<?php

// Audit log page strings (R16). Shared buttons live in common.php.
return [
    // Header
    'eyebrow' => 'Security',
    'heading' => 'Audit log',
    'event_count' => ':count events',

    // Events panel
    'panel_title' => 'Events',
    'panel_subtitle' => 'newest first',
    'pagination_nav' => 'Audit pages',
    'pagination_prev' => 'Previous',
    'pagination_next' => 'Next',
    'search_label' => 'Search audit log',
    'search_placeholder' => 'Actor, action, target …',

    // Empty state
    'empty_title' => 'No events',
    'empty_filtered' => 'No audit entries found for “:query”.',
    'empty_none' => 'There are no audit entries yet.',

    // Retention
    'retention_title' => 'Retention',
    'retention_subtitle' => 'Automatically prune the audit log',
    'retention_label' => 'Retention',
    'retention_unlimited' => 'unlimited',
    'retention_days' => ':count days',
    'retention_save' => 'Save',
    'retention_saved_notify' => 'Retention policy saved.',
    'retention_hint' => 'Number of days (1–3650). Leave empty to keep entries forever. Older entries are deleted daily.',

    // Human-readable labels for the raw action codes shown in the event list.
    'actions' => [
        'alert.rule_create' => 'Alert rule created',
        'alert.rule_update' => 'Alert rule changed',
        'alert.rule_delete' => 'Alert rule deleted',
        'alert.channels_update' => 'Alert channels changed',
        'audit.retention_set' => 'Retention changed',
        'auth.login_failed' => 'Failed sign-in',
        'auth.2fa_failed' => 'Failed 2FA check',
        'auth.ip_banned' => 'IP address banned',
        'auth.ip_unbanned' => 'IP ban lifted',
        'auth.protection_updated' => 'Login protection changed',
        'deploy.update_request' => 'Update requested',
        'deploy.staging_release' => 'Staging release requested',
        'deploy.staging_release_failed' => 'Staging release failed',
        'deploy.public' => 'Public promotion triggered',
        'deploy.public_failed' => 'Public promotion failed',
        'deploy.stable' => 'Stable promotion triggered',
        'deploy.stable_failed' => 'Stable promotion failed',
        'deploy.yank' => 'Release retracted',
        'deploy.yank_failed' => 'Yank failed',
        'fail2ban.ban' => 'fail2ban: IP banned',
        'fail2ban.unban' => 'fail2ban: IP unbanned',
        'fail2ban.configure' => 'fail2ban configured',
        'fail2ban.ignoreip_add' => 'fail2ban: exception added',
        'fail2ban.ignoreip_remove' => 'fail2ban: exception removed',
        'cert.endpoint_add' => 'Certificate endpoint added',
        'cert.endpoint_delete' => 'Certificate endpoint removed',
        'command.run' => 'Fleet command run',
        'docker.action' => 'Container action',
        'runbook.create' => 'Runbook created',
        'runbook.delete' => 'Runbook deleted',
        'file.edit' => 'File edited',
        'firewall.rule_add' => 'Firewall rule added',
        'firewall.rule_delete' => 'Firewall rule deleted',
        'group.create' => 'Server group created',
        'health.check_add' => 'Uptime check added',
        'health.check_delete' => 'Uptime check removed',
        'group.update' => 'Server group changed',
        'group.delete' => 'Server group deleted',
        'group.members' => 'Group membership changed',
        'mail.configure' => 'E-mail (SMTP) configured',
        'password.change' => 'Password changed',
        'patch.apply' => 'Updates applied',
        'password.reset' => 'Password reset',
        'profile.update' => 'Profile updated',
        // Neutral, WAF/IDS-style labels — deliberately do NOT reveal the deception layer to anyone
        // reading the audit log. The DB action keys stay `security.honeypot_*`; only the visible text
        // is disguised so an attacker with panel/audit access cannot tell the decoy paths are a trap.
        'security.honeypot_hit' => 'Attack attempt',
        'security.honeypot_login' => 'Login attack attempt',
        'security.honeytoken_used' => 'Compromised credentials',
        'server.create' => 'Server added',
        'server.credential_updated' => 'SSH credentials updated',
        'ssh_key.add' => 'SSH key added',
        'system.package_upgrade' => 'Package upgraded',
        'system.settings_updated' => 'System settings changed',
        'tls.cert_request' => 'TLS certificate requested',
        'two_factor.recovery_regenerate' => 'Backup codes regenerated',
        'user.create' => 'User created',
        'user.delete' => 'User deleted',
        'user.logout' => 'Session ended',
        'user.role_change' => 'Role changed',
        'webauthn.register' => 'Security key registered',
        'webauthn.remove' => 'Security key removed',
        'wg.setup' => 'WireGuard set up',
        'wg.add-peer' => 'WireGuard peer added',
        'wg.remove-peer' => 'WireGuard peer removed',
        'wg.set-endpoint' => 'WireGuard endpoint changed',
        'wg.set-port' => 'WireGuard port changed',
        'wg.set-subnet' => 'WireGuard subnet changed',
        'wg.set-dns' => 'WireGuard DNS changed',
        'wg.action-failed' => 'WireGuard action failed',
    ],

    // Page title
    'title' => 'Audit log — Clusev',
];