import React, { useCallback, useEffect, useId, useMemo, useRef, useState } from "react";

import {
  Alert,
  Box,
  Button,
  Chip,
  Paper,
  Stack,
  Tab,
  Tabs,
  TextField,
  Typography,
  Checkbox,
  FormControlLabel,
  LinearProgress,
} from "@mui/material";

import { api, getApiErrorMessage } from "../api";
import { useI18n } from "../i18n/I18nProvider";
import { PageHeader, PageSection } from "../layout/PageLayout";
import type { TranslationKey } from "../i18n/translations";
import { checkSessionCookie, getSessionContext, isSessionInvalidated } from "../sessionBoundary";

type AiServiceMetrics = {
  healthy: boolean;
  model?: string | null;
  device?: string | null;
  gpuAvailable?: boolean;
  gpuName?: string | null;
  ocrAvailable?: boolean | null;
  ocrLanguages?: string | null;
  ollamaConfigured?: boolean | null;
  ollamaReachable?: boolean | null;
  ollamaModel?: string | null;
  ollamaModelAvailable?: boolean | null;
  ollamaVersion?: string | null;
  ollamaInstalledModels?: string[] | null;
  ollamaLoadedModels?: string[] | null;
  ollamaLoadedCount?: number | null;
  healthLatencyMs?: number | null;
  probeLatencyMs?: number | null;
  lastProbeAt?: string | null;
  lastProbeSuccessAt?: string | null;
  lastProbeFailureAt?: string | null;
  probeFailures: number;
  requests: number;
  cacheHits: number;
  cacheMisses: number;
  failures: number;
  averageLatencyMs?: number | null;
  ocrRequests: number;
  ocrFailures: number;
  averageOcrLatencyMs?: number | null;
  lastOcrSuccessAt?: string | null;
  lastOcrFailureAt?: string | null;
  lastSuccessAt?: string | null;
  lastFailureAt?: string | null;
  lastError?: string | null;
};

type EditableEmailSettings = {
  enabled: boolean;
  host: string;
  port: number;
  user: string;
  from: string;
  fromName: string;
  enableSsl: boolean;
  timeoutMs: number;
  usesOverrides: boolean;
  hasPassword: boolean;
};

type CvBenchmarkEntry = {
  FileName: string;
  Slug: string;
  Extension: string;
  Characters: number;
  OutputPath: string;
  ApprovedFixturePath?: string | null;
  CandidateFixturePath?: string | null;
  ContactLocation?: string | null;
  FirstJob?: string | null;
  FirstJobLocation?: string | null;
  FirstEducation?: string | null;
  FirstEducationLocation?: string | null;
  QualificationLevels: string[];
  SuspiciousLocations: string[];
  CoverageScore: number;
  ConfidenceScore: number;
  ConsistencyScore: number;
  DiffSummary?: string | null;
};

type CvBenchmarkIndex = {
  CorpusRoot: string;
  OutputRoot: string;
  GeneratedAtUtc: string;
  TotalFiles: number;
  AverageCoverage: number;
  AverageConfidence: number;
  AverageConsistency: number;
  FilesWithSuspiciousLocations: number;
  MissingApprovedFixtures: number;
  Entries: CvBenchmarkEntry[];
};

type CvBenchmarkStatus = {
  indexJson?: string | null;
  reportMarkdown?: string | null;
  rootPath: string;
  lastUpdatedAtUtc?: string | null;
};

type MaintenanceJob = {
  id: string;
  title: string;
  description: string;
  available: boolean;
  runsUrl?: string | null;
};

type SystemStatus = {
  environment: string;
  contentRoot: string;
  version: string;
  commitSha?: string | null;
  buildStamp?: string | null;
  storage: {
    dataRoot: string;
    dbPath: string;
    dbExists: boolean;
    dbSizeBytes?: number | null;
    companyCount: number;
    jobCount: number;
    deletedCount: number;
  };
  email: {
    enabled: boolean;
    host?: string | null;
    port: number;
    enableSsl: boolean;
    from?: string | null;
    fromName?: string | null;
  };
  database: {
    provider: string;
    looksConfigured: boolean;
    canConnect: boolean;
    target?: string | null;
    usesFileStorage: boolean;
    warning?: string | null;
  };
  runtime: {
    framework: string;
    osDescription: string;
    processArchitecture: string;
    machineName?: string | null;
  };
  auth: {
    required: boolean;
    hasJwtKey: boolean;
    googleConfigured: boolean;
    gmailConfigured: boolean;
  };
  ai: AiServiceMetrics;
};

function formatBytes(bytes?: number | null) {
  if (bytes == null) return "-";
  if (bytes < 1024) return `${bytes} B`;
  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
  return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
}

function displayMetadata(value?: string | null) {
  return value && value.trim().length > 0 ? value : "-";
}

function formatDate(value?: string | null, locale?: string) {
  return value ? new Date(value).toLocaleString(locale) : "-";
}

function formatPercent(value?: number | null) {
  return typeof value === "number" ? `${Math.round(value * 100)}%` : "-";
}

function parseBenchmarkIndex(indexJson?: string | null): CvBenchmarkIndex | null {
  if (!indexJson?.trim()) return null;
  try {
    return JSON.parse(indexJson) as CvBenchmarkIndex;
  } catch {
    return null;
  }
}

function benchmarkTone(value?: number | null) {
  if (typeof value !== "number") return "default" as const;
  if (value >= 0.8) return "success" as const;
  if (value >= 0.6) return "warning" as const;
  return "error" as const;
}

function SummaryCard({ title, value, subtitle, tone = "default" }: { title: string; value: string; subtitle?: string; tone?: "default" | "success" | "warning" | "error" }) {
  const color = tone === "success" ? "success.main" : tone === "warning" ? "warning.main" : tone === "error" ? "error.main" : "text.primary";
  return (
    <Paper variant="outlined" sx={{ p: "var(--app-card-padding)", borderRadius: 1, minWidth: 0 }}>
      <Typography variant="overline" sx={{ color: "text.secondary" }}>{title}</Typography>
      <Typography component="p" variant="h5" sx={{ fontWeight: 950, color }}>{value}</Typography>
      <Typography variant="body2" sx={{ color: "text.secondary", mt: 1 }}>{subtitle || "-"}</Typography>
    </Paper>
  );
}

function DetailRow({ label, value }: { label: string; value: React.ReactNode }) {
  return <Typography variant="body2" sx={{ overflowWrap: "anywhere", minWidth: 0 }}><strong>{label}:</strong> {value}</Typography>;
}

type ReadKind = "status" | "email" | "benchmark" | "maintenance";
type ActionKind = "save" | "test" | "probe" | "maintenance";
const readPaths: Record<ReadKind, string> = { status: "/admin/system", email: "/admin/system/email-settings", benchmark: "/admin/system/cv-benchmark", maintenance: "/admin/system/maintenance-jobs" };
const readErrorKeys: Record<ReadKind, TranslationKey> = { status: "adminSystemLoadFailed", email: "adminSystemEmailSettingsLoadFailed", benchmark: "adminSystemBenchmarkLoadFailed", maintenance: "adminSystemMaintenanceLoadFailed" };
const actionErrorKeys: Record<ActionKind, TranslationKey> = { save: "adminSystemEmailSaveFailed", test: "adminSystemTestEmailFailed", probe: "adminSystemProbeFailed", maintenance: "adminMaintenanceFailed" };

export default function AdminSystemPage() {
  const { language, t } = useI18n();
  const [tab, setTab] = useState(0);
  const [status, setStatus] = useState<SystemStatus | null>(null);
  const [emailSettings, setEmailSettings] = useState<EditableEmailSettings | null>(null);
  const [benchmarkStatus, setBenchmarkStatus] = useState<CvBenchmarkStatus | null>(null);
  const [maintenanceJobs, setMaintenanceJobs] = useState<MaintenanceJob[]>([]);
  const [smtpPassword, setSmtpPassword] = useState("");
  const [clearPassword, setClearPassword] = useState(false);
  const [loading, setLoading] = useState(true);
  const [readErrors, setReadErrors] = useState<Partial<Record<ReadKind, unknown>>>({});
  const [accessDenied, setAccessDenied] = useState(false);
  const [action, setAction] = useState<ActionKind | null>(null);
  const [actionError, setActionError] = useState<{ kind: ActionKind; cause: unknown } | null>(null);
  const [message, setMessage] = useState<TranslationKey | null>(null);
  const [testEmailTo, setTestEmailTo] = useState("");
  const [testEmailSubject, setTestEmailSubject] = useState("Jobbjakt SMTP test");
  const [testEmailMessage, setTestEmailMessage] = useState(() => t("adminSystemDefaultTestMessage"));
  const mounted = useRef(false);
  const generation = useRef(0);
  const readPending = useRef(false);
  const actionPending = useRef(false);
  const denied = useRef(false);
  const controller = useRef<AbortController | null>(null);
  const draftRevision = useRef(0);
  const passwordRevision = useRef(0);
  const savedRevision = useRef(0);
  const bodyRef = useRef<HTMLDivElement>(null);
  const headingRef = useRef<HTMLHeadingElement>(null);
  const restoreFocus = useRef<HTMLElement | null>(null);
  const navigationId = useId();

  const load = useCallback(async (kind?: ReadKind, afterWrite = false) => {
    checkSessionCookie();
    if (!mounted.current || denied.current || isSessionInvalidated() || readPending.current || actionPending.current && !afterWrite) return;
    const context = getSessionContext();
    const lifetime = generation.current;
    const active = () => { checkSessionCookie(); return mounted.current && lifetime === generation.current && !isSessionInvalidated() && getSessionContext() === context; };
    readPending.current = true;
    const abort = new AbortController();
    controller.current = abort;
    setLoading(true);
    const revision = draftRevision.current;
    await Promise.all((kind ? [kind] : Object.keys(readPaths) as ReadKind[]).map(async (part) => {
      try {
        const response = await api.get(readPaths[part], { signal: abort.signal });
        if (!active() || abort.signal.aborted || denied.current) return;
        if (part === "status") setStatus(response.data);
        if (part === "email" && revision === draftRevision.current && revision === savedRevision.current) setEmailSettings(response.data);
        if (part === "benchmark") setBenchmarkStatus(response.data ?? null);
        if (part === "maintenance") setMaintenanceJobs(response.data ?? []);
        setReadErrors(errors => { const next = { ...errors }; delete next[part]; return next; });
      } catch (cause) {
        if (active() && !abort.signal.aborted) {
          const responseStatus = (cause as { response?: { status?: number } })?.response?.status;
          if (responseStatus === 401 || responseStatus === 403) {
            denied.current = true; setAccessDenied(true);
            setStatus(null); setEmailSettings(null); setBenchmarkStatus(null); setMaintenanceJobs([]);
            setSmtpPassword(""); setClearPassword(false);
          }
          setReadErrors(errors => ({ ...errors, [part]: cause }));
        }
      }
    }));
    if (active() && !abort.signal.aborted) { readPending.current = false; setLoading(false); }
  }, []);

  useEffect(() => {
    mounted.current = true;
    generation.current += 1;
    void load();
    return () => { mounted.current = false; generation.current += 1; controller.current?.abort(); readPending.current = false; };
  }, [load]);

  useEffect(() => {
    if (loading || action || !restoreFocus.current) return;
    const target = restoreFocus.current;
    restoreFocus.current = null;
    if (document.activeElement !== bodyRef.current) return;
    if (target.isConnected && !target.matches(":disabled")) target.focus();
    else headingRef.current?.focus();
  }, [loading, action]);

  const rememberFocus = () => {
    const target = document.activeElement;
    if (target instanceof HTMLElement && bodyRef.current?.contains(target)) { restoreFocus.current = target; bodyRef.current.focus(); }
  };
  const refresh = (kind?: ReadKind) => { if (!readPending.current && !actionPending.current) { rememberFocus(); void load(kind); } };
  const updateSettings = (update: Partial<EditableEmailSettings>) => {
    draftRevision.current += 1;
    setEmailSettings(previous => previous ? { ...previous, ...update } : previous);
  };
  const locked = loading || action !== null || accessDenied;
  const runAction = async (kind: ActionKind, write: (active: () => boolean) => Promise<void>, success: TranslationKey) => {
    checkSessionCookie();
    if (!mounted.current || denied.current || isSessionInvalidated() || readPending.current || actionPending.current) return;
    const context = getSessionContext();
    const lifetime = generation.current;
    const active = () => { checkSessionCookie(); return mounted.current && lifetime === generation.current && !isSessionInvalidated() && getSessionContext() === context; };
    actionPending.current = true;
    rememberFocus(); setAction(kind); setActionError(null); setMessage(null);
    try { await write(active); if (active()) setMessage(success); }
    catch (cause) { if (active()) setActionError({ kind, cause }); }
    finally { actionPending.current = false; if (active()) setAction(null); }
  };
  const readNotice = (kind: ReadKind) => {
    if (!readErrors[kind]) return null;
    const title = t(kind === "status" && status ? "adminSystemRefreshFailed" : readErrorKeys[kind]);
    const detail = getApiErrorMessage(readErrors[kind], title);
    return <Alert severity="error" sx={{ overflowWrap: "anywhere", display: "grid", gridTemplateColumns: "auto minmax(0, 1fr)", "& .MuiAlert-message": { minWidth: 0 }, "& .MuiAlert-action": { gridColumn: 2, m: 0, p: 0, justifySelf: "start" } }} action={!accessDenied ? <Button color="inherit" disabled={locked} onClick={() => refresh(kind)}>{t("retry")}</Button> : undefined}>
      <Typography variant="body2">{title}</Typography>
      {detail !== title ? <Typography variant="body2">{detail}</Typography> : null}
    </Alert>;
  };

  const dbTone = useMemo(() => {
    if (!status) return "default" as const;
    if (!status.database.looksConfigured || !status.database.canConnect) return "error" as const;
    if (status.database.warning) return "warning" as const;
    return "success" as const;
  }, [status]);

  const aiTone = useMemo(() => {
    if (!status) return "default" as const;
    if (!status.ai.healthy) return "error" as const;
    if (status.ai.probeFailures > 0 || status.ai.failures > 0 || (status.ai.ocrFailures ?? 0) > 0) return "warning" as const;
    return "success" as const;
  }, [status]);

  const benchmarkIndex = useMemo(() => parseBenchmarkIndex(benchmarkStatus?.indexJson), [benchmarkStatus?.indexJson]);
  const cvBenchmarkJob = useMemo(() => maintenanceJobs.find((job) => job.id === "cv-benchmark"), [maintenanceJobs]);
  const weakestEntries = useMemo(() => {
    if (!benchmarkIndex) return [] as CvBenchmarkEntry[];
    return [...benchmarkIndex.Entries]
      .sort((a, b) => (a.CoverageScore + a.ConfidenceScore + a.ConsistencyScore) - (b.CoverageScore + b.ConfidenceScore + b.ConsistencyScore))
      .slice(0, 6);
  }, [benchmarkIndex]);

  const benchmarkFindings = useMemo(() => {
    if (!benchmarkIndex) return [] as Array<{ file: string; issue: string }>;
    return benchmarkIndex.Entries.flatMap((entry) => {
      const findings: Array<{ file: string; issue: string }> = [];
      if (entry.ContactLocation && /(culture|education|arial|hobbies|cooperate|ag, ni|bold)/i.test(entry.ContactLocation)) {
        findings.push({ file: entry.FileName, issue: t("adminBenchmarkSuspiciousLocation", { value: entry.ContactLocation }) });
      }
      if (entry.FirstEducation && entry.FirstEducation.length > 120) {
        findings.push({ file: entry.FileName, issue: t("adminBenchmarkEducationOvercaptured") });
      }
      if ((entry.FirstJob ?? "").length > 120) {
        findings.push({ file: entry.FileName, issue: t("adminBenchmarkWorkTitleOvercaptured") });
      }
      if ((entry.QualificationLevels ?? []).includes("Other")) {
        findings.push({ file: entry.FileName, issue: t("adminBenchmarkQualificationOther") });
      }
      return findings;
    }).slice(0, 10);
  }, [benchmarkIndex, t]);

  const sendTestEmail = () => runAction("test", async () => {
      await api.post("/users/send-test-email", {
        toEmail: testEmailTo.trim() || null,
        subject: testEmailSubject.trim() || null,
        message: testEmailMessage.trim() || null,
      });
  }, "adminSystemTestEmailSent");

  const saveEmailSettings = async () => {
    if (!emailSettings) return;
    const revision = draftRevision.current;
    const secretRevision = passwordRevision.current;
    const snapshot = emailSettings;
    await runAction("save", async (active) => {
      const res = await api.put<EditableEmailSettings>("/admin/system/email-settings", {
        enabled: snapshot.enabled,
        host: snapshot.host,
        port: Number(snapshot.port) || 587,
        user: snapshot.user,
        password: smtpPassword.trim() || null,
        clearPassword,
        from: snapshot.from,
        fromName: snapshot.fromName,
        enableSsl: snapshot.enableSsl,
        timeoutMs: Number(snapshot.timeoutMs) || 15000,
      });
      if (!active()) return;
      if (draftRevision.current === revision) { setEmailSettings(res.data); savedRevision.current = revision; }
      if (passwordRevision.current === secretRevision) { setSmtpPassword(""); setClearPassword(false); }
      setReadErrors(errors => { const next = { ...errors }; delete next.email; return next; });
    }, "adminSystemSettingsSaved");
  };

  const runMaintenanceJob = async (jobId: string) => {
    if (jobId !== "cv-benchmark" || !cvBenchmarkJob?.available || readErrors.maintenance) return;
    await runAction("maintenance", async () => {
      await api.post(`/admin/system/maintenance-jobs/${encodeURIComponent(jobId)}/runs`);
    }, "adminMaintenanceQueued");
  };

  return (
    <Box ref={bodyRef} role="region" aria-label={t("adminSystemTitle")} aria-busy={locked} tabIndex={-1} sx={{ display: "flex", flexDirection: "column", gap: "var(--app-section-gap)", minWidth: 0, overflowWrap: "anywhere", "& .MuiButton-root": { whiteSpace: "normal", overflowWrap: "anywhere", maxWidth: "100%", minHeight: { xs: 44, sm: 36 }, "@media (pointer: coarse)": { minHeight: 44 } }, "& .MuiChip-root": { maxWidth: "100%", height: "auto" }, "& .MuiChip-label": { whiteSpace: "normal", overflowWrap: "anywhere", py: 0.5 } }}>
      <PageHeader level="h2" titleRef={headingRef} title={t("adminSystemTitle")} description={t("adminSystemSubtitle")} actions={
        <Box sx={{ display: "flex", gap: 1, flexWrap: "wrap" }}>
          <Button
            variant="outlined"
            onClick={async () => {
              await runAction("probe", async (active) => { await api.post("/admin/system/ai/probe"); if (active()) await load("status", true); }, "adminSystemProbeCompleted");
            }}
            disabled={locked || !status || !!readErrors.status}
          >
            {action === "probe" ? t("adminSystemRunningProbe") : t("adminSystemRunProbe")}
          </Button>
          <Button variant="contained" onClick={() => refresh()} disabled={locked}>
            {loading ? t("adminSystemRefreshing") : t("adminSystemRefresh")}
          </Button>
        </Box> } />

      <Tabs value={tab} aria-label={t("adminSystemTitle")} onChange={(_, value) => setTab(value)} variant="scrollable" scrollButtons="auto" allowScrollButtonsMobile>
        <Tab id={`${navigationId}-tab-0`} aria-controls={`${navigationId}-panel-0`} label={t("adminSystemStatusTab")} />
        <Tab id={`${navigationId}-tab-1`} aria-controls={`${navigationId}-panel-1`} label={t("adminSystemSettingsTab")} />
      </Tabs>

      {loading ? <LinearProgress aria-label={t("loading")} /> : null}
      {actionError ? <Alert severity="error" sx={{ overflowWrap: "anywhere" }}>{getApiErrorMessage(actionError.cause, t(actionErrorKeys[actionError.kind]))}</Alert> : null}
      {message ? <Alert severity="success" role="status">{t(message)}</Alert> : null}
      {readNotice("status")}
      {status?.database.warning && tab === 0 ? <Alert severity={status.database.canConnect ? "warning" : "error"}>{status.database.warning}</Alert> : null}
      {status?.ai.lastError && tab === 0 ? <Alert severity={status.ai.healthy ? "warning" : "error"}>{status.ai.lastError}</Alert> : null}

      <Box role="tabpanel" id={`${navigationId}-panel-0`} aria-labelledby={`${navigationId}-tab-0`} hidden={tab !== 0} sx={{ minWidth: 0 }}>
      <Stack spacing={1}>{readNotice("benchmark")}{readNotice("maintenance")}</Stack>
      {status ? <Stack spacing={2}>
          <Box sx={{ display: "grid", gridTemplateColumns: { xs: "1fr", md: "repeat(4, 1fr)" }, gap: 2 }}>
            <SummaryCard
              title={t("adminSystemEnvironment")}
              value={status?.environment ?? "-"}
              subtitle={t("adminSystemVersionCommit", { version: displayMetadata(status?.version), commit: displayMetadata(status?.commitSha) })}
            />
            <SummaryCard
              title={t("adminSystemDatabase")}
              value={status ? (status.database.canConnect ? t("adminSystemConnected") : t("adminSystemOffline")) : "-"}
              subtitle={status ? `${status.database.provider} · ${status.database.target || t("adminSystemNoTarget")}` : "-"}
              tone={dbTone}
            />
            <SummaryCard
              title={t("adminSystemSmtp")}
              value={status?.email.enabled ? t("adminSystemEnabled") : t("adminSystemDisabled")}
              subtitle={status?.email.host || t("adminSystemNoSmtpHost")}
              tone={status?.email.enabled ? "success" : "default"}
            />
            <SummaryCard
              title={t("adminSystemSummarizer")}
              value={status?.ai.healthy ? t("adminSystemHealthy") : t("adminSystemOffline")}
              subtitle={status?.ai.probeLatencyMs != null
                ? t("adminSystemProbeDevice", { latency: status.ai.probeLatencyMs, device: status.ai.device || t("adminSystemUnknownDevice") })
                : status?.ai.healthLatencyMs != null
                  ? t("adminSystemHealthDevice", { latency: status.ai.healthLatencyMs, device: status.ai.device || t("adminSystemUnknownDevice") })
                  : t("adminSystemNoLatencyData")}
              tone={aiTone}
            />
          </Box>

          <Box sx={{ display: "grid", gridTemplateColumns: { xs: "1fr", lg: "1.2fr 1fr" }, gap: 2 }}>
            <PageSection surface level="h3" title={t("adminSystemDatabaseStorage")}>
              <Stack spacing={0.75}>
                <DetailRow label={t("adminSystemProvider")} value={status?.database.provider || "-"} />
                <DetailRow label={t("adminSystemTarget")} value={status?.database.target || "-"} />
                <DetailRow label={t("adminSystemConfigured")} value={status?.database.looksConfigured ? t("yes") : t("noWord")} />
                <DetailRow label={t("adminSystemCanConnect")} value={status?.database.canConnect ? t("yes") : t("noWord")} />
                <DetailRow label={t("adminSystemUsesFileStorage")} value={status?.database.usesFileStorage ? t("yes") : t("noWord")} />
                <DetailRow label={t("adminSystemDataRoot")} value={status?.storage.dataRoot || "-"} />
                <DetailRow label={t("adminSystemDbPath")} value={status?.storage.dbPath || "-"} />
                <DetailRow label={t("adminSystemDbFileExists")} value={status?.storage.dbExists ? t("yes") : t("noWord")} />
                <DetailRow label={t("adminSystemDbSize")} value={formatBytes(status?.storage.dbSizeBytes)} />
                <DetailRow label={t("companies")} value={status?.storage.companyCount ?? 0} />
                <DetailRow label={t("adminSystemJobs")} value={status?.storage.jobCount ?? 0} />
                <DetailRow label={t("adminSystemDeletedJobs")} value={status?.storage.deletedCount ?? 0} />
              </Stack>
            </PageSection>

            <PageSection surface level="h3" title={t("adminSystemRuntimeAuth")}>
              <Stack spacing={0.75}>
                <DetailRow label={t("adminSystemFramework")} value={status?.runtime.framework || "-"} />
                <DetailRow label={t("adminSystemOs")} value={status?.runtime.osDescription || "-"} />
                <DetailRow label={t("adminSystemArchitecture")} value={status?.runtime.processArchitecture || "-"} />
                <DetailRow label={t("adminSystemMachine")} value={status?.runtime.machineName || "-"} />
                <DetailRow label={t("adminSystemContentRoot")} value={status?.contentRoot || "-"} />
                <DetailRow label={t("adminSystemBuildStamp")} value={displayMetadata(status?.buildStamp)} />
                <DetailRow label={t("adminSystemAuthRequired")} value={status?.auth.required ? t("yes") : t("noWord")} />
                <DetailRow label={t("adminSystemJwtConfigured")} value={status?.auth.hasJwtKey ? t("yes") : t("noWord")} />
                <DetailRow label={t("adminSystemGoogleConfigured")} value={status?.auth.googleConfigured ? t("yes") : t("noWord")} />
                <DetailRow label={t("adminSystemGmailConfigured")} value={status?.auth.gmailConfigured ? t("yes") : t("noWord")} />
              </Stack>
            </PageSection>
          </Box>

          <Box sx={{ display: "grid", gridTemplateColumns: { xs: "1fr", lg: "1fr 1fr" }, gap: 2 }}>
            <PageSection surface level="h3" title={t("adminSystemEmailConfig")}>
              <Stack spacing={0.75}>
                <DetailRow label={t("adminSystemEnabled")} value={status?.email.enabled ? t("yes") : t("noWord")} />
                <DetailRow label={t("adminSystemFrom")} value={status?.email.from || "-"} />
                <DetailRow label={t("adminSystemFromName")} value={status?.email.fromName || "-"} />
                <DetailRow label={t("adminSystemHost")} value={status?.email.host || "-"} />
                <DetailRow label={t("adminSystemPort")} value={status?.email.port ?? "-"} />
                <DetailRow label={t("adminSystemSsl")} value={status?.email.enableSsl ? t("yes") : t("noWord")} />
              </Stack>
            </PageSection>

            <PageSection surface level="h3" title={t("adminSystemSummarizerRuntime")}>
              <Stack spacing={0.75}>
                <DetailRow label={t("adminSystemModel")} value={status?.ai.model || "-"} />
                <DetailRow label={t("adminSystemDevice")} value={status?.ai.device || "-"} />
                <DetailRow label={t("adminSystemGpuAvailable")} value={status?.ai.gpuAvailable ? t("yes") : t("noWord")} />
                <DetailRow label={t("adminSystemGpuName")} value={status?.ai.gpuName || "-"} />
                <DetailRow label={t("adminSystemOllamaConfigured")} value={status?.ai.ollamaConfigured ? t("yes") : t("noWord")} />
                <DetailRow label={t("adminSystemOllamaReachable")} value={status?.ai.ollamaReachable ? t("yes") : t("noWord")} />
                <DetailRow label={t("adminSystemOllamaModel")} value={status?.ai.ollamaModel || "-"} />
                <DetailRow label={t("adminSystemOllamaModelAvailable")} value={status?.ai.ollamaModelAvailable ? t("yes") : t("noWord")} />
                <DetailRow label={t("adminSystemOllamaVersion")} value={status?.ai.ollamaVersion || "-"} />
                <DetailRow label={t("adminSystemLoadedModels")} value={status?.ai.ollamaLoadedCount ?? 0} />
                <DetailRow label={t("adminSystemHealthLatency")} value={status?.ai.healthLatencyMs != null ? `${status.ai.healthLatencyMs} ms` : "-"} />
                <DetailRow label={t("adminSystemProbeLatency")} value={status?.ai.probeLatencyMs != null ? `${status.ai.probeLatencyMs} ms` : "-"} />
                <DetailRow label={t("adminSystemLastProbe")} value={formatDate(status?.ai.lastProbeAt, language === "nb" ? "nb-NO" : "en")} />
                <DetailRow label={t("adminSystemLastSuccessfulProbe")} value={formatDate(status?.ai.lastProbeSuccessAt, language === "nb" ? "nb-NO" : "en")} />
                <DetailRow label={t("adminSystemLastSummarizationSuccess")} value={formatDate(status?.ai.lastSuccessAt, language === "nb" ? "nb-NO" : "en")} />
              </Stack>
            </PageSection>
          </Box>

          <PageSection surface level="h3" title={t("adminSystemSummarizerTelemetry")}>
            <Box sx={{ display: "grid", gridTemplateColumns: { xs: "1fr 1fr", md: "repeat(8, 1fr)" }, gap: 2 }}>
              <Box><Typography variant="overline" sx={{ color: "text.secondary" }}>{t("adminSystemRequests")}</Typography><Typography component="p" variant="h6" sx={{ fontWeight: 900 }}>{status?.ai.requests ?? 0}</Typography></Box>
              <Box><Typography variant="overline" sx={{ color: "text.secondary" }}>{t("adminSystemCacheHits")}</Typography><Typography component="p" variant="h6" sx={{ fontWeight: 900 }}>{status?.ai.cacheHits ?? 0}</Typography></Box>
              <Box><Typography variant="overline" sx={{ color: "text.secondary" }}>{t("adminSystemCacheMisses")}</Typography><Typography component="p" variant="h6" sx={{ fontWeight: 900 }}>{status?.ai.cacheMisses ?? 0}</Typography></Box>
              <Box><Typography variant="overline" sx={{ color: "text.secondary" }}>{t("adminSystemFailures")}</Typography><Typography component="p" variant="h6" sx={{ fontWeight: 900 }}>{status?.ai.failures ?? 0}</Typography></Box>
              <Box><Typography variant="overline" sx={{ color: "text.secondary" }}>{t("adminSystemProbeFailures")}</Typography><Typography component="p" variant="h6" sx={{ fontWeight: 900 }}>{status?.ai.probeFailures ?? 0}</Typography></Box>
              <Box><Typography variant="overline" sx={{ color: "text.secondary" }}>{t("adminSystemAvgLatency")}</Typography><Typography component="p" variant="h6" sx={{ fontWeight: 900 }}>{status?.ai.averageLatencyMs != null ? `${status.ai.averageLatencyMs} ms` : "-"}</Typography></Box>
              <Box><Typography variant="overline" sx={{ color: "text.secondary" }}>{t("adminSystemOcrRequests")}</Typography><Typography component="p" variant="h6" sx={{ fontWeight: 900 }}>{status?.ai.ocrRequests ?? 0}</Typography></Box>
              <Box><Typography variant="overline" sx={{ color: "text.secondary" }}>{t("adminSystemOcrAvgLatency")}</Typography><Typography component="p" variant="h6" sx={{ fontWeight: 900 }}>{status?.ai.averageOcrLatencyMs != null ? `${status.ai.averageOcrLatencyMs} ms` : "-"}</Typography></Box>
            </Box>
            <Box sx={{ display: "flex", gap: 1, flexWrap: "wrap", mt: 2 }}>
              <Chip label={status?.database.canConnect ? t("adminSystemDatabaseConnected") : t("adminSystemDatabaseIssue")} color={status?.database.canConnect ? "success" : "error"} size="small" />
              <Chip label={status?.auth.required ? t("adminSystemAuthEnforced") : t("adminSystemAuthOptional")} color={status?.auth.required ? "success" : "warning"} size="small" />
              <Chip label={status?.auth.googleConfigured ? t("adminSystemGoogleReady") : t("adminSystemGoogleOff")} variant="outlined" size="small" />
              <Chip label={status?.auth.gmailConfigured ? t("adminSystemGmailReady") : t("adminSystemGmailIncomplete")} variant="outlined" size="small" />
              <Chip label={status?.ai.gpuAvailable ? t("adminSystemGpuVisible") : t("adminSystemCpuMode")} color={status?.ai.gpuAvailable ? "success" : "default"} size="small" />
              <Chip label={status?.ai.ocrAvailable ? t("adminSystemOcrEnabled", { languages: status.ai.ocrLanguages || t("adminSystemEnabled") }) : t("adminSystemOcrUnavailable")} variant="outlined" size="small" />
              {(status?.ai.ollamaInstalledModels ?? []).slice(0, 4).map((model) => (
                <Chip key={model} label={t("adminSystemModelName", { model })} variant="outlined" size="small" />
              ))}
              {(status?.ai.ollamaLoadedModels ?? []).slice(0, 3).map((model) => (
                <Chip key={`loaded-${model}`} label={t("adminSystemLoadedModel", { model })} color="primary" variant="outlined" size="small" />
              ))}
            </Box>
          </PageSection>

          <PageSection surface level="h3" title={t("adminBenchmarkTitle")}>
            <Box sx={{ display: "flex", alignItems: "flex-start", justifyContent: "space-between", gap: 2, flexWrap: "wrap", mb: 1 }}>
              <Box>
                <Typography variant="body2" sx={{ color: "text.secondary", mt: 0.25 }}>
                  {cvBenchmarkJob?.description || t("adminBenchmarkRunScript")}
                </Typography>
              </Box>
              <Stack direction="row" spacing={1} sx={{ flexWrap: "wrap" }}>
                {cvBenchmarkJob?.runsUrl ? (
                  <Button component="a" href={cvBenchmarkJob.runsUrl} target="_blank" rel="noreferrer" variant="outlined">
                    {t("adminMaintenanceViewRuns")}
                  </Button>
                ) : null}
                <Button
                  variant="contained"
                  disabled={locked || !cvBenchmarkJob?.available || !!readErrors.maintenance}
                  onClick={() => void runMaintenanceJob("cv-benchmark")}
                >
                  {action === "maintenance" ? t("adminMaintenanceStarting") : t("adminMaintenanceRunBenchmark")}
                </Button>
              </Stack>
            </Box>
            {!loading && !readErrors.maintenance && !cvBenchmarkJob?.available ? <Alert severity="info" sx={{ mb: 1.5 }}>{t("adminMaintenanceUnavailable")}</Alert> : null}
            {!readErrors.benchmark && !loading ? <>
            <Stack spacing={0.75}>
              <DetailRow label={t("adminBenchmarkRoot")} value={benchmarkStatus?.rootPath || "-"} />
              <DetailRow label={t("adminBenchmarkLastUpdate")} value={formatDate(benchmarkStatus?.lastUpdatedAtUtc, language === "nb" ? "nb-NO" : "en")} />
              <DetailRow label={t("adminBenchmarkCorpusRoot")} value={benchmarkIndex?.CorpusRoot || "-"} />
            </Stack>

            {benchmarkIndex ? (
              <>
                <Box sx={{ mt: 2, display: "grid", gridTemplateColumns: { xs: "1fr 1fr", md: "repeat(5, 1fr)" }, gap: 1.25 }}>
                  <SummaryCard title={t("adminBenchmarkFiles")} value={String(benchmarkIndex.TotalFiles)} subtitle={t("adminBenchmarkCorpusInputs")} />
                  <SummaryCard title={t("adminBenchmarkCoverage")} value={formatPercent(benchmarkIndex.AverageCoverage)} subtitle={t("adminBenchmarkCoverageHelp")} tone={benchmarkTone(benchmarkIndex.AverageCoverage)} />
                  <SummaryCard title={t("adminBenchmarkConfidence")} value={formatPercent(benchmarkIndex.AverageConfidence)} subtitle={t("adminBenchmarkConfidenceHelp")} tone={benchmarkTone(benchmarkIndex.AverageConfidence)} />
                  <SummaryCard title={t("adminBenchmarkConsistency")} value={formatPercent(benchmarkIndex.AverageConsistency)} subtitle={t("adminBenchmarkConsistencyHelp")} tone={benchmarkTone(benchmarkIndex.AverageConsistency)} />
                  <SummaryCard title={t("adminBenchmarkMissingApproved")} value={String(benchmarkIndex.MissingApprovedFixtures)} subtitle={t("adminBenchmarkNeedsReview")} tone={benchmarkIndex.MissingApprovedFixtures > 0 ? "warning" : "success"} />
                </Box>

                <Box sx={{ mt: 2.5, display: "grid", gridTemplateColumns: { xs: "1fr", xl: "1.1fr 0.9fr" }, gap: 2 }}>
                  <Paper variant="outlined" sx={{ p: 1.5, borderRadius: 3 }}>
                    <Typography component="h4" variant="subtitle1" sx={{ fontWeight: 900, mb: 1 }}>{t("adminBenchmarkTopFindings")}</Typography>
                    <Stack spacing={1}>
                      {benchmarkFindings.length > 0 ? benchmarkFindings.map((finding) => (
                        <Box key={`${finding.file}:${finding.issue}`} sx={{ p: 1.25, borderRadius: 2, backgroundColor: "background.default", border: "none", boxShadow: "0px 1px 2px 0px rgba(15,23,42,0.04), 0px 8px 24px -12px rgba(15,23,42,0.12)" }}>
                          <Typography variant="caption" sx={{ color: "text.secondary" }}>{finding.file}</Typography>
                          <Typography variant="body2">{finding.issue}</Typography>
                        </Box>
                      )) : <Typography variant="body2" sx={{ color: "text.secondary" }}>{t("adminBenchmarkNoAnomalies")}</Typography>}
                    </Stack>
                  </Paper>

                  <Paper variant="outlined" sx={{ p: 1.5, borderRadius: 3 }}>
                    <Typography component="h4" variant="subtitle1" sx={{ fontWeight: 900, mb: 1 }}>{t("adminBenchmarkWeakest")}</Typography>
                    <Stack spacing={1}>
                      {weakestEntries.map((entry) => (
                        <Box key={entry.Slug} sx={{ p: 1.25, borderRadius: 2, backgroundColor: "background.default", border: "none", boxShadow: "0px 1px 2px 0px rgba(15,23,42,0.04), 0px 8px 24px -12px rgba(15,23,42,0.12)" }}>
                          <Typography variant="body2" sx={{ fontWeight: 800 }}>{entry.FileName}</Typography>
                          <Box sx={{ display: "flex", gap: 0.75, flexWrap: "wrap", mt: 0.75 }}>
                            <Chip size="small" label={t("adminBenchmarkCoverageValue", { value: formatPercent(entry.CoverageScore) })} color={benchmarkTone(entry.CoverageScore)} />
                            <Chip size="small" label={t("adminBenchmarkConfidenceValue", { value: formatPercent(entry.ConfidenceScore) })} color={benchmarkTone(entry.ConfidenceScore)} />
                            <Chip size="small" label={t("adminBenchmarkConsistencyValue", { value: formatPercent(entry.ConsistencyScore) })} color={benchmarkTone(entry.ConsistencyScore)} />
                          </Box>
                          <Typography variant="caption" sx={{ display: "block", color: "text.secondary", mt: 0.75 }}>{entry.DiffSummary || "-"}</Typography>
                        </Box>
                      ))}
                    </Stack>
                  </Paper>
                </Box>

                <Box sx={{ mt: 2, p: 1.5, borderRadius: 2, backgroundColor: "background.default", border: "none", boxShadow: "0px 1px 2px 0px rgba(15,23,42,0.04), 0px 8px 24px -12px rgba(15,23,42,0.12)", maxHeight: 280, overflow: "auto" }}>
                  <Typography component="h4" variant="subtitle2" sx={{ fontWeight: 800, mb: 1 }}>{t("adminBenchmarkLatestSummary")}</Typography>
                  <Typography variant="body2" sx={{ whiteSpace: "pre-wrap", fontFamily: "ui-monospace, SFMono-Regular, monospace" }}>
                    {benchmarkStatus?.reportMarkdown || "-"}
                  </Typography>
                </Box>
              </>
            ) : (
              <Box sx={{ mt: 1.5, p: 1.5, borderRadius: 2, backgroundColor: "background.default", border: "none", boxShadow: "0px 1px 2px 0px rgba(15,23,42,0.04), 0px 8px 24px -12px rgba(15,23,42,0.12)" }}>
                <Typography variant="body2" sx={{ whiteSpace: "pre-wrap", fontFamily: "ui-monospace, SFMono-Regular, monospace" }}>
                  {benchmarkStatus?.reportMarkdown || t("adminBenchmarkRunScript")}
                </Typography>
              </Box>
            )}</> : null}
          </PageSection>
        </Stack> : null}
      </Box>
      <Box role="tabpanel" id={`${navigationId}-panel-1`} aria-labelledby={`${navigationId}-tab-1`} hidden={tab !== 1} sx={{ minWidth: 0 }}>
        <Box sx={{ display: "grid", gap: 2, minWidth: 0 }}>
          {readNotice("email")}
          {emailSettings ? <PageSection surface level="h3" title={t("adminSystemEmailSettingsTitle")}>
            <Typography variant="body2" sx={{ color: "text.secondary", mb: 1.5 }}>{t("adminSystemEmailSettingsBody")}</Typography>
            <Box sx={{ display: "grid", gridTemplateColumns: { xs: "1fr", md: "1fr 1fr" }, gap: 1.5 }}>
              <FormControlLabel
                control={<Checkbox checked={Boolean(emailSettings?.enabled)} onChange={(e) => updateSettings({ enabled: e.target.checked })} />}
                label={t("adminSystemEnabled")}
                sx={{ gridColumn: { xs: "1 / -1", md: "1 / -1" } }}
              />
              <TextField label={t("adminSystemHost")} value={emailSettings?.host ?? ""} onChange={(e) => updateSettings({ host: e.target.value })} fullWidth />
              <TextField label={t("adminSystemPort")} type="number" value={emailSettings?.port ?? 587} onChange={(e) => updateSettings({ port: Number(e.target.value) })} fullWidth />
              <TextField label={t("adminSystemUsername")} value={emailSettings?.user ?? ""} onChange={(e) => updateSettings({ user: e.target.value })} fullWidth />
              <TextField label={t("adminSystemPassword")} type="password" value={smtpPassword} onChange={(e) => { draftRevision.current += 1; passwordRevision.current += 1; setSmtpPassword(e.target.value); if (e.target.value.trim()) setClearPassword(false); }} helperText={emailSettings?.hasPassword ? t("adminSystemPasswordStored") : t("adminSystemPasswordMissing")} fullWidth />
              <TextField label={t("adminSystemFrom")} value={emailSettings?.from ?? ""} onChange={(e) => updateSettings({ from: e.target.value })} fullWidth />
              <TextField label={t("adminSystemFromName")} value={emailSettings?.fromName ?? ""} onChange={(e) => updateSettings({ fromName: e.target.value })} fullWidth />
              <TextField label={t("adminSystemTimeoutMs")} type="number" value={emailSettings?.timeoutMs ?? 15000} onChange={(e) => updateSettings({ timeoutMs: Number(e.target.value) })} fullWidth />
              <FormControlLabel control={<Checkbox checked={Boolean(emailSettings?.enableSsl)} onChange={(e) => updateSettings({ enableSsl: e.target.checked })} />} label={t("adminSystemSsl")} />
              <FormControlLabel control={<Checkbox checked={clearPassword} onChange={(e) => { draftRevision.current += 1; passwordRevision.current += 1; setClearPassword(e.target.checked); if (e.target.checked) setSmtpPassword(""); }} />} label={t("adminSystemClearStoredPassword")} sx={{ gridColumn: { xs: "1 / -1", md: "1 / -1" } }} />
            </Box>
            {draftRevision.current !== savedRevision.current ? <Typography variant="body2" color="text.secondary" role="status" sx={{ mt: 1.5 }}>{t("adminSystemUnsavedChanges")}</Typography> : null}
            <Box sx={{ display: "flex", justifyContent: "flex-end", mt: 1.5 }}>
              <Button variant="contained" disabled={locked || !!readErrors.email} onClick={() => void saveEmailSettings()}>
                {action === "save" ? t("adminSystemSaving") : t("adminSystemSaveSettings")}
              </Button>
            </Box>
          </PageSection> : null}

          <PageSection surface level="h3" title={t("adminSystemSmtpTest")}>
            <Typography variant="body2" sx={{ color: "text.secondary", mb: 1.5 }}>
              {t("adminSystemSmtpTestBody")}
            </Typography>
            <Box sx={{ display: "grid", gridTemplateColumns: { xs: "1fr", md: "1fr 1fr" }, gap: 1.5 }}>
              <TextField label={t("adminSystemRecipientEmail")} value={testEmailTo} onChange={(e) => setTestEmailTo(e.target.value)} placeholder={t("adminSystemRecipientPlaceholder")} />
              <TextField label={t("adminSystemSubject")} value={testEmailSubject} onChange={(e) => setTestEmailSubject(e.target.value)} />
              <TextField label={t("adminSystemMessage")} multiline minRows={3} value={testEmailMessage} onChange={(e) => setTestEmailMessage(e.target.value)} sx={{ gridColumn: { xs: "1 / -1", md: "1 / -1" } }} />
            </Box>
            <Box sx={{ display: "flex", justifyContent: "flex-end", mt: 1.5 }}>
              <Button variant="contained" disabled={locked || !emailSettings || !!readErrors.email} onClick={() => void sendTestEmail()}>
                {action === "test" ? t("adminSystemSending") : t("adminSystemSendTestEmail")}
              </Button>
            </Box>
          </PageSection>
        </Box>
      </Box>
    </Box>
  );
}