<?php
/*
 * single-file issue tracker
 * stores data in issues.json
 * 3 open issues per ip limit
 */

$DATA_FILE = __DIR__ . '/issues.json';
$LOGIN_FILE = __DIR__ . '/logins.json';
$MAX_OPEN_PER_IP = 3;
$MAX_TITLE = 30;
$MAX_BODY = 5000;
$MAX_LOGIN_ATTEMPTS = 3;
$ADMIN_PASSWORD = 'changeme'; // change this!

$CATEGORIES = ['Issue', 'Suggestion', 'Question'];
$PRIORITIES = ['low', 'medium', 'high'];

// --- data helpers ---

function load_issues(string $file): array {
    if (!file_exists($file)) return [];
    $data = json_decode(file_get_contents($file), true);
    return is_array($data) ? $data : [];
}

function save_issues(string $file, array $issues): void {
    file_put_contents($file, json_encode($issues, JSON_PRETTY_PRINT), LOCK_EX);
}

function load_logins(string $file): array {
    if (!file_exists($file)) return ['last_cleanup' => 0, 'attempts' => []];
    $data = json_decode(file_get_contents($file), true);
    if (!is_array($data)) return ['last_cleanup' => 0, 'attempts' => []];
    if (!isset($data['attempts']) || !is_array($data['attempts'])) $data['attempts'] = [];
    if (!isset($data['last_cleanup'])) $data['last_cleanup'] = 0;
    return $data;
}

function save_logins(string $file, array $logins): void {
    file_put_contents($file, json_encode($logins, JSON_PRETTY_PRINT), LOCK_EX);
}

/*
 * cleanup rule:
 *  - runs when we've passed the most recent 03:00 since last_cleanup
 *  - only removes entries with < MAX_LOGIN_ATTEMPTS failures
 *  - entries at or above the limit stay forever (permanent lockout)
 */
function cleanup_logins(array $logins, int $max_attempts): array {
    $now = time();
    $today3 = strtotime('today 03:00');
    $last3 = ($now >= $today3) ? $today3 : strtotime('yesterday 03:00');

    if ($logins['last_cleanup'] < $last3) {
        foreach ($logins['attempts'] as $ip => $count) {
            if ($count < $max_attempts) {
                unset($logins['attempts'][$ip]);
            }
        }
        $logins['last_cleanup'] = $now;
    }
    return $logins;
}

function count_open_by_ip(array $issues, string $ip): int {
    $count = 0;
    foreach ($issues as $issue) {
        if ($issue['ip'] === $ip && $issue['status'] === 'open') $count++;
    }
    return $count;
}

function next_id(array $issues): int {
    $max = 0;
    foreach ($issues as $issue) {
        if ($issue['id'] > $max) $max = $issue['id'];
    }
    return $max + 1;
}

function is_admin(): bool {
    return isset($_SESSION['admin']) && $_SESSION['admin'] === true;
}

function is_locked_out(array $logins, string $ip, int $max_attempts): bool {
    $count = $logins['attempts'][$ip] ?? 0;
    return $count >= $max_attempts;
}

function h(string $s): string {
    return htmlspecialchars($s, ENT_QUOTES, 'UTF-8');
}

function fmt_date(int $ts): string {
    return date('j.n.Y', $ts);
}

// --- session & routing ---

session_start();
$issues = load_issues($DATA_FILE);
$logins = load_logins($LOGIN_FILE);

$ip = $_SERVER['REMOTE_ADDR'] ?? '0.0.0.0';

// run daily cleanup
$logins_before = $logins;
$logins = cleanup_logins($logins, $MAX_LOGIN_ATTEMPTS);
if ($logins !== $logins_before) save_logins($LOGIN_FILE, $logins);

$locked = is_locked_out($logins, $ip, $MAX_LOGIN_ATTEMPTS);
$action = $_GET['action'] ?? 'list';
$msg = '';
$msg_type = '';

// --- handle POST actions ---

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    if (isset($_POST['action'])) {

        // create issue -- blocked if locked out
        if ($_POST['action'] === 'create') {
            if ($locked) {
                header('Location: ?action=list');
                exit;
            }

            $title = trim($_POST['title'] ?? '');
            $body = trim($_POST['body'] ?? '');
            $category = $_POST['category'] ?? 'Issue';
            $priority = $_POST['priority'] ?? 'medium';

            if (!in_array($category, $CATEGORIES)) $category = 'Issue';
            if (!in_array($priority, $PRIORITIES)) $priority = 'medium';

            if ($title === '') {
                $msg = 'title is required.';
                $msg_type = 'error';
            } elseif (mb_strlen($title) > $MAX_TITLE) {
                $msg = "title too long (max {$MAX_TITLE} chars).";
                $msg_type = 'error';
            } elseif (mb_strlen($body) > $MAX_BODY) {
                $msg = "description too long (max {$MAX_BODY} chars).";
                $msg_type = 'error';
            } elseif (count_open_by_ip($issues, $ip) >= $MAX_OPEN_PER_IP) {
                $msg = "you already have {$MAX_OPEN_PER_IP} open issues. wait for one to be closed.";
                $msg_type = 'error';
            } else {
                $issues[] = [
                    'id' => next_id($issues),
                    'title' => $title,
                    'body' => $body,
                    'category' => $category,
                    'priority' => $priority,
                    'status' => 'open',
                    'ip' => $ip,
                    'created' => time(),
                ];
                save_issues($DATA_FILE, $issues);
                header('Location: ?action=list&created=1');
                exit;
            }
        }

        // admin login -- blocked if locked out
        if ($_POST['action'] === 'login') {
            if ($locked) {
                header('Location: ?action=list');
                exit;
            }

            if (($_POST['password'] ?? '') === $ADMIN_PASSWORD) {
                $_SESSION['admin'] = true;
                if (isset($logins['attempts'][$ip])) {
                    unset($logins['attempts'][$ip]);
                    save_logins($LOGIN_FILE, $logins);
                }
                header('Location: ?action=list');
                exit;
            } else {
                $logins['attempts'][$ip] = ($logins['attempts'][$ip] ?? 0) + 1;
                save_logins($LOGIN_FILE, $logins);

                if ($logins['attempts'][$ip] >= $MAX_LOGIN_ATTEMPTS) {
                    header('Location: ?action=list');
                    exit;
                }

                $remaining = $MAX_LOGIN_ATTEMPTS - $logins['attempts'][$ip];
                $msg = "wrong password. {$remaining} attempt(s) remaining.";
                $msg_type = 'error';
            }
        }

        // admin logout
        if ($_POST['action'] === 'logout') {
            unset($_SESSION['admin']);
            header('Location: ?action=list');
            exit;
        }

        // admin toggle status
        if ($_POST['action'] === 'toggle' && is_admin()) {
            $toggle_id = (int)($_POST['id'] ?? 0);
            foreach ($issues as &$issue) {
                if ($issue['id'] === $toggle_id) {
                    $issue['status'] = $issue['status'] === 'open' ? 'closed' : 'open';
                    break;
                }
            }
            unset($issue);
            save_issues($DATA_FILE, $issues);
            header('Location: ?action=view&id=' . $toggle_id);
            exit;
        }

        // admin edit issue
        if ($_POST['action'] === 'edit' && is_admin()) {
            $edit_id = (int)($_POST['id'] ?? 0);
            $e_title = trim($_POST['title'] ?? '');
            $e_body = trim($_POST['body'] ?? '');
            $e_category = $_POST['category'] ?? 'Issue';
            $e_priority = $_POST['priority'] ?? 'medium';

            if (!in_array($e_category, $CATEGORIES)) $e_category = 'Issue';
            if (!in_array($e_priority, $PRIORITIES)) $e_priority = 'medium';

            if ($e_title === '') {
                $msg = 'title is required.';
                $msg_type = 'error';
            } elseif (mb_strlen($e_title) > $MAX_TITLE) {
                $msg = "title too long (max {$MAX_TITLE} chars).";
                $msg_type = 'error';
            } elseif (mb_strlen($e_body) > $MAX_BODY) {
                $msg = "description too long (max {$MAX_BODY} chars).";
                $msg_type = 'error';
            } else {
                foreach ($issues as &$issue) {
                    if ($issue['id'] === $edit_id) {
                        $issue['title'] = $e_title;
                        $issue['body'] = $e_body;
                        $issue['category'] = $e_category;
                        $issue['priority'] = $e_priority;
                        break;
                    }
                }
                unset($issue);
                save_issues($DATA_FILE, $issues);
                header('Location: ?action=view&id=' . $edit_id . '&edited=1');
                exit;
            }
        }

        // admin delete
        if ($_POST['action'] === 'delete' && is_admin()) {
            $del_id = (int)($_POST['id'] ?? 0);
            $issues = array_values(array_filter($issues, fn($i) => $i['id'] !== $del_id));
            save_issues($DATA_FILE, $issues);
            header('Location: ?action=list&deleted=1');
            exit;
        }

        // admin ban user by ip (via issue)
        if ($_POST['action'] === 'ban' && is_admin()) {
            $ban_id = (int)($_POST['id'] ?? 0);
            $ban_ip = null;
            foreach ($issues as $i) {
                if ($i['id'] === $ban_id) { $ban_ip = $i['ip']; break; }
            }
            if ($ban_ip !== null) {
                // set attempts to the max so cleanup will never remove it
                $logins['attempts'][$ban_ip] = $MAX_LOGIN_ATTEMPTS;
                save_logins($LOGIN_FILE, $logins);
                header('Location: ?action=view&id=' . $ban_id . '&banned=1');
                exit;
            }
        }

        // admin unban user by ip (via issue)
        if ($_POST['action'] === 'unban' && is_admin()) {
            $unban_id = (int)($_POST['id'] ?? 0);
            $unban_ip = null;
            foreach ($issues as $i) {
                if ($i['id'] === $unban_id) { $unban_ip = $i['ip']; break; }
            }
            if ($unban_ip !== null && isset($logins['attempts'][$unban_ip])) {
                unset($logins['attempts'][$unban_ip]);
                save_logins($LOGIN_FILE, $logins);
                header('Location: ?action=view&id=' . $unban_id . '&unbanned=1');
                exit;
            }
        }
    }
}

// --- if locked out, silently force list view ---
if ($locked && !is_admin()) {
    if ($action === 'login' || $action === 'new') {
        header('Location: ?action=list');
        exit;
    }
}

// --- flash messages from redirects ---
if (isset($_GET['created']))  { $msg = 'issue created.';   $msg_type = 'success'; }
if (isset($_GET['deleted']))  { $msg = 'issue deleted.';   $msg_type = 'success'; }
if (isset($_GET['edited']))   { $msg = 'issue updated.';   $msg_type = 'success'; }
if (isset($_GET['banned']))   { $msg = 'user banned.';     $msg_type = 'success'; }
if (isset($_GET['unbanned'])) { $msg = 'user unbanned.';   $msg_type = 'success'; }

// --- filter/sort for list ---
$filter_status = $_GET['status'] ?? 'open';
$filter_category = $_GET['category'] ?? '';

$filtered = array_filter($issues, function($i) use ($filter_status, $filter_category) {
    if ($filter_status && $i['status'] !== $filter_status) return false;
    if ($filter_category && $i['category'] !== $filter_category) return false;
    return true;
});

$priority_order = ['high' => 0, 'medium' => 1, 'low' => 2];
usort($filtered, function($a, $b) use ($priority_order) {
    $sa = $a['status'] === 'open' ? 0 : 1;
    $sb = $b['status'] === 'open' ? 0 : 1;
    if ($sa !== $sb) return $sa - $sb;
    $pa = $priority_order[$a['priority']] ?? 1;
    $pb = $priority_order[$b['priority']] ?? 1;
    if ($pa !== $pb) return $pa - $pb;
    return $b['created'] - $a['created'];
});

// --- view single issue ---
$view_issue = null;
if ($action === 'view') {
    $view_id = (int)($_GET['id'] ?? 0);
    foreach ($issues as $i) {
        if ($i['id'] === $view_id) { $view_issue = $i; break; }
    }
    if (!$view_issue) { $action = 'list'; $msg = 'issue not found.'; $msg_type = 'error'; }
}

$open_count = count(array_filter($issues, fn($i) => $i['status'] === 'open'));
$closed_count = count(array_filter($issues, fn($i) => $i['status'] === 'closed'));
$my_open = count_open_by_ip($issues, $ip);

$ev_title    = $_POST['title']    ?? $view_issue['title']    ?? '';
$ev_body     = $_POST['body']     ?? $view_issue['body']     ?? '';
$ev_category = $_POST['category'] ?? $view_issue['category'] ?? 'Issue';
$ev_priority = $_POST['priority'] ?? $view_issue['priority'] ?? 'medium';

// check if viewed issue's ip is banned
$view_ip_banned = false;
if ($view_issue) {
    $view_ip_banned = is_locked_out($logins, $view_issue['ip'], $MAX_LOGIN_ATTEMPTS);
}

?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>issues</title>
<style>
* {
  margin: 0;
  padding: 0;
  box-sizing: border-box;
}
html, body {
  background: #0a0a0a;
  color: #c0c0c0;
  font-family: "courier new", courier, monospace;
  font-size: 14px;
  line-height: 1.5;
  max-width: 720px;
  margin: 0 auto;
  padding: 20px;
}
h2 {
  font-size: 14px;
  font-weight: normal;
  text-transform: lowercase;
  margin: 1.8em 0 0.6em 0;
  color: #ffffff;
}
p { margin-bottom: 1em; }
a {
  color: #80a0c0;
  text-decoration: none;
}
a:hover { text-decoration: underline; }
code {
  color: #e0e0e0;
  background: #1a1a1a;
  padding: 1px 4px;
}
strong { color: #e0e0e0; }

input[type="text"], textarea, select {
  background: #1a1a1a;
  border: 1px solid #333;
  color: #e0e0e0;
  font-family: "courier new", courier, monospace;
  font-size: 14px;
  padding: 6px 8px;
  width: 100%;
  margin-bottom: 0.8em;
}
textarea {
  resize: vertical;
  min-height: 100px;
}
select {
  width: auto;
  min-width: 120px;
  cursor: pointer;
}
input[type="text"]:focus, textarea:focus, select:focus {
  outline: none;
  border-color: #80a0c0;
}
button, input[type="submit"] {
  background: #1a1a1a;
  border: 1px solid #333;
  color: #80a0c0;
  font-family: "courier new", courier, monospace;
  font-size: 14px;
  padding: 6px 14px;
  cursor: pointer;
}
button:hover, input[type="submit"]:hover {
  border-color: #80a0c0;
  color: #ffffff;
}
label {
  display: block;
  margin-bottom: 0.3em;
  color: #808080;
}
.hint {
  color: #555;
  font-size: 12px;
  margin: -0.5em 0 0.8em 0;
}

.issue-row {
  border-bottom: 1px solid #1a1a1a;
  padding: 0.6em 0;
  display: flex;
  gap: 0.8em;
  align-items: baseline;
}
.issue-row:hover {
  background: #111;
}
.issue-id {
  color: #555;
  min-width: 3em;
}
.issue-title {
  flex: 1;
}
.issue-meta {
  color: #555;
  font-size: 12px;
  white-space: nowrap;
}

.tag {
  display: inline-block;
  padding: 0 5px;
  font-size: 11px;
  margin-right: 4px;
}
.tag-open { color: #5a5; border: 1px solid #3a3; }
.tag-closed { color: #888; border: 1px solid #444; }
.tag-high { color: #c55; border: 1px solid #933; }
.tag-medium { color: #ca5; border: 1px solid #a83; }
.tag-low { color: #888; border: 1px solid #444; }
.tag-category { color: #88a; border: 1px solid #668; }
.tag-banned { color: #c55; border: 1px solid #933; }

.msg {
  padding: 8px 12px;
  margin-bottom: 1em;
  border: 1px solid #333;
}
.msg-error { border-color: #933; color: #c55; }
.msg-success { border-color: #393; color: #5a5; }

.filters {
  margin-bottom: 1em;
  display: flex;
  gap: 0.5em;
  flex-wrap: wrap;
  align-items: center;
}
.filter-link {
  padding: 2px 8px;
  border: 1px solid #333;
  font-size: 12px;
}
.filter-link.active {
  border-color: #80a0c0;
  color: #fff;
}

.issue-body {
  background: #111;
  padding: 12px;
  margin: 1em 0;
  white-space: pre-wrap;
  word-wrap: break-word;
}

.admin-bar {
  display: flex;
  gap: 0.5em;
  margin: 1em 0;
  flex-wrap: wrap;
  align-items: center;
}
.admin-bar form { display: inline; }
.btn-danger { color: #c55; border-color: #933; }
.btn-danger:hover { color: #fff; border-color: #c55; }

.nav {
  margin-bottom: 1.5em;
  display: flex;
  gap: 1em;
  align-items: center;
}

.issue-detail-meta {
  color: #555;
  font-size: 12px;
  margin: 0.5em 0;
}

input[type="password"] {
  background: #1a1a1a;
  border: 1px solid #333;
  color: #e0e0e0;
  font-family: "courier new", courier, monospace;
  font-size: 14px;
  padding: 6px 8px;
  width: 200px;
}
input[type="password"]:focus {
  outline: none;
  border-color: #80a0c0;
}

.footer {
  margin-top: 3em;
  color: #333;
  font-size: 12px;
}
</style>
</head>
<body>

<div class="nav">
  <a href="?action=list"><strong>issues</strong></a>
  <?php if (!$locked): ?>
    <a href="?action=new">new issue</a>
  <?php endif; ?>
  <?php if (is_admin()): ?>
    <form method="post" style="display:inline;margin-left:auto;">
      <input type="hidden" name="action" value="logout">
      <button type="submit" style="border:none;padding:0;color:#555;font-size:12px;">logout</button>
    </form>
  <?php elseif (!$locked): ?>
    <a href="?action=login" style="margin-left:auto;color:#555;font-size:12px;">admin</a>
  <?php endif; ?>
</div>

<?php if ($msg): ?>
  <div class="msg msg-<?= $msg_type ?>"><?= h($msg) ?></div>
<?php endif; ?>

<?php if ($action === 'login' && !is_admin() && !$locked): ?>

  <h2>admin login</h2>
  <form method="post">
    <input type="hidden" name="action" value="login">
    <input type="password" name="password" placeholder="password" autofocus>
    <button type="submit">login</button>
  </form>

<?php elseif ($action === 'new' && !$locked): ?>

  <h2>create new issue</h2>
  <p style="color:#555;font-size:12px;">you have <?= $my_open ?>/<?= $MAX_OPEN_PER_IP ?> open issues.</p>

  <form method="post">
    <input type="hidden" name="action" value="create">

    <label>title</label>
    <input type="text" name="title" maxlength="<?= $MAX_TITLE ?>" required
           value="<?= h($_POST['title'] ?? '') ?>" autofocus>
    <p class="hint">max <?= $MAX_TITLE ?> characters</p>

    <label>category</label>
    <select name="category">
      <?php foreach ($CATEGORIES as $cat): ?>
        <option value="<?= h($cat) ?>" <?= ($_POST['category'] ?? '') === $cat ? 'selected' : '' ?>><?= h(strtolower($cat)) ?></option>
      <?php endforeach; ?>
    </select>

    <label>priority</label>
    <select name="priority">
      <?php foreach ($PRIORITIES as $pri): ?>
        <option value="<?= h($pri) ?>" <?= ($_POST['priority'] ?? 'medium') === $pri ? 'selected' : '' ?>><?= h($pri) ?></option>
      <?php endforeach; ?>
    </select>

    <label>description</label>
    <textarea name="body" maxlength="<?= $MAX_BODY ?>" placeholder="describe the issue..."><?= h($_POST['body'] ?? '') ?></textarea>
    <p class="hint">max <?= number_format($MAX_BODY, 0, ',', '.') ?> characters</p>

    <button type="submit">submit</button>
  </form>

<?php elseif ($action === 'view' && $view_issue): ?>

  <p><a href="?action=list">&larr; back to list</a></p>

  <h2>#<?= $view_issue['id'] ?> — <?= h($view_issue['title']) ?></h2>

  <div>
    <span class="tag tag-<?= $view_issue['status'] ?>"><?= $view_issue['status'] ?></span>
    <span class="tag tag-<?= $view_issue['priority'] ?>"><?= $view_issue['priority'] ?></span>
    <span class="tag tag-category"><?= h(strtolower($view_issue['category'])) ?></span>
  </div>

  <div class="issue-detail-meta">
    opened <?= fmt_date($view_issue['created']) ?>
  </div>

  <?php if ($view_issue['body'] !== ''): ?>
    <div class="issue-body"><?= h($view_issue['body']) ?></div>
  <?php else: ?>
    <div class="issue-body" style="color:#555;">no description provided.</div>
  <?php endif; ?>

  <?php if (is_admin()): ?>
    <h2>edit issue (admin)</h2>
    <form method="post">
      <input type="hidden" name="action" value="edit">
      <input type="hidden" name="id" value="<?= $view_issue['id'] ?>">

      <label>title</label>
      <input type="text" name="title" maxlength="<?= $MAX_TITLE ?>" value="<?= h($ev_title) ?>">
      <p class="hint">max <?= $MAX_TITLE ?> characters</p>

      <label>category</label>
      <select name="category">
        <?php foreach ($CATEGORIES as $cat): ?>
          <option value="<?= h($cat) ?>" <?= $ev_category === $cat ? 'selected' : '' ?>><?= h(strtolower($cat)) ?></option>
        <?php endforeach; ?>
      </select>

      <label>priority</label>
      <select name="priority">
        <?php foreach ($PRIORITIES as $pri): ?>
          <option value="<?= h($pri) ?>" <?= $ev_priority === $pri ? 'selected' : '' ?>><?= h($pri) ?></option>
        <?php endforeach; ?>
      </select>

      <label>description</label>
      <textarea name="body" maxlength="<?= $MAX_BODY ?>"><?= h($ev_body) ?></textarea>
      <p class="hint">max <?= number_format($MAX_BODY, 0, ',', '.') ?> characters</p>

      <button type="submit">save changes</button>
    </form>

    <div class="admin-bar">
      <form method="post">
        <input type="hidden" name="action" value="toggle">
        <input type="hidden" name="id" value="<?= $view_issue['id'] ?>">
        <button type="submit">
          <?= $view_issue['status'] === 'open' ? 'close issue' : 'reopen issue' ?>
        </button>
      </form>

      <form method="post" onsubmit="return confirm('delete this issue?');">
        <input type="hidden" name="action" value="delete">
        <input type="hidden" name="id" value="<?= $view_issue['id'] ?>">
        <button type="submit" class="btn-danger">delete</button>
      </form>

      <?php if ($view_ip_banned): ?>
        <form method="post" onsubmit="return confirm('unban this user (ip <?= h($view_issue['ip']) ?>)?');">
          <input type="hidden" name="action" value="unban">
          <input type="hidden" name="id" value="<?= $view_issue['id'] ?>">
          <button type="submit">unban user</button>
        </form>
        <span class="tag tag-banned">banned</span>
      <?php else: ?>
        <form method="post" onsubmit="return confirm('ban this user (ip <?= h($view_issue['ip']) ?>)? they will no longer be able to create issues or log in as admin.');">
          <input type="hidden" name="action" value="ban">
          <input type="hidden" name="id" value="<?= $view_issue['id'] ?>">
          <button type="submit" class="btn-danger">ban user</button>
        </form>
      <?php endif; ?>

      <span style="color:#555;font-size:12px;margin-left:1em;">ip: <?= h($view_issue['ip']) ?></span>
    </div>
  <?php endif; ?>

<?php else: ?>

  <h2>issue tracker</h2>

  <div class="filters">
    <?php
    $statuses = ['open', 'closed', 'all'];
    foreach ($statuses as $s):
      $is_active = ($filter_status === $s) || ($s === 'all' && $filter_status === '');
      $params = $s === 'all' ? ['status' => ''] : ['status' => $s];
      if ($filter_category) $params['category'] = $filter_category;
    ?>
      <a href="?action=list&<?= http_build_query($params) ?>"
         class="filter-link <?= $is_active ? 'active' : '' ?>">
        <?= $s === 'all' ? 'all' : $s ?>
        <?php if ($s === 'open'): ?>(<?= $open_count ?>)<?php endif; ?>
        <?php if ($s === 'closed'): ?>(<?= $closed_count ?>)<?php endif; ?>
      </a>
    <?php endforeach; ?>

    <span style="color:#333;">|</span>

    <a href="?action=list&status=<?= h($filter_status) ?>"
       class="filter-link <?= $filter_category === '' ? 'active' : '' ?>">all</a>
    <?php foreach ($CATEGORIES as $cat):
      $is_active = $filter_category === $cat;
    ?>
      <a href="?action=list&status=<?= h($filter_status) ?>&category=<?= h($cat) ?>"
         class="filter-link <?= $is_active ? 'active' : '' ?>"><?= h(strtolower($cat)) ?></a>
    <?php endforeach; ?>
  </div>

  <?php if (empty($filtered)): ?>
    <p style="color:#555;">no issues found.</p>
  <?php else: ?>
    <?php foreach ($filtered as $issue): ?>
      <div class="issue-row">
        <span class="issue-id">#<?= $issue['id'] ?></span>
        <span class="issue-title">
          <a href="?action=view&id=<?= $issue['id'] ?>"><?= h($issue['title']) ?></a>
          <span class="tag tag-<?= $issue['status'] ?>"><?= $issue['status'] ?></span>
          <span class="tag tag-<?= $issue['priority'] ?>"><?= $issue['priority'] ?></span>
          <span class="tag tag-category"><?= h(strtolower($issue['category'])) ?></span>
        </span>
        <span class="issue-meta"><?= fmt_date($issue['created']) ?></span>
      </div>
    <?php endforeach; ?>
  <?php endif; ?>

<?php endif; ?>

<div class="footer">
  <?= count($issues) ?> total issues · <a href="https://vextoly.link/unimg/ticket.html">about</a>
</div>

</body>
</html>