<?php

// Human-readable strings returned by backend services (HardeningService,
// FirewallService, Fail2banService, MaintenanceService, OsProfile) and shown in
// the UI: confirm-modal copy, guard/lockout refusals, read errors, and the
// supports()/reason sentences. Technical tokens (sshd, ufw, firewalld, ports,
// paths) stay verbatim. Reuse common.* for save/cancel/active/inactive/etc.
return [
    // ── HardeningService: state labels + detail ──────────────────────────
    'item_not_installed' => 'not installed',
    'label_ssh_root' => 'SSH root login',
    'label_ssh_password' => 'SSH password login',
    'label_auto_updates' => 'Automatic updates',

    // ── HardeningService: modal titles (per direction) ───────────────────
    'title_ssh_root_enable' => 'Allow SSH root login',
    'title_ssh_root_disable' => 'Disable SSH root login',
    'title_ssh_password_enable' => 'Allow SSH password login',
    'title_ssh_password_disable' => 'Disable SSH password login',
    'title_fail2ban_enable' => 'Enable fail2ban',
    'title_fail2ban_disable' => 'Disable fail2ban',
    'title_firewall_enable' => 'Enable firewall',
    'title_firewall_disable' => 'Disable firewall',
    'title_unattended_enable' => 'Enable automatic updates',
    'title_unattended_disable' => 'Disable automatic updates',

    // ── HardeningService: modal descriptions (per direction) ─────────────
    'desc_ssh_root_enable' => 'Re-allows direct root login over SSH (PermitRootLogin yes) and reloads the SSH service.',
    'desc_ssh_root_disable' => 'Blocks direct root login over SSH (PermitRootLogin no) and reloads the SSH service.',
    'desc_ssh_password_enable' => 'Re-allows password login (PasswordAuthentication yes).',
    'desc_ssh_password_disable' => 'Login via SSH key only (PasswordAuthentication no). Only possible if a key is in place.',
    'desc_fail2ban_enable' => 'Installs fail2ban (if needed) and starts the service. Repeated failed logins get banned.',
    'desc_fail2ban_disable' => 'Stops fail2ban and disables autostart.',
    'desc_firewall_enable' => 'Installs the firewall (if needed), opens SSH + 80/443 first, then enables it.',
    'desc_firewall_disable' => 'Disables the server firewall.',
    'desc_unattended_enable' => 'Installs (if needed) and enables the system\'s automatic security updates.',
    'desc_unattended_disable' => 'Turns off automatic updates.',

    // ── HardeningService: errors + guards ────────────────────────────────
    'hardening_status_read_failed' => 'Could not read hardening status.',
    'ssh_probe_no_exec' => 'SSH login succeeded, but commands could not be executed.',
    'ssh_password_self_lockout' => 'Clusev connects itself via password — password login cannot be disabled, otherwise Clusev loses access. Set up SSH key access first.',
    'ssh_password_no_key' => 'No SSH key in place — password login cannot be disabled (lockout risk).',
    'ssh_root_self_lockout' => 'Clusev connects as root — root login cannot be disabled, otherwise Clusev locks itself out. Add a non-root user (sudo + SSH key) first and switch Clusev to it.',

    // ── FirewallService: guards / reasons / errors ───────────────────────
    'firewalld_read_only' => 'Rule management for firewalld is read-only in this version — please configure it on the server.',
    'invalid_port' => 'Invalid port (1–65535).',
    'invalid_source' => 'Invalid source — IP address or CIDR expected.',
    'port_or_source_required' => 'Port or source is required.',
    'deny_without_port_blocks_ssh' => 'A :action rule without a port would also block SSH access and is not allowed. Use fail2ban to block individual IPs from SSH access.',
    'deny_on_ssh_port_blocks_ssh' => 'A :action rule on the SSH port (:port) is not allowed (lockout risk). Use fail2ban to block individual IPs from SSH access.',
    'firewalld_port_required' => 'firewalld: Please specify a port.',
    'firewall_status_read_failed' => 'Could not read firewall status — rule not removed.',
    'rule_gone' => 'Rule no longer exists.',
    'ssh_rule_guard' => 'This rule keeps SSH access (port :port) open and cannot be removed — otherwise Clusev locks itself out. Disable the whole firewall if needed.',

    // ── Fail2banService: guards / reasons / errors ───────────────────────
    'ip_belongs_to_clusev' => 'This IP belongs to Clusev\'s access and cannot be banned (lockout risk).',
    'already_whitelisted' => 'Already on the whitelist.',
    'not_on_whitelist' => 'Not on the whitelist.',
    'loopback_stays_whitelisted' => 'Loopback always stays on the whitelist.',
    'invalid_input' => 'Invalid input.',
    'invalid_ip_or_cidr' => 'Invalid IP address or CIDR.',
    'fail2ban_config_read_failed' => 'Could not read fail2ban configuration.',

    // ── OsProfile: family labels ─────────────────────────────────────────
    'family_debian' => 'Debian/Ubuntu',
    'family_rhel' => 'RHEL/Fedora',
    'family_suse' => 'openSUSE/SLES',
    'family_arch' => 'Arch Linux',
    'family_alpine' => 'Alpine Linux',
    'family_unknown' => 'Unknown system',

    // ── OsProfile: firewall labels ───────────────────────────────────────
    'firewall_label_ufw' => 'Firewall (UFW)',
    'firewall_label_firewalld' => 'Firewall (firewalld)',
    'firewall_label_generic' => 'Firewall',

    // ── OsProfile: supports() reasons (:family = familyLabel()) ──────────
    'support_ssh' => 'SSH hardening requires systemd, which was not detected on :family.',
    'support_services' => 'Service control requires systemd, which was not detected here.',
    'support_updates' => 'Package updates via Clusev are not yet supported on :family.',
    'support_fail2ban' => 'fail2ban is not yet supported on :family via Clusev.',
    'support_firewall' => 'No supported firewall (UFW or firewalld) was found on :family.',
    'support_auto_updates' => 'Automatic updates are not yet supported on :family via Clusev.',

    // ── FleetService: SFTP / file-manager / journal errors ───────────────
    'authorized_keys_unreadable' => 'authorized_keys is empty or unreadable.',
    'delete_failed_perms' => 'Delete failed (permissions?).',
    'file_too_large_download' => 'File too large to download (>50 MB).',
    'save_failed_perms' => 'Save failed (permissions?).',
    'upload_failed_perms' => 'Upload failed (permissions?).',
    'journal_needs_privileges' => 'The system journal requires elevated privileges (group adm/systemd-journal) or sudo.',

    // ── CredentialVault: SSH credential guards (:server = name) ──────────
    'no_ssh_credential' => 'No SSH credential stored for server :server.',
    'ssh_access_locked' => 'SSH access for :server is locked.',

    // ── HardeningService: invalid action invariant (:action) ─────────────
    'unknown_hardening' => 'Unknown hardening action: :action',

    // ── SshKeyProvisioner ─────────────────────────────────────────────────
    'ssh_key_verify_failed' => 'Key login could not be verified (:error) — password login stays enabled.',
];
