_margin_bottom(12);
    tab_signature->set_margin_start(12);
    tab_signature->set_margin_end(12);
 
    auto sName = Gtk::make_managed<Gtk::Entry>();
    auto sRole = Gtk::make_managed<Gtk::Entry>();
    auto sCompany = Gtk::make_managed<Gtk::Entry>();
    auto sPhone = Gtk::make_managed<Gtk::Entry>();
    auto sWeb = Gtk::make_managed<Gtk::Entry>();
 
    auto sig_grid = Gtk::make_managed<Gtk::Grid>();
    sig_grid->set_row_spacing(10);
    sig_grid->set_column_spacing(12);
 
    int sr = 0;
    auto attach_sig_row = [&](const Glib::ustring& lbl, Gtk::Widget& w) {
        sig_grid->attach(*mkLabel(lbl), 0, sr, 1, 1);
        sig_grid->attach(w, 1, sr, 1, 1);
        sr++;
    };
 
    attach_sig_row(_("Nome visualizzato"), *sName);
    attach_sig_row(_("Ruolo"), *sRole);
    attach_sig_row(_("Azienda"), *sCompany);
    attach_sig_row(_("Telefono"), *sPhone);
    attach_sig_row(_("Sito web"), *sWeb);
 
    auto fixedLogoInfo = Gtk::make_managed<Gtk::Label>(
        _("Logo fisso utilizzato: /usr/share/BastionGuard/data/logo.png")
    );
    fixedLogoInfo->set_halign(Gtk::Align::START);
    fixedLogoInfo->set_xalign(0.0f);
 
    tab_signature->append(*sig_grid);
    tab_signature->append(*fixedLogoInfo);
 
    auto load_signature_fields = [=]() {
        if (profiles->empty()) return;
        *ui_updating = true;
 
        auto& s = (*profiles)[*selected_profile].signature;
        sName->set_text(s.display_name);
        sRole->set_text(s.job_title);
        sCompany->set_text(s.company);
        sPhone->set_text(s.phone);
        sWeb->set_text(s.website);
 
        *ui_updating = false;
    };
 
    auto save_signature_fields = [=]() {
        if (profiles->empty()) return;
        auto& s = (*profiles)[*selected_profile].signature;
        s.display_name = sName->get_text();
        s.job_title = sRole->get_text();
        s.company = sCompany->get_text();
        s.phone = sPhone->get_text();
        s.website = sWeb->get_text();
        s.logo_path = "/usr/share/BastionGuard/data/logo.png";
    };
 
    auto tab_thunderbird = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 12);
    tab_thunderbird->set_margin_top(12);
    tab_thunderbird->set_margin_bottom(12);
    tab_thunderbird->set_margin_start(12);
    tab_thunderbird->set_margin_end(12);
 
    auto tbInstallInfo = Gtk::make_managed<Gtk::Label>(
        _("Installa l'estensione BastionGuard per Thunderbird e il native host.\n"
          "Se necessario, inserisci la password amministratore per completare l'installazione.")
    );
    tbInstallInfo->set_wrap(true);
    tbInstallInfo->set_halign(Gtk::Align::START);
    tbInstallInfo->set_xalign(0.0f);
    tab_thunderbird->append(*tbInstallInfo);
 
    auto tbInstallGrid = Gtk::make_managed<Gtk::Grid>();
    tbInstallGrid->set_row_spacing(10);
    tbInstallGrid->set_column_spacing(12);
 
    int tbr = 0;
 
    auto lblAdminPw = Gtk::make_managed<Gtk::Label>(_("Password amministratore"));
    lblAdminPw->set_halign(Gtk::Align::START);
    lblAdminPw->set_xalign(0.0f);
 
    auto eAdminPw = Gtk::make_managed<Gtk::Entry>();
    eAdminPw->set_visibility(false);
    eAdminPw->set_hexpand(true);
    eAdminPw->set_placeholder_text(_("Inserisci la password sudo"));
 
    tbInstallGrid->attach(*lblAdminPw, 0, tbr, 1, 1);
    tbInstallGrid->attach(*eAdminPw, 1, tbr, 1, 1);
    tbr++;
 
    tab_thunderbird->append(*tbInstallGrid);
 
    auto tbInstallButtons = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::HORIZONTAL, 8);
 
    auto btnInstallTbExt = Gtk::make_managed<Gtk::Button>(_("Installa estensione Thunderbird"));
    btnInstallTbExt->add_css_class("suggested-action");
 
    auto btnClearTbLog = Gtk::make_managed<Gtk::Button>(_("Pulisci log"));
 
    tbInstallButtons->append(*btnInstallTbExt);
    tbInstallButtons->append(*btnClearTbLog);
    tab_thunderbird->append(*tbInstallButtons);
 
    auto tbInstallOutput = Gtk::make_managed<Gtk::TextView>();
    tbInstallOutput->set_editable(false);
    tbInstallOutput->set_cursor_visible(false);
    tbInstallOutput->set_monospace(true);
    tbInstallOutput->set_wrap_mode(Gtk::WrapMode::WORD_CHAR);
    tbInstallOutput->set_vexpand(true);
 
    auto tbInstallBuffer = Gtk::TextBuffer::create();
    tbInstallOutput->set_buffer(tbInstallBuffer);
 
    auto tbInstallScroll = Gtk::make_managed<Gtk::ScrolledWindow>();
    tbInstallScroll->set_policy(Gtk::PolicyType::AUTOMATIC, Gtk::PolicyType::AUTOMATIC);
    tbInstallScroll->set_min_content_height(260);
    tbInstallScroll->set_child(*tbInstallOutput);
    tab_thunderbird->append(*tbInstallScroll);
 
    btnClearTbLog->signal_clicked().connect([=]() {
        tbInstallBuffer->set_text("");
    });
 
    auto run_tb_installer = [=]() {
        const std::string script_path =
            "/usr/share/BastionGuard/data/extension/bastionguard-tb-extension/install-tb-extension.sh";
 
        tbInstallBuffer->set_text("");
 
        if (!Glib::file_test(script_path, Glib::FileTest::IS_REGULAR)) {
            tbInstallBuffer->set_text(
                _("Script non trovato:\n") + Glib::ustring(script_path) + "\n"
            );
            return;
        }
 
        const std::string password = std::string(eAdminPw->get_text());
 
        // Password goes only to the child's environment, never to a shell or argv.
        // The installer consumes it via sudo -S, and the parent does not log it.
        const auto install = bg_process::run({script_path}, true,
                        8U * 1024U * 1024U, {{"BASTIONGUARD_SUDO_PASSWORD", password}});
        if (!install.started) {
            tbInstallBuffer->set_text(_("Impossibile avviare lo script di installazione.\n"));
            return;
        }
        const std::string& output = install.output;
        const int exit_code = install.exit_code;
 
        if (exit_code == 0) {
            tbInstallBuffer->insert(
                tbInstallBuffer->end(),
                _("\n✔ Installazione Thunderbird completata.\n")
            );
        } else {
            tbInstallBuffer->insert(
                tbInstallBuffer->end(),
                Glib::ustring::compose(_("\n❌ Installazione fallita (exit=%1)\n"), exit_code)
            );
        }
    };
 
    btnInstallTbExt->signal_clicked().connect([=]() {
        run_tb_installer();
    });
 
 
    auto tab_profiles = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 12);
    tab_profiles->set_margin_top(12);
    tab_profiles->set_margin_bottom(12);
    tab_profiles->set_margin_start(12);
    tab_profiles->set_margin_end(12);
 
    auto lbl_profiles_info = Gtk::make_managed<Gtk::Label>(
        _("Seleziona i profili SMTP da importare da Thunderbird.\n"
          "Le password non sono esportabili: dovrai inserirle manualmente dopo l'importazione.")
    );
    lbl_profiles_info->set_wrap(true);
    lbl_profiles_info->set_halign(Gtk::Align::START);
    lbl_profiles_info->add_css_class("alert-info");
    tab_profiles->append(*lbl_profiles_info);
 
    auto tb_status = Gtk::make_managed<Gtk::Label>();
    tb_status->set_halign(Gtk::Align::START);
    tb_status->add_css_class("status-muted");
    tab_profiles->append(*tb_status);
 
    auto tb_list_frame = Gtk::make_managed<Gtk::Frame>(_("Profili trovati in Thunderbird"));
    auto tb_list_box   = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 6);
    tb_list_box->set_margin(8);
    tb_list_frame->set_child(*tb_list_box);
    tab_profiles->append(*tb_list_frame);
 
    auto tb_found    = std::make_shared<std::vector<MailRelayProfile>>();
    auto tb_selected = std::make_shared<std::vector<Gtk::CheckButton*>>();
 
    using PwEntriesPtr = std::shared_ptr<std::vector<Gtk::Entry*>>;
    auto tb_pw_entries_ref = std::make_shared<PwEntriesPtr>();
 
    using HostEntriesPtr = std::shared_ptr<std::vector<Gtk::Entry*>>;
    auto tb_host_entries_ref = std::make_shared<HostEntriesPtr>();
 
    using PortSpinsPtr = std::shared_ptr<std::vector<Gtk::SpinButton*>>;
    auto tb_port_spins_ref = std::make_shared<PortSpinsPtr>();
 
    auto populate_profile_list = [=](const std::vector<MailRelayProfile>& source_profiles,
                                     bool from_json) {
        for (auto* w : tb_list_box->get_children())
            tb_list_box->remove(*w);
 
        tb_found->clear();
        tb_selected->clear();
 
        auto tb_pw_entries   = std::make_shared<std::vector<Gtk::Entry*>>();
        auto tb_host_entries = std::make_shared<std::vector<Gtk::Entry*>>();
        auto tb_port_spins   = std::make_shared<std::vector<Gtk::SpinButton*>>();
 
        for (size_t i = 0; i < source_profiles.size(); ++i) {
            const auto& p = source_profiles[i];
            tb_found->push_back(p);
 
            auto row = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 4);
            row->set_margin_bottom(10);
 
            if (i == 0 && from_json) {
                auto sep_lbl = Gtk::make_managed<Gtk::Label>(_("Profili attivi (da mail.json)"));
                sep_lbl->set_halign(Gtk::Align::START);
                sep_lbl->add_css_class("caption");
                sep_lbl->add_css_class("status-muted");
                tb_list_box->append(*sep_lbl);
            }
 
            std::string title = p.label + "  —  " + p.smtp_host + ":" + std::to_string(p.smtp_port);
            auto cb = Gtk::make_managed<Gtk::CheckButton>(title);
            cb->set_active(true);
            if (from_json)
                cb->set_sensitive(false);
            row->append(*cb);
 
            std::string emails;
            for (size_t j = 0; j < p.match_from.size(); ++j) {
                if (j) emails += ", ";
                emails += p.match_from[j];
            }
 
            if (!emails.empty()) {
                auto lbl_emails = Gtk::make_managed<Gtk::Label>(
                    "    " + std::string(_("Email: ")) + emails);
                lbl_emails->set_halign(Gtk::Align::START);
                lbl_emails->set_xalign(0.0f);
                lbl_emails->add_css_class("status-muted");
                row->append(*lbl_emails);
            }
 
            const bool host_is_local = (
                p.smtp_host == "127.0.0.1" ||
                p.smtp_host == "127.0.0.4" ||
                p.smtp_host == "::1" ||
                p.smtp_host == "localhost" ||
                p.smtp_host.empty()
            );
 
            if (host_is_local && !from_json) {
                auto lbl_warn = Gtk::make_managed<Gtk::Label>(
                    "⚠ " + std::string(_("smtp_host non valido — inserisci il server SMTP reale")));
                lbl_warn->set_halign(Gtk::Align::START);
                lbl_warn->set_margin_start(24);
                lbl_warn->add_css_class("alert-warning");
                row->append(*lbl_warn);
            }
 
            auto host_row = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::HORIZONTAL, 6);
            host_row->set_margin_start(24);
 
            auto lbl_host = Gtk::make_managed<Gtk::Label>(_("Server SMTP:"));
            lbl_host->set_halign(Gtk::Align::START);
            lbl_host->set_size_request(100, -1);
 
            auto host_entry = Gtk::make_managed<Gtk::Entry>();
            host_entry->set_text(host_is_local ? "" : p.smtp_host);
            host_entry->set_placeholder_text(_("es. mail.esempio.it"));
            host_entry->set_hexpand(true);
 
            if (host_is_local && !from_json)
                host_entry->add_css_class("entry-error");
 
            if (from_json)
                host_entry->set_sensitive(!p.smtp_host.empty());
 
            host_row->append(*lbl_host);
            host_row->append(*host_entry);
 
            auto lbl_port = Gtk::make_managed<Gtk::Label>(_("Porta:"));
            lbl_port->set_halign(Gtk::Align::START);
 
            auto port_spin = Gtk::make_managed<Gtk::SpinButton>();
            port_spin->set_range(1, 65535);
            port_spin->set_increments(1, 10);
            port_spin->set_value(host_is_local ? 587 : (p.smtp_port > 0 ? p.smtp_port : 587));
            port_spin->set_size_request(90, -1);
 
            if (from_json)
                port_spin->set_sensitive(false);
 
            host_row->append(*lbl_port);
            host_row->append(*port_spin);
            row->append(*host_row);
 
            auto pw_row = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::HORIZONTAL, 6);
            pw_row->set_margin_start(24);
 
            auto lbl_pw_label = Gtk::make_managed<Gtk::Label>(_("Password:"));
            lbl_pw_label->set_halign(Gtk::Align::START);
            lbl_pw_label->set_size_request(100, -1);
 
            auto pw_entry = Gtk::make_managed<Gtk::Entry>();
            pw_entry->set_visibility(false);
            pw_entry->set_placeholder_text(
                from_json ? _("(salvata)") : _("Inserisci la password SMTP")
            );
            pw_entry->set_hexpand(true);
 
            for (const auto& existing : *profiles) {
                if ((existing.id == p.id || existing.smtp_host == p.smtp_host) &&
                    !existing.password.empty() &&
                    existing.password != "placeholder") {
                    pw_entry->set_text(existing.password);
                    break;
                }
            }
 
            pw_row->append(*lbl_pw_label);
            pw_row->append(*pw_entry);
            row->append(*pw_row);
 
            tb_list_box->append(*row);
            tb_selected->push_back(cb);
            tb_pw_entries->push_back(pw_entry);
            tb_host_entries->push_back(host_entry);
            tb_port_spins->push_back(port_spin);
        }
 
        *tb_pw_entries_ref   = tb_pw_entries;
        *tb_host_entries_ref = tb_host_entries;
        *tb_port_spins_ref   = tb_port_spins;
    };
 
    {
        auto existing_cfg = load_mail_security_config();
        if (!existing_cfg.profiles.empty()) {
            tb_status->set_text(Glib::ustring::compose(
                _("✔ %1 profili attivi"), (int)existing_cfg.profiles.size()));
            populate_profile_list(existing_cfg.profiles, true);
        }
    }
 
    auto btn_scan_tb = Gtk::make_managed<Gtk::Button>(_("🔍 Scansiona Thunderbird"));
    btn_scan_tb->add_css_class("suggested-action");
    tab_profiles->append(*btn_scan_tb);
 
    btn_scan_tb->signal_clicked().connect([=]() {
        std::string err;
        auto scanned = tb_import_profiles(err);
 
        if (scanned.empty()) {
            tb_status->set_text("❌ " + (err.empty()
                ? std::string(_("Nessun profilo trovato"))
                : err));
            return;
        }
 
        tb_status->set_text(Glib::ustring::compose(
            _("✔ Trovati %1 profili SMTP da Thunderbird"), (int)scanned.size()));
 
        populate_profile_list(scanned, false);
    });
 
    auto btn_import_tb = Gtk::make_managed<Gtk::Button>(_("⬇ Importa profili selezionati"));
    tab_profiles->append(*btn_import_tb);
 
    btn_import_tb->signal_clicked().connect([=]() {
        if (tb_found->empty()) {
            tb_status->set_text(_("❌ Nessun profilo da importare. Scansiona prima."));
            return;
        }
 
        int imported = 0;
        auto& pw_entries = *tb_pw_entries_ref;
 
        for (size_t i = 0; i < tb_found->size() && i < tb_selected->size(); ++i) {
            if (!(*tb_selected)[i]->get_active())
                continue;
 
            MailRelayProfile src = (*tb_found)[i];
 
            if (pw_entries && i < pw_entries->size()) {
                std::string pw = std::string((*pw_entries)[i]->get_text());
                if (!pw.empty())
                    src.password = pw;
            }
 
            auto& host_entries = *tb_host_entries_ref;
            auto& port_spins   = *tb_port_spins_ref;
 
            if (host_entries && i < host_entries->size()) {
                std::string h = std::string((*host_entries)[i]->get_text());
                auto start = h.find_first_not_of(" \t");
                if (start == std::string::npos) {
                    h.clear();
                } else {
                    auto end = h.find_last_not_of(" \t");
                    h = h.substr(start, end - start + 1);
                }
                if (!h.empty())
                    src.smtp_host = h;
            }
 
            if (port_spins && i < port_spins->size()) {
                int pt = (*port_spins)[i]->get_value_as_int();
                if (pt > 0 && pt < 65536)
                    src.smtp_port = pt;
            }
 
            bool found = false;
            for (auto& existing : *profiles) {
                if (existing.id == src.id || existing.smtp_host == src.smtp_host) {
                    existing = src;
                    found = true;
                    break;
                }
            }
 
            if (!found) {
                profiles->push_back(src);
                if (profiles->size() == 1)
                    *selected_profile = 0;
            }
 
            ++imported;
        }
 
        if (imported > 0) {
            MailSecurityConfig auto_save = load_mail_security_config();
            auto_save.profiles = *profiles;
 
            if (!auto_save.default_profile_id.empty()) {
                bool found = false;
                for (const auto& p : auto_save.profiles) {
                    if (p.id == auto_save.default_profile_id) {
                        found = true;
                        break;
                    }
                }
                if (!found && !auto_save.profiles.empty())
                    auto_save.default_profile_id = auto_save.profiles[0].id;
            } else if (!auto_save.profiles.empty()) {
                auto_save.default_profile_id = auto_save.profiles[0].id;
            }
 
            if (save_mail_security_config(auto_save)) {
                (bg_process::run({"/usr/libexec/bastionguard/bastionguard-service", "--user", "restart", "BastionGuard-mailproxy.service"}).exit_code);
                tb_status->set_text(Glib::ustring::compose(
                    _("✔ %1 profili salvati e proxy riavviato."),
                    (int)auto_save.profiles.size()));
            } else {
                tb_status->set_text(Glib::ustring::compose(
                    _("✔ Importati %1 profili — salvataggio fallito, usa 'Salva' manualmente."),
                    imported));
            }
 
            load_signature_fields();
 
            auto refreshed = load_mail_security_config();
            populate_profile_list(
                refreshed.profiles.empty() ? *profiles : refreshed.profiles,
                true);
        } else {
            tb_status->set_text(_("Nessun profilo selezionato."));
        }
    });
 
    tabs->add(*tab_general, "general", _("Generale"));
    tabs->add(*tab_signature, "signature", _("Firma"));
    tabs->add(*tab_profiles, "smtp-profiles", _("Profili SMTP"));
    tabs->add(*tab_thunderbird, "thunderbird", _("Thunderbird"));
 
    inner->append(*tabs_switcher);
    inner->append(*tabs);
 
    auto status = Gtk::make_managed<Gtk::Label>();
    status->set_halign(Gtk::Align::START);
    status->set_xalign(0.0f);
    status->add_css_class("status-muted");
    inner->append(*status);
 
    auto btnSave = Gtk::make_managed<Gtk::Button>(_("Salva configurazione email"));
    btnSave->add_css_class("suggested-action");
    btnSave->set_halign(Gtk::Align::START);
    inner->append(*btnSave);
 
    btnSave->signal_clicked().connect([=]() {
        if (*ui_updating)
            return;
 
        save_signature_fields();
 
        MailSecurityConfig out;
        out.version = 2;
        out.enabled = swEnable->get_active();
        out.scan_outgoing = swScan->get_active();
        out.inject_signature = swSig->get_active();
        out.local_host = cfg.local_host.empty() ? "127.0.0.1" : cfg.local_host;
        out.local_port = cfg.local_port > 0 ? cfg.local_port : 2525;
        out.local_tls_port = cfg.local_tls_port > 0 ? cfg.local_tls_port : 2465;
        out.local_submission_port = cfg.local_submission_port > 0 ? cfg.local_submission_port : 2587;
        out.advertise_starttls = swAdvertiseStartTls->get_active();
        out.enable_implicit_tls_listener = swImplicitTlsListener->get_active();
 
        MailSignatureConfig sig_ui;
        sig_ui.display_name = sName->get_text();
        sig_ui.job_title    = sRole->get_text();
        sig_ui.company      = sCompany->get_text();
        sig_ui.phone        = sPhone->get_text();
        sig_ui.website      = sWeb->get_text();
        sig_ui.logo_path    = "/usr/share/BastionGuard/data/logo.png";
 
        if (out.inject_signature) {
            if (sig_ui.display_name.empty() &&
                sig_ui.job_title.empty() &&
                sig_ui.company.empty() &&
                sig_ui.phone.empty() &&
                sig_ui.website.empty()) {
                auto dlg = Gtk::AlertDialog::create(_("Firma vuota"));
                dlg->set_detail(_("La firma automatica è abilitata ma tutti i campi firma sono vuoti."));
                dlg->show();
                return;
            }
        }
 
        out.profiles = *profiles;
 
        if (out.profiles.empty()) {
            MailRelayProfile p;
            p.id = "bastionguard";
            p.label = "BastionGuard";
            p.signature = sig_ui;
            out.profiles.push_back(p);
            out.default_profile_id = "bastionguard";
        } else {
            for (auto& p : out.profiles)
                p.signature = sig_ui;
 
            std::vector<std::string> loop_profiles;
            for (auto& p : out.profiles) {
                const std::string h = p.smtp_host;
                if (h == "127.0.0.1" || h == "127.0.0.4" || h == "::1" || h == "localhost") {
                    loop_profiles.push_back(p.label.empty() ? p.id : p.label);
                    p.smtp_host = "";
                }
            }
 
            if (!loop_profiles.empty()) {
                std::string names;
                for (const auto& n : loop_profiles)
                    names += "• " + n + "\n";
 
                auto dlg = Gtk::AlertDialog::create(_("Profili SMTP non configurati"));
                dlg->set_detail(
                    _("I seguenti profili avevano smtp_host = 127.0.0.1 e non possono essere usati come relay:\n") +
                    names +
                    _("\nSono stati salvati senza server SMTP. Aggiorna i campi 'Server SMTP' nel tab Profili SMTP e reimporta.")
                );
                dlg->show();
            }
 
            bool def_found = false;
            for (const auto& p : out.profiles) {
                if (p.id == out.default_profile_id) {
                    def_found = true;
                    break;
                }
            }
            if (!def_found)
                out.default_profile_id = out.profiles[0].id;
        }
 
        if (!save_mail_security_config(out)) {
            status->set_text(_("❌ Impossibile salvare la configurazione"));
            auto dlg = Gtk::AlertDialog::create(_("Errore salvataggio"));
            dlg->set_detail(_("Impossibile scrivere ~/.config/BastionGuard/mail.json"));
            dlg->show();
            return;
        }
 
        (bg_process::run({"/usr/libexec/bastionguard/bastionguard-service", "--user", "restart", "BastionGuard-mailproxy.service"}).exit_code);
 
        status->set_text(_("✔ Configurazione salvata in ~/.config/BastionGuard/mail.json"));
 
        populate_profile_list(out.profiles, true);
        tb_status->set_text(Glib::ustring::compose(
            _("✔ %1 profili attivi"), (int)out.profiles.size()));
    });
 
    load_signature_fields();
 
    frame->set_child(*inner);
    center->append(*frame);
    outer->append(*center);
    scrolled->set_child(*outer);
    page->append(*scrolled);
 
    page_order_.push_back(page);
    stack.add(*page, "email", _("Email"));
}