{{> header.html page_title="Administrator Account Audit" header_widgets="" }}

<link rel="stylesheet" href="{{assets}}/css/design-v2-common.css" media="all" nonce="{{nonce}}">
{{> threat/free_common.html }}

<style>

  {{custom_css}}

  /* ============================================================
   * Admin-audit page-specific styles. Layered on top of the
   * generic threat-view (.tv-*) component CSS.
   * ============================================================ */

  .ad-summary {
    grid-template-columns: repeat(5, minmax(0, 1fr));
  }

  /* User cell — login + secondary email line */
  .ad-user       { font-family: var(--mono); color: var(--fg); font-weight: 600; word-break: break-all; }
  .ad-email      { font-family: var(--mono); color: var(--fg-dim); margin-top: 2px; word-break: break-all; }

  /* Date / time cells */
  .tv-table .ad-date       { font-family: var(--mono); color: var(--fg); white-space: nowrap; }
  .tv-table .ad-date.is-na { color: var(--fg-dimmer); }

  /* Last-login source chip */
  .ad-src {
    display: inline-block;
    margin-left: 6px;
    padding: 1px 6px;
    border-radius: var(--bf-r-sm);
    font-family: var(--mono);
    letter-spacing: 0.02em;
    cursor: help;
  }
  .ad-src-bf   { color: var(--green); background: var(--green-bg); border: 1px solid var(--green-border); }
  .ad-src-sess { color: var(--fg-dimmer); background: var(--bg-raised); border: 1px solid var(--border); font-style: italic; }

  /* App-password cell — count chip OR muted "none" */
  .ad-ap-count {
    display: inline-flex; align-items: center;
    padding: 1px 8px; border-radius: var(--bf-r-pill);
    background: var(--blue-bg); border: 1px solid var(--blue-border);
    color: var(--blue);
    font-family: var(--mono);
  }
  .ad-ap-none { font-family: var(--mono); color: var(--fg-dimmer); font-style: italic; }

  /* Active-sessions table — two rows per session */
  .tv-table-sessions tbody.ad-sess-group tr.ad-sess-row-primary > td { border-bottom: 0; }
  .tv-table-sessions tbody.ad-sess-group tr.ad-sess-row-ua > td {
    padding-top: 0; padding-left: 24px; text-align: left;
  }
  .tv-table-sessions tbody.ad-sess-group:hover tr > td { background: var(--bg-hover); }
  .tv-table-sessions .ad-ua {
    font-family: var(--mono); color: var(--fg-dim);
    word-break: break-all; white-space: normal;
  }
  .tv-table-sessions .ad-ua.is-na { color: var(--fg-dimmer); font-style: italic; }

  /* Disabled-row treatment — dim the whole row's text */
  .tv-table tbody tr.is-disabled td { color: var(--fg-dimmer); }
  .tv-table tbody tr.is-disabled .ad-user { color: var(--fg-dim); }

  .db-body {
    display: block;
    max-width: 420px;
    color: var(--fg-dim);
    word-break: break-all;
    white-space: pre-wrap;
    line-height: 1.45;
  }

  @media (max-width: 1100px) {
    .ad-summary {
      grid-template-columns: repeat(2, minmax(0, 1fr));
    }
  }

  @media (max-width: 700px) {
    .ad-summary {
      grid-template-columns: 1fr;
    }
  }
</style>

<div class="tv-shell">

  {{> threat/nav.html }}

  <section class="tv-hero">
    <h1>Admin and database persistence audit</h1>
    <p class="lede">
      Not every compromise lives in files. Attackers also create rogue administrator accounts,
      issue application passwords, keep stolen sessions alive, and hide persistence inside the database.
      BitFire PRO audits those access and database layers for takeover indicators.
    </p>
  </section>

  <div class="th-pro-note">
    <strong>Why this tab matters:</strong>
    a site is not clean if the attacker still has admin access or if a hidden database trigger can rebuild the compromise later.
    BitFire PRO helps you review privileged users, application passwords, sessions, and suspicious database objects from one place.
    <a class="th-pro-inline-link" href="https://bitfire.co/purchase" target="_blank" rel="noopener">Purchase PRO</a> to unlock the live audit.
  </div>

  {{#db_error_visible}}
  <div class="tv-callout fs-body">
    <div class="tv-callout-head">
      <span>Database connection unavailable</span>
    </div>
    <p>Unable to query admin users. The audit cannot run without database access — re-open this page from the WordPress admin dashboard.</p>
  </div>
  {{/db_error_visible}}

  {{^db_error_visible}}

  <div class="tv-statusbar">
    <div class="tv-statusbar-left fs-lg">
      <span class="label">Site-wide</span>
      <span class="tv-badge is-info fs-sm">
        <span>Preview only — access and database checks below are listed as not checked</span>
      </span>
    </div>
    <div class="tv-statusbar-right">
      <span class="tv-toggle-status fs-sm">Live actions are unlocked in BitFire PRO.</span>
    </div>
  </div>

  <dl class="tv-summary ad-summary">
    <div class="tv-stat">
      <dt class="tv-stat-k">Administrators</dt>
      <dd class="tv-stat-v">{{+ user_count }}</dd>
      <dd class="tv-stat-sub fs-xs">total admin accounts</dd>
    </div>
    <div class="tv-stat">
      <dt class="tv-stat-k">Suspicious</dt>
      <dd class="tv-stat-v">not checked</dd>
      <dd class="tv-stat-sub fs-xs">preview mode</dd>
    </div>
    <div class="tv-stat">
      <dt class="tv-stat-k">Disabled</dt>
      <dd class="tv-stat-v">not checked</dd>
      <dd class="tv-stat-sub fs-xs">preview mode</dd>
    </div>
    <div class="tv-stat">
      <dt class="tv-stat-k">App Passwords</dt>
      <dd class="tv-stat-v is-info">{{+ ap_total_count }}</dd>
      <dd class="tv-stat-sub fs-xs">issued across all admins</dd>
    </div>
    <div class="tv-stat">
      <dt class="tv-stat-k">Active Sessions</dt>
      <dd class="tv-stat-v is-info">{{+ session_total_count }}</dd>
      <dd class="tv-stat-sub fs-xs">live admin browser sessions</dd>
    </div>
  </dl>

  <section class="tv-section">
    <div class="tv-section-head">
      <div class="tv-section-head-text">
        <div class="tv-section-eyebrow">Accounts</div>
        <h2>
          Administrator accounts
          <span class="tv-count-pill"><span class="num">{{+ user_count }}</span></span>
        </h2>
        <p class="tv-section-blurb fs-lg">
          Each row is a user with the <code>administrator</code> role. This preview shows the administrator accounts BitFire can read,
          but does not score them yet.
        </p>
      </div>
    </div>

    {{#users_empty_visible}}
    <div class="tv-empty">
      <div class="tv-empty-icon" aria-hidden="true">∅</div>
      <p class="tv-empty-title fs-body">No administrator accounts found.</p>
      <p class="tv-empty-sub">The user table is reachable but contains no admins.</p>
    </div>
    {{/users_empty_visible}}

    {{#users_has_visible}}
    <div class="tv-table-wrap">
      <table class="tv-table" id="admins-table">
        <thead>
          <tr>
            <th>User</th>
            <th>Registered</th>
            <th>Last login</th>
            <th>App pw</th>
            <th>Status</th>
          </tr>
        </thead>
        <tbody>
          {{ template:user_row "data" }}
          <tr class="{{- data.tr_class }}" data-uid="{{- data.id }}">
            <td>
              <div class="ad-user fs-body">{{- data.login }}</div>
              <div class="ad-email fs-xs">{{- data.email }}</div>
            </td>
            <td><span class="ad-date fs-sm">{{- data.registered_short }}</span></td>
            <td>
              <span class="ad-date fs-sm {{- data.last_login_na_class }}">{{- data.last_login }}</span>
              {{ data.last_login_source_html }}
            </td>
            <td>{{ data.ap_html }}</td>
            <td>
              <span class="tv-badge fs-xs is-neutral">
                <span class="tv-sr-only">Status: </span>not checked
              </span>
            </td>
          </tr>
          {{ end template }}
          {{ render:user_row "users" }}
        </tbody>
      </table>
    </div>
    {{/users_has_visible}}
  </section>

  {{#ap_section_visible}}
  <section class="tv-section">
    <div class="tv-section-head">
      <div class="tv-section-head-text">
        <div class="tv-section-eyebrow">App passwords</div>
        <h2>
          Application passwords
          <span class="tv-count-pill"><span class="num">{{+ ap_total_count }}</span></span>
        </h2>
        <p class="tv-section-blurb fs-lg">
          Application passwords allow REST API access without the user's real password. This preview lists the application passwords BitFire can read,
          but does not score them yet.
        </p>
      </div>
    </div>

    <div class="tv-table-wrap">
      <table class="tv-table">
        <thead>
          <tr>
            <th>User</th>
            <th>Password name</th>
            <th>Created</th>
            <th>Last used</th>
            <th>Status</th>
          </tr>
        </thead>
        <tbody>
          {{ template:ap_row "ap" }}
          <tr class="{{- ap.row_class }}">
            <td><span class="ad-user fs-sm">{{- ap.login }}</span></td>
            <td><span class="ad-user fs-sm">{{- ap.name }}</span></td>
            <td><span class="ad-date fs-sm">{{- ap.created }}</span></td>
            <td><span class="ad-date fs-sm {{- ap.last_used_na_class }}">{{- ap.last_used }}</span></td>
            <td>
              <span class="tv-badge fs-xs is-neutral">
                <span class="tv-sr-only">Status: </span>not checked
              </span>
            </td>
          </tr>
          {{ end template }}
          {{ render:ap_row "app_passwords" }}
        </tbody>
      </table>
    </div>
  </section>
  {{/ap_section_visible}}

  {{#sessions_section_visible}}
  <section class="tv-section">
    <div class="tv-section-head">
      <div class="tv-section-head-text">
        <div class="tv-section-eyebrow">Active sessions</div>
        <h2>
          Active admin sessions
          <span class="tv-count-pill"><span class="num">{{+ session_total_count }}</span></span>
        </h2>
        <p class="tv-section-blurb fs-lg">
          Each row is one live browser session belonging to an administrator. This preview lists the sessions BitFire can read,
          but does not score or revoke them yet.
        </p>
      </div>
    </div>

    <div class="tv-table-wrap">
      <table class="tv-table tv-table-sessions">
        <thead>
          <tr>
            <th>User</th>
            <th>IP</th>
            <th>Location</th>
            <th>Logged in</th>
            <th>Expires</th>
          </tr>
        </thead>
        {{ template:sess_row "s" }}
        <tbody class="ad-sess-group">
          <tr class="ad-sess-row-primary">
            <td><span class="ad-user fs-sm">{{- s.login_user }}</span></td>
            <td><span class="ad-date fs-sm {{- s.ip_na_class }}">{{- s.ip }}</span></td>
            <td><span class="ad-date fs-sm {{- s.geo_na_class }}">{{- s.geo }}</span></td>
            <td><span class="ad-date fs-sm {{- s.logged_in_na }}">{{- s.logged_in }}</span></td>
            <td><span class="ad-date fs-sm {{- s.expires_na }}">{{- s.expires }}</span></td>
          </tr>
          <tr class="ad-sess-row-ua">
            <td colspan="5"><span class="ad-ua fs-xs {{- s.ua_na_class }}">{{- s.ua_full }}</span></td>
          </tr>
        </tbody>
        {{ end template }}
        {{ render:sess_row "sessions" }}
      </table>
    </div>
  </section>
  {{/sessions_section_visible}}

  <section class="tv-section">
    <div class="tv-section-head">
      <div class="tv-section-head-text">
        <div class="tv-section-eyebrow">Database</div>
        <h2>
          Triggers, events &amp; routines
          <span class="tv-count-pill"><span class="num">{{+ db_object_count }}</span></span>
        </h2>
        <p class="tv-section-blurb fs-lg">
          WordPress never creates database triggers, scheduled events, stored procedures, or custom views.
          This preview lists the database objects BitFire can read, but does not score them yet.
        </p>
      </div>
    </div>

    <div class="tv-empty">
      <p class="tv-empty-title fs-body">No triggers, events, routines, or not checked.</p>
    </div>

  </section>

  {{/db_error_visible}}

  <div class="th-pro-cta">
    <div class="th-pro-cta-copy">
      <h2>Unlock the admin audit in BitFire PRO</h2>
      <p>Purchase BitFire PRO to review administrator accounts, application passwords, live sessions, and suspicious database objects that can keep a compromised WordPress site under attacker control.</p>
      <div class="th-pro-meta">Recommended after any confirmed breach, unknown admin appearance, or unexplained access recurrence.</div>
    </div>
    <div class="th-pro-actions">
      <a class="th-pro-btn is-primary" href="https://bitfire.co/purchase" target="_blank" rel="noopener">Purchase BitFire PRO</a>
    </div>
  </div>

</div>