{#
SSH & VTY Unified Security Template - Displays comprehensive SSH and VTY line security status

Metadata structure expected:
- ssh_v2_configured: Boolean (CRITICAL prerequisite)
- ssh_config: Dictionary
  - ssh_version_2: Boolean
  - ssh_timeout_configured: Boolean
  - ssh_timeout_value: Integer (seconds)
  - ssh_source_interface: String or None
  - domain_name: String or None
  - rsa_keypair: Boolean
  - kex_algorithms: Boolean
  - ssh_logging: Boolean
  - auth_retries: Integer or None
- vty_security: Dictionary
  - total_lines: Integer
  - ssh_only_count: Integer
  - timeout_count: Integer
  - acl_count: Integer
  - telnet_count: Integer
  - timeout_reasonable_count: Integer
  - ssh_percentage: Float
  - timeout_percentage: Float
  - acl_percentage: Float
  - vty_lines: List of VTY line dicts
  - applicable: Boolean
- advanced_security: Dictionary
  - strong_ciphers: Boolean
  - strong_macs: Boolean
  - strong_kex: Boolean
- score_details: Dictionary
  - ssh_score: Integer (0-17)
  - vty_transport_score: Integer (0-9)
  - vty_timeout_score: Integer (0-6)
  - vty_acl_score: Integer (0-5)
  - vty_timeout_valid_score: Integer (0-2)
  - vty_no_telnet_score: Integer (0-1)
  - advanced_score: Integer (0-5 bonus)
  - base_score: Integer (0-40)
  - bonus_score: Integer (0-5)
  - total_score: Integer (0-45)
  - issues: List of strings
- achieved_score: Integer
- base_score: Integer
- bonus_score: Integer
- percentage: Float
#}

<div class="check-detail">
    <h4>SSH & VTY Comprehensive Security Status</h4>

    {% if not metadata.ssh_v2_configured %}
    {# ==================== SSHv2 PREREQUISITE FAILURE ==================== #}
    <div class="critical-section critical-prerequisite-failure">
        <h5><span class="status-icon fail">✗</span> CRITICAL PREREQUISITE FAILURE</h5>
        <p class="critical-title">
            ❌ SSHv2 is NOT configured globally on this device
        </p>
        <p style="margin: 15px 0;">
            The command <code class="critical-command">ip ssh version 2</code>
            is <strong>MANDATORY</strong> for SSH and VTY security.
        </p>
        <div class="alert-box alert-danger">
            <p><strong>Why This is Critical:</strong></p>
            <ul>
                <li>VTY lines may accept SSHv1 connections (cryptographically weak)</li>
                <li>SSHv1 has known vulnerabilities (man-in-the-middle, encryption weaknesses)</li>
                <li>Violates DISA STIG V-215818 security requirement</li>
                <li>Non-compliant with CIS Benchmark and modern security standards</li>
                <li>Exposes device to unauthorized access attempts</li>
            </ul>
        </div>
        <div class="alert-box alert-warning">
            <p><strong>Required Action:</strong></p>
            <pre><code>configure terminal
ip ssh version 2
end
write memory</code></pre>
        </div>
        <p class="critical-score-warning">
            ⚠️ This check scores <span class="critical-score-value">0/45 points</span> until SSHv2 is properly configured.
        </p>
        <p style="font-style: italic; color: #666; margin-top: 10px;">
            No SSH or VTY security can be validated without this critical prerequisite.
        </p>
    </div>

    {# Do not display other sections if SSHv2 prerequisite fails #}
    {% else %}

    {# ==================== OVERALL SCORE DASHBOARD ==================== #}
    <div class="summary-stats">
        <p><strong>Overall Score:</strong>
            <span class="{% if metadata.percentage >= 90 %}pass-status{% elif metadata.percentage >= 70 %}partial-status{% else %}fail-status{% endif %}">
                {{ metadata.achieved_score }}/40 base points ({{ metadata.percentage }}%)
            </span>
            {% if metadata.bonus_score > 0 %}
                <span class="bonus-indicator"> + {{ metadata.bonus_score }}/5 bonus</span>
            {% endif %}
        </p>
        <p><strong>Score Breakdown:</strong>
            <span class="info-status">
                SSH: {{ metadata.score_details.ssh_score }}/17 pts |
                VTY: {{ metadata.score_details.vty_transport_score + metadata.score_details.vty_timeout_score + metadata.score_details.vty_acl_score + metadata.score_details.vty_timeout_valid_score + metadata.score_details.vty_no_telnet_score }}/23 pts |
                Advanced: {{ metadata.score_details.advanced_score }}/5 pts
            </span>
        </p>
        <p><strong>Issues Found:</strong>
            <span class="{% if metadata.score_details.issues|length == 0 %}pass-status{% elif metadata.score_details.issues|length <= 3 %}partial-status{% else %}fail-status{% endif %}">
                {{ metadata.score_details.issues|length }}
            </span>
        </p>
    </div>

    {# ==================== CORE SSH CONFIGURATION (17 points) ==================== #}
    <details class="collapsible-section" open>
        <summary><h5>Core SSH Configuration ({{ metadata.score_details.ssh_score }}/17 points)</h5></summary>

        <table class="detail-table">
            <thead>
                <tr>
                    <th>Feature</th>
                    <th>Points</th>
                    <th>Status</th>
                    <th>Value/Details</th>
                </tr>
            </thead>
            <tbody>
                <tr class="pass-row">
                    <td><strong>SSHv2 Configured</strong></td>
                    <td class="centered">5</td>
                    <td class="centered">
                        <span class="status-icon pass">✓</span>
                    </td>
                    <td>
                        <span class="pass-status">SSHv2 Enabled (Prerequisite Met)</span>
                    </td>
                </tr>
                <tr class="{% if metadata.ssh_config.ssh_timeout_configured and metadata.ssh_config.ssh_timeout_value and metadata.ssh_config.ssh_timeout_value <= 120 %}pass-row{% elif metadata.ssh_config.ssh_timeout_configured %}warn-row{% else %}fail-row{% endif %}">
                    <td><strong>SSH Timeout</strong></td>
                    <td class="centered">2</td>
                    <td class="centered">
                        {% if metadata.ssh_config.ssh_timeout_configured %}
                            {% if metadata.ssh_config.ssh_timeout_value and metadata.ssh_config.ssh_timeout_value <= 120 %}
                                <span class="status-icon pass">✓</span>
                            {% else %}
                                <span class="status-icon warn">⚠</span>
                            {% endif %}
                        {% else %}
                            <span class="status-icon fail">✗</span>
                        {% endif %}
                    </td>
                    <td>
                        {% if metadata.ssh_config.ssh_timeout_configured %}
                            {{ metadata.ssh_config.ssh_timeout_value }} seconds
                            {% if metadata.ssh_config.ssh_timeout_value > 120 %}
                                <span class="fail-status">(Too high - recommend ≤120s)</span>
                            {% endif %}
                        {% else %}
                            <span class="fail-status">Not configured</span>
                        {% endif %}
                    </td>
                </tr>
                <tr class="{% if metadata.ssh_config.ssh_source_interface %}pass-row{% else %}warn-row{% endif %}">
                    <td><strong>Source Interface</strong></td>
                    <td class="centered">2</td>
                    <td class="centered">
                        {% if metadata.ssh_config.ssh_source_interface %}
                            <span class="status-icon pass">✓</span>
                        {% else %}
                            <span class="status-icon fail">✗</span>
                        {% endif %}
                    </td>
                    <td>
                        {% if metadata.ssh_config.ssh_source_interface %}
                            <code>{{ metadata.ssh_config.ssh_source_interface }}</code>
                        {% else %}
                            <span class="fail-status">Not configured</span>
                        {% endif %}
                    </td>
                </tr>
                <tr class="{% if metadata.ssh_config.domain_name %}pass-row{% else %}fail-row{% endif %}">
                    <td><strong>Domain Name</strong></td>
                    <td class="centered">1</td>
                    <td class="centered">
                        {% if metadata.ssh_config.domain_name %}
                            <span class="status-icon pass">✓</span>
                        {% else %}
                            <span class="status-icon fail">✗</span>
                        {% endif %}
                    </td>
                    <td>
                        {% if metadata.ssh_config.domain_name %}
                            <code>{{ metadata.ssh_config.domain_name }}</code>
                        {% else %}
                            <span class="fail-status">Not configured (required for RSA keys)</span>
                        {% endif %}
                    </td>
                </tr>
                <tr class="{% if metadata.ssh_config.rsa_keypair %}pass-row{% else %}fail-row{% endif %}">
                    <td><strong>RSA Keypair</strong></td>
                    <td class="centered">2</td>
                    <td class="centered">
                        {% if metadata.ssh_config.rsa_keypair %}
                            <span class="status-icon pass">✓</span>
                        {% else %}
                            <span class="status-icon fail">✗</span>
                        {% endif %}
                    </td>
                    <td>
                        {% if metadata.ssh_config.rsa_keypair %}
                            <span class="pass-status">Configured</span>
                        {% else %}
                            <span class="fail-status">Not found</span>
                        {% endif %}
                    </td>
                </tr>
                <tr class="{% if metadata.ssh_config.kex_algorithms %}pass-row{% else %}warn-row{% endif %}">
                    <td><strong>KEX Algorithms</strong></td>
                    <td class="centered">2</td>
                    <td class="centered">
                        {% if metadata.ssh_config.kex_algorithms %}
                            <span class="status-icon pass">✓</span>
                        {% else %}
                            <span class="status-icon fail">✗</span>
                        {% endif %}
                    </td>
                    <td>
                        {% if metadata.ssh_config.kex_algorithms %}
                            <span class="pass-status">Configured</span>
                        {% else %}
                            <span class="fail-status">Not configured</span>
                        {% endif %}
                    </td>
                </tr>
                <tr class="{% if metadata.ssh_config.ssh_logging %}pass-row{% else %}warn-row{% endif %}">
                    <td><strong>SSH Logging</strong></td>
                    <td class="centered">2</td>
                    <td class="centered">
                        {% if metadata.ssh_config.ssh_logging %}
                            <span class="status-icon pass">✓</span>
                        {% else %}
                            <span class="status-icon fail">✗</span>
                        {% endif %}
                    </td>
                    <td>
                        {% if metadata.ssh_config.ssh_logging %}
                            <span class="pass-status">Enabled</span>
                        {% else %}
                            <span class="fail-status">Not enabled</span>
                        {% endif %}
                    </td>
                </tr>
                <tr class="{% if metadata.ssh_config.auth_retries and metadata.ssh_config.auth_retries <= 3 %}pass-row{% else %}warn-row{% endif %}">
                    <td><strong>Authentication Retries</strong></td>
                    <td class="centered">1</td>
                    <td class="centered">
                        {% if metadata.ssh_config.auth_retries and metadata.ssh_config.auth_retries <= 3 %}
                            <span class="status-icon pass">✓</span>
                        {% else %}
                            <span class="status-icon warn">⚠</span>
                        {% endif %}
                    </td>
                    <td>
                        {% if metadata.ssh_config.auth_retries %}
                            {{ metadata.ssh_config.auth_retries }} attempts
                            {% if metadata.ssh_config.auth_retries > 3 %}
                                <span class="fail-status">(Recommend ≤3)</span>
                            {% endif %}
                        {% else %}
                            <span class="fail-status">Not configured</span>
                        {% endif %}
                    </td>
                </tr>
            </tbody>
        </table>
    </details>

    {# ==================== VTY LINE SECURITY (23 points) ==================== #}
    {% if metadata.vty_security.applicable and metadata.vty_security.total_lines > 0 %}
    <details class="collapsible-section" open>
        <summary><h5>VTY Line Security ({{ metadata.score_details.vty_transport_score + metadata.score_details.vty_timeout_score + metadata.score_details.vty_acl_score + metadata.score_details.vty_timeout_valid_score + metadata.score_details.vty_no_telnet_score }}/23 points)</h5></summary>

        <p><strong>VTY Lines Detected:</strong> <span class="info-status">{{ metadata.vty_security.total_lines }}</span></p>

        <h6>Weighted Scoring Breakdown</h6>
        <table class="detail-table">
            <thead>
                <tr>
                    <th>Criterion</th>
                    <th>Weight</th>
                    <th>Score</th>
                    <th>Compliance</th>
                </tr>
            </thead>
            <tbody>
                <tr class="{% if metadata.score_details.vty_transport_score == 9 %}pass-row{% elif metadata.score_details.vty_transport_score >= 4 %}warn-row{% else %}fail-row{% endif %}">
                    <td><strong>SSH-Only Transport</strong></td>
                    <td>9 points</td>
                    <td class="centered">{{ metadata.score_details.vty_transport_score }}/9</td>
                    <td>{{ metadata.vty_security.ssh_only_count }}/{{ metadata.vty_security.total_lines }} lines ({{ metadata.vty_security.ssh_percentage }}%)</td>
                </tr>
                <tr class="{% if metadata.score_details.vty_timeout_score == 6 %}pass-row{% elif metadata.score_details.vty_timeout_score >= 3 %}warn-row{% else %}fail-row{% endif %}">
                    <td><strong>Exec-Timeout Configured</strong></td>
                    <td>6 points</td>
                    <td class="centered">{{ metadata.score_details.vty_timeout_score }}/6</td>
                    <td>{{ metadata.vty_security.timeout_count }}/{{ metadata.vty_security.total_lines }} lines ({{ metadata.vty_security.timeout_percentage }}%)</td>
                </tr>
                <tr class="{% if metadata.score_details.vty_acl_score == 5 %}pass-row{% elif metadata.score_details.vty_acl_score >= 2 %}warn-row{% else %}fail-row{% endif %}">
                    <td><strong>Access-Class ACL</strong></td>
                    <td>5 points</td>
                    <td class="centered">{{ metadata.score_details.vty_acl_score }}/5</td>
                    <td>{{ metadata.vty_security.acl_count }}/{{ metadata.vty_security.total_lines }} lines ({{ metadata.vty_security.acl_percentage }}%)</td>
                </tr>
                <tr class="{% if metadata.score_details.vty_timeout_valid_score == 2 %}pass-row{% elif metadata.score_details.vty_timeout_valid_score == 1 %}warn-row{% else %}fail-row{% endif %}">
                    <td><strong>Timeout Validation (≤10 min)</strong></td>
                    <td>2 points</td>
                    <td class="centered">{{ metadata.score_details.vty_timeout_valid_score }}/2</td>
                    <td>
                        {% if metadata.vty_security.timeout_count > 0 %}
                            {{ metadata.vty_security.timeout_reasonable_count }}/{{ metadata.vty_security.timeout_count }} within limit
                        {% else %}
                            N/A
                        {% endif %}
                    </td>
                </tr>
                <tr class="{% if metadata.score_details.vty_no_telnet_score == 1 %}pass-row{% else %}fail-row{% endif %}">
                    <td><strong>No Telnet Access</strong></td>
                    <td>1 point</td>
                    <td class="centered">{{ metadata.score_details.vty_no_telnet_score }}/1</td>
                    <td>
                        {% if metadata.vty_security.telnet_count == 0 %}
                            <span class="pass-status">No telnet detected</span>
                        {% else %}
                            <span class="fail-status">{{ metadata.vty_security.telnet_count }} lines allow telnet</span>
                        {% endif %}
                    </td>
                </tr>
            </tbody>
        </table>

        {% if metadata.vty_security.vty_lines %}
        <h6>Per-VTY Line Details</h6>
        <table class="detail-table">
            <thead>
                <tr>
                    <th>VTY Line</th>
                    <th>Transport</th>
                    <th>Timeout</th>
                    <th>ACL</th>
                    <th>Compliant</th>
                </tr>
            </thead>
            <tbody>
                {% for vty in metadata.vty_security.vty_lines %}
                <tr class="{% if vty.compliant %}pass-row{% elif vty.ssh_only %}warn-row{% else %}fail-row{% endif %}">
                    <td><code>{{ vty.name }}</code></td>
                    <td class="centered">
                        {% if vty.ssh_only %}
                            <span class="status-icon pass">✓</span> SSH
                        {% elif vty.has_telnet %}
                            <span class="status-icon fail">✗</span> {{ vty.transport }}
                        {% else %}
                            <span class="status-icon fail">✗</span> Unknown
                        {% endif %}
                    </td>
                    <td class="centered">
                        {% if vty.has_timeout %}
                            <span class="status-icon pass">✓</span> {{ vty.timeout_minutes }} min
                            {% if not vty.timeout_reasonable %}
                                <span class="fail-status">(>10)</span>
                            {% endif %}
                        {% else %}
                            <span class="status-icon fail">✗</span> None
                        {% endif %}
                    </td>
                    <td>
                        {% if vty.has_acl %}
                            <code>{{ vty.acl_name }}</code>
                        {% else %}
                            <span class="fail-status">None</span>
                        {% endif %}
                    </td>
                    <td class="centered">
                        {% if vty.compliant %}
                            <span class="status-icon pass">✓</span>
                        {% else %}
                            <span class="status-icon fail">✗</span>
                        {% endif %}
                    </td>
                </tr>
                {% endfor %}
            </tbody>
        </table>
        {% endif %}
    </details>
    {% else %}
    <details class="collapsible-section">
        <summary><h5>VTY Line Security (NOT APPLICABLE)</h5></summary>
        <p class="info-status">No VTY lines detected in configuration. VTY security checks not applicable.</p>
    </details>
    {% endif %}

    {# ==================== ADVANCED SECURITY (5 bonus points) ==================== #}
    <details class="collapsible-section">
        <summary><h5>Advanced Security - BONUS ({{ metadata.score_details.advanced_score }}/5 points)</h5></summary>

        <p style="margin-bottom: 15px; color: #856404; font-style: italic;">
            These are optional security enhancements that provide bonus points. They encourage best practices without penalizing basic compliance.
        </p>

        <table class="detail-table">
            <thead>
                <tr>
                    <th>Feature</th>
                    <th>Bonus Points</th>
                    <th>Status</th>
                    <th>Details</th>
                </tr>
            </thead>
            <tbody>
                <tr class="{% if metadata.advanced_security.strong_ciphers %}pass-row{% else %}warn-row{% endif %}">
                    <td><strong>Strong Ciphers</strong></td>
                    <td class="centered">2</td>
                    <td class="centered">
                        {% if metadata.advanced_security.strong_ciphers %}
                            <span class="status-icon pass">✓</span>
                        {% else %}
                            <span class="status-icon warn">⚠</span>
                        {% endif %}
                    </td>
                    <td>
                        {% if metadata.advanced_security.strong_ciphers %}
                            <span class="pass-status">Configured</span>
                        {% else %}
                            <span class="fail-status">Not configured (optional)</span>
                        {% endif %}
                    </td>
                </tr>
                <tr class="{% if metadata.advanced_security.strong_macs %}pass-row{% else %}warn-row{% endif %}">
                    <td><strong>Strong MACs</strong></td>
                    <td class="centered">2</td>
                    <td class="centered">
                        {% if metadata.advanced_security.strong_macs %}
                            <span class="status-icon pass">✓</span>
                        {% else %}
                            <span class="status-icon warn">⚠</span>
                        {% endif %}
                    </td>
                    <td>
                        {% if metadata.advanced_security.strong_macs %}
                            <span class="pass-status">Configured</span>
                        {% else %}
                            <span class="fail-status">Not configured (optional)</span>
                        {% endif %}
                    </td>
                </tr>
                <tr class="{% if metadata.advanced_security.strong_kex %}pass-row{% else %}warn-row{% endif %}">
                    <td><strong>Strong KEX Algorithms</strong></td>
                    <td class="centered">1</td>
                    <td class="centered">
                        {% if metadata.advanced_security.strong_kex %}
                            <span class="status-icon pass">✓</span>
                        {% else %}
                            <span class="status-icon warn">⚠</span>
                        {% endif %}
                    </td>
                    <td>
                        {% if metadata.advanced_security.strong_kex %}
                            <span class="pass-status">Configured</span>
                        {% else %}
                            <span class="fail-status">Not configured (optional)</span>
                        {% endif %}
                    </td>
                </tr>
            </tbody>
        </table>

        <div class="info-box" style="margin-top: 15px;">
            <h6>About Advanced Security Features:</h6>
            <p><strong>Strong Ciphers:</strong> Configure AES-128-CTR, AES-192-CTR, AES-256-CTR for encryption</p>
            <p><strong>Strong MACs:</strong> Configure HMAC-SHA2-256, HMAC-SHA2-512 for message authentication</p>
            <p><strong>Strong KEX:</strong> Configure Diffie-Hellman Group 14/16 or ECDH for key exchange</p>
        </div>
    </details>

    {# ==================== ISSUES SUMMARY ==================== #}
    {% if metadata.score_details.issues %}
    <div class="critical-section">
        <h5><span class="status-icon fail">✗</span> Issues Found ({{ metadata.score_details.issues|length }})</h5>
        <ul class="issue-list">
            {% for issue in metadata.score_details.issues %}
            <li>{{ issue }}</li>
            {% endfor %}
        </ul>
    </div>
    {% endif %}

    {# ==================== CONFIGURATION RECOMMENDATIONS ==================== #}
    <div class="recommendation-box">
        <h5>Configuration Recommendations:</h5>
        <h6>Core SSH Configuration:</h6>
        <ul>
            <li><strong>SSHv2:</strong> <code>ip ssh version 2</code> (MANDATORY - disables SSHv1)</li>
            <li><strong>SSH Timeout:</strong> <code>ip ssh time-out 60</code> (60-120 seconds recommended)</li>
            <li><strong>Source Interface:</strong> <code>ip ssh source-interface Loopback0</code> (consistency)</li>
            <li><strong>Domain Name:</strong> <code>ip domain-name yourdomain.com</code> (required for RSA keys)</li>
            <li><strong>Generate RSA Keys:</strong> <code>crypto key generate rsa modulus 2048</code> (2048-bit minimum)</li>
            <li><strong>KEX Algorithms:</strong> <code>ip ssh server algorithm key-exchange group14-sha1</code> (IOS-XE 16.3+)</li>
            <li><strong>SSH Logging:</strong> <code>ip ssh logging events</code> (audit trail)</li>
            <li><strong>Auth Retries:</strong> <code>ip ssh authentication-retries 3</code> (limit brute force)</li>
        </ul>
        <h6>VTY Line Configuration:</h6>
        <ul>
            <li><strong>SSH Only:</strong> <code>transport input ssh</code> under all <code>line vty</code> configurations</li>
            <li><strong>VTY Timeout:</strong> <code>exec-timeout 10 0</code> under all VTY lines (10 minutes recommended)</li>
            <li><strong>VTY ACL:</strong> <code>access-class &lt;acl-name&gt; in</code> to restrict source IPs</li>
            <li><strong>Remove Telnet:</strong> Ensure no <code>transport input telnet</code> or <code>transport input all</code></li>
        </ul>
        <h6>Advanced Security (Bonus):</h6>
        <ul>
            <li><strong>Strong Ciphers:</strong> <code>ip ssh server algorithm encryption aes128-ctr aes192-ctr aes256-ctr</code></li>
            <li><strong>Strong MACs:</strong> <code>ip ssh server algorithm mac hmac-sha2-256 hmac-sha2-512</code></li>
            <li><strong>Strong KEX:</strong> <code>ip ssh server algorithm key-exchange diffie-hellman-group14-sha1</code></li>
        </ul>
    </div>

    {# ==================== SECURITY BEST PRACTICES ==================== #}
    <div class="info-box">
        <h5>SSH & VTY Security Best Practices:</h5>
        <ul>
            <li><strong>SSHv2 Only:</strong> SSHv1 has known vulnerabilities - always use version 2</li>
            <li><strong>Timeouts:</strong> Short SSH timeouts (60-120s) and VTY exec-timeouts (≤10 min) reduce exposure</li>
            <li><strong>Source Interface:</strong> Use Loopback0 for predictable source IP address</li>
            <li><strong>Key Size:</strong> Minimum 2048-bit RSA keys (4096-bit for high security environments)</li>
            <li><strong>VTY Protection:</strong> Always restrict VTY access with ACLs limiting source networks</li>
            <li><strong>Transport Security:</strong> Never use telnet - SSH encryption is mandatory</li>
            <li><strong>Strong Algorithms:</strong> Configure strong ciphers, MACs, and KEX (IOS-XE 16.3+)</li>
            <li><strong>Logging:</strong> Enable SSH logging for audit trails and forensics</li>
            <li><strong>STIG Compliance:</strong> V-215818 (SSHv2), V-215819 (VTY SSH), V-215820 (Timeout), V-215822 (VTY Timeout)</li>
            <li><strong>CIS Benchmark:</strong> 2.1.1 (SSH Configuration), 2.3.1 (VTY Access Control)</li>
        </ul>
    </div>

    {% endif %}{# End of ssh_v2_configured check #}
</div>

{# ==================== STYLES ==================== #}
<style>
/* Summary Stats */
.summary-stats {
    background-color: #f8f9fa;
    padding: 15px;
    border-radius: 5px;
    margin: 15px 0;
}

.summary-stats p {
    margin: 5px 0;
}

.bonus-indicator {
    color: #28a745;
    font-weight: 600;
    font-size: 0.95em;
}

/* Detail Tables */
.detail-table {
    width: 100%;
    border-collapse: collapse;
    margin: 15px 0;
}

.detail-table th,
.detail-table td {
    padding: 10px;
    text-align: left;
    border: 1px solid #dee2e6;
}

.detail-table th {
    background-color: #1e3a8a;
    color: white;
    font-weight: 600;
}

.detail-table td.centered {
    text-align: center;
}

/* Row Colors */
.pass-row {
    background-color: #d4edda;
}

.fail-row {
    background-color: #f8d7da;
}

.warn-row {
    background-color: #fff3cd;
}

/* Status Icons */
.status-icon {
    font-weight: bold;
    font-size: 1.2em;
}

.status-icon.pass {
    color: #28a745;
}

.status-icon.fail {
    color: #dc3545;
}

.status-icon.warn {
    color: #ffc107;
}

/* Status Text */
.pass-status {
    color: #28a745;
    font-weight: 600;
}

.fail-status {
    color: #dc3545;
    font-weight: 600;
}

.partial-status {
    color: #ffc107;
    font-weight: 600;
}

.info-status {
    color: #0c5460;
    font-weight: 600;
}

/* Collapsible Sections */
.collapsible-section {
    border: 1px solid #dee2e6;
    border-radius: 5px;
    padding: 15px;
    margin: 20px 0;
}

.collapsible-section summary {
    cursor: pointer;
    font-weight: 600;
    color: #1e3a8a;
}

.collapsible-section summary:hover {
    color: #3b82f6;
}

/* Critical Sections */
.critical-section {
    background-color: #fff5f5;
    border: 2px solid #dc3545;
    border-radius: 5px;
    padding: 15px;
    margin: 20px 0;
}

.critical-section h5 {
    color: #721c24;
    margin-top: 0;
}

.critical-prerequisite-failure {
    border: 3px solid #dc3545;
    background-color: #ffe6e6;
}

.critical-title {
    color: #721c24;
    font-weight: 600;
    font-size: 1.2em;
}

.critical-command {
    background-color: #f8f9fa;
    padding: 3px 8px;
    border-radius: 3px;
    color: #dc3545;
    font-weight: 600;
    font-family: 'Courier New', monospace;
}

.critical-score-warning {
    color: #721c24;
    font-weight: 600;
    margin-top: 15px;
    font-size: 1.05em;
}

.critical-score-value {
    font-size: 1.3em;
    color: #dc3545;
    font-weight: 700;
}

/* Alert Boxes */
.alert-box {
    padding: 12px;
    border-left: 3px solid;
    margin: 15px 0;
    border-radius: 3px;
}

.alert-danger {
    background-color: #fff5f5;
    border-color: #dc3545;
}

.alert-danger strong {
    color: #721c24;
}

.alert-danger ul {
    margin: 5px 0;
    padding-left: 20px;
    color: #721c24;
}

.alert-warning {
    background-color: #fffacd;
    border-color: #ffc107;
}

.alert-warning strong {
    color: #856404;
}

.alert-warning pre {
    background-color: #f8f9fa;
    padding: 10px;
    border-radius: 5px;
    margin: 10px 0;
}

/* Issue Lists */
.issue-list {
    margin: 10px 0 0 20px;
    padding: 0;
}

.issue-list li {
    margin: 8px 0;
    color: #721c24;
}

/* Recommendation Box */
.recommendation-box {
    background-color: #fff3cd;
    border-left: 4px solid #ffc107;
    padding: 15px;
    margin: 15px 0;
    border-radius: 5px;
}

.recommendation-box h5, .recommendation-box h6 {
    margin-top: 10px;
    margin-bottom: 8px;
    color: #856404;
}

.recommendation-box ul {
    margin: 10px 0 0 0;
    padding-left: 20px;
}

.recommendation-box li {
    margin: 8px 0;
}

.recommendation-box code {
    background-color: #f8f9fa;
    padding: 2px 6px;
    border-radius: 3px;
    font-family: 'Courier New', monospace;
}

/* Info Box */
.info-box {
    background-color: #d1ecf1;
    border-left: 4px solid #0c5460;
    padding: 15px;
    margin: 15px 0;
    border-radius: 5px;
}

.info-box h5, .info-box h6 {
    margin-top: 10px;
    margin-bottom: 8px;
    color: #0c5460;
}

.info-box ul {
    margin: 10px 0 0 0;
    padding-left: 20px;
}

.info-box li {
    margin: 8px 0;
}

.info-box p {
    margin: 8px 0;
}

/* Headers */
h4, h5, h6 {
    color: #1e3a8a;
}

h5 {
    margin-top: 20px;
}

h6 {
    margin-top: 15px;
    font-size: 1.05em;
}
</style>
