IPBanGUI.ps1

param(
    [switch]$tray,
    [switch]$minimized,
    [switch]$show
)

# ==============================================================================
# IPBan Manager & Control Center (GUI)
# Повнофункціональний графічний інтерфейс для керування DigitalRuby IPBan Free
# ==============================================================================

Add-Type -AssemblyName System.Windows.Forms
Add-Type -AssemblyName System.Drawing
Add-Type -AssemblyName System.IO.Compression.FileSystem

[System.Windows.Forms.Application]::EnableVisualStyles()

# ------------------------------------------------------------------------------
# Захист від автозапуску в сторонніх сесіях:
# Видаляємо застарілий глобальний автозапуск із HKLM (залишаємо тільки в HKCU користувача)
# ------------------------------------------------------------------------------
try {
    $hklmRun = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
    if (Test-Path $hklmRun) {
        Remove-ItemProperty -Path $hklmRun -Name "IPBanControlCenter" -ErrorAction SilentlyContinue
    }
} catch {}

# ------------------------------------------------------------------------------
# Захист від повторного запуску (Single Instance):
# Якщо програма вже відкрита — активуємо вікно та тихо виходимо
# ------------------------------------------------------------------------------
$script:AppMutex = $null
$mutexCreated = $false
try {
    $script:AppMutex = New-Object System.Threading.Mutex($true, "Local\IPBanGUI_ControlCenter_Instance", [ref]$mutexCreated)
    if (-not $mutexCreated) {
        try {
            $user32 = Add-Type -MemberDefinition @'
[DllImport("user32.dll")] public static extern bool SetForegroundWindow(IntPtr hWnd);
[DllImport("user32.dll")] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow);
'@ -Name "User32SingleInstance" -Namespace "Win32" -PassThru -ErrorAction SilentlyContinue
            if ($user32) {
                # 1. Відновлення за збереженим хендлом з реєстру (активує навіть якщо вікно сховане у трей)
                try {
                    $regU = "HKCU:\SOFTWARE\IPBanControlCenter"
                    if (Test-Path $regU) {
                        $hVal = (Get-ItemProperty -Path $regU -Name "WindowHandle" -ErrorAction SilentlyContinue).WindowHandle
                        if ($hVal) {
                            $savedH = [IntPtr]$hVal
                            [Win32.User32SingleInstance]::ShowWindow($savedH, 9) | Out-Null
                            [Win32.User32SingleInstance]::SetForegroundWindow($savedH) | Out-Null
                        }
                    }
                } catch {}

                Get-Process | Where-Object { $_.MainWindowTitle -like "IPBan*Control Center*" -and $_.Id -ne $PID } | ForEach-Object {
                    [Win32.User32SingleInstance]::ShowWindow($_.MainWindowHandle, 9)
                    [Win32.User32SingleInstance]::SetForegroundWindow($_.MainWindowHandle)
                }
            }
        } catch {}
        exit 0
    }
} catch {}

# ------------------------------------------------------------------------------
# Глобальні змінні та стан
# ------------------------------------------------------------------------------
$script:AppVersion = "v2.2.5"
$script:DefaultInstallPath = "C:\Program Files\IPBan"
$script:CurrentInstallPath = $script:DefaultInstallPath
$script:ServiceName = "IPBan"
$script:LocalZipBackup = $null
$script:AppContext = $null

# Визначення режиму запуску (у системний трей за замовчуванням чи у вікно)
$regStartInTray = 1
try {
    $regU = "HKCU:\SOFTWARE\IPBanControlCenter"
    if (Test-Path $regU) {
        $val = (Get-ItemProperty -Path $regU -Name "StartInTray" -ErrorAction SilentlyContinue).StartInTray
        if ($null -ne $val) { $regStartInTray = [int]$val }
    }
} catch {}
$script:StartInTray = ($tray -or $minimized -or ($regStartInTray -ne 0)) -and (-not $show)
$script:IsAdmin = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
$script:AutoRefreshTimer = $null
$script:LastBannedIPs = @()
$script:TrayIcon = $null
$script:TrayMenu = $null
$script:CurrentTrayState = ""
$script:PreviousBannedCount = -1
$script:AlertActive = $false
$script:AlertResetTimer = $null
$script:TrayMonitorTimer = $null
$script:IsExiting = $false
$script:ManualBanTimes = @{}
$script:CurrentBanTimeSetting = "01:00:00:00"
$script:ReportedAbuseIPs = New-Object 'System.Collections.Generic.HashSet[string]'

function Send-AbuseIPDBReport([string]$ip, [string]$comment = "Brute-force attack detected by IPBan") {
    try {
        $regAbuse = "HKCU:\SOFTWARE\IPBanControlCenter\AbuseIPDB"
        if (-not (Test-Path $regAbuse)) { return }
        $p = Get-ItemProperty -Path $regAbuse -ErrorAction SilentlyContinue
        if (-not $p -or [int]$p.AutoReport -ne 1 -or [string]::IsNullOrWhiteSpace($p.ApiKey)) { return }
        if (-not $ip -or $script:ReportedAbuseIPs.Contains($ip)) { return }

        [void]$script:ReportedAbuseIPs.Add($ip)

        [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 -bor [System.Net.SecurityProtocolType]::Tls13
        $headers = @{
            "Key" = $p.ApiKey.Trim()
            "Accept" = "application/json"
        }
        $body = @{
            ip = $ip
            categories = "18,22" # 18: Brute-Force, 22: SSH/RDP/Server exploit
            comment = $comment
        }
        Invoke-RestMethod -Uri "https://api.abuseipdb.com/api/v2/report" -Method Post -Headers $headers -Body $body -TimeoutSec 10 -ErrorAction SilentlyContinue | Out-Null
    } catch {}
}

# Підтримка читання бази ipban.sqlite через вбудований у Windows winsqlite3.dll
$script:HasWinSqlite = (Test-Path "$env:windir\System32\winsqlite3.dll")
if ($script:HasWinSqlite -and -not ([System.Management.Automation.PSTypeName]'IPBanSqlite').Type) {
    try {
        $csSqlite = @'
using System;
using System.Runtime.InteropServices;
using System.Collections.Generic;

public class IPBanSqlite {
    [DllImport("winsqlite3.dll", EntryPoint = "sqlite3_open16", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Cdecl)]
    private static extern int sqlite3_open16(string filename, out IntPtr db);

    [DllImport("winsqlite3.dll", EntryPoint = "sqlite3_prepare16_v2", CharSet = CharSet.Unicode, CallingConvention = CallingConvention.Cdecl)]
    private static extern int sqlite3_prepare16_v2(IntPtr db, string zSql, int nByte, out IntPtr ppStmt, IntPtr pzTail);

    [DllImport("winsqlite3.dll", EntryPoint = "sqlite3_step", CallingConvention = CallingConvention.Cdecl)]
    private static extern int sqlite3_step(IntPtr pStmt);

    [DllImport("winsqlite3.dll", EntryPoint = "sqlite3_column_text16", CallingConvention = CallingConvention.Cdecl)]
    private static extern IntPtr sqlite3_column_text16(IntPtr pStmt, int iCol);

    [DllImport("winsqlite3.dll", EntryPoint = "sqlite3_column_int64", CallingConvention = CallingConvention.Cdecl)]
    private static extern long sqlite3_column_int64(IntPtr pStmt, int iCol);

    [DllImport("winsqlite3.dll", EntryPoint = "sqlite3_finalize", CallingConvention = CallingConvention.Cdecl)]
    private static extern int sqlite3_finalize(IntPtr pStmt);

    [DllImport("winsqlite3.dll", EntryPoint = "sqlite3_close", CallingConvention = CallingConvention.Cdecl)]
    private static extern int sqlite3_close(IntPtr db);

    [DllImport("winsqlite3.dll", EntryPoint = "sqlite3_busy_timeout", CallingConvention = CallingConvention.Cdecl)]
    private static extern int sqlite3_busy_timeout(IntPtr db, int ms);

    private const int SQLITE_ROW = 100;
    private const int SQLITE_OK = 0;

    public static Dictionary<string, long[]> ReadBanDates(string dbPath) {
        var dict = new Dictionary<string, long[]>(StringComparer.OrdinalIgnoreCase);
        if (string.IsNullOrEmpty(dbPath) || !System.IO.File.Exists(dbPath)) return dict;
        IntPtr db = IntPtr.Zero;
        if (sqlite3_open16(dbPath, out db) != SQLITE_OK || db == IntPtr.Zero) return dict;
        try {
            sqlite3_busy_timeout(db, 2000);
            IntPtr stmt = IntPtr.Zero;
            string sql = "SELECT IPAddressText, BanDate, BanEndDate FROM IPAddresses WHERE BanDate IS NOT NULL AND BanDate > 0";
            int rc = sqlite3_prepare16_v2(db, sql, -1, out stmt, IntPtr.Zero);
            if (rc != SQLITE_OK || stmt == IntPtr.Zero) {
                sql = "SELECT IPAddressText, BanDate, 0 FROM IPAddresses WHERE BanDate IS NOT NULL AND BanDate > 0";
                rc = sqlite3_prepare16_v2(db, sql, -1, out stmt, IntPtr.Zero);
            }
            if (rc == SQLITE_OK && stmt != IntPtr.Zero) {
                try {
                    while (sqlite3_step(stmt) == SQLITE_ROW) {
                        IntPtr ptr = sqlite3_column_text16(stmt, 0);
                        string ip = Marshal.PtrToStringUni(ptr);
                        long banDate = sqlite3_column_int64(stmt, 1);
                        long banEndDate = sqlite3_column_int64(stmt, 2);
                        if (!string.IsNullOrEmpty(ip)) {
                            dict[ip] = new long[] { banDate, banEndDate };
                        }
                    }
                } finally {
                    sqlite3_finalize(stmt);
                }
            }
        } catch {}
        finally {
            sqlite3_close(db);
        }
        return dict;
    }
}
'@
        Add-Type -TypeDefinition $csSqlite -ErrorAction SilentlyContinue
    } catch {}
}

# ------------------------------------------------------------------------------
# Локалізація (Multi-Language: UA / EN)
# ------------------------------------------------------------------------------
$script:I18N = @{
    "UA" = @{
        "AppTitle" = "IPBan Manager & Control Center"
        "HeaderTitle" = "IPBan Control Center"
        "HeaderSubtitle" = "Автоматичний захист від Brute-Force атак (RDP, SSH, SQL)"
        "StatusChecking" = "Перевірка..."
        "StatusRunning" = "ЗАПУЩЕНО"
        "StatusStopped" = "ЗУПИНЕНО"
        "StatusNotInstalled" = "НЕ ВСТАНОВЛЕНО"
        "BtnStart" = "Запустити"
        "BtnStop" = "Зупинити"
        "BtnRestart" = "Рестарт"
        "BtnRefresh" = "Оновити"
        "LangToggle" = "English"
        "PathLabel" = "Папка IPBan:"
        "BtnBrowse" = "Огляд..."
        "BtnOpenFolder" = "Відкрити папку"
        "BtnOpenConfig" = "Відкрити конфіг"
        "TabBanned" = "  Заблоковані IP  "
        "TabStats" = "  📊 Статистика  "
        "TabSettings" = "  Налаштування  "
        "TabLists" = "  Білий / Чорний списки  "
        "TabLogs" = "  Журнал та аудит  "
        "TabSetup" = "  Інсталяція та Сервіс  "
        "Search" = "Пошук:"
        "Filter" = "Фільтр:"
        "FilterBanned" = "⛔ Тільки локальні блокування"
        "FilterWhitelist" = "⚪ Тільки білий список"
        "FilterBlacklist" = "🏴 Чорний список (Blacklist)"
        "FilterAllRules" = "📋 Всі правила IPBan"
        "BtnUnbanSelected" = "Розблокувати обрані"
        "BtnManualBan" = "Заблокувати вручну..."
        "BtnUnbanAll" = "Очистити блокування"
        "BtnExport" = "Експорт..."
        "ColIndex" = "#"
        "ColIP" = "IP-адреса (Whois)"
        "ColCountry" = "Країна"
        "ColBanTime" = "Час блокування"
        "ColUnbanTime" = "Час розблокування"
        "BanPermanent" = "— (Назавжди)"
        "BanActive" = "Активне"
        "BanTimeUnknown" = "— (Час не зафіксовано)"
        "BanPerConfig" = "За конфігом"
        "WhitelistNote" = "— (Білий список)"
        "BlacklistNote" = "— (Чорний список)"
        "CardTotalBanned" = "Локально заблоковано"
        "CardUniqueCountries" = "Країн-джерел атак"
        "CardTopCountry" = "Головна країна атак"
        "CardPeakHour" = "Піковий час атак"
        "GbCountryStats" = "Топ країн за локальними атаками"
        "GbTimeStats" = "Розподіл локальних атак за часом доби (24 години)"
        "ColStatsRank" = "#"
        "ColStatsCountry" = "Країна"
        "ColStatsCount" = "Заблоковано IP"
        "ColStatsShare" = "Частка"
        "ColStatsBar" = "Активність"
        "ColHour" = "Часовий проміжок"
        "ColHourAttacks" = "Кількість подій"
        "ColHourBar" = "Рівень активності"
        "BtnRefreshStats" = "Оновити статистику"
        "PeakNotice" = "[!] Пік локальних атак: {0}:00 - {1}:00 ({2} спроб)"
        "NoActiveBans" = "Локальних блокувань немає"
        "ResolvingCountry" = "🌐 Визначення..."
        "LocalNetwork" = "Локальна мережа"
        "UnknownCountry" = "Невідомо"
        "StatusActive" = "🟢 Активно"
        "StatusDisabled" = "⚪ Вимкнено"
        "LblNoBans" = "🟢 Локальних блокувань немає (0 IP-адрес) | Білий список: {0} | Чорний список: {1}"
        "LblBansCount" = "⛔ Локально заблоковано: {0} IP (Відображено: {1}) | Чорний список: {2} | Білий список: {3}"
        "LblWhiteCount" = "⚪ У білому списку брандмауера: {0} IP (Відображено: {1}) | Локально заблоковано: {2}"
        "LblBlackCount" = "🏴 У чорному списку (Blacklist): {0} IP (Відображено: {1}) | Локально заблоковано: {2}"
        "LblAllRulesCount" = "📋 Всього записів IPBan у брандмауері: {0} | Відображено: {1}"
        "GbGeneral" = "Правила виявлення та блокування"
        "LblFailedAttempts" = "Поріг невдалих спроб входу (FailedLoginAttemptsBeforeBan):"
        "LblBanTime" = "Час блокування (BanTime, формат Дні:Год:Хв:Сек):"
        "LblExpireTime" = "Час життя невдалих спроб до скидання (ExpireTime):"
        "LblCycleTime" = "Інтервал циклу перевірки та бану (CycleTime):"
        "GbBehavior" = "Додаткова поведінка та очищення"
        "ChkClearOnRestart" = "Очищати всі заблоковані IP при перезапуску служби (ClearBannedIPAddressesOnRestart)"
        "ChkClearOnSuccess" = "Скидати лічильник невдалих спроб при успішному вході (ClearFailedLoginsOnSuccessfulLogin)"
        "ChkProcessInternal" = "Обробляти та блокувати внутрішні локальні IP-адреси (ProcessInternalIPAddresses)"
        "ChkResetUnbanned" = "Скидати лічильник після розблокування IP (ResetFailedLoginCountForUnbannedIPAddresses)"
        "ChkStartInTray" = "Запускати програму згорнутою у системний трей (Start in tray)"
        "GbMonitoring" = "Моніторинг сервісів та протоколів (Event Viewer & Logs)"
        "LblMonitoringDesc" = "Контроль та виявлення атак на сервіси Windows за конфігурацією IPBan:"
        "StatusEnabled" = "Включено"
        "StatusDisabledService" = "Вимкнено"
        "GbAbuseIPDB" = "Хмарна база загроз AbuseIPDB (Threat Intelligence)"
        "LblAbuseApiKey" = "API Ключ AbuseIPDB (Key):"
        "LblAbuseConfidence" = "Поріг впевненості (Confidence Score, %):"
        "LblAbuseLimit" = "Кількість IP для завантаження (Limit):"
        "ChkAbuseAutoReport" = "Автоматично надсилати репорти про атаки в AbuseIPDB (за замовчуванням: ВИМКНЕНО)"
        "BtnFetchAbuse" = "📥 Завантажити чорний список з AbuseIPDB"
        "BtnCheckUpdate" = "Перевірити оновлення"
        "UpdateChecking" = "Перевірка нових версій на GitHub..."
        "UpdateLatest" = "У вас встановлена найновіша версія ({0}). Оновлень немає."
        "UpdateAvailableTitle" = "Доступна нова версія {0}!"
        "UpdateAvailableMsg" = "Вийшла нова версія IPBan Control Center: {0}`n`nПоточна версія: {1}`n`nБажаєте відкрити сторінку релізу та завантажити оновлення зараз?"
        "BtnSaveConfig" = "Зберегти налаштування у файл"
        "BtnReloadConfig" = "Скинути до значень файлу"
        "BtnRestoreBak" = "Відновити з бекапу (.bak)"
        "GbWhitelist" = "Білий список (Whitelist - ніколи не блокувати)"
        "LblWhiteDesc" = "Введіть IP-адреси або підмережі CIDR через кому або з нового рядка:"
        "BtnAddLocalIP" = "+ Додати мою локальну IP"
        "BtnAddPublicIP" = "+ Додати мою зовнішню WAN IP"
        "GbBlacklist" = "Чорний список (Blacklist - перманентно блокувати)"
        "LblBlackDesc" = "Введіть IP-адреси або підмережі CIDR для постійного блокування:"
        "BtnSaveLists" = "Зберегти Білий та Чорний списки у конфігурацію"
        "RbIPBanLog" = "Лог IPBan (logfile.txt)"
        "RbEventLog" = "Спроби входу Windows (Security 4625)"
        "BtnRefreshLog" = "Оновити журнал"
        "ChkAutoRefresh" = "Авто (кожні 5 сек)"
        "BtnClearLog" = "Очистити logfile.txt"
        "ChkWordWrap" = "Перенос рядків"
        "ColTime" = "Час"
        "ColUser" = "Користувач"
        "ColLogonType" = "Тип входу"
        "ColWorkstation" = "Робоча станція"
        "ColStatus" = "Статус"
        "MiCopyIP" = "Копіювати IP"
        "MiUnban" = "Розблокувати"
        "MiWhitelist" = "Додати до Білого списку (Whitelist)"
        "MiEventBan" = "Заблокувати цей IP"
        "MiEventWhite" = "Додати цей IP до Whitelist"
        "MiEventCopy" = "Копіювати IP-адресу"
        "GbSysStatus" = "Стан компонентів системи"
        "BtnBrowseZip" = "Обрати ZIP-архів..."
        "GbInstallActions" = "Керування встановленням та налаштуванням"
        "BtnSetupAudit" = "Увімкнути аудит безпеки Windows (AuditPol)"
        "LblAuditHint" = "(Обов'язково для виявлення невдалих спроб входу RDP/Windows)"
        "BtnInstallLocal" = "Встановити IPBan з локального архіву"
        "BtnInstallWeb" = "Завантажити та встановити найновішу з GitHub"
        "BtnUninstallService" = "Повністю видалити службу IPBan"
        "GbLinks" = "Корисні посилання та документація"
        "LlGithub" = "Офіційний репозиторій DigitalRuby/IPBan на GitHub"
        "LlWiki" = "Документація налаштувань та конфігурації (Wiki)"
        "StatusReady" = "Готово"
        "AdminYes" = "Адміністратор"
        "AdminNo" = "Без прав адміністратора"
        "TrayTitle" = "🛡 IPBan Control Center"
        "TrayStatusChecking" = "Статус: Перевірка..."
        "TrayBannedCount" = "Заблоковано IP: {0}"
        "TrayStart" = "▶ Запустити службу"
        "TrayStop" = "⏹ Зупинити службу"
        "TrayRestart" = "🔄 Перезапустити службу"
        "TrayRefresh" = "📋 Оновити дані"
        "TrayShow" = "🪟 Відкрити вікно програми"
        "TrayExit" = "❌ Вихід з програми"
        "SvcRunning" = "Служба Windows (IPBan): Працює (Running)"
        "SvcStopped" = "Служба Windows (IPBan): Зупинена (Stopped)"
        "SvcNotInstalled" = "Служба Windows (IPBan): Не знайдена в системі"
        "PromptInstallTitle" = "Майстер налаштувань IPBan"
        "PromptInstallText" = "Службу захисту IPBan ще не встановлено на цьому комп'ютері.`n`nВідкрито розділ «Інсталяція та Сервіс».`nДля захисту сервера від підбору паролів (RDP, SSH, SMB тощо) необхідно встановити службу IPBan.`n`nБажаєте завантажити та встановити найновішу версію IPBan прямо зараз з офіційного GitHub?"
        "StatusLogUpdated" = "Лог IPBan оновлено ({0} останніх рядків)"
        "StatusPollingEvents" = "Опитування журналу безпеки Windows (Event 4625)..."
        "StatusEventsLoaded" = "Отримано невдалих спроб входу: {0}"
        "StatusEventsError" = "Помилка читання журналу подій: {0}"
        "LogReadError" = "Не вдалося прочитати лог-файл: {0}"
        "LogNotFound" = "Файл логу не знайдено за шляхом: {0}`n`nЛоги з'являться після запуску служби IPBan."
        "StatusServiceRestarting" = "Перезапуск служби IPBan..."
        "StatusServiceRestarted" = "Службу IPBan успішно перезапущено!"
        "StatusServiceRestartError" = "Помилка перезапуску служби"
        "StatusServiceStarting" = "Запуск служби IPBan..."
        "StatusServiceStarted" = "Службу IPBan запущено!"
        "StatusServiceStopping" = "Зупинка служби IPBan..."
        "StatusServiceStopped" = "Службу IPBan зупинено!"
        "StatusLogCleared" = "Лог-файл успішно очищено"
        "StatusAuditConfiguring" = "Налаштування Windows Audit Policy..."
        "StatusGettingPublicIP" = "Отримання зовнішньої публічної IP-адреси..."
        "StatusAbuseDownloaded" = "AbuseIPDB: Завантажено {0} шкідливих IP-адрес"
        "StatusConfigSaved" = "Налаштування успішно збережено у {0}"
        "StatusConfigLoaded" = "Налаштування завантажено з {0}"
        "StatusConfigNotFound" = "Файл конфігурації не знайдено: {0}"
        "StatusInstallLocal" = "Встановлення IPBan з локального архіву..."
        "StatusInstallWeb" = "Завантаження та встановлення IPBan з GitHub..."
        "StatusRulesLoading" = "Завантаження правил брандмауера IPBan..."
        "StatusRulesRefreshed" = "Правила оновлено. Локальних блокувань: {0} | Білий список: {1} | Чорний список: {2}"
    }
    "EN" = @{
        "AppTitle" = "IPBan Manager & Control Center"
        "HeaderTitle" = "IPBan Control Center"
        "HeaderSubtitle" = "Automated Brute-Force Attack Protection (RDP, SSH, SQL)"
        "StatusChecking" = "Checking..."
        "StatusRunning" = "RUNNING"
        "StatusStopped" = "STOPPED"
        "StatusNotInstalled" = "NOT INSTALLED"
        "BtnStart" = "Start"
        "BtnStop" = "Stop"
        "BtnRestart" = "Restart"
        "BtnRefresh" = "Refresh"
        "LangToggle" = "Українська"
        "PathLabel" = "IPBan Folder:"
        "BtnBrowse" = "Browse..."
        "BtnOpenFolder" = "Open Folder"
        "BtnOpenConfig" = "Open Config"
        "TabBanned" = "  Banned IPs  "
        "TabStats" = "  📊 Analytics  "
        "TabSettings" = "  Settings  "
        "TabLists" = "  White / Black Lists  "
        "TabLogs" = "  Logs & Audit  "
        "TabSetup" = "  Installation & Service  "
        "Search" = "Search:"
        "Filter" = "Filter:"
        "FilterBanned" = "⛔ Local Bans Only"
        "FilterWhitelist" = "⚪ Whitelist Only"
        "FilterBlacklist" = "🏴 Blacklist Only"
        "FilterAllRules" = "📋 All IPBan Rules"
        "BtnUnbanSelected" = "Unban Selected"
        "BtnManualBan" = "Manual Ban..."
        "BtnUnbanAll" = "Clear Local Bans"
        "BtnExport" = "Export..."
        "ColIndex" = "#"
        "ColIP" = "IP Address (Whois)"
        "ColCountry" = "Country"
        "ColBanTime" = "Ban Date & Time"
        "ColUnbanTime" = "Unban Date & Time"
        "BanPermanent" = "— (Permanent)"
        "BanActive" = "Active"
        "BanTimeUnknown" = "— (Time not recorded)"
        "BanPerConfig" = "Per config"
        "WhitelistNote" = "— (Whitelist)"
        "BlacklistNote" = "— (Blacklist)"
        "CardTotalBanned" = "Locally Blocked IPs"
        "CardUniqueCountries" = "Unique Countries"
        "CardTopCountry" = "Top Attack Country"
        "CardPeakHour" = "Peak Attack Hours"
        "GbCountryStats" = "Top Attacking Countries (Local)"
        "GbTimeStats" = "24-Hour Local Attack Distribution"
        "ColStatsRank" = "#"
        "ColStatsCountry" = "Country"
        "ColStatsCount" = "Blocked IPs"
        "ColStatsShare" = "Share"
        "ColStatsBar" = "Activity"
        "ColHour" = "Time Window"
        "ColHourAttacks" = "Event Count"
        "ColHourBar" = "Activity Level"
        "BtnRefreshStats" = "Refresh Analytics"
        "PeakNotice" = "[!] Peak local attacks: {0}:00 - {1}:00 ({2} attempts)"
        "NoActiveBans" = "No local bans"
        "ResolvingCountry" = "🌐 Resolving..."
        "LocalNetwork" = "Local Network"
        "UnknownCountry" = "Unknown"
        "StatusActive" = "🟢 Active"
        "StatusDisabled" = "⚪ Disabled"
        "LblNoBans" = "🟢 No local bans (0 IP addresses) | Whitelist: {0} | Blacklist: {1}"
        "LblBansCount" = "⛔ Locally blocked: {0} IPs (Showing: {1}) | Blacklist: {2} | Whitelist: {3}"
        "LblWhiteCount" = "⚪ Firewall whitelist: {0} IPs (Showing: {1}) | Locally blocked: {2}"
        "LblBlackCount" = "🏴 Firewall blacklist: {0} IPs (Showing: {1}) | Locally blocked: {2}"
        "LblAllRulesCount" = "📋 Total IPBan records in firewall: {0} | Showing: {1}"
        "GbGeneral" = "Detection and Blocking Rules"
        "LblFailedAttempts" = "Failed login attempts threshold (FailedLoginAttemptsBeforeBan):"
        "LblBanTime" = "Ban duration (BanTime, format Days:Hours:Min:Sec):"
        "LblExpireTime" = "Failed attempt expiration window (ExpireTime):"
        "LblCycleTime" = "Cycle checking interval (CycleTime):"
        "GbBehavior" = "Additional Behavior and Cleanup"
        "ChkClearOnRestart" = "Clear all banned IPs on service restart (ClearBannedIPAddressesOnRestart)"
        "ChkClearOnSuccess" = "Reset failed attempts counter on successful login (ClearFailedLoginsOnSuccessfulLogin)"
        "ChkProcessInternal" = "Process and ban internal/local IP addresses (ProcessInternalIPAddresses)"
        "ChkResetUnbanned" = "Reset counter after unbanning an IP (ResetFailedLoginCountForUnbannedIPAddresses)"
        "ChkStartInTray" = "Start application minimized to system tray"
        "GbMonitoring" = "Service & Protocol Monitoring (Event Viewer & Logs)"
        "LblMonitoringDesc" = "Detection and attack prevention across Windows services per IPBan config:"
        "StatusEnabled" = "Enabled"
        "StatusDisabledService" = "Disabled"
        "GbAbuseIPDB" = "AbuseIPDB Cloud Threat Intelligence"
        "LblAbuseApiKey" = "AbuseIPDB API Key:"
        "LblAbuseConfidence" = "Confidence Score (%):"
        "LblAbuseLimit" = "Download IP Limit:"
        "ChkAbuseAutoReport" = "Automatically report attack attempts to AbuseIPDB (Default: DISABLED)"
        "BtnFetchAbuse" = "📥 Download Blacklist from AbuseIPDB"
        "BtnCheckUpdate" = "Check for Updates"
        "UpdateChecking" = "Checking for new versions on GitHub..."
        "UpdateLatest" = "You have the latest version ({0}). No updates available."
        "UpdateAvailableTitle" = "New version {0} is available!"
        "UpdateAvailableMsg" = "A newer version of IPBan Control Center is available: {0}`n`nCurrent version: {1}`n`nWould you like to open the release page and download the update now?"
        "BtnSaveConfig" = "Save Settings to File"
        "BtnReloadConfig" = "Reset to File Values"
        "BtnRestoreBak" = "Restore from Backup (.bak)"
        "GbWhitelist" = "Whitelist (Never ban these addresses)"
        "LblWhiteDesc" = "Enter IP addresses or CIDR subnets separated by comma or new lines:"
        "BtnAddLocalIP" = "+ Add My Local IP"
        "BtnAddPublicIP" = "+ Add My Public WAN IP"
        "GbBlacklist" = "Blacklist (Permanently block these addresses)"
        "LblBlackDesc" = "Enter IP addresses or CIDR subnets to permanently block:"
        "BtnSaveLists" = "Save Whitelist & Blacklist to Configuration"
        "RbIPBanLog" = "IPBan Log (logfile.txt)"
        "RbEventLog" = "Windows Logon Attempts (Security 4625)"
        "BtnRefreshLog" = "Refresh Log"
        "ChkAutoRefresh" = "Auto (every 5 sec)"
        "BtnClearLog" = "Clear logfile.txt"
        "ChkWordWrap" = "Word Wrap"
        "ColTime" = "Time"
        "ColUser" = "User"
        "ColLogonType" = "Logon Type"
        "ColWorkstation" = "Workstation"
        "ColStatus" = "Status"
        "MiCopyIP" = "Copy IP"
        "MiUnban" = "Unban"
        "MiWhitelist" = "Add to Whitelist"
        "MiEventBan" = "Ban This IP"
        "MiEventWhite" = "Add This IP to Whitelist"
        "MiEventCopy" = "Copy IP Address"
        "GbSysStatus" = "System Components Status"
        "BtnBrowseZip" = "Choose ZIP Archive..."
        "GbInstallActions" = "Installation and Maintenance Controls"
        "BtnSetupAudit" = "Enable Windows Security Audit (AuditPol)"
        "LblAuditHint" = "(Required to detect failed RDP/Windows login attempts)"
        "BtnInstallLocal" = "Install IPBan from Local Archive"
        "BtnInstallWeb" = "Download and Install Latest from GitHub"
        "BtnUninstallService" = "Completely Remove IPBan Service"
        "GbLinks" = "Useful Links & Documentation"
        "LlGithub" = "Official DigitalRuby/IPBan Repository on GitHub"
        "LlWiki" = "Configuration and Settings Documentation (Wiki)"
        "StatusReady" = "Ready"
        "AdminYes" = "Administrator"
        "AdminNo" = "Standard User (Non-Admin)"
        "TrayTitle" = "🛡 IPBan Control Center"
        "TrayStatusChecking" = "Status: Checking..."
        "TrayBannedCount" = "Banned IPs: {0}"
        "TrayStart" = "▶ Start Service"
        "TrayStop" = "⏹ Stop Service"
        "TrayRestart" = "🔄 Restart Service"
        "TrayRefresh" = "📋 Refresh Data"
        "TrayShow" = "🪟 Open Control Center"
        "TrayExit" = "❌ Exit Application"
        "SvcRunning" = "Windows Service (IPBan): Running"
        "SvcStopped" = "Windows Service (IPBan): Stopped"
        "SvcNotInstalled" = "Windows Service (IPBan): Not found in system"
        "PromptInstallTitle" = "IPBan Setup Wizard"
        "PromptInstallText" = "The IPBan protection service is not yet installed on this computer.`n`nOpened the 'Installation & Service' section.`nTo protect this server from brute-force password attacks (RDP, SSH, SMB, etc.), the IPBan service must be installed.`n`nWould you like to download and install the latest IPBan release from GitHub right now?"
        "StatusLogUpdated" = "IPBan log updated (last {0} lines)"
        "StatusPollingEvents" = "Querying Windows Security log (Event 4625)..."
        "StatusEventsLoaded" = "Received failed login attempts: {0}"
        "StatusEventsError" = "Error reading event log: {0}"
        "LogReadError" = "Failed to read log file: {0}"
        "LogNotFound" = "Log file not found at: {0}`n`nLogs will appear after starting IPBan service."
        "StatusServiceRestarting" = "Restarting IPBan service..."
        "StatusServiceRestarted" = "IPBan service successfully restarted!"
        "StatusServiceRestartError" = "Failed to restart IPBan service"
        "StatusServiceStarting" = "Starting IPBan service..."
        "StatusServiceStarted" = "IPBan service started!"
        "StatusServiceStopping" = "Stopping IPBan service..."
        "StatusServiceStopped" = "IPBan service stopped!"
        "StatusLogCleared" = "Log file successfully cleared"
        "StatusAuditConfiguring" = "Configuring Windows Audit Policy..."
        "StatusGettingPublicIP" = "Retrieving external public IP address..."
        "StatusAbuseDownloaded" = "AbuseIPDB: Downloaded {0} malicious IP addresses"
        "StatusConfigSaved" = "Settings successfully saved to {0}"
        "StatusConfigLoaded" = "Settings loaded from {0}"
        "StatusConfigNotFound" = "Configuration file not found: {0}"
        "StatusInstallLocal" = "Installing IPBan from local archive..."
        "StatusInstallWeb" = "Downloading and installing IPBan from GitHub..."
        "StatusRulesLoading" = "Loading IPBan firewall rules..."
        "StatusRulesRefreshed" = "Rules refreshed. Local bans: {0} | Whitelist: {1} | Blacklist: {2}"
    }
}

# Визначення поточної мови (реєстр або культура ОС)
$regKeyLang = "HKCU:\Software\IPBanControlCenter"
$savedLang = $null
try {
    if (Test-Path $regKeyLang) {
        $savedLang = (Get-ItemProperty -Path $regKeyLang -Name "Language" -ErrorAction SilentlyContinue).Language
    }
} catch {}

if ($savedLang -in @("UA", "EN")) {
    $script:CurrentLang = $savedLang
} else {
    $uiCulture = [System.Globalization.CultureInfo]::CurrentUICulture.TwoLetterISOLanguageName.ToLower()
    if ($uiCulture -in @("uk", "ru", "be")) {
        $script:CurrentLang = "UA"
    } else {
        $script:CurrentLang = "EN"
    }
}

function T([string]$key) {
    if ($script:I18N[$script:CurrentLang].ContainsKey($key)) {
        return $script:I18N[$script:CurrentLang][$key]
    }
    if ($script:I18N["EN"].ContainsKey($key)) {
        return $script:I18N["EN"][$key]
    }
    return $key
}

# Підключення P/Invoke для коректного вивільнення дескрипторів іконок
if (-not ([System.Management.Automation.PSTypeName]'NativeMethods').Type) {
    $nativeCode = @"
using System;
using System.Runtime.InteropServices;
public class NativeMethods {
    [DllImport("user32.dll", CharSet = CharSet.Auto)]
    public static extern bool DestroyIcon(IntPtr handle);
}
"@
    Add-Type -TypeDefinition $nativeCode -ErrorAction SilentlyContinue
}

# Генератор динамічних іконок для системного трею (Працює, Не працює, Алерт)
function Get-AppTrayIcon([string]$state) {
    $bmp = New-Object System.Drawing.Bitmap 32, 32
    $g = [System.Drawing.Graphics]::FromImage($bmp)
    $g.SmoothingMode = [System.Drawing.Drawing2D.SmoothingMode]::AntiAlias
    $g.Clear([System.Drawing.Color]::Transparent)
    $rect = New-Object System.Drawing.Rectangle 1, 1, 29, 29

    switch ($state) {
        "Running" {
            # 🟢 Працює: Зелений щит/коло з білою галочкою
            $brush = New-Object System.Drawing.SolidBrush ([System.Drawing.Color]::FromArgb(22, 163, 74))
            $g.FillEllipse($brush, $rect)
            $brush.Dispose()
            $pen = New-Object System.Drawing.Pen ([System.Drawing.Color]::White, 3.5)
            $pen.StartCap = [System.Drawing.Drawing2D.LineCap]::Round
            $pen.EndCap = [System.Drawing.Drawing2D.LineCap]::Round
            $g.DrawLine($pen, 8, 16, 13, 21)
            $g.DrawLine($pen, 13, 21, 23, 10)
            $pen.Dispose()
        }
        "Alert" {
            # 🟠 Алерт: Помаранчевий/бурштиновий з білим знаком оклику (!)
            $brush = New-Object System.Drawing.SolidBrush ([System.Drawing.Color]::FromArgb(234, 88, 12))
            $g.FillEllipse($brush, $rect)
            $brush.Dispose()
            $pen = New-Object System.Drawing.Pen ([System.Drawing.Color]::White, 3.5)
            $pen.StartCap = [System.Drawing.Drawing2D.LineCap]::Round
            $pen.EndCap = [System.Drawing.Drawing2D.LineCap]::Round
            $g.DrawLine($pen, 15, 7, 15, 17)
            $pen.Dispose()
            $brushWhite = New-Object System.Drawing.SolidBrush ([System.Drawing.Color]::White)
            $g.FillEllipse($brushWhite, 13, 21, 5, 5)
            $brushWhite.Dispose()
        }
        default {
            # 🔴 Не працює: Червоне коло з білим хрестиком (X)
            $brush = New-Object System.Drawing.SolidBrush ([System.Drawing.Color]::FromArgb(220, 38, 38))
            $g.FillEllipse($brush, $rect)
            $brush.Dispose()
            $pen = New-Object System.Drawing.Pen ([System.Drawing.Color]::White, 3.5)
            $pen.StartCap = [System.Drawing.Drawing2D.LineCap]::Round
            $pen.EndCap = [System.Drawing.Drawing2D.LineCap]::Round
            $g.DrawLine($pen, 9, 9, 21, 21)
            $g.DrawLine($pen, 21, 9, 9, 21)
            $pen.Dispose()
        }
    }

    $g.Dispose()
    $hIcon = $bmp.GetHicon()
    $ico = [System.Drawing.Icon]::FromHandle($hIcon)
    $clone = $ico.Clone()
    $ico.Dispose()
    [NativeMethods]::DestroyIcon($hIcon) | Out-Null
    $bmp.Dispose()
    return $clone
}

function Enable-DoubleBuffering($control) {
    if (-not $control) { return }
    try {
        $prop = [System.Windows.Forms.Control].GetProperty("DoubleBuffered", [System.Reflection.BindingFlags]::NonPublic -bor [System.Reflection.BindingFlags]::Instance)
        if ($prop) { $prop.SetValue($control, $true, $null) }
    } catch {}
}

# Допоміжна функція створення згладжених кнопок та бейджів (Rounded Buttons)
function Set-SmoothButton {
    param(
        [Parameter(Mandatory=$true)]
        [System.Windows.Forms.Control]$control,
        [int]$radius = 7,
        [System.Drawing.Color]$borderColor = [System.Drawing.Color]::Empty
    )
    if ($control -is [System.Windows.Forms.ButtonBase]) {
        $control.FlatStyle = [System.Windows.Forms.FlatStyle]::Flat
        $control.FlatAppearance.BorderSize = 0
        $control.Cursor = [System.Windows.Forms.Cursors]::Hand
    }

    $rVal = if ($radius -gt 0) { $radius } else { 7 }
    $bColorVal = $borderColor

    $updateRegion = {
        param($s, $e)
        try {
            $curR = if ($rVal -gt 0) { $rVal } else { 7 }
            $d = [int]($curR * 2)
            if ($s -and $s.Width -gt $d -and $s.Height -gt $d) {
                $path = New-Object System.Drawing.Drawing2D.GraphicsPath
                $r = $s.ClientRectangle
                if ($r.Width -gt $d -and $r.Height -gt $d) {
                    $path.AddArc($r.X, $r.Y, $d, $d, 180, 90)
                    $path.AddArc(($r.Right - $d), $r.Y, $d, $d, 270, 90)
                    $path.AddArc(($r.Right - $d), ($r.Bottom - $d), $d, $d, 0, 90)
                    $path.AddArc($r.X, ($r.Bottom - $d), $d, $d, 90, 90)
                    $path.CloseFigure()
                    $s.Region = New-Object System.Drawing.Region($path)
                }
                $path.Dispose()
            }
        } catch {}
    }.GetNewClosure()
    $control.Add_Resize($updateRegion)
    & $updateRegion $control $null

    if (-not $bColorVal.IsEmpty) {
        $paintBorder = {
            param($s, $e)
            try {
                $curR = if ($rVal -gt 0) { $rVal } else { 7 }
                $d = [int]($curR * 2)
                if ($s -and $s.Width -gt $d -and $s.Height -gt $d) {
                    $e.Graphics.SmoothingMode = [System.Drawing.Drawing2D.SmoothingMode]::AntiAlias
                    $r = New-Object System.Drawing.Rectangle 0, 0, ($s.Width - 1), ($s.Height - 1)
                    $path = New-Object System.Drawing.Drawing2D.GraphicsPath
                    $path.AddArc($r.X, $r.Y, $d, $d, 180, 90)
                    $path.AddArc(($r.Right - $d), $r.Y, $d, $d, 270, 90)
                    $path.AddArc(($r.Right - $d), ($r.Bottom - $d), $d, $d, 0, 90)
                    $path.AddArc($r.X, ($r.Bottom - $d), $d, $d, 90, 90)
                    $path.CloseFigure()
                    $pen = New-Object System.Drawing.Pen($bColorVal, 1)
                    $e.Graphics.DrawPath($pen, $path)
                    $pen.Dispose()
                    $path.Dispose()
                }
            } catch {}
        }.GetNewClosure()
        $control.Add_Paint($paintBorder)
    }
}

function Find-LocalIPBanZip {
    if ($script:LocalZipBackup -and (Test-Path $script:LocalZipBackup)) {
        return $script:LocalZipBackup
    }

    $candidates = @(
        $PSScriptRoot,
        (Get-Location).Path,
        [System.IO.Path]::Combine($env:USERPROFILE, "Downloads"),
        "C:\Downloads",
        "C:\Temp",
        "C:\"
    )
    if (Test-Path "D:\") {
        $candidates += @("D:\Downloads", "D:\Temp", "D:\")
    }

    foreach ($dir in $candidates) {
        if ($dir -and (Test-Path $dir)) {
            $zip = Get-ChildItem -Path $dir -Filter "*IPBan*.zip" -File -ErrorAction SilentlyContinue | Select-Object -First 1
            if ($zip) {
                return $zip.FullName
            }
        }
    }
    return $null
}

function Get-IPBanPath {
    if ($txtInstallPath -and -not [string]::IsNullOrWhiteSpace($txtInstallPath.Text)) {
        $p = $txtInstallPath.Text.Trim()
        if (Test-Path "$p\DigitalRuby.IPBan.exe") {
            $script:CurrentInstallPath = $p
            return $p
        }
    }
    if (Test-Path "$script:CurrentInstallPath\DigitalRuby.IPBan.exe") {
        return $script:CurrentInstallPath
    }
    if (Test-Path "C:\Program Files\IPBan\DigitalRuby.IPBan.exe") {
        $script:CurrentInstallPath = "C:\Program Files\IPBan"
        return $script:CurrentInstallPath
    }
    if (Test-Path "C:\IPBan\DigitalRuby.IPBan.exe") {
        $script:CurrentInstallPath = "C:\IPBan"
        return $script:CurrentInstallPath
    }
    if ($txtInstallPath -and -not [string]::IsNullOrWhiteSpace($txtInstallPath.Text)) {
        return $txtInstallPath.Text.Trim()
    }
    return $script:CurrentInstallPath
}

function Get-IPBanConfigFile {
    $path = Get-IPBanPath
    if (Test-Path "$path\ipban.config") {
        return "$path\ipban.config"
    }
    if (Test-Path "$path\ipban.override.config") {
        return "$path\ipban.override.config"
    }
    return "$path\ipban.config"
}

function Get-IPBanServiceStatus {
    try {
        $svc = Get-Service -Name $script:ServiceName -ErrorAction SilentlyContinue
        if ($null -eq $svc) { return "NotInstalled" }
        return $svc.Status.ToString()
    } catch {
        return "NotInstalled"
    }
}

function Expand-ZipArchiveSafe {
    param(
        [Parameter(Mandatory=$true)]
        [string]$zipPath,
        [Parameter(Mandatory=$true)]
        [string]$destDir
    )
    if (-not (Test-Path $destDir)) {
        New-Item -ItemType Directory -Path $destDir -Force | Out-Null
    }
    Add-Type -AssemblyName System.IO.Compression.FileSystem
    $archive = [System.IO.Compression.ZipFile]::OpenRead($zipPath)
    try {
        foreach ($entry in $archive.Entries) {
            $destFile = [System.IO.Path]::Combine($destDir, $entry.FullName)
            if ($entry.FullName.EndsWith("/") -or $entry.FullName.EndsWith("\")) {
                if (-not (Test-Path $destFile)) {
                    New-Item -ItemType Directory -Path $destFile -Force | Out-Null
                }
            } else {
                $parentDir = [System.IO.Path]::GetDirectoryName($destFile)
                if (-not (Test-Path $parentDir)) {
                    New-Item -ItemType Directory -Path $parentDir -Force | Out-Null
                }
                [System.IO.Compression.ZipFileExtensions]::ExtractToFile($entry, $destFile, $true)
            }
        }
    } finally {
        $archive.Dispose()
    }
}

function Install-IPBanFromArchive {
    param(
        [Parameter(Mandatory=$true)]
        [string]$zipPath,
        [Parameter(Mandatory=$true)]
        [string]$destPath,
        [System.Windows.Forms.Label]$progressLabel = $null,
        [System.Windows.Forms.Label]$detailsLabel = $null
    )

    # 1. Резервне копіювання конфігурації
    $tempBackup = [System.IO.Path]::Combine([System.IO.Path]::GetTempPath(), "ipban_cfg_backup")
    if (Test-Path $destPath) {
        if (-not (Test-Path $tempBackup)) { New-Item -ItemType Directory -Path $tempBackup -Force | Out-Null }
        foreach ($cfg in @("ipban.config", "ipban.override.config", "ipban.sqlite", "nlog.config")) {
            $srcFile = Join-Path $destPath $cfg
            if (Test-Path $srcFile) {
                Copy-Item -Path $srcFile -Destination $tempBackup -Force
            }
        }
    }

    # 2. Зупинка та видалення старої служби
    if (Get-Service $script:ServiceName -ErrorAction SilentlyContinue) {
        if ($detailsLabel) { $detailsLabel.Text = "Зупинка попередньої служби IPBan..."; [System.Windows.Forms.Application]::DoEvents() }
        try { Stop-Service $script:ServiceName -Force } catch {}
        & sc.exe delete $script:ServiceName
        Start-Sleep -Seconds 1
    }

    # 3. Розпакування файлів
    if ($detailsLabel) { $detailsLabel.Text = "Розпакування файлів у $destPath..."; [System.Windows.Forms.Application]::DoEvents() }
    Expand-ZipArchiveSafe -zipPath $zipPath -destDir $destPath

    # 4. Відновлення конфігурації
    if (Test-Path $tempBackup) {
        foreach ($cfg in @("ipban.config", "ipban.override.config", "ipban.sqlite", "nlog.config")) {
            $bakFile = Join-Path $tempBackup $cfg
            if (Test-Path $bakFile) {
                Copy-Item -Path $bakFile -Destination $destPath -Force
            }
        }
        Remove-Item $tempBackup -Recurse -Force -ErrorAction SilentlyContinue
    }

    # 5. Налаштування аудиту безпеки
    if ($detailsLabel) { $detailsLabel.Text = "Налаштування аудиту входу Windows (AuditPol)..."; [System.Windows.Forms.Application]::DoEvents() }
    & auditpol.exe /set /category:"{69979849-797A-11D9-BED3-505054503030}" /success:enable /failure:enable
    & auditpol.exe /set /category:"{69979850-797A-11D9-BED3-505054503030}" /success:enable /failure:enable

    # 6. Створення та запуск служби Windows
    if ($detailsLabel) { $detailsLabel.Text = "Створення та запуск служби Windows..."; [System.Windows.Forms.Application]::DoEvents() }
    $exePath = Join-Path $destPath "DigitalRuby.IPBan.exe"
    if (-not (Test-Path $exePath)) {
        throw "Не знайдено файл DigitalRuby.IPBan.exe у $destPath після розпакування!"
    }
    & sc.exe create $script:ServiceName binPath= "`"$exePath`"" start= auto
    & sc.exe failure $script:ServiceName reset= 86400 actions= restart/60000/restart/60000/restart/60000 | Out-Null
    Start-Sleep -Seconds 1
    Start-Service $script:ServiceName
}

function Get-FirewallBannedIPs {
    $results = @()
    try {
        $fw = New-Object -ComObject HNetCfg.FwPolicy2
        foreach ($rule in $fw.Rules) {
            if ($rule.Name -like "IPBan*") {
                # Якщо правило блокування IPBan було вимкнено - автоматично відновлюємо активність
                if (-not $rule.Enabled -and $rule.Action -eq 0 -and $rule.Name -notlike "*Whitelist*") {
                    try { $rule.Enabled = $true } catch {}
                }
                # Вимкнені правила не блокують трафік і не повинні показуватися як активні блокування
                if (-not $rule.Enabled) { continue }

                $ips = $rule.RemoteAddresses -split ","
                foreach ($ip in $ips) {
                    $trim = $ip.Trim()
                    if (-not $trim -or $trim -eq "*") { continue }

                    # Нормалізація діапазону X.X.X.X-X.X.X.X до одного IP
                    if ($trim -match '^([^-\s]+)-\1$') {
                        $trim = $matches[1].Trim()
                    }

                    # Пропуск dummy/broadcast адрес Windows Firewall
                    if ($trim -like "255.255.255.255*" -or $trim -like "*-255.255.255.255" -or $trim -eq "255.255.255.255") {
                        continue
                    }

                    $cleanIp = $trim.Replace("/255.255.255.255", "").Replace("/32", "")
                    if ($cleanIp -eq "255.255.255.255" -or $cleanIp -like "255.255.255.255*") {
                        continue
                    }

                    $isWhite = ($rule.Action -ne 0) -or ($rule.Name -like "*Whitelist*")
                    $isBlacklist = (-not $isWhite) -and ($rule.Name -like "*Blacklist*")
                    $actionType = if ($isWhite) { "Allow" } elseif ($isBlacklist) { "Blacklist" } else { "Block" }
                    $actionLabel = if ($isWhite) { "⚪ Дозволено (Whitelist)" } elseif ($isBlacklist) { "🏴 Чорний список (Blacklist)" } else { "⛔ Локальне блокування" }

                    $results += [PSCustomObject]@{
                        IPAddress   = $cleanIp
                        RuleName    = $rule.Name
                        ActionType  = $actionType
                        ActionLabel = $actionLabel
                        Enabled     = $rule.Enabled
                    }
                }
            }
        }
    } catch {
        try {
            $rules = Get-NetFirewallRule -Name "IPBan*" -ErrorAction SilentlyContinue
            foreach ($r in $rules) {
                if (-not $r.Enabled -and $r.Action -eq "Block" -and $r.Name -notlike "*Whitelist*") {
                    try { Enable-NetFirewallRule -Name $r.Name -ErrorAction SilentlyContinue } catch {}
                }
                if (-not $r.Enabled) { continue }
                $filters = Get-NetFirewallAddressFilter -AssociatedNetFirewallRule $r -ErrorAction SilentlyContinue
                foreach ($f in $filters) {
                    foreach ($ip in $f.RemoteAddress) {
                        $trim = $ip.Trim()
                        if (-not $trim -or $trim -eq "*") { continue }

                        if ($trim -match '^([^-\s]+)-\1$') {
                            $trim = $matches[1].Trim()
                        }

                        if ($trim -like "255.255.255.255*" -or $trim -like "*-255.255.255.255" -or $trim -eq "255.255.255.255") {
                            continue
                        }

                        $cleanIp = $trim.Replace("/255.255.255.255", "").Replace("/32", "")
                        if ($cleanIp -eq "255.255.255.255" -or $cleanIp -like "255.255.255.255*") {
                            continue
                        }

                        $isWhite = ($r.Action -ne "Block") -or ($r.Name -like "*Whitelist*")
                        $isBlacklist = (-not $isWhite) -and ($r.Name -like "*Blacklist*")
                        $actionType = if ($isWhite) { "Allow" } elseif ($isBlacklist) { "Blacklist" } else { "Block" }
                        $actionLabel = if ($isWhite) { "⚪ Дозволено (Whitelist)" } elseif ($isBlacklist) { "🏴 Чорний список (Blacklist)" } else { "⛔ Локальне блокування" }

                        $results += [PSCustomObject]@{
                            IPAddress   = $cleanIp
                            RuleName    = $r.Name
                            ActionType  = $actionType
                            ActionLabel = $actionLabel
                            Enabled     = $r.Enabled
                        }
                    }
                }
            }
        } catch {}
    }
    return ,$results
}

function Get-IPBanTimesMap {
    $map = @{}
    $path = Get-IPBanPath

    # 1. Читання бази ipban.sqlite якщо winsqlite3 доступний
    if ($script:HasWinSqlite -and ([System.Management.Automation.PSTypeName]'IPBanSqlite').Type) {
        $dbPath = Join-Path $path "ipban.sqlite"
        if (Test-Path $dbPath) {
            try {
                $sqliteBans = [IPBanSqlite]::ReadBanDates($dbPath)
                foreach ($entry in $sqliteBans.GetEnumerator()) {
                    $vals = $entry.Value
                    $banMs = if ($vals -and $vals.Length -gt 0) { $vals[0] } else { 0 }
                    $endMs = if ($vals -and $vals.Length -gt 1) { $vals[1] } else { 0 }
                    $dtBan = if ($banMs -gt 0) { [DateTimeOffset]::FromUnixTimeMilliseconds($banMs).ToLocalTime().DateTime } else { $null }
                    $dtEnd = if ($endMs -gt 0) { [DateTimeOffset]::FromUnixTimeMilliseconds($endMs).ToLocalTime().DateTime } else { $null }
                    if ($dtBan) {
                        $map[$entry.Key] = @{
                            BanDate = $dtBan
                            UnbanDate = $dtEnd
                            Duration = $null
                        }
                    }
                }
            } catch {}
        }
    }

    # 2. Читання logfile.txt через швидкий стрімінг Select-String
    $logFile = Join-Path $path "logfile.txt"
    if (Test-Path $logFile) {
        try {
            $foundMatches = Select-String -Path $logFile -Pattern '(\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}).*?Banning ip address:\s*([^,\s]+)' -Encoding UTF8 -ErrorAction SilentlyContinue
            if ($foundMatches) {
                foreach ($m in $foundMatches) {
                    $line = $m.Line
                    if ($line -match '^(\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}).*?Banning ip address:\s*([^,\s]+)') {
                        $rawTime = $Matches[1]
                        $ip = $Matches[2].Trim()
                        $dur = $null
                        if ($line -match 'duration:\s*([0-9\.:]+)') {
                            $dur = $Matches[1].Trim()
                        }
                        try {
                            $dt = [DateTime]::ParseExact($rawTime, "yyyy-MM-dd HH:mm:ss", [System.Globalization.CultureInfo]::InvariantCulture)
                            if ($map.ContainsKey($ip)) {
                                if (-not $map[$ip].BanDate -or $dt -gt $map[$ip].BanDate) {
                                    $map[$ip].BanDate = $dt
                                    if ($dur) { $map[$ip].Duration = $dur }
                                } elseif (-not $map[$ip].Duration -and $dur) {
                                    $map[$ip].Duration = $dur
                                }
                            } else {
                                $map[$ip] = @{
                                    BanDate = $dt
                                    UnbanDate = $null
                                    Duration = $dur
                                }
                            }
                        } catch {}
                    }
                }
            }
        } catch {}
    }

    # 3. Ручні блокування поточної сесії
    if ($script:ManualBanTimes) {
        foreach ($k in $script:ManualBanTimes.Keys) {
            if (-not $map.ContainsKey($k)) {
                $map[$k] = @{
                    BanDate = $script:ManualBanTimes[$k]
                    UnbanDate = $null
                    Duration = $script:CurrentBanTimeSetting
                }
            }
        }
    }

    return $map
}

# ==============================================================================
# Модуль GeoIP та візуалізації аналітики
# ==============================================================================
$script:GeoIPCache = @{}
$script:GeoIPPending = New-Object System.Collections.Generic.HashSet[string]
$script:GeoIPTimer = $null
$script:GeoIPIsBusy = $false

function Get-GeoIPCachePath {
    $dir = Get-IPBanPath
    if (-not (Test-Path $dir)) {
        $dir = Join-Path $env:LOCALAPPDATA "IPBanControlCenter"
        if (-not (Test-Path $dir)) { New-Item -ItemType Directory -Path $dir -Force | Out-Null }
    }
    return (Join-Path $dir "geoip_cache.json")
}

function Load-GeoIPCache {
    try {
        $path = Get-GeoIPCachePath
        if (Test-Path $path) {
            $json = Get-Content -Path $path -Raw -Encoding UTF8 -ErrorAction SilentlyContinue
            if ($json) {
                $obj = ConvertFrom-Json $json -ErrorAction SilentlyContinue
                if ($obj) {
                    foreach ($prop in $obj.psobject.Properties) {
                        $c = $prop.Value.Code
                        $n = $prop.Value.Name
                        # Очищаємо застарілі або збійні записи "?? / Невідомо" для повторної успішної перевірки
                        if ($c -and $c -ne "??" -and $n -ne "Невідомо" -and $n -ne "Unknown") {
                            $script:GeoIPCache[$prop.Name] = @{
                                Code  = $c
                                Name  = $n
                                Emoji = $prop.Value.Emoji
                            }
                        }
                    }
                }
            }
        }
    } catch {}
}

function Save-GeoIPCache {
    try {
        $path = Get-GeoIPCachePath
        $script:GeoIPCache | ConvertTo-Json -Compress | Set-Content -Path $path -Encoding UTF8 -Force
    } catch {}
}

function Get-CountryFlagEmoji([string]$countryCode) {
    if ([string]::IsNullOrWhiteSpace($countryCode) -or $countryCode.Length -ne 2) { return "🌐" }
    $code = $countryCode.ToUpper()
    if ($code[0] -lt 'A' -or $code[0] -gt 'Z' -or $code[1] -lt 'A' -or $code[1] -gt 'Z') { return "🌐" }
    $high = [char]0xD83C
    $low1 = [char](0xDDE6 + ([int][char]$code[0] - [int][char]'A'))
    $low2 = [char](0xDDE6 + ([int][char]$code[1] - [int][char]'A'))
    return "$high$low1$high$low2"
}

function Test-IsPrivateIP([string]$ip) {
    if ($ip -like "10.*" -or $ip -like "192.168.*" -or $ip -like "127.*" -or $ip -eq "::1" -or $ip -eq "localhost") { return $true }
    if ($ip -match '^172\.(1[6-9]|2[0-9]|3[0-1])\.') { return $true }
    if ($ip -like "169.254.*") { return $true }
    if ($ip -like "255.255.255.255*" -or $ip -like "*-255.255.255.255" -or $ip -eq "255.255.255.255") { return $true }
    return $false
}

function Format-CountryDisplay([string]$code, [string]$name) {
    if ([string]::IsNullOrWhiteSpace($code) -or $code -eq "??") {
        return "🌐 ?? - " + (T "UnknownCountry")
    }
    if ($code -eq "LAN") {
        return "🏠 LAN - " + (T "LocalNetwork")
    }
    $c = $code.ToUpper().Trim()
    if ($name -and $name.Trim() -ne $c) {
        return "$c - $($name.Trim())"
    }
    return $c
}

function Get-IPCountryInfo([string]$ip) {
    $clean = $ip.Trim().Replace("/255.255.255.255", "").Replace("/32", "")
    if ([string]::IsNullOrWhiteSpace($clean)) { return $null }
    if (Test-IsPrivateIP $clean) {
        return @{
            Code  = "LAN"
            Name  = (T "LocalNetwork")
            Emoji = "🏠"
        }
    }
    if ($script:GeoIPCache.ContainsKey($clean)) {
        $cached = $script:GeoIPCache[$clean]
        if ($cached -and $cached.Code -and $cached.Code -ne "??" -and $cached.Name -ne "Невідомо" -and $cached.Name -ne "Unknown") {
            return $cached
        }
    }
    return $null
}

function Get-VisualBar([double]$percent, [int]$maxBlocks = 12) {
    if ($percent -le 0) { return ([string][char]0x2591 * $maxBlocks) }
    $filled = [Math]::Min($maxBlocks, [Math]::Max(1, [int][Math]::Round(($percent / 100.0) * $maxBlocks)))
    $empty = $maxBlocks - $filled
    return (([string][char]0x2588 * $filled) + ([string][char]0x2591 * $empty))
}

function Resolve-NextPendingGeoIP {
    if ($script:GeoIPPending.Count -eq 0) { return }
    if ($script:GeoIPIsBusy) { return }
    $script:GeoIPIsBusy = $true

    try {
        # Беремо пачку до 100 адрес для пакетного запиту
        $batch = @()
        foreach ($item in $script:GeoIPPending) {
            $batch += $item
            if ($batch.Count -ge 100) { break }
        }

        $resolvedAny = $false
        $remoteIPs = @()

        foreach ($ip in $batch) {
            $script:GeoIPPending.Remove($ip) | Out-Null
            if (Test-IsPrivateIP $ip) {
                $script:GeoIPCache[$ip] = @{
                    Code  = "LAN"
                    Name  = (T "LocalNetwork")
                    Emoji = "🏠"
                }
                $resolvedAny = $true
            } else {
                $remoteIPs += $ip
            }
        }

        if ($remoteIPs.Count -gt 0) {
            $batchSuccess = $false
            # 1. Пакетний запит через ip-api.com/batch (до 100 IP за 1 HTTP POST)
            try {
                $queries = @($remoteIPs | ForEach-Object { @{ query = $_ } })
                $jsonBody = $queries | ConvertTo-Json -Compress
                $url = "http://ip-api.com/batch?fields=status,country,countryCode,query"
                $resList = Invoke-RestMethod -Uri $url -Method Post -Body $jsonBody -ContentType "application/json" -TimeoutSec 6 -ErrorAction Stop

                if ($resList) {
                    foreach ($res in $resList) {
                        if ($res -and $res.query) {
                            $qIp = $res.query
                            if ($res.status -eq "success" -and $res.countryCode) {
                                $code = $res.countryCode
                                $name = $res.country
                                $emoji = Get-CountryFlagEmoji $code
                                $script:GeoIPCache[$qIp] = @{
                                    Code  = $code
                                    Name  = $name
                                    Emoji = $emoji
                                }
                                $resolvedAny = $true
                            } else {
                                # Запасний варіант для IP, не знайденого в ip-api
                                try {
                                    $res2 = Invoke-RestMethod -Uri "https://api.country.is/$qIp" -TimeoutSec 2 -ErrorAction Stop
                                    if ($res2 -and $res2.country) {
                                        $code = $res2.country
                                        $script:GeoIPCache[$qIp] = @{
                                            Code  = $code
                                            Name  = $code
                                            Emoji = (Get-CountryFlagEmoji $code)
                                        }
                                        $resolvedAny = $true
                                    }
                                } catch {}
                            }
                        }
                    }
                    $batchSuccess = $true
                }
            } catch {
                $batchSuccess = $false
            }

            # 2. Якщо пакетний запит не пройшов (блокування/таймаут), обробляємо запасним сервісом
            if (-not $batchSuccess) {
                $subBatch = @($remoteIPs | Select-Object -First 5)
                foreach ($ip in $subBatch) {
                    try {
                        $res2 = Invoke-RestMethod -Uri "https://api.country.is/$ip" -TimeoutSec 2 -ErrorAction Stop
                        if ($res2 -and $res2.country) {
                            $code = $res2.country
                            $script:GeoIPCache[$ip] = @{
                                Code  = $code
                                Name  = $code
                                Emoji = (Get-CountryFlagEmoji $code)
                            }
                            $resolvedAny = $true
                        } else {
                            $script:GeoIPPending.Add($ip) | Out-Null
                        }
                    } catch {
                        $script:GeoIPPending.Add($ip) | Out-Null
                    }
                }
                if ($remoteIPs.Count -gt 5) {
                    for ($i = 5; $i -lt $remoteIPs.Count; $i++) {
                        $script:GeoIPPending.Add($remoteIPs[$i]) | Out-Null
                    }
                }
            }
        }

        if ($resolvedAny) {
            # Оновлюємо комірки таблиці $dgvBanned
            if ($dgvBanned -and $dgvBanned.Columns["Country"]) {
                $cIdx = $dgvBanned.Columns["Country"].Index
                for ($r = 0; $r -lt $dgvBanned.Rows.Count; $r++) {
                    $row = $dgvBanned.Rows[$r]
                    $cellIp = $row.Cells["IPAddress"].Value
                    if ($cellIp) {
                        $clean = $cellIp.ToString().Trim().Replace("/255.255.255.255", "").Replace("/32", "")
                        if ($script:GeoIPCache.ContainsKey($clean)) {
                            $geo = $script:GeoIPCache[$clean]
                            $row.Cells[$cIdx].Value = Format-CountryDisplay $geo.Code $geo.Name
                        }
                    }
                }
            }
            Save-GeoIPCache
            Update-StatsUI
        }
    } finally {
        $script:GeoIPIsBusy = $false
    }
}

function Unban-IPAddress {
    param([string]$ip)
    if ([string]::IsNullOrWhiteSpace($ip)) { return $false }
    $cleanIp = $ip.Trim().Replace("/255.255.255.255", "").Replace("/32", "")
    $path = Get-IPBanPath
    $success = $false

    # 1. Запис у unban.txt (офіційний механізм IPBan)
    try {
        if (Test-Path $path) {
            $unbanFile = Join-Path $path "unban.txt"
            Add-Content -Path $unbanFile -Value $cleanIp -Encoding UTF8
            $success = $true
        }
    } catch {}

    # 2. Негайне видалення з брандмауера Windows (тільки правила блокування!)
    try {
        $fw = New-Object -ComObject HNetCfg.FwPolicy2
        foreach ($rule in $fw.Rules) {
            if ($rule.Name -like "IPBan*" -and $rule.Name -notlike "*Whitelist*" -and $rule.Action -eq 0) {
                $addresses = ($rule.RemoteAddresses -split ",") | ForEach-Object {
                    $a = $_.Trim().Replace("/255.255.255.255", "").Replace("/32", "")
                    if ($a -match '^([^-\s]+)-\1$') { $a = $matches[1].Trim() }
                    $a
                }
                if ($addresses -contains $cleanIp) {
                    $remaining = $addresses | Where-Object {
                        $_ -ne $cleanIp -and
                        $_ -ne "255.255.255.255" -and
                        -not ($_ -like "255.255.255.255*") -and
                        -not ($_ -like "*-255.255.255.255")
                    }
                    if ($remaining.Count -eq 0) {
                        $rule.RemoteAddresses = "255.255.255.255"
                        $rule.Enabled = $true
                    } else {
                        $rule.RemoteAddresses = ($remaining -join ",")
                        $rule.Enabled = $true
                    }
                    $success = $true
                }
            }
        }
    } catch {}

    return $success
}

function Ban-IPAddressManual {
    param([string]$ip)
    if ([string]::IsNullOrWhiteSpace($ip)) { return $false }
    $cleanIp = $ip.Trim().Replace("/255.255.255.255", "").Replace("/32", "")
    if (-not $script:ManualBanTimes) { $script:ManualBanTimes = @{} }
    $script:ManualBanTimes[$cleanIp] = (Get-Date)

    try {
        $fw = New-Object -ComObject HNetCfg.FwPolicy2
        $manualRule = $null
        foreach ($rule in $fw.Rules) {
            if ($rule.Name -eq "IPBan_Manual_Block") {
                $manualRule = $rule
                break
            }
        }

        if ($null -eq $manualRule) {
            $ruleType = [Type]::GetTypeFromProgID("HNetCfg.FWRule")
            $newRule = [Activator]::CreateInstance($ruleType)
            $newRule.Name = "IPBan_Manual_Block"
            $newRule.Description = "Ручне блокування IP-адреси через IPBan GUI Manager"
            $newRule.Action = 0 # NET_FW_ACTION_BLOCK
            $newRule.Direction = 1 # NET_FW_RULE_DIR_IN
            $newRule.Enabled = $true
            $newRule.Protocol = 256 # Any
            $newRule.RemoteAddresses = $cleanIp
            $fw.Rules.Add($newRule)
        } else {
            $addresses = ($manualRule.RemoteAddresses -split ",") | ForEach-Object { $_.Trim() }
            if ($addresses -notcontains $cleanIp) {
                $addresses += $cleanIp
                $manualRule.RemoteAddresses = ($addresses -join ",")
                $manualRule.Enabled = $true
            }
        }
        return $true
    } catch {
        [System.Windows.Forms.MessageBox]::Show("Помилка додавання блокування у Firewall: $_", "Помилка", [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Error)
        return $false
    }
}

function Get-WindowsFailedLogins {
    param([int]$maxEvents = 30)
    $events = @()
    try {
        $rawEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents $maxEvents -ErrorAction Stop
        foreach ($ev in $rawEvents) {
            $xml = [xml]$ev.ToXml()
            $eventData = @{}
            foreach ($data in $xml.Event.EventData.Data) {
                $eventData[$data.Name] = $data.'#text'
            }

            $user = $eventData['TargetUserName']
            $domain = $eventData['TargetDomainName']
            if ($domain -and $domain -ne "-") { $user = "$domain\$user" }
            $ip = $eventData['IpAddress']
            if ([string]::IsNullOrWhiteSpace($ip) -or $ip -eq "-") { $ip = "Локальний процес" }
            $workstation = $eventData['WorkstationName']
            $logonType = $eventData['LogonType']
            $logonTypeDesc = switch ($logonType) {
                "2"  { "Interactive (Локально)" }
                "3"  { "Network (Мережа/SMB)" }
                "10" { "RemoteDesktop (RDP)" }
                default { "Тип $logonType" }
            }

            $events += [PSCustomObject]@{
                TimeCreated   = $ev.TimeCreated.ToString("yyyy-MM-dd HH:mm:ss")
                TargetUser    = $user
                IPAddress     = $ip
                LogonType     = $logonTypeDesc
                Workstation   = $workstation
                Status        = $eventData['Status']
            }
        }
    } catch {
        # Подій немає або немає доступу
    }
    return $events
}

# ------------------------------------------------------------------------------
# Створення Головного Вікна
# ------------------------------------------------------------------------------

$form = New-Object System.Windows.Forms.Form
$form.Text = "IPBan Manager & Control Center"
$screen = [System.Windows.Forms.Screen]::PrimaryScreen
$workArea = if ($screen) { $screen.WorkingArea } else { New-Object System.Drawing.Rectangle(0, 0, 1024, 768) }
$initWidth = [Math]::Min(1050, [Math]::Max(760, $workArea.Width - 30))
$initHeight = [Math]::Min(690, [Math]::Max(480, $workArea.Height - 40))
$form.Size = New-Object System.Drawing.Size($initWidth, $initHeight)
$form.MinimumSize = New-Object System.Drawing.Size(740, 480)
$form.StartPosition = "CenterScreen"
$form.Font = New-Object System.Drawing.Font("Segoe UI", 9.25)
$form.BackColor = [System.Drawing.Color]::FromArgb(248, 250, 252)

# Підлаштування форми під робочу область екрана (запобігає зрізанню нижньої границі)
$form.Add_Load({
    try {
        $wa = [System.Windows.Forms.Screen]::FromControl($form).WorkingArea
        if ($form.Height -gt $wa.Height) {
            $form.Height = [Math]::Max(480, $wa.Height - 30)
        }
        if ($form.Width -gt $wa.Width) {
            $form.Width = [Math]::Max(740, $wa.Width - 30)
        }
        $form.Top = [Math]::Max($wa.Top, [int]($wa.Top + ($wa.Height - $form.Height) / 2))
        $form.Left = [Math]::Max($wa.Left, [int]($wa.Left + ($wa.Width - $form.Width) / 2))
    } catch {}
})

# Головна вертикальна розмітка
$mainLayout = New-Object System.Windows.Forms.TableLayoutPanel
$mainLayout.Dock = [System.Windows.Forms.DockStyle]::Fill
$mainLayout.ColumnCount = 1
$mainLayout.RowCount = 4
$mainLayout.RowStyles.Add((New-Object System.Windows.Forms.RowStyle([System.Windows.Forms.SizeType]::Absolute, 85)))  # Header
$mainLayout.RowStyles.Add((New-Object System.Windows.Forms.RowStyle([System.Windows.Forms.SizeType]::Absolute, 45)))  # Path Bar
$mainLayout.RowStyles.Add((New-Object System.Windows.Forms.RowStyle([System.Windows.Forms.SizeType]::Percent, 100))) # Tabs
$mainLayout.RowStyles.Add((New-Object System.Windows.Forms.RowStyle([System.Windows.Forms.SizeType]::Absolute, 30)))  # StatusStrip
$form.Controls.Add($mainLayout)

# ------------------------------------------------------------------------------
# 1. Шапка форми (Header / Service Control)
# ------------------------------------------------------------------------------
$headerPanel = New-Object System.Windows.Forms.Panel
$headerPanel.Dock = [System.Windows.Forms.DockStyle]::Fill
$headerPanel.BackColor = [System.Drawing.Color]::FromArgb(24, 32, 47)
$headerPanel.Padding = New-Object System.Windows.Forms.Padding(15, 10, 15, 10)
$mainLayout.Controls.Add($headerPanel, 0, 0)

$lblTitle = New-Object System.Windows.Forms.Label
$lblTitle.Text = "IPBan Control Center $script:AppVersion"
$lblTitle.Font = New-Object System.Drawing.Font("Segoe UI", 14, [System.Drawing.FontStyle]::Bold)
$lblTitle.ForeColor = [System.Drawing.Color]::White
$lblTitle.Location = New-Object System.Drawing.Point(15, 12)
$lblTitle.AutoSize = $true
$headerPanel.Controls.Add($lblTitle)

$lblSubtitle = New-Object System.Windows.Forms.Label
$lblSubtitle.Text = "Автоматичний захист від Brute-Force атак (RDP, SSH, SQL)"
$lblSubtitle.Font = New-Object System.Drawing.Font("Segoe UI", 8.5)
$lblSubtitle.ForeColor = [System.Drawing.Color]::FromArgb(148, 163, 184)
$lblSubtitle.Location = New-Object System.Drawing.Point(18, 42)
$lblSubtitle.AutoSize = $true
$headerPanel.Controls.Add($lblSubtitle)

# Статус бейдж
$lblStatusBadge = New-Object System.Windows.Forms.Label
$lblStatusBadge.Text = "Перевірка..."
$lblStatusBadge.Font = New-Object System.Drawing.Font("Segoe UI", 10, [System.Drawing.FontStyle]::Bold)
$lblStatusBadge.ForeColor = [System.Drawing.Color]::White
$lblStatusBadge.BackColor = [System.Drawing.Color]::FromArgb(71, 85, 105)
$lblStatusBadge.Size = New-Object System.Drawing.Size(150, 36)
$lblStatusBadge.TextAlign = [System.Drawing.ContentAlignment]::MiddleCenter
$headerPanel.Controls.Add($lblStatusBadge)

# Кнопки керування службою
$btnStartService = New-Object System.Windows.Forms.Button
$btnStartService.Text = T "BtnStart"
$btnStartService.Size = New-Object System.Drawing.Size(95, 36)
$btnStartService.Font = New-Object System.Drawing.Font("Segoe UI", 9, [System.Drawing.FontStyle]::Bold)
$btnStartService.BackColor = [System.Drawing.Color]::FromArgb(22, 163, 74)
$btnStartService.ForeColor = [System.Drawing.Color]::White
$btnStartService.FlatStyle = [System.Windows.Forms.FlatStyle]::Flat
$btnStartService.FlatAppearance.BorderSize = 0
$btnStartService.Cursor = [System.Windows.Forms.Cursors]::Hand
$headerPanel.Controls.Add($btnStartService)

$btnStopService = New-Object System.Windows.Forms.Button
$btnStopService.Text = T "BtnStop"
$btnStopService.Size = New-Object System.Drawing.Size(92, 36)
$btnStopService.Font = New-Object System.Drawing.Font("Segoe UI", 9, [System.Drawing.FontStyle]::Bold)
$btnStopService.BackColor = [System.Drawing.Color]::FromArgb(220, 38, 38)
$btnStopService.ForeColor = [System.Drawing.Color]::White
$btnStopService.FlatStyle = [System.Windows.Forms.FlatStyle]::Flat
$btnStopService.FlatAppearance.BorderSize = 0
$btnStopService.Cursor = [System.Windows.Forms.Cursors]::Hand
$headerPanel.Controls.Add($btnStopService)

$btnRestartService = New-Object System.Windows.Forms.Button
$btnRestartService.Text = T "BtnRestart"
$btnRestartService.Size = New-Object System.Drawing.Size(85, 36)
$btnRestartService.Font = New-Object System.Drawing.Font("Segoe UI", 9, [System.Drawing.FontStyle]::Bold)
$btnRestartService.BackColor = [System.Drawing.Color]::FromArgb(37, 99, 235)
$btnRestartService.ForeColor = [System.Drawing.Color]::White
$btnRestartService.FlatStyle = [System.Windows.Forms.FlatStyle]::Flat
$btnRestartService.FlatAppearance.BorderSize = 0
$btnRestartService.Cursor = [System.Windows.Forms.Cursors]::Hand
$headerPanel.Controls.Add($btnRestartService)

$btnRefreshAll = New-Object System.Windows.Forms.Button
$btnRefreshAll.Text = T "BtnRefresh"
$btnRefreshAll.Size = New-Object System.Drawing.Size(88, 36)
$btnRefreshAll.Font = New-Object System.Drawing.Font("Segoe UI", 9, [System.Drawing.FontStyle]::Bold)
$btnRefreshAll.BackColor = [System.Drawing.Color]::FromArgb(71, 85, 105)
$btnRefreshAll.ForeColor = [System.Drawing.Color]::White
$btnRefreshAll.FlatStyle = [System.Windows.Forms.FlatStyle]::Flat
$btnRefreshAll.FlatAppearance.BorderSize = 0
$btnRefreshAll.Cursor = [System.Windows.Forms.Cursors]::Hand
$headerPanel.Controls.Add($btnRefreshAll)

# Кнопка перемикання мови інтерфейсу (UA / EN)
$btnLang = New-Object System.Windows.Forms.Button
$btnLang.Text = T "LangToggle"
$btnLang.Size = New-Object System.Drawing.Size(95, 36)
$btnLang.Font = New-Object System.Drawing.Font("Segoe UI", 9, [System.Drawing.FontStyle]::Bold)
$btnLang.BackColor = [System.Drawing.Color]::FromArgb(51, 65, 85)
$btnLang.ForeColor = [System.Drawing.Color]::White
$btnLang.FlatStyle = [System.Windows.Forms.FlatStyle]::Flat
$btnLang.FlatAppearance.BorderSize = 0
$btnLang.Cursor = [System.Windows.Forms.Cursors]::Hand
$headerPanel.Controls.Add($btnLang)

Set-SmoothButton $lblStatusBadge 8
Set-SmoothButton $btnStartService 8
Set-SmoothButton $btnStopService 8
Set-SmoothButton $btnRestartService 8
Set-SmoothButton $btnRefreshAll 8
Set-SmoothButton $btnLang 8

function Update-HeaderLayout {
    $w = $headerPanel.ClientSize.Width
    $right = $w - 15

    $btnLang.Location = New-Object System.Drawing.Point(($right - 95), 20)
    $right -= (95 + 8)

    $btnRefreshAll.Location = New-Object System.Drawing.Point(($right - 88), 20)
    $right -= (88 + 8)

    $btnRestartService.Location = New-Object System.Drawing.Point(($right - 85), 20)
    $right -= (85 + 8)

    $btnStopService.Location = New-Object System.Drawing.Point(($right - 92), 20)
    $right -= (92 + 8)

    $btnStartService.Location = New-Object System.Drawing.Point(($right - 95), 20)
    $right -= (95 + 12)

    $lblStatusBadge.Location = New-Object System.Drawing.Point(($right - 150), 20)
}
$headerPanel.Add_Resize({ Update-HeaderLayout })
Update-HeaderLayout

$btnLang.Add_Click({
    if ($script:CurrentLang -eq "UA") {
        Apply-Language "EN"
    } else {
        Apply-Language "UA"
    }
})

# ------------------------------------------------------------------------------
# 2. Рядок шляху до IPBan (Path Bar)
# ------------------------------------------------------------------------------
$pathPanel = New-Object System.Windows.Forms.Panel
$pathPanel.Dock = [System.Windows.Forms.DockStyle]::Fill
$pathPanel.BackColor = [System.Drawing.Color]::FromArgb(241, 245, 249)
$pathPanel.Padding = New-Object System.Windows.Forms.Padding(10, 8, 10, 8)
$mainLayout.Controls.Add($pathPanel, 0, 1)

$lblPath = New-Object System.Windows.Forms.Label
$lblPath.Text = "Папка IPBan:"
$lblPath.Font = New-Object System.Drawing.Font("Segoe UI", 9, [System.Drawing.FontStyle]::Bold)
$lblPath.Location = New-Object System.Drawing.Point(10, 11)
$lblPath.AutoSize = $true
$pathPanel.Controls.Add($lblPath)

$txtInstallPath = New-Object System.Windows.Forms.TextBox
$txtInstallPath.Text = Get-IPBanPath
$pathPanel.Controls.Add($txtInstallPath)

$btnBrowsePath = New-Object System.Windows.Forms.Button
$btnBrowsePath.Text = "Огляд..."
$btnBrowsePath.Size = New-Object System.Drawing.Size(80, 27)
$pathPanel.Controls.Add($btnBrowsePath)

$btnOpenFolder = New-Object System.Windows.Forms.Button
$btnOpenFolder.Text = "Відкрити папку"
$btnOpenFolder.Size = New-Object System.Drawing.Size(130, 27)
$pathPanel.Controls.Add($btnOpenFolder)

$btnOpenConfigFile = New-Object System.Windows.Forms.Button
$btnOpenConfigFile.Text = "Відкрити конфіг"
$btnOpenConfigFile.Size = New-Object System.Drawing.Size(135, 27)
$pathPanel.Controls.Add($btnOpenConfigFile)

Set-SmoothButton $btnBrowsePath 6 ([System.Drawing.Color]::FromArgb(203, 213, 225))
Set-SmoothButton $btnOpenFolder 6 ([System.Drawing.Color]::FromArgb(203, 213, 225))
Set-SmoothButton $btnOpenConfigFile 6 ([System.Drawing.Color]::FromArgb(203, 213, 225))

function Update-PathPanelLayout {
    if (-not $pathPanel -or -not $btnOpenConfigFile -or -not $lblPath -or -not $txtInstallPath) { return }
    $w = $pathPanel.ClientSize.Width
    $right = $w - 10

    $btnOpenConfigFile.Location = New-Object System.Drawing.Point(($right - $btnOpenConfigFile.Width), 7)
    $right -= ($btnOpenConfigFile.Width + 8)

    $btnOpenFolder.Location = New-Object System.Drawing.Point(($right - $btnOpenFolder.Width), 7)
    $right -= ($btnOpenFolder.Width + 8)

    $btnBrowsePath.Location = New-Object System.Drawing.Point(($right - $btnBrowsePath.Width), 7)
    $right -= ($btnBrowsePath.Width + 8)

    $txtLeft = $lblPath.Right + 8
    $txtWidth = [Math]::Max(80, ($right - $txtLeft))
    $txtInstallPath.Location = New-Object System.Drawing.Point($txtLeft, 8)
    $txtInstallPath.Size = New-Object System.Drawing.Size($txtWidth, 25)
}
$pathPanel.Add_Resize({ Update-PathPanelLayout })
Update-PathPanelLayout

# ------------------------------------------------------------------------------
# 3. Вкладки інтерфейсу (TabControl)
# ------------------------------------------------------------------------------
$tabControl = New-Object System.Windows.Forms.TabControl
$tabControl.Dock = [System.Windows.Forms.DockStyle]::Fill
$tabControl.Font = New-Object System.Drawing.Font("Segoe UI", 9.5)
$mainLayout.Controls.Add($tabControl, 0, 2)

# ==============================================================================
# ВКЛАДКА 1: Заблоковані IP (Banned IPs & Firewall)
# ==============================================================================
$tabBanned = New-Object System.Windows.Forms.TabPage
$tabBanned.Text = "  Заблоковані IP  "
$tabBanned.BackColor = [System.Drawing.Color]::White
$tabControl.TabPages.Add($tabBanned)

$layoutBanned = New-Object System.Windows.Forms.TableLayoutPanel
$layoutBanned.Dock = [System.Windows.Forms.DockStyle]::Fill
$layoutBanned.RowCount = 3
$layoutBanned.ColumnCount = 1
$layoutBanned.RowStyles.Add((New-Object System.Windows.Forms.RowStyle([System.Windows.Forms.SizeType]::AutoSize)))
$layoutBanned.RowStyles.Add((New-Object System.Windows.Forms.RowStyle([System.Windows.Forms.SizeType]::Percent, 100)))
$layoutBanned.RowStyles.Add((New-Object System.Windows.Forms.RowStyle([System.Windows.Forms.SizeType]::Absolute, 40)))
$tabBanned.Controls.Add($layoutBanned)

# Панель дій над заблокованими IP (адаптивний FlowLayoutPanel із автоперенесенням)
$panelBannedActions = New-Object System.Windows.Forms.FlowLayoutPanel
$panelBannedActions.Dock = [System.Windows.Forms.DockStyle]::Fill
$panelBannedActions.AutoSize = $true
$panelBannedActions.AutoSizeMode = [System.Windows.Forms.AutoSizeMode]::GrowAndShrink
$panelBannedActions.WrapContents = $true
$panelBannedActions.Padding = New-Object System.Windows.Forms.Padding(6, 6, 6, 4)
$layoutBanned.Controls.Add($panelBannedActions, 0, 0)

$lblSearch = New-Object System.Windows.Forms.Label
$lblSearch.Text = (T "Search")
$lblSearch.AutoSize = $true
$lblSearch.Margin = New-Object System.Windows.Forms.Padding(3, 7, 3, 3)
$panelBannedActions.Controls.Add($lblSearch)

$txtSearchBanned = New-Object System.Windows.Forms.TextBox
$txtSearchBanned.Size = New-Object System.Drawing.Size(110, 25)
$txtSearchBanned.Margin = New-Object System.Windows.Forms.Padding(3, 4, 8, 3)
$panelBannedActions.Controls.Add($txtSearchBanned)

$lblFilterType = New-Object System.Windows.Forms.Label
$lblFilterType.Text = (T "Filter")
$lblFilterType.AutoSize = $true
$lblFilterType.Margin = New-Object System.Windows.Forms.Padding(3, 7, 3, 3)
$panelBannedActions.Controls.Add($lblFilterType)

$cbRuleFilter = New-Object System.Windows.Forms.ComboBox
$cbRuleFilter.DropDownStyle = [System.Windows.Forms.ComboBoxStyle]::DropDownList
$cbRuleFilter.Size = New-Object System.Drawing.Size(190, 25)
$cbRuleFilter.Margin = New-Object System.Windows.Forms.Padding(3, 4, 8, 3)
$cbRuleFilter.Items.AddRange(@(
    "⛔ Тільки локальні блокування",
    "⚪ Тільки білий список",
    "🏴 Чорний список (Blacklist)",
    "📋 Всі правила IPBan"
))
$cbRuleFilter.SelectedIndex = 0
$panelBannedActions.Controls.Add($cbRuleFilter)

$btnUnbanSelected = New-Object System.Windows.Forms.Button
$btnUnbanSelected.Text = (T "BtnUnbanSelected")
$btnUnbanSelected.Size = New-Object System.Drawing.Size(150, 28)
$btnUnbanSelected.Font = New-Object System.Drawing.Font("Segoe UI", 9, [System.Drawing.FontStyle]::Bold)
$btnUnbanSelected.BackColor = [System.Drawing.Color]::FromArgb(239, 246, 255)
$btnUnbanSelected.ForeColor = [System.Drawing.Color]::FromArgb(29, 78, 216)
$btnUnbanSelected.Margin = New-Object System.Windows.Forms.Padding(3, 2, 6, 3)
$panelBannedActions.Controls.Add($btnUnbanSelected)

$btnManualBan = New-Object System.Windows.Forms.Button
$btnManualBan.Text = (T "BtnManualBan")
$btnManualBan.Size = New-Object System.Drawing.Size(150, 28)
$btnManualBan.BackColor = [System.Drawing.Color]::FromArgb(254, 242, 242)
$btnManualBan.ForeColor = [System.Drawing.Color]::FromArgb(185, 28, 28)
$btnManualBan.Margin = New-Object System.Windows.Forms.Padding(3, 2, 6, 3)
$panelBannedActions.Controls.Add($btnManualBan)

$btnUnbanAll = New-Object System.Windows.Forms.Button
$btnUnbanAll.Text = (T "BtnUnbanAll")
$btnUnbanAll.Size = New-Object System.Drawing.Size(155, 28)
$btnUnbanAll.Margin = New-Object System.Windows.Forms.Padding(3, 2, 6, 3)
$panelBannedActions.Controls.Add($btnUnbanAll)

$btnExportBanned = New-Object System.Windows.Forms.Button
$btnExportBanned.Text = (T "BtnExport")
$btnExportBanned.Size = New-Object System.Drawing.Size(90, 28)
$btnExportBanned.Margin = New-Object System.Windows.Forms.Padding(3, 2, 6, 3)
$panelBannedActions.Controls.Add($btnExportBanned)

Set-SmoothButton $btnUnbanSelected 6
Set-SmoothButton $btnManualBan 6
Set-SmoothButton $btnUnbanAll 6
Set-SmoothButton $btnExportBanned 6

# Таблиця заблокованих IP
$dgvBanned = New-Object System.Windows.Forms.DataGridView
$dgvBanned.Dock = [System.Windows.Forms.DockStyle]::Fill
$dgvBanned.ReadOnly = $true
$dgvBanned.AllowUserToAddRows = $false
$dgvBanned.AllowUserToDeleteRows = $false
$dgvBanned.SelectionMode = [System.Windows.Forms.DataGridViewSelectionMode]::FullRowSelect
$dgvBanned.MultiSelect = $true
$dgvBanned.AutoSizeColumnsMode = [System.Windows.Forms.DataGridViewAutoSizeColumnsMode]::Fill
$dgvBanned.BackgroundColor = [System.Drawing.Color]::White
$dgvBanned.BorderStyle = [System.Windows.Forms.BorderStyle]::None
$dgvBanned.RowHeadersVisible = $false

[void]$dgvBanned.Columns.Add("Index", "#")

$colIPLink = New-Object System.Windows.Forms.DataGridViewLinkColumn
$colIPLink.Name = "IPAddress"
$colIPLink.HeaderText = (T "ColIP")
$colIPLink.LinkColor = [System.Drawing.Color]::FromArgb(29, 78, 216)
$colIPLink.ActiveLinkColor = [System.Drawing.Color]::FromArgb(30, 58, 138)
$colIPLink.VisitedLinkColor = [System.Drawing.Color]::FromArgb(29, 78, 216)
$colIPLink.LinkBehavior = [System.Windows.Forms.LinkBehavior]::HoverUnderline
[void]$dgvBanned.Columns.Add($colIPLink)

[void]$dgvBanned.Columns.Add("Country", (T "ColCountry"))
[void]$dgvBanned.Columns.Add("BanDate", (T "ColBanTime"))
[void]$dgvBanned.Columns.Add("UnbanDate", (T "ColUnbanTime"))

$dgvBanned.Columns["Index"].FillWeight = 6
$dgvBanned.Columns["IPAddress"].FillWeight = 24
$dgvBanned.Columns["Country"].FillWeight = 24
$dgvBanned.Columns["BanDate"].FillWeight = 23
$dgvBanned.Columns["UnbanDate"].FillWeight = 23

# Перевірка Whois при кліку на IP-адресу
$dgvBanned.Add_CellContentClick({
    param($sender, $e)
    if ($e.RowIndex -ge 0 -and $e.ColumnIndex -eq $dgvBanned.Columns["IPAddress"].Index) {
        $cellVal = $dgvBanned.Rows[$e.RowIndex].Cells["IPAddress"].Value
        if ($cellVal) {
            $ipStr = $cellVal.ToString().Trim().Replace("/255.255.255.255", "").Replace("/32", "")
            if ($ipStr) {
                try {
                    [System.Diagnostics.Process]::Start("https://ipinfo.io/$ipStr") | Out-Null
                } catch {
                    [System.Windows.Forms.MessageBox]::Show("Не вдалося відкрити браузер: $_", "Помилка", [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Warning)
                }
            }
        }
    }
})

$layoutBanned.Controls.Add($dgvBanned, 0, 1)

# Підвал таблиці
$panelBannedFooter = New-Object System.Windows.Forms.Panel
$panelBannedFooter.Dock = [System.Windows.Forms.DockStyle]::Fill
$panelBannedFooter.Padding = New-Object System.Windows.Forms.Padding(10, 8, 10, 5)
$layoutBanned.Controls.Add($panelBannedFooter, 0, 2)

$lblBannedCount = New-Object System.Windows.Forms.Label
$lblBannedCount.Text = "Загалом заблоковано: 0 IP-адрес"
$lblBannedCount.Font = New-Object System.Drawing.Font("Segoe UI", 9, [System.Drawing.FontStyle]::Bold)
$lblBannedCount.ForeColor = [System.Drawing.Color]::FromArgb(51, 65, 85)
$lblBannedCount.Location = New-Object System.Drawing.Point(10, 10)
$lblBannedCount.AutoSize = $true
$panelBannedFooter.Controls.Add($lblBannedCount)

# Контекстне меню для таблиці заблокованих IP (без Whois, оскільки IP тепер клікабельний лінк)
$ctxBanned = New-Object System.Windows.Forms.ContextMenuStrip
$miCopyIP = $ctxBanned.Items.Add((T "MiCopyIP"))
$miUnban = $ctxBanned.Items.Add((T "MiUnban"))
$miWhitelist = $ctxBanned.Items.Add((T "MiWhitelist"))
$dgvBanned.ContextMenuStrip = $ctxBanned
Enable-DoubleBuffering $dgvBanned

# ==============================================================================
# ВКЛАДКА 2: Статистика атак (GeoIP та розподіл за часом)
# ==============================================================================
$tabStats = New-Object System.Windows.Forms.TabPage
$tabStats.Text = (T "TabStats")
$tabStats.BackColor = [System.Drawing.Color]::White
$tabStats.AutoScroll = $true
$tabControl.TabPages.Add($tabStats)

$layoutStats = New-Object System.Windows.Forms.TableLayoutPanel
$layoutStats.Dock = [System.Windows.Forms.DockStyle]::Fill
$layoutStats.RowCount = 3
$layoutStats.ColumnCount = 1
$layoutStats.RowStyles.Add((New-Object System.Windows.Forms.RowStyle([System.Windows.Forms.SizeType]::AutoSize)))
$layoutStats.RowStyles.Add((New-Object System.Windows.Forms.RowStyle([System.Windows.Forms.SizeType]::Percent, 100)))
$layoutStats.RowStyles.Add((New-Object System.Windows.Forms.RowStyle([System.Windows.Forms.SizeType]::Absolute, 40)))
$tabStats.Controls.Add($layoutStats)

# --- Рядок 0: KPI картки (4 шт) ---
$panelKpis = New-Object System.Windows.Forms.TableLayoutPanel
$panelKpis.Dock = [System.Windows.Forms.DockStyle]::Fill
$panelKpis.AutoSize = $true
$panelKpis.AutoSizeMode = [System.Windows.Forms.AutoSizeMode]::GrowAndShrink
$panelKpis.RowCount = 1
$panelKpis.ColumnCount = 4
$panelKpis.ColumnStyles.Add((New-Object System.Windows.Forms.ColumnStyle([System.Windows.Forms.SizeType]::Percent, 25)))
$panelKpis.ColumnStyles.Add((New-Object System.Windows.Forms.ColumnStyle([System.Windows.Forms.SizeType]::Percent, 25)))
$panelKpis.ColumnStyles.Add((New-Object System.Windows.Forms.ColumnStyle([System.Windows.Forms.SizeType]::Percent, 25)))
$panelKpis.ColumnStyles.Add((New-Object System.Windows.Forms.ColumnStyle([System.Windows.Forms.SizeType]::Percent, 25)))
$panelKpis.Padding = New-Object System.Windows.Forms.Padding(8, 4, 8, 6)
$panelKpis.Margin = New-Object System.Windows.Forms.Padding(0, 0, 0, 6)
$layoutStats.Controls.Add($panelKpis, 0, 0)

# Card 1: Всього заблоковано
$cardTotalBanned = New-Object System.Windows.Forms.Panel
$cardTotalBanned.Dock = [System.Windows.Forms.DockStyle]::Fill
$cardTotalBanned.Height = 84
$cardTotalBanned.BackColor = [System.Drawing.Color]::FromArgb(239, 246, 255)
$cardTotalBanned.BorderStyle = [System.Windows.Forms.BorderStyle]::None
$cardTotalBanned.Margin = New-Object System.Windows.Forms.Padding(4, 3, 4, 5)
$cardTotalBanned.Padding = New-Object System.Windows.Forms.Padding(8, 6, 8, 4)
$cardTotalBanned.Add_Paint([System.Windows.Forms.PaintEventHandler]{
    param($s, $e)
    $pen = New-Object System.Drawing.Pen([System.Drawing.Color]::FromArgb(147, 197, 253), 1)
    $e.Graphics.DrawRectangle($pen, 0, 0, ($s.Width - 1), ($s.Height - 1))
    $pen.Dispose()
})

$lblCardTotalBannedTitle = New-Object System.Windows.Forms.Label
$lblCardTotalBannedTitle.Text = (T "CardTotalBanned")
$lblCardTotalBannedTitle.Font = New-Object System.Drawing.Font("Segoe UI", 8.5)
$lblCardTotalBannedTitle.ForeColor = [System.Drawing.Color]::FromArgb(71, 85, 105)
$lblCardTotalBannedTitle.Location = New-Object System.Drawing.Point(8, 6)
$lblCardTotalBannedTitle.AutoSize = $true

$lblCardTotalBannedVal = New-Object System.Windows.Forms.Label
$lblCardTotalBannedVal.Text = "0"
$lblCardTotalBannedVal.Font = New-Object System.Drawing.Font("Segoe UI", 15, [System.Drawing.FontStyle]::Bold)
$lblCardTotalBannedVal.ForeColor = [System.Drawing.Color]::FromArgb(30, 64, 175)
$lblCardTotalBannedVal.Location = New-Object System.Drawing.Point(8, 26)
$lblCardTotalBannedVal.AutoSize = $true

$cardTotalBanned.Controls.Add($lblCardTotalBannedVal)
$cardTotalBanned.Controls.Add($lblCardTotalBannedTitle)
$panelKpis.Controls.Add($cardTotalBanned, 0, 0)

# Card 2: Унікальних країн
$cardUniqueCountries = New-Object System.Windows.Forms.Panel
$cardUniqueCountries.Dock = [System.Windows.Forms.DockStyle]::Fill
$cardUniqueCountries.Height = 84
$cardUniqueCountries.BackColor = [System.Drawing.Color]::FromArgb(236, 253, 245)
$cardUniqueCountries.BorderStyle = [System.Windows.Forms.BorderStyle]::None
$cardUniqueCountries.Margin = New-Object System.Windows.Forms.Padding(4, 3, 4, 5)
$cardUniqueCountries.Padding = New-Object System.Windows.Forms.Padding(8, 6, 8, 4)
$cardUniqueCountries.Add_Paint([System.Windows.Forms.PaintEventHandler]{
    param($s, $e)
    $pen = New-Object System.Drawing.Pen([System.Drawing.Color]::FromArgb(110, 231, 183), 1)
    $e.Graphics.DrawRectangle($pen, 0, 0, ($s.Width - 1), ($s.Height - 1))
    $pen.Dispose()
})

$lblCardUniqueCountriesTitle = New-Object System.Windows.Forms.Label
$lblCardUniqueCountriesTitle.Text = (T "CardUniqueCountries")
$lblCardUniqueCountriesTitle.Font = New-Object System.Drawing.Font("Segoe UI", 8.5)
$lblCardUniqueCountriesTitle.ForeColor = [System.Drawing.Color]::FromArgb(71, 85, 105)
$lblCardUniqueCountriesTitle.Location = New-Object System.Drawing.Point(8, 6)
$lblCardUniqueCountriesTitle.AutoSize = $true

$lblCardUniqueCountriesVal = New-Object System.Windows.Forms.Label
$lblCardUniqueCountriesVal.Text = "0"
$lblCardUniqueCountriesVal.Font = New-Object System.Drawing.Font("Segoe UI", 15, [System.Drawing.FontStyle]::Bold)
$lblCardUniqueCountriesVal.ForeColor = [System.Drawing.Color]::FromArgb(6, 95, 70)
$lblCardUniqueCountriesVal.Location = New-Object System.Drawing.Point(8, 26)
$lblCardUniqueCountriesVal.AutoSize = $true

$cardUniqueCountries.Controls.Add($lblCardUniqueCountriesVal)
$cardUniqueCountries.Controls.Add($lblCardUniqueCountriesTitle)
$panelKpis.Controls.Add($cardUniqueCountries, 1, 0)

# Card 3: Топ-країна атак
$cardTopCountry = New-Object System.Windows.Forms.Panel
$cardTopCountry.Dock = [System.Windows.Forms.DockStyle]::Fill
$cardTopCountry.Height = 84
$cardTopCountry.BackColor = [System.Drawing.Color]::FromArgb(255, 241, 242)
$cardTopCountry.BorderStyle = [System.Windows.Forms.BorderStyle]::None
$cardTopCountry.Margin = New-Object System.Windows.Forms.Padding(4, 3, 4, 5)
$cardTopCountry.Padding = New-Object System.Windows.Forms.Padding(8, 6, 8, 4)
$cardTopCountry.Add_Paint([System.Windows.Forms.PaintEventHandler]{
    param($s, $e)
    $pen = New-Object System.Drawing.Pen([System.Drawing.Color]::FromArgb(252, 165, 165), 1)
    $e.Graphics.DrawRectangle($pen, 0, 0, ($s.Width - 1), ($s.Height - 1))
    $pen.Dispose()
})

$lblCardTopCountryTitle = New-Object System.Windows.Forms.Label
$lblCardTopCountryTitle.Text = (T "CardTopCountry")
$lblCardTopCountryTitle.Font = New-Object System.Drawing.Font("Segoe UI", 8.5)
$lblCardTopCountryTitle.ForeColor = [System.Drawing.Color]::FromArgb(71, 85, 105)
$lblCardTopCountryTitle.Location = New-Object System.Drawing.Point(8, 6)
$lblCardTopCountryTitle.AutoSize = $true

$lblCardTopCountryVal = New-Object System.Windows.Forms.Label
$lblCardTopCountryVal.Text = "—"
$lblCardTopCountryVal.Font = New-Object System.Drawing.Font("Segoe UI", 11.5, [System.Drawing.FontStyle]::Bold)
$lblCardTopCountryVal.ForeColor = [System.Drawing.Color]::FromArgb(159, 18, 57)
$lblCardTopCountryVal.Location = New-Object System.Drawing.Point(8, 26)
$lblCardTopCountryVal.Size = New-Object System.Drawing.Size(220, 52)
$lblCardTopCountryVal.TextAlign = [System.Drawing.ContentAlignment]::TopLeft
$lblCardTopCountryVal.AutoEllipsis = $true
$lblCardTopCountryVal.Anchor = ([System.Windows.Forms.AnchorStyles]::Top -bor [System.Windows.Forms.AnchorStyles]::Left -bor [System.Windows.Forms.AnchorStyles]::Right -bor [System.Windows.Forms.AnchorStyles]::Bottom)

$cardTopCountry.Controls.Add($lblCardTopCountryVal)
$cardTopCountry.Controls.Add($lblCardTopCountryTitle)
$panelKpis.Controls.Add($cardTopCountry, 2, 0)

# Card 4: Піковий час атак
$cardPeakHour = New-Object System.Windows.Forms.Panel
$cardPeakHour.Dock = [System.Windows.Forms.DockStyle]::Fill
$cardPeakHour.Height = 84
$cardPeakHour.BackColor = [System.Drawing.Color]::FromArgb(255, 251, 235)
$cardPeakHour.BorderStyle = [System.Windows.Forms.BorderStyle]::None
$cardPeakHour.Margin = New-Object System.Windows.Forms.Padding(4, 3, 4, 5)
$cardPeakHour.Padding = New-Object System.Windows.Forms.Padding(8, 6, 8, 4)
$cardPeakHour.Add_Paint([System.Windows.Forms.PaintEventHandler]{
    param($s, $e)
    $pen = New-Object System.Drawing.Pen([System.Drawing.Color]::FromArgb(252, 211, 77), 1)
    $e.Graphics.DrawRectangle($pen, 0, 0, ($s.Width - 1), ($s.Height - 1))
    $pen.Dispose()
})

$lblCardPeakHourTitle = New-Object System.Windows.Forms.Label
$lblCardPeakHourTitle.Text = (T "CardPeakHour")
$lblCardPeakHourTitle.Font = New-Object System.Drawing.Font("Segoe UI", 8.5)
$lblCardPeakHourTitle.ForeColor = [System.Drawing.Color]::FromArgb(71, 85, 105)
$lblCardPeakHourTitle.Location = New-Object System.Drawing.Point(8, 6)
$lblCardPeakHourTitle.AutoSize = $true

$lblCardPeakHourVal = New-Object System.Windows.Forms.Label
$lblCardPeakHourVal.Text = "—"
$lblCardPeakHourVal.Font = New-Object System.Drawing.Font("Segoe UI", 12.5, [System.Drawing.FontStyle]::Bold)
$lblCardPeakHourVal.ForeColor = [System.Drawing.Color]::FromArgb(146, 64, 14)
$lblCardPeakHourVal.Location = New-Object System.Drawing.Point(8, 26)
$lblCardPeakHourVal.Size = New-Object System.Drawing.Size(220, 52)
$lblCardPeakHourVal.TextAlign = [System.Drawing.ContentAlignment]::TopLeft
$lblCardPeakHourVal.AutoEllipsis = $true
$lblCardPeakHourVal.Anchor = ([System.Windows.Forms.AnchorStyles]::Top -bor [System.Windows.Forms.AnchorStyles]::Left -bor [System.Windows.Forms.AnchorStyles]::Right -bor [System.Windows.Forms.AnchorStyles]::Bottom)

$cardPeakHour.Controls.Add($lblCardPeakHourVal)
$cardPeakHour.Controls.Add($lblCardPeakHourTitle)
$panelKpis.Controls.Add($cardPeakHour, 3, 0)

# --- Рядок 1: Головна область (2 колонки: Країни ліворуч, Години праворуч) ---
$panelStatsBody = New-Object System.Windows.Forms.TableLayoutPanel
$panelStatsBody.Dock = [System.Windows.Forms.DockStyle]::Fill
$panelStatsBody.RowCount = 1
$panelStatsBody.ColumnCount = 2
$panelStatsBody.ColumnStyles.Add((New-Object System.Windows.Forms.ColumnStyle([System.Windows.Forms.SizeType]::Percent, 50)))
$panelStatsBody.ColumnStyles.Add((New-Object System.Windows.Forms.ColumnStyle([System.Windows.Forms.SizeType]::Percent, 50)))
$panelStatsBody.Padding = New-Object System.Windows.Forms.Padding(8, 0, 8, 4)
$panelStatsBody.Margin = New-Object System.Windows.Forms.Padding(0, 6, 0, 0)
$layoutStats.Controls.Add($panelStatsBody, 0, 1)

# Ліва група: Топ-країни атак
$gbCountryStats = New-Object System.Windows.Forms.GroupBox
$gbCountryStats.Text = (T "GbCountryStats")
$gbCountryStats.Dock = [System.Windows.Forms.DockStyle]::Fill
$gbCountryStats.Font = New-Object System.Drawing.Font("Segoe UI", 9.5, [System.Drawing.FontStyle]::Bold)
$gbCountryStats.ForeColor = [System.Drawing.Color]::FromArgb(30, 41, 59)
$gbCountryStats.Padding = New-Object System.Windows.Forms.Padding(6)
$panelStatsBody.Controls.Add($gbCountryStats, 0, 0)

$dgvCountryStats = New-Object System.Windows.Forms.DataGridView
$dgvCountryStats.Dock = [System.Windows.Forms.DockStyle]::Fill
$dgvCountryStats.ReadOnly = $true
$dgvCountryStats.AllowUserToAddRows = $false
$dgvCountryStats.AllowUserToDeleteRows = $false
$dgvCountryStats.SelectionMode = [System.Windows.Forms.DataGridViewSelectionMode]::FullRowSelect
$dgvCountryStats.MultiSelect = $false
$dgvCountryStats.AutoSizeColumnsMode = [System.Windows.Forms.DataGridViewAutoSizeColumnsMode]::Fill
$dgvCountryStats.BackgroundColor = [System.Drawing.Color]::White
$dgvCountryStats.BorderStyle = [System.Windows.Forms.BorderStyle]::None
$dgvCountryStats.RowHeadersVisible = $false
$dgvCountryStats.Font = New-Object System.Drawing.Font("Segoe UI", 9, [System.Drawing.FontStyle]::Regular)
Enable-DoubleBuffering $dgvCountryStats

[void]$dgvCountryStats.Columns.Add("Rank", (T "ColStatsRank"))
[void]$dgvCountryStats.Columns.Add("Country", (T "ColStatsCountry"))
[void]$dgvCountryStats.Columns.Add("Count", (T "ColStatsCount"))
[void]$dgvCountryStats.Columns.Add("Share", (T "ColStatsShare"))
[void]$dgvCountryStats.Columns.Add("Bar", (T "ColStatsBar"))

$dgvCountryStats.Columns["Rank"].FillWeight = 8
$dgvCountryStats.Columns["Country"].FillWeight = 42
$dgvCountryStats.Columns["Count"].FillWeight = 16
$dgvCountryStats.Columns["Share"].FillWeight = 14
$dgvCountryStats.Columns["Bar"].FillWeight = 20
$dgvCountryStats.Columns["Rank"].DefaultCellStyle.Alignment = [System.Windows.Forms.DataGridViewContentAlignment]::MiddleCenter
$dgvCountryStats.Columns["Count"].DefaultCellStyle.Alignment = [System.Windows.Forms.DataGridViewContentAlignment]::MiddleCenter
$dgvCountryStats.Columns["Share"].DefaultCellStyle.Alignment = [System.Windows.Forms.DataGridViewContentAlignment]::MiddleCenter
$gbCountryStats.Controls.Add($dgvCountryStats)

# Права група: Розподіл атак за 24 години
$gbTimeStats = New-Object System.Windows.Forms.GroupBox
$gbTimeStats.Text = (T "GbTimeStats")
$gbTimeStats.Dock = [System.Windows.Forms.DockStyle]::Fill
$gbTimeStats.Font = New-Object System.Drawing.Font("Segoe UI", 9.5, [System.Drawing.FontStyle]::Bold)
$gbTimeStats.ForeColor = [System.Drawing.Color]::FromArgb(30, 41, 59)
$gbTimeStats.Padding = New-Object System.Windows.Forms.Padding(8, 22, 8, 8)
$panelStatsBody.Controls.Add($gbTimeStats, 1, 0)

$lblPeakBanner = New-Object System.Windows.Forms.Label
$lblPeakBanner.Dock = [System.Windows.Forms.DockStyle]::Top
$lblPeakBanner.AutoSize = $true
$lblPeakBanner.BackColor = [System.Drawing.Color]::FromArgb(254, 242, 242)
$lblPeakBanner.ForeColor = [System.Drawing.Color]::FromArgb(185, 28, 28)
$lblPeakBanner.Font = New-Object System.Drawing.Font("Segoe UI", 8.5, [System.Drawing.FontStyle]::Bold)
$lblPeakBanner.Padding = New-Object System.Windows.Forms.Padding(6, 4, 6, 4)
$lblPeakBanner.Visible = $false
$lblPeakBanner.TextAlign = [System.Drawing.ContentAlignment]::MiddleLeft
$lblPeakBanner.AutoEllipsis = $false

$gbTimeStats.Add_Resize({
    if ($lblPeakBanner) {
        $lblPeakBanner.MaximumSize = New-Object System.Drawing.Size([Math]::Max(100, ($gbTimeStats.ClientSize.Width - 16)), 0)
    }
})

$dgvTimeStats = New-Object System.Windows.Forms.DataGridView
$dgvTimeStats.Dock = [System.Windows.Forms.DockStyle]::Fill
$dgvTimeStats.ReadOnly = $true
$dgvTimeStats.AllowUserToAddRows = $false
$dgvTimeStats.AllowUserToDeleteRows = $false
$dgvTimeStats.SelectionMode = [System.Windows.Forms.DataGridViewSelectionMode]::FullRowSelect
$dgvTimeStats.MultiSelect = $false
$dgvTimeStats.AutoSizeColumnsMode = [System.Windows.Forms.DataGridViewAutoSizeColumnsMode]::Fill
$dgvTimeStats.BackgroundColor = [System.Drawing.Color]::White
$dgvTimeStats.BorderStyle = [System.Windows.Forms.BorderStyle]::None
$dgvTimeStats.RowHeadersVisible = $false
$dgvTimeStats.Font = New-Object System.Drawing.Font("Segoe UI", 9, [System.Drawing.FontStyle]::Regular)
Enable-DoubleBuffering $dgvTimeStats

[void]$dgvTimeStats.Columns.Add("Hour", (T "ColHour"))
[void]$dgvTimeStats.Columns.Add("Count", (T "ColHourAttacks"))
[void]$dgvTimeStats.Columns.Add("Bar", (T "ColHourBar"))

$dgvTimeStats.Columns["Hour"].FillWeight = 26
$dgvTimeStats.Columns["Count"].FillWeight = 22
$dgvTimeStats.Columns["Bar"].FillWeight = 52
$dgvTimeStats.Columns["Hour"].DefaultCellStyle.Alignment = [System.Windows.Forms.DataGridViewContentAlignment]::MiddleCenter
$dgvTimeStats.Columns["Count"].DefaultCellStyle.Alignment = [System.Windows.Forms.DataGridViewContentAlignment]::MiddleCenter

$gbTimeStats.Controls.Add($dgvTimeStats)
$gbTimeStats.Controls.Add($lblPeakBanner)

# --- Рядок 2: Нижня панель (Кнопка оновлення та статус) ---
$panelStatsFooter = New-Object System.Windows.Forms.Panel
$panelStatsFooter.Dock = [System.Windows.Forms.DockStyle]::Fill
$panelStatsFooter.Padding = New-Object System.Windows.Forms.Padding(10, 6, 10, 6)
$layoutStats.Controls.Add($panelStatsFooter, 0, 2)

$btnRefreshStats = New-Object System.Windows.Forms.Button
$btnRefreshStats.Text = (T "BtnRefreshStats")
$btnRefreshStats.Location = New-Object System.Drawing.Point(10, 6)
$btnRefreshStats.Size = New-Object System.Drawing.Size(185, 30)
$btnRefreshStats.BackColor = [System.Drawing.Color]::FromArgb(241, 245, 249)
$panelStatsFooter.Controls.Add($btnRefreshStats)
Set-SmoothButton $btnRefreshStats 6

$lblStatsStatus = New-Object System.Windows.Forms.Label
$lblStatsStatus.Text = ""
$lblStatsStatus.Location = New-Object System.Drawing.Point(205, 12)
$lblStatsStatus.AutoSize = $true
$lblStatsStatus.Font = New-Object System.Drawing.Font("Segoe UI", 9)
$lblStatsStatus.ForeColor = [System.Drawing.Color]::FromArgb(100, 116, 139)
$panelStatsFooter.Controls.Add($lblStatsStatus)

$btnRefreshStats.Add_Click({
    Update-StatsUI -forceRefreshHeavy $true
    $lblStatsStatus.Text = if ($script:CurrentLang -eq "EN") { "Updated at $(Get-Date -Format 'HH:mm:ss')" } else { "Оновлено о $(Get-Date -Format 'HH:mm:ss')" }
})

# ==============================================================================
# ВКЛАДКА 3: Налаштування блокування (Конфігурація)
# ==============================================================================
$tabSettings = New-Object System.Windows.Forms.TabPage
$tabSettings.Text = "  Налаштування  "
$tabSettings.BackColor = [System.Drawing.Color]::White
$tabControl.TabPages.Add($tabSettings)

$scrollSettings = New-Object System.Windows.Forms.Panel
$scrollSettings.Dock = [System.Windows.Forms.DockStyle]::Fill
$scrollSettings.AutoScroll = $true
$scrollSettings.Padding = New-Object System.Windows.Forms.Padding(20)
$tabSettings.Controls.Add($scrollSettings)

# Група: Основні правила
$gbGeneral = New-Object System.Windows.Forms.GroupBox
$gbGeneral.Text = "Правила виявлення та блокування"
$gbGeneral.Font = New-Object System.Drawing.Font("Segoe UI", 9.5, [System.Drawing.FontStyle]::Bold)
$gbGeneral.Location = New-Object System.Drawing.Point(20, 15)
$gbGeneral.Size = New-Object System.Drawing.Size(990, 215)
$scrollSettings.Controls.Add($gbGeneral)

$lblFailedAttempts = New-Object System.Windows.Forms.Label
$lblFailedAttempts.Text = "Поріг невдалих спроб входу (FailedLoginAttemptsBeforeBan):"
$lblFailedAttempts.Font = New-Object System.Drawing.Font("Segoe UI", 9)
$lblFailedAttempts.Location = New-Object System.Drawing.Point(20, 32)
$lblFailedAttempts.AutoSize = $true
$gbGeneral.Controls.Add($lblFailedAttempts)

$numFailedAttempts = New-Object System.Windows.Forms.NumericUpDown
$numFailedAttempts.Font = New-Object System.Drawing.Font("Segoe UI", 9)
$numFailedAttempts.Location = New-Object System.Drawing.Point(450, 30)
$numFailedAttempts.Size = New-Object System.Drawing.Size(120, 25)
$numFailedAttempts.Minimum = 1
$numFailedAttempts.Maximum = 1000
$numFailedAttempts.Value = 5
$gbGeneral.Controls.Add($numFailedAttempts)

$lblBanTime = New-Object System.Windows.Forms.Label
$lblBanTime.Text = "Час блокування (BanTime, формат Дні:Год:Хв:Сек):"
$lblBanTime.Font = New-Object System.Drawing.Font("Segoe UI", 9)
$lblBanTime.Location = New-Object System.Drawing.Point(20, 72)
$lblBanTime.AutoSize = $true
$gbGeneral.Controls.Add($lblBanTime)

$cbBanTimePreset = New-Object System.Windows.Forms.ComboBox
$cbBanTimePreset.Font = New-Object System.Drawing.Font("Segoe UI", 9)
$cbBanTimePreset.Location = New-Object System.Drawing.Point(450, 70)
$cbBanTimePreset.Size = New-Object System.Drawing.Size(200, 25)
$cbBanTimePreset.Items.AddRange(@(
    "01:00:00:00 (1 доба)",
    "03:00:00:00 (3 доби)",
    "07:00:00:00 (1 тиждень)",
    "30:00:00:00 (30 днів)",
    "00:01:00:00 (1 година)",
    "00:00:00:00 (Назавжди)"
))
$cbBanTimePreset.SelectedIndex = 0
$gbGeneral.Controls.Add($cbBanTimePreset)

$txtBanTimeCustom = New-Object System.Windows.Forms.TextBox
$txtBanTimeCustom.Font = New-Object System.Drawing.Font("Segoe UI", 9)
$txtBanTimeCustom.Location = New-Object System.Drawing.Point(660, 70)
$txtBanTimeCustom.Size = New-Object System.Drawing.Size(120, 25)
$txtBanTimeCustom.Text = "01:00:00:00"
$gbGeneral.Controls.Add($txtBanTimeCustom)

$lblExpireTime = New-Object System.Windows.Forms.Label
$lblExpireTime.Text = "Час життя невдалих спроб до скидання (ExpireTime):"
$lblExpireTime.Font = New-Object System.Drawing.Font("Segoe UI", 9)
$lblExpireTime.Location = New-Object System.Drawing.Point(20, 115)
$lblExpireTime.AutoSize = $true
$gbGeneral.Controls.Add($lblExpireTime)

$txtExpireTime = New-Object System.Windows.Forms.TextBox
$txtExpireTime.Font = New-Object System.Drawing.Font("Segoe UI", 9)
$txtExpireTime.Location = New-Object System.Drawing.Point(450, 112)
$txtExpireTime.Size = New-Object System.Drawing.Size(160, 25)
$txtExpireTime.Text = "01:00:00:00"
$gbGeneral.Controls.Add($txtExpireTime)

$lblCycleTime = New-Object System.Windows.Forms.Label
$lblCycleTime.Text = "Інтервал циклу перевірки та бану (CycleTime):"
$lblCycleTime.Font = New-Object System.Drawing.Font("Segoe UI", 9)
$lblCycleTime.Location = New-Object System.Drawing.Point(20, 158)
$lblCycleTime.AutoSize = $true
$gbGeneral.Controls.Add($lblCycleTime)

$txtCycleTime = New-Object System.Windows.Forms.TextBox
$txtCycleTime.Font = New-Object System.Drawing.Font("Segoe UI", 9)
$txtCycleTime.Location = New-Object System.Drawing.Point(450, 155)
$txtCycleTime.Size = New-Object System.Drawing.Size(160, 25)
$txtCycleTime.Text = "00:00:00:15"
$gbGeneral.Controls.Add($txtCycleTime)

# Група: Додаткові опції поведінки
$gbBehavior = New-Object System.Windows.Forms.GroupBox
$gbBehavior.Text = "Додаткова поведінка та очищення"
$gbBehavior.Font = New-Object System.Drawing.Font("Segoe UI", 9.5, [System.Drawing.FontStyle]::Bold)
$gbBehavior.Location = New-Object System.Drawing.Point(20, 245)
$gbBehavior.Size = New-Object System.Drawing.Size(990, 190)
$scrollSettings.Controls.Add($gbBehavior)

$chkClearOnRestart = New-Object System.Windows.Forms.CheckBox
$chkClearOnRestart.Text = "Очищати всі заблоковані IP при перезапуску служби (ClearBannedIPAddressesOnRestart)"
$chkClearOnRestart.Font = New-Object System.Drawing.Font("Segoe UI", 9)
$chkClearOnRestart.Location = New-Object System.Drawing.Point(20, 30)
$chkClearOnRestart.AutoSize = $true
$gbBehavior.Controls.Add($chkClearOnRestart)

$chkClearOnSuccess = New-Object System.Windows.Forms.CheckBox
$chkClearOnSuccess.Text = "Скидати лічильник невдалих спроб при успішному вході (ClearFailedLoginsOnSuccessfulLogin)"
$chkClearOnSuccess.Font = New-Object System.Drawing.Font("Segoe UI", 9)
$chkClearOnSuccess.Location = New-Object System.Drawing.Point(20, 60)
$chkClearOnSuccess.AutoSize = $true
$gbBehavior.Controls.Add($chkClearOnSuccess)

$chkProcessInternal = New-Object System.Windows.Forms.CheckBox
$chkProcessInternal.Text = "Обробляти та блокувати внутрішні локальні IP-адреси (ProcessInternalIPAddresses)"
$chkProcessInternal.Font = New-Object System.Drawing.Font("Segoe UI", 9)
$chkProcessInternal.Location = New-Object System.Drawing.Point(20, 90)
$chkProcessInternal.AutoSize = $true
$gbBehavior.Controls.Add($chkProcessInternal)

$chkResetUnbanned = New-Object System.Windows.Forms.CheckBox
$chkResetUnbanned.Text = "Скидати лічильник після розблокування IP (ResetFailedLoginCountForUnbannedIPAddresses)"
$chkResetUnbanned.Font = New-Object System.Drawing.Font("Segoe UI", 9)
$chkResetUnbanned.Location = New-Object System.Drawing.Point(20, 120)
$chkResetUnbanned.AutoSize = $true
$gbBehavior.Controls.Add($chkResetUnbanned)

$chkStartInTray = New-Object System.Windows.Forms.CheckBox
$chkStartInTray.Text = (T "ChkStartInTray")
$chkStartInTray.Font = New-Object System.Drawing.Font("Segoe UI", 9)
$chkStartInTray.Location = New-Object System.Drawing.Point(20, 150)
$chkStartInTray.AutoSize = $true
$chkStartInTray.Checked = $true
$gbBehavior.Controls.Add($chkStartInTray)

# ------------------------------------------------------------------------------
# Група: Моніторинг сервісів та протоколів (Monitoring)
# ------------------------------------------------------------------------------
$gbMonitoring = New-Object System.Windows.Forms.GroupBox
$gbMonitoring.Text = (T "GbMonitoring")
$gbMonitoring.Font = New-Object System.Drawing.Font("Segoe UI", 9.5, [System.Drawing.FontStyle]::Bold)
$gbMonitoring.Location = New-Object System.Drawing.Point(20, 445)
$gbMonitoring.Size = New-Object System.Drawing.Size(990, 255)
$scrollSettings.Controls.Add($gbMonitoring)

$lblMonitoringDesc = New-Object System.Windows.Forms.Label
$lblMonitoringDesc.Text = (T "LblMonitoringDesc")
$lblMonitoringDesc.Font = New-Object System.Drawing.Font("Segoe UI", 8.5)
$lblMonitoringDesc.ForeColor = [System.Drawing.Color]::FromArgb(100, 116, 139)
$lblMonitoringDesc.Location = New-Object System.Drawing.Point(20, 25)
$lblMonitoringDesc.AutoSize = $true
$gbMonitoring.Controls.Add($lblMonitoringDesc)

# Список контрольованих протоколів
$script:MonitoredProtocols = @(
    @{ Id = "RDP"; Name = "RDP (Remote Desktop)"; Def = $true; Port = "3389" },
    @{ Id = "SSH"; Name = "OpenSSH"; Def = $false; Port = "22" },
    @{ Id = "MSSQL"; Name = "MS-SQL Server"; Def = $false; Port = "1433" },
    @{ Id = "MySQL"; Name = "MySQL / MariaDB"; Def = $false; Port = "3306" },
    @{ Id = "FTP"; Name = "FTP (IIS / FileZilla)"; Def = $false; Port = "21" },
    @{ Id = "HTTP"; Name = "HTTP / Web (IIS / Apache)"; Def = $false; Port = "80/443" },
    @{ Id = "SMTP"; Name = "SMTP (Mail Server)"; Def = $false; Port = "25/587" },
    @{ Id = "IMAP"; Name = "IMAP (Mail Server)"; Def = $false; Port = "143/993" },
    @{ Id = "POP3"; Name = "POP3 (Mail Server)"; Def = $false; Port = "110/995" },
    @{ Id = "RRAS"; Name = "MS VPN (RRAS)"; Def = $false; Port = "1723/4500" },
    @{ Id = "RDWeb"; Name = "RD Web Access"; Def = $false; Port = "443" },
    @{ Id = "VNC"; Name = "VNC (Remote Control)"; Def = $false; Port = "5900" }
)

$script:ProtocolControls = @{}

$flpMonitoring = New-Object System.Windows.Forms.TableLayoutPanel
$flpMonitoring.Location = New-Object System.Drawing.Point(20, 50)
$flpMonitoring.Size = New-Object System.Drawing.Size(950, 190)
$flpMonitoring.ColumnCount = 3
$flpMonitoring.RowCount = 4
for ($c = 0; $c -lt 3; $c++) {
    $flpMonitoring.ColumnStyles.Add((New-Object System.Windows.Forms.ColumnStyle([System.Windows.Forms.SizeType]::Percent, 33.33)))
}
for ($r = 0; $r -lt 4; $r++) {
    $flpMonitoring.RowStyles.Add((New-Object System.Windows.Forms.RowStyle([System.Windows.Forms.SizeType]::Absolute, 45)))
}
$gbMonitoring.Controls.Add($flpMonitoring)

$pIdx = 0
foreach ($proto in $script:MonitoredProtocols) {
    $col = [int]($pIdx % 3)
    $row = [int]($pIdx / 3)

    $cardPanel = New-Object System.Windows.Forms.Panel
    $cardPanel.Dock = [System.Windows.Forms.DockStyle]::Fill
    $cardPanel.Padding = New-Object System.Windows.Forms.Padding(5)

    $chkProto = New-Object System.Windows.Forms.CheckBox
    $chkProto.Text = "$($proto.Name):"
    $chkProto.Font = New-Object System.Drawing.Font("Segoe UI", 9, [System.Drawing.FontStyle]::Bold)
    $chkProto.Location = New-Object System.Drawing.Point(5, 10)
    $chkProto.Size = New-Object System.Drawing.Size(190, 24)
    $chkProto.Checked = $proto.Def
    $cardPanel.Controls.Add($chkProto)

    $lblBadge = New-Object System.Windows.Forms.Label
    $lblBadge.Location = New-Object System.Drawing.Point(200, 11)
    $lblBadge.Size = New-Object System.Drawing.Size(95, 22)
    $lblBadge.Font = New-Object System.Drawing.Font("Segoe UI", 8.5, [System.Drawing.FontStyle]::Bold)
    $lblBadge.TextAlign = [System.Drawing.ContentAlignment]::MiddleCenter
    $cardPanel.Controls.Add($lblBadge)

    $updateBadge = {
        param($chk, $badge)
        if ($chk.Checked) {
            $badge.Text = "🟢 " + (T "StatusEnabled")
            $badge.ForeColor = [System.Drawing.Color]::FromArgb(22, 101, 52)
            $badge.BackColor = [System.Drawing.Color]::FromArgb(220, 252, 231)
        } else {
            $badge.Text = "⚪ " + (T "StatusDisabledService")
            $badge.ForeColor = [System.Drawing.Color]::FromArgb(100, 116, 139)
            $badge.BackColor = [System.Drawing.Color]::FromArgb(241, 245, 249)
        }
    }

    $cRef = $chkProto
    $bRef = $lblBadge
    $handler = {
        & $updateBadge $cRef $bRef
        if (Get-Command Save-PersistentAppSettings -ErrorAction SilentlyContinue) {
            Save-PersistentAppSettings
        }
    }.GetNewClosure()
    $chkProto.Add_CheckedChanged($handler)
    & $updateBadge $chkProto $lblBadge

    $script:ProtocolControls[$proto.Id] = @{
        CheckBox = $chkProto
        Badge = $lblBadge
    }

    $flpMonitoring.Controls.Add($cardPanel, $col, $row)
    $pIdx++
}

# ------------------------------------------------------------------------------
# Група: Хмарна база AbuseIPDB (Threat Intelligence)
# ------------------------------------------------------------------------------
$gbAbuseIPDB = New-Object System.Windows.Forms.GroupBox
$gbAbuseIPDB.Text = (T "GbAbuseIPDB")
$gbAbuseIPDB.Font = New-Object System.Drawing.Font("Segoe UI", 9.5, [System.Drawing.FontStyle]::Bold)
$gbAbuseIPDB.Location = New-Object System.Drawing.Point(20, 710)
$gbAbuseIPDB.Size = New-Object System.Drawing.Size(990, 205)
$scrollSettings.Controls.Add($gbAbuseIPDB)

# 1. Рядок: API Key
$lblAbuseApiKey = New-Object System.Windows.Forms.Label
$lblAbuseApiKey.Text = (T "LblAbuseApiKey")
$lblAbuseApiKey.Font = New-Object System.Drawing.Font("Segoe UI", 9)
$lblAbuseApiKey.Location = New-Object System.Drawing.Point(20, 32)
$lblAbuseApiKey.AutoSize = $true
$gbAbuseIPDB.Controls.Add($lblAbuseApiKey)

$txtAbuseApiKey = New-Object System.Windows.Forms.TextBox
$txtAbuseApiKey.Font = New-Object System.Drawing.Font("Consolas", 9.5)
$txtAbuseApiKey.Location = New-Object System.Drawing.Point(340, 29)
$txtAbuseApiKey.Size = New-Object System.Drawing.Size(420, 24)
$gbAbuseIPDB.Controls.Add($txtAbuseApiKey)

$llGetAbuseKey = New-Object System.Windows.Forms.LinkLabel
$llGetAbuseKey.Text = "Отримати безкоштовний ключ на abuseipdb.com"
$llGetAbuseKey.Font = New-Object System.Drawing.Font("Segoe UI", 8.5)
$llGetAbuseKey.Location = New-Object System.Drawing.Point(770, 33)
$llGetAbuseKey.AutoSize = $true
$llGetAbuseKey.Add_Click({
    try { [System.Diagnostics.Process]::Start("https://www.abuseipdb.com/register") } catch {}
})
$gbAbuseIPDB.Controls.Add($llGetAbuseKey)

# 2. Рядок: Confidence Score & Limit
$lblAbuseConfidence = New-Object System.Windows.Forms.Label
$lblAbuseConfidence.Text = (T "LblAbuseConfidence")
$lblAbuseConfidence.Font = New-Object System.Drawing.Font("Segoe UI", 9)
$lblAbuseConfidence.Location = New-Object System.Drawing.Point(20, 70)
$lblAbuseConfidence.AutoSize = $true
$gbAbuseIPDB.Controls.Add($lblAbuseConfidence)

$numAbuseConfidence = New-Object System.Windows.Forms.NumericUpDown
$numAbuseConfidence.Font = New-Object System.Drawing.Font("Segoe UI", 9)
$numAbuseConfidence.Location = New-Object System.Drawing.Point(340, 68)
$numAbuseConfidence.Size = New-Object System.Drawing.Size(85, 25)
$numAbuseConfidence.Minimum = 25
$numAbuseConfidence.Maximum = 100
$numAbuseConfidence.Value = 100
$gbAbuseIPDB.Controls.Add($numAbuseConfidence)

$lblAbuseLimit = New-Object System.Windows.Forms.Label
$lblAbuseLimit.Text = (T "LblAbuseLimit")
$lblAbuseLimit.Font = New-Object System.Drawing.Font("Segoe UI", 9)
$lblAbuseLimit.Location = New-Object System.Drawing.Point(460, 70)
$lblAbuseLimit.AutoSize = $true
$gbAbuseIPDB.Controls.Add($lblAbuseLimit)

$numAbuseLimit = New-Object System.Windows.Forms.NumericUpDown
$numAbuseLimit.Font = New-Object System.Drawing.Font("Segoe UI", 9)
$numAbuseLimit.Location = New-Object System.Drawing.Point(670, 68)
$numAbuseLimit.Size = New-Object System.Drawing.Size(90, 25)
$numAbuseLimit.Minimum = 50
$numAbuseLimit.Maximum = 10000
$numAbuseLimit.Increment = 100
$numAbuseLimit.Value = 1000
$gbAbuseIPDB.Controls.Add($numAbuseLimit)

# 3. Рядок: Авто-репорт опція (вимкнена за замовчуванням)
$chkAbuseAutoReport = New-Object System.Windows.Forms.CheckBox
$chkAbuseAutoReport.Text = (T "ChkAbuseAutoReport")
$chkAbuseAutoReport.Font = New-Object System.Drawing.Font("Segoe UI", 9)
$chkAbuseAutoReport.ForeColor = [System.Drawing.Color]::FromArgb(185, 28, 28)
$chkAbuseAutoReport.Location = New-Object System.Drawing.Point(20, 108)
$chkAbuseAutoReport.AutoSize = $true
$chkAbuseAutoReport.Checked = $false
$gbAbuseIPDB.Controls.Add($chkAbuseAutoReport)

# 4. Рядок: Кнопка завантаження бази зараз
$btnFetchAbuse = New-Object System.Windows.Forms.Button
$btnFetchAbuse.Text = (T "BtnFetchAbuse")
$btnFetchAbuse.Font = New-Object System.Drawing.Font("Segoe UI", 9, [System.Drawing.FontStyle]::Bold)
$btnFetchAbuse.BackColor = [System.Drawing.Color]::FromArgb(59, 130, 246)
$btnFetchAbuse.ForeColor = [System.Drawing.Color]::White
$btnFetchAbuse.FlatStyle = [System.Windows.Forms.FlatStyle]::Flat
$btnFetchAbuse.FlatAppearance.BorderSize = 0
$btnFetchAbuse.Location = New-Object System.Drawing.Point(20, 145)
$btnFetchAbuse.Size = New-Object System.Drawing.Size(340, 36)
$gbAbuseIPDB.Controls.Add($btnFetchAbuse)
Set-SmoothButton $btnFetchAbuse 7

$lblAbuseStatus = New-Object System.Windows.Forms.Label
$lblAbuseStatus.Location = New-Object System.Drawing.Point(375, 154)
$lblAbuseStatus.AutoSize = $true
$lblAbuseStatus.Font = New-Object System.Drawing.Font("Segoe UI", 8.5)
$lblAbuseStatus.ForeColor = [System.Drawing.Color]::FromArgb(100, 116, 139)
$lblAbuseStatus.Text = "Готово до синхронізації"
$gbAbuseIPDB.Controls.Add($lblAbuseStatus)

# Панель кнопок збереження налаштувань
$btnSaveConfig = New-Object System.Windows.Forms.Button
$btnSaveConfig.Text = "Зберегти налаштування у файл"
$btnSaveConfig.Font = New-Object System.Drawing.Font("Segoe UI", 9.5, [System.Drawing.FontStyle]::Bold)
$btnSaveConfig.BackColor = [System.Drawing.Color]::FromArgb(22, 163, 74)
$btnSaveConfig.ForeColor = [System.Drawing.Color]::White
$btnSaveConfig.FlatStyle = [System.Windows.Forms.FlatStyle]::Flat
$btnSaveConfig.FlatAppearance.BorderSize = 0
$btnSaveConfig.Location = New-Object System.Drawing.Point(20, 930)
$btnSaveConfig.Size = New-Object System.Drawing.Size(260, 38)
$scrollSettings.Controls.Add($btnSaveConfig)

$btnReloadConfig = New-Object System.Windows.Forms.Button
$btnReloadConfig.Text = "Скинути до значень файлу"
$btnReloadConfig.Font = New-Object System.Drawing.Font("Segoe UI", 9)
$btnReloadConfig.Location = New-Object System.Drawing.Point(290, 930)
$btnReloadConfig.Size = New-Object System.Drawing.Size(210, 38)
$scrollSettings.Controls.Add($btnReloadConfig)

$btnRestoreBak = New-Object System.Windows.Forms.Button
$btnRestoreBak.Text = "Відновити з бекапу (.bak)"
$btnRestoreBak.Font = New-Object System.Drawing.Font("Segoe UI", 9)
$btnRestoreBak.Location = New-Object System.Drawing.Point(510, 930)
$btnRestoreBak.Size = New-Object System.Drawing.Size(210, 38)
$scrollSettings.Controls.Add($btnRestoreBak)

Set-SmoothButton $btnSaveConfig 8
Set-SmoothButton $btnReloadConfig 8
Set-SmoothButton $btnRestoreBak 8

# ==============================================================================
# ВКЛАДКА 3: Білий та Чорний списки (Whitelist / Blacklist)
# ==============================================================================
$tabLists = New-Object System.Windows.Forms.TabPage
$tabLists.Text = "  Білий / Чорний списки  "
$tabLists.BackColor = [System.Drawing.Color]::White
$tabControl.TabPages.Add($tabLists)

$layoutLists = New-Object System.Windows.Forms.TableLayoutPanel
$layoutLists.Dock = [System.Windows.Forms.DockStyle]::Fill
$layoutLists.ColumnCount = 2
$layoutLists.RowCount = 2
$layoutLists.ColumnStyles.Add((New-Object System.Windows.Forms.ColumnStyle([System.Windows.Forms.SizeType]::Percent, 50)))
$layoutLists.ColumnStyles.Add((New-Object System.Windows.Forms.ColumnStyle([System.Windows.Forms.SizeType]::Percent, 50)))
$layoutLists.RowStyles.Add((New-Object System.Windows.Forms.RowStyle([System.Windows.Forms.SizeType]::Percent, 100)))
$layoutLists.RowStyles.Add((New-Object System.Windows.Forms.RowStyle([System.Windows.Forms.SizeType]::Absolute, 50)))
$tabLists.Controls.Add($layoutLists)

# Ліва колонка: Whitelist
$gbWhitelist = New-Object System.Windows.Forms.GroupBox
$gbWhitelist.Text = "Білий список (Whitelist - ніколи не блокувати)"
$gbWhitelist.Font = New-Object System.Drawing.Font("Segoe UI", 9.5, [System.Drawing.FontStyle]::Bold)
$gbWhitelist.ForeColor = [System.Drawing.Color]::FromArgb(22, 101, 52)
$gbWhitelist.Dock = [System.Windows.Forms.DockStyle]::Fill
$gbWhitelist.Padding = New-Object System.Windows.Forms.Padding(10)
$layoutLists.Controls.Add($gbWhitelist, 0, 0)

$layoutWhiteInner = New-Object System.Windows.Forms.TableLayoutPanel
$layoutWhiteInner.Dock = [System.Windows.Forms.DockStyle]::Fill
$layoutWhiteInner.RowCount = 3
$layoutWhiteInner.ColumnCount = 1
$layoutWhiteInner.RowStyles.Add((New-Object System.Windows.Forms.RowStyle([System.Windows.Forms.SizeType]::Absolute, 35)))
$layoutWhiteInner.RowStyles.Add((New-Object System.Windows.Forms.RowStyle([System.Windows.Forms.SizeType]::Percent, 100)))
$layoutWhiteInner.RowStyles.Add((New-Object System.Windows.Forms.RowStyle([System.Windows.Forms.SizeType]::Absolute, 45)))
$gbWhitelist.Controls.Add($layoutWhiteInner)

$lblWhiteDesc = New-Object System.Windows.Forms.Label
$lblWhiteDesc.Text = "Введіть IP-адреси або підмережі CIDR через кому або з нового рядка:"
$lblWhiteDesc.Font = New-Object System.Drawing.Font("Segoe UI", 8.5)
$lblWhiteDesc.ForeColor = [System.Drawing.Color]::FromArgb(100, 116, 139)
$lblWhiteDesc.Dock = [System.Windows.Forms.DockStyle]::Fill
$layoutWhiteInner.Controls.Add($lblWhiteDesc, 0, 0)

$txtWhitelist = New-Object System.Windows.Forms.TextBox
$txtWhitelist.Multiline = $true
$txtWhitelist.ScrollBars = [System.Windows.Forms.ScrollBars]::Vertical
$txtWhitelist.Dock = [System.Windows.Forms.DockStyle]::Fill
$txtWhitelist.Font = New-Object System.Drawing.Font("Consolas", 10)
$txtWhitelist.BackColor = [System.Drawing.Color]::FromArgb(240, 253, 244)
$txtWhitelist.ForeColor = [System.Drawing.Color]::FromArgb(22, 101, 52)
$layoutWhiteInner.Controls.Add($txtWhitelist, 0, 1)

$panelWhiteButtons = New-Object System.Windows.Forms.FlowLayoutPanel
$panelWhiteButtons.Dock = [System.Windows.Forms.DockStyle]::Fill
$panelWhiteButtons.Padding = New-Object System.Windows.Forms.Padding(0, 5, 0, 0)
$layoutWhiteInner.Controls.Add($panelWhiteButtons, 0, 2)

$btnAddLocalIP = New-Object System.Windows.Forms.Button
$btnAddLocalIP.Text = "+ Додати мою локальну IP"
$btnAddLocalIP.Size = New-Object System.Drawing.Size(180, 30)
$btnAddLocalIP.Font = New-Object System.Drawing.Font("Segoe UI", 8.5)
$panelWhiteButtons.Controls.Add($btnAddLocalIP)

$btnAddPublicIP = New-Object System.Windows.Forms.Button
$btnAddPublicIP.Text = "+ Додати мою зовнішню WAN IP"
$btnAddPublicIP.Size = New-Object System.Drawing.Size(205, 30)
$btnAddPublicIP.Font = New-Object System.Drawing.Font("Segoe UI", 8.5)
$panelWhiteButtons.Controls.Add($btnAddPublicIP)

Set-SmoothButton $btnAddLocalIP 6
Set-SmoothButton $btnAddPublicIP 6

# Права колонка: Blacklist
$gbBlacklist = New-Object System.Windows.Forms.GroupBox
$gbBlacklist.Text = "Чорний список (Blacklist - перманентно блокувати)"
$gbBlacklist.Font = New-Object System.Drawing.Font("Segoe UI", 9.5, [System.Drawing.FontStyle]::Bold)
$gbBlacklist.ForeColor = [System.Drawing.Color]::FromArgb(153, 27, 27)
$gbBlacklist.Dock = [System.Windows.Forms.DockStyle]::Fill
$gbBlacklist.Padding = New-Object System.Windows.Forms.Padding(10)
$layoutLists.Controls.Add($gbBlacklist, 1, 0)

$layoutBlackInner = New-Object System.Windows.Forms.TableLayoutPanel
$layoutBlackInner.Dock = [System.Windows.Forms.DockStyle]::Fill
$layoutBlackInner.RowCount = 2
$layoutBlackInner.ColumnCount = 1
$layoutBlackInner.RowStyles.Add((New-Object System.Windows.Forms.RowStyle([System.Windows.Forms.SizeType]::Absolute, 35)))
$layoutBlackInner.RowStyles.Add((New-Object System.Windows.Forms.RowStyle([System.Windows.Forms.SizeType]::Percent, 100)))
$gbBlacklist.Controls.Add($layoutBlackInner)

$lblBlackDesc = New-Object System.Windows.Forms.Label
$lblBlackDesc.Text = "Введіть IP-адреси або підмережі CIDR для постійного блокування:"
$lblBlackDesc.Font = New-Object System.Drawing.Font("Segoe UI", 8.5)
$lblBlackDesc.ForeColor = [System.Drawing.Color]::FromArgb(100, 116, 139)
$lblBlackDesc.Dock = [System.Windows.Forms.DockStyle]::Fill
$layoutBlackInner.Controls.Add($lblBlackDesc, 0, 0)

$txtBlacklist = New-Object System.Windows.Forms.TextBox
$txtBlacklist.Multiline = $true
$txtBlacklist.ScrollBars = [System.Windows.Forms.ScrollBars]::Vertical
$txtBlacklist.Dock = [System.Windows.Forms.DockStyle]::Fill
$txtBlacklist.Font = New-Object System.Drawing.Font("Consolas", 10)
$txtBlacklist.BackColor = [System.Drawing.Color]::FromArgb(254, 242, 242)
$txtBlacklist.ForeColor = [System.Drawing.Color]::FromArgb(153, 27, 27)
$layoutBlackInner.Controls.Add($txtBlacklist, 0, 1)

# Нижня панель збереження списків
$panelListsFooter = New-Object System.Windows.Forms.Panel
$panelListsFooter.Dock = [System.Windows.Forms.DockStyle]::Fill
$layoutLists.SetColumnSpan($panelListsFooter, 2)
$layoutLists.Controls.Add($panelListsFooter, 0, 1)

$btnSaveLists = New-Object System.Windows.Forms.Button
$btnSaveLists.Text = "Зберегти Білий та Чорний списки у конфігурацію"
$btnSaveLists.Font = New-Object System.Drawing.Font("Segoe UI", 9.5, [System.Drawing.FontStyle]::Bold)
$btnSaveLists.BackColor = [System.Drawing.Color]::FromArgb(37, 99, 235)
$btnSaveLists.ForeColor = [System.Drawing.Color]::White
$btnSaveLists.FlatStyle = [System.Windows.Forms.FlatStyle]::Flat
$btnSaveLists.FlatAppearance.BorderSize = 0
$btnSaveLists.Location = New-Object System.Drawing.Point(10, 8)
$btnSaveLists.Size = New-Object System.Drawing.Size(390, 34)
$panelListsFooter.Controls.Add($btnSaveLists)

Set-SmoothButton $btnSaveLists 8

# ==============================================================================
# ВКЛАДКА 4: Журнал подій та логи (Logs & Events)
# ==============================================================================
$tabLogs = New-Object System.Windows.Forms.TabPage
$tabLogs.Text = "  Журнал та аудит  "
$tabLogs.BackColor = [System.Drawing.Color]::White
$tabControl.TabPages.Add($tabLogs)

$layoutLogs = New-Object System.Windows.Forms.TableLayoutPanel
$layoutLogs.Dock = [System.Windows.Forms.DockStyle]::Fill
$layoutLogs.RowCount = 2
$layoutLogs.ColumnCount = 1
$layoutLogs.RowStyles.Add((New-Object System.Windows.Forms.RowStyle([System.Windows.Forms.SizeType]::Absolute, 45)))
$layoutLogs.RowStyles.Add((New-Object System.Windows.Forms.RowStyle([System.Windows.Forms.SizeType]::Percent, 100)))
$tabLogs.Controls.Add($layoutLogs)

# Панель перемикання та кнопок логів (FlowLayoutPanel для адаптивності при зміні розміру)
$panelLogsHeader = New-Object System.Windows.Forms.FlowLayoutPanel
$panelLogsHeader.Dock = [System.Windows.Forms.DockStyle]::Fill
$panelLogsHeader.Padding = New-Object System.Windows.Forms.Padding(6, 6, 6, 2)
$panelLogsHeader.WrapContents = $false
$panelLogsHeader.AutoScroll = $false
$layoutLogs.Controls.Add($panelLogsHeader, 0, 0)

$rbIPBanLog = New-Object System.Windows.Forms.RadioButton
$rbIPBanLog.Text = (T "RbIPBanLog")
$rbIPBanLog.Checked = $true
$rbIPBanLog.Font = New-Object System.Drawing.Font("Segoe UI", 9, [System.Drawing.FontStyle]::Bold)
$rbIPBanLog.AutoSize = $true
$rbIPBanLog.Margin = New-Object System.Windows.Forms.Padding(3, 7, 6, 3)
$panelLogsHeader.Controls.Add($rbIPBanLog)

$rbEventLog = New-Object System.Windows.Forms.RadioButton
$rbEventLog.Text = (T "RbEventLog")
$rbEventLog.Font = New-Object System.Drawing.Font("Segoe UI", 9, [System.Drawing.FontStyle]::Bold)
$rbEventLog.AutoSize = $true
$rbEventLog.Margin = New-Object System.Windows.Forms.Padding(3, 7, 10, 3)
$panelLogsHeader.Controls.Add($rbEventLog)

$btnRefreshLog = New-Object System.Windows.Forms.Button
$btnRefreshLog.Text = (T "BtnRefreshLog")
$btnRefreshLog.Size = New-Object System.Drawing.Size(125, 28)
$btnRefreshLog.Margin = New-Object System.Windows.Forms.Padding(3, 4, 4, 3)
$panelLogsHeader.Controls.Add($btnRefreshLog)

$chkAutoRefreshLog = New-Object System.Windows.Forms.CheckBox
$chkAutoRefreshLog.Text = (T "ChkAutoRefresh")
$chkAutoRefreshLog.AutoSize = $true
$chkAutoRefreshLog.Margin = New-Object System.Windows.Forms.Padding(4, 7, 8, 3)
$panelLogsHeader.Controls.Add($chkAutoRefreshLog)

$btnClearLog = New-Object System.Windows.Forms.Button
$btnClearLog.Text = (T "BtnClearLog")
$btnClearLog.Size = New-Object System.Drawing.Size(135, 28)
$btnClearLog.Margin = New-Object System.Windows.Forms.Padding(3, 4, 10, 3)
$panelLogsHeader.Controls.Add($btnClearLog)

$chkWordWrapLog = New-Object System.Windows.Forms.CheckBox
$chkWordWrapLog.Text = (T "ChkWordWrap")
$chkWordWrapLog.Checked = $true
$chkWordWrapLog.AutoSize = $true
$chkWordWrapLog.Margin = New-Object System.Windows.Forms.Padding(4, 7, 8, 3)
$panelLogsHeader.Controls.Add($chkWordWrapLog)

$btnZoomOutLog = New-Object System.Windows.Forms.Button
$btnZoomOutLog.Text = "A-"
$btnZoomOutLog.Font = New-Object System.Drawing.Font("Segoe UI", 8.5, [System.Drawing.FontStyle]::Bold)
$btnZoomOutLog.Size = New-Object System.Drawing.Size(32, 28)
$btnZoomOutLog.Margin = New-Object System.Windows.Forms.Padding(2, 4, 1, 3)
$panelLogsHeader.Controls.Add($btnZoomOutLog)

$lblZoomLog = New-Object System.Windows.Forms.Label
$lblZoomLog.Text = "100%"
$lblZoomLog.Font = New-Object System.Drawing.Font("Segoe UI", 8.5)
$lblZoomLog.TextAlign = [System.Drawing.ContentAlignment]::MiddleCenter
$lblZoomLog.Size = New-Object System.Drawing.Size(42, 28)
$lblZoomLog.Margin = New-Object System.Windows.Forms.Padding(1, 4, 1, 3)
$lblZoomLog.Cursor = [System.Windows.Forms.Cursors]::Hand
$panelLogsHeader.Controls.Add($lblZoomLog)

$btnZoomInLog = New-Object System.Windows.Forms.Button
$btnZoomInLog.Text = "A+"
$btnZoomInLog.Font = New-Object System.Drawing.Font("Segoe UI", 8.5, [System.Drawing.FontStyle]::Bold)
$btnZoomInLog.Size = New-Object System.Drawing.Size(32, 28)
$btnZoomInLog.Margin = New-Object System.Windows.Forms.Padding(1, 4, 3, 3)
$panelLogsHeader.Controls.Add($btnZoomInLog)

Set-SmoothButton $btnRefreshLog 6
Set-SmoothButton $btnClearLog 6
Set-SmoothButton $btnZoomOutLog 5
Set-SmoothButton $btnZoomInLog 5

# Контейнер для вмісту логів: або текстове поле, або таблиця Windows Event
$panelLogContainer = New-Object System.Windows.Forms.Panel
$panelLogContainer.Dock = [System.Windows.Forms.DockStyle]::Fill
$layoutLogs.Controls.Add($panelLogContainer, 0, 1)

$txtIPBanLog = New-Object System.Windows.Forms.RichTextBox
$txtIPBanLog.Dock = [System.Windows.Forms.DockStyle]::Fill
$txtIPBanLog.ReadOnly = $true
$txtIPBanLog.Font = New-Object System.Drawing.Font("Consolas", 9.5)
$txtIPBanLog.BackColor = [System.Drawing.Color]::FromArgb(15, 23, 42)
$txtIPBanLog.ForeColor = [System.Drawing.Color]::FromArgb(226, 232, 240)
$txtIPBanLog.BorderStyle = [System.Windows.Forms.BorderStyle]::None
$txtIPBanLog.WordWrap = $true
$txtIPBanLog.ScrollBars = [System.Windows.Forms.RichTextBoxScrollBars]::Both
$panelLogContainer.Controls.Add($txtIPBanLog)

$dgvEventLog = New-Object System.Windows.Forms.DataGridView
$dgvEventLog.Dock = [System.Windows.Forms.DockStyle]::Fill
$dgvEventLog.ReadOnly = $true
$dgvEventLog.AllowUserToAddRows = $false
$dgvEventLog.SelectionMode = [System.Windows.Forms.DataGridViewSelectionMode]::FullRowSelect
$dgvEventLog.AutoSizeColumnsMode = [System.Windows.Forms.DataGridViewAutoSizeColumnsMode]::Fill
$dgvEventLog.BackgroundColor = [System.Drawing.Color]::White
$dgvEventLog.BorderStyle = [System.Windows.Forms.BorderStyle]::None
$dgvEventLog.Visible = $false
[void]$dgvEventLog.Columns.Add("Time", "Час")
[void]$dgvEventLog.Columns.Add("User", "Користувач")
[void]$dgvEventLog.Columns.Add("IPAddress", "IP-адреса")
[void]$dgvEventLog.Columns.Add("LogonType", "Тип входу")
[void]$dgvEventLog.Columns.Add("Workstation", "Робоча станція")
[void]$dgvEventLog.Columns.Add("Status", "Статус")
$panelLogContainer.Controls.Add($dgvEventLog)

# Контекстне меню для Windows Events
$ctxEvents = New-Object System.Windows.Forms.ContextMenuStrip
$miEventBan = $ctxEvents.Items.Add((T "MiEventBan"))
$miEventWhite = $ctxEvents.Items.Add((T "MiEventWhite"))
$miEventCopy = $ctxEvents.Items.Add((T "MiEventCopy"))
$dgvEventLog.ContextMenuStrip = $ctxEvents

# ==============================================================================
# ВКЛАДКА 5: Інсталяція та Сервіс (Setup & Maintenance)
# ==============================================================================
$tabSetup = New-Object System.Windows.Forms.TabPage
$tabSetup.Text = "  Інсталяція та Сервіс  "
$tabSetup.BackColor = [System.Drawing.Color]::White
$tabControl.TabPages.Add($tabSetup)

$scrollSetup = New-Object System.Windows.Forms.Panel
$scrollSetup.Dock = [System.Windows.Forms.DockStyle]::Fill
$scrollSetup.AutoScroll = $true
$scrollSetup.Padding = New-Object System.Windows.Forms.Padding(20)
$tabSetup.Controls.Add($scrollSetup)

# Група: Стан компонентів системи
$gbSysStatus = New-Object System.Windows.Forms.GroupBox
$gbSysStatus.Text = "Стан компонентів системи"
$gbSysStatus.Font = New-Object System.Drawing.Font("Segoe UI", 9.5, [System.Drawing.FontStyle]::Bold)
$gbSysStatus.Location = New-Object System.Drawing.Point(20, 15)
$gbSysStatus.Size = New-Object System.Drawing.Size(990, 140)
$scrollSetup.Controls.Add($gbSysStatus)

$lblSvcStatusText = New-Object System.Windows.Forms.Label
$lblSvcStatusText.Text = "Служба Windows (IPBan): Невідомо"
$lblSvcStatusText.Font = New-Object System.Drawing.Font("Segoe UI", 9)
$lblSvcStatusText.Location = New-Object System.Drawing.Point(20, 30)
$lblSvcStatusText.AutoSize = $true
$gbSysStatus.Controls.Add($lblSvcStatusText)

$lblAuditStatusText = New-Object System.Windows.Forms.Label
$lblAuditStatusText.Text = "Аудит невдалих спроб входу (AuditPol): Перевірка..."
$lblAuditStatusText.Font = New-Object System.Drawing.Font("Segoe UI", 9)
$lblAuditStatusText.Location = New-Object System.Drawing.Point(20, 60)
$lblAuditStatusText.AutoSize = $true
$gbSysStatus.Controls.Add($lblAuditStatusText)

$lblZipStatusText = New-Object System.Windows.Forms.Label
$lblZipStatusText.Text = "Локальний архів IPBan: Перевірка..."
$lblZipStatusText.Font = New-Object System.Drawing.Font("Segoe UI", 9)
$lblZipStatusText.Location = New-Object System.Drawing.Point(20, 93)
$lblZipStatusText.AutoSize = $true
$gbSysStatus.Controls.Add($lblZipStatusText)

$btnBrowseZip = New-Object System.Windows.Forms.Button
$btnBrowseZip.Text = "Обрати ZIP-архів..."
$btnBrowseZip.Font = New-Object System.Drawing.Font("Segoe UI", 8.5)
$btnBrowseZip.Location = New-Object System.Drawing.Point(800, 88)
$btnBrowseZip.Size = New-Object System.Drawing.Size(160, 28)
$gbSysStatus.Controls.Add($btnBrowseZip)

$btnBrowseZip.Add_Click({
    $ofd = New-Object System.Windows.Forms.OpenFileDialog
    $ofd.Filter = "IPBan Zip Архів (*.zip)|*.zip|Всі файли (*.*)|*.*"
    $ofd.Title = "Оберіть архів інсталятора IPBan"
    if ($ofd.ShowDialog() -eq [System.Windows.Forms.DialogResult]::OK) {
        $script:LocalZipBackup = $ofd.FileName
        Update-ServiceUI
    }
})

# Група: Дії інсталяції та обслуговування
$gbInstallActions = New-Object System.Windows.Forms.GroupBox
$gbInstallActions.Text = "Керування встановленням та налаштуванням"
$gbInstallActions.Font = New-Object System.Drawing.Font("Segoe UI", 9.5, [System.Drawing.FontStyle]::Bold)
$gbInstallActions.Location = New-Object System.Drawing.Point(20, 170)
$gbInstallActions.Size = New-Object System.Drawing.Size(990, 200)
$scrollSetup.Controls.Add($gbInstallActions)

$btnSetupAudit = New-Object System.Windows.Forms.Button
$btnSetupAudit.Text = "Увімкнути аудит безпеки Windows (AuditPol)"
$btnSetupAudit.Font = New-Object System.Drawing.Font("Segoe UI", 9, [System.Drawing.FontStyle]::Bold)
$btnSetupAudit.Location = New-Object System.Drawing.Point(20, 35)
$btnSetupAudit.Size = New-Object System.Drawing.Size(340, 35)
$btnSetupAudit.BackColor = [System.Drawing.Color]::FromArgb(241, 245, 249)
$gbInstallActions.Controls.Add($btnSetupAudit)

$lblAuditHint = New-Object System.Windows.Forms.Label
$lblAuditHint.Text = "(Обов'язково для виявлення невдалих спроб входу RDP/Windows)"
$lblAuditHint.Font = New-Object System.Drawing.Font("Segoe UI", 8.5)
$lblAuditHint.ForeColor = [System.Drawing.Color]::FromArgb(100, 116, 139)
$lblAuditHint.Location = New-Object System.Drawing.Point(370, 43)
$lblAuditHint.AutoSize = $true
$gbInstallActions.Controls.Add($lblAuditHint)

$btnInstallLocal = New-Object System.Windows.Forms.Button
$btnInstallLocal.Text = "Встановити IPBan з локального архіву"
$btnInstallLocal.Font = New-Object System.Drawing.Font("Segoe UI", 9, [System.Drawing.FontStyle]::Bold)
$btnInstallLocal.Location = New-Object System.Drawing.Point(20, 85)
$btnInstallLocal.Size = New-Object System.Drawing.Size(340, 35)
$btnInstallLocal.BackColor = [System.Drawing.Color]::FromArgb(220, 252, 231)
$btnInstallLocal.ForeColor = [System.Drawing.Color]::FromArgb(22, 101, 52)
$gbInstallActions.Controls.Add($btnInstallLocal)

$btnInstallWeb = New-Object System.Windows.Forms.Button
$btnInstallWeb.Text = "Завантажити та встановити найновішу з GitHub"
$btnInstallWeb.Font = New-Object System.Drawing.Font("Segoe UI", 9, [System.Drawing.FontStyle]::Bold)
$btnInstallWeb.Location = New-Object System.Drawing.Point(375, 85)
$btnInstallWeb.Size = New-Object System.Drawing.Size(340, 35)
$btnInstallWeb.BackColor = [System.Drawing.Color]::FromArgb(219, 234, 254)
$btnInstallWeb.ForeColor = [System.Drawing.Color]::FromArgb(29, 78, 216)
$gbInstallActions.Controls.Add($btnInstallWeb)

$btnUninstall = New-Object System.Windows.Forms.Button
$btnUninstall.Text = "Повністю видалити службу IPBan"
$btnUninstall.Font = New-Object System.Drawing.Font("Segoe UI", 9)
$btnUninstall.ForeColor = [System.Drawing.Color]::FromArgb(185, 28, 28)
$btnUninstall.Location = New-Object System.Drawing.Point(20, 135)
$btnUninstall.Size = New-Object System.Drawing.Size(340, 35)
$gbInstallActions.Controls.Add($btnUninstall)

Set-SmoothButton $btnBrowseZip 6
Set-SmoothButton $btnSetupAudit 7
Set-SmoothButton $btnInstallLocal 7
Set-SmoothButton $btnInstallWeb 7
Set-SmoothButton $btnUninstall 7

# Група: Документація та посилання
$gbLinks = New-Object System.Windows.Forms.GroupBox
$gbLinks.Text = "Корисні посилання та документація"
$gbLinks.Font = New-Object System.Drawing.Font("Segoe UI", 9.5, [System.Drawing.FontStyle]::Bold)
$gbLinks.Location = New-Object System.Drawing.Point(20, 385)
$gbLinks.Size = New-Object System.Drawing.Size(990, 100)
$scrollSetup.Controls.Add($gbLinks)

$llGithub = New-Object System.Windows.Forms.LinkLabel
$llGithub.Text = "Офіційний репозиторій DigitalRuby/IPBan на GitHub"
$llGithub.Font = New-Object System.Drawing.Font("Segoe UI", 9)
$llGithub.Location = New-Object System.Drawing.Point(20, 30)
$llGithub.AutoSize = $true
$gbLinks.Controls.Add($llGithub)

$llWiki = New-Object System.Windows.Forms.LinkLabel
$llWiki.Text = "Документація налаштувань та конфігурації (Wiki)"
$llWiki.Font = New-Object System.Drawing.Font("Segoe UI", 9)
$llWiki.Location = New-Object System.Drawing.Point(20, 60)
$llWiki.AutoSize = $true
$gbLinks.Controls.Add($llWiki)

$btnCheckUpdate = New-Object System.Windows.Forms.Button
$btnCheckUpdate.Text = "🔍 " + (T "BtnCheckUpdate")
$btnCheckUpdate.Font = New-Object System.Drawing.Font("Segoe UI", 9, [System.Drawing.FontStyle]::Bold)
$btnCheckUpdate.Location = New-Object System.Drawing.Point(620, 32)
$btnCheckUpdate.Size = New-Object System.Drawing.Size(220, 34)
$btnCheckUpdate.BackColor = [System.Drawing.Color]::FromArgb(238, 242, 255)
$btnCheckUpdate.ForeColor = [System.Drawing.Color]::FromArgb(67, 56, 202)
$gbLinks.Controls.Add($btnCheckUpdate)
Set-SmoothButton $btnCheckUpdate 6 ([System.Drawing.Color]::FromArgb(199, 210, 254))

# ------------------------------------------------------------------------------
# 4. Нижня смуга стану (StatusStrip)
# ------------------------------------------------------------------------------
$statusStrip = New-Object System.Windows.Forms.StatusStrip
$statusStrip.Dock = [System.Windows.Forms.DockStyle]::Fill
$mainLayout.Controls.Add($statusStrip, 0, 3)

$statusLabel = New-Object System.Windows.Forms.ToolStripStatusLabel
$statusLabel.Text = (T "StatusReady")
$statusLabel.Spring = $true
$statusLabel.TextAlign = [System.Drawing.ContentAlignment]::MiddleLeft
[void]$statusStrip.Items.Add($statusLabel)

$statusAdmin = New-Object System.Windows.Forms.ToolStripStatusLabel
if ($script:IsAdmin) {
    $statusAdmin.Text = (T "AdminYes")
    $statusAdmin.ForeColor = [System.Drawing.Color]::FromArgb(22, 101, 52)
} else {
    $statusAdmin.Text = (T "AdminNo")
    $statusAdmin.ForeColor = [System.Drawing.Color]::FromArgb(185, 28, 28)
}
[void]$statusStrip.Items.Add($statusAdmin)

# ------------------------------------------------------------------------------
# Реалізація Логіки та Обробників Подій
# ------------------------------------------------------------------------------

function Update-UILanguage {
    $form.Text = "$((T 'AppTitle')) $script:AppVersion"
    $lblTitle.Text = "$((T 'HeaderTitle')) $script:AppVersion"
    $lblSubtitle.Text = T "HeaderSubtitle"
    $btnStartService.Text = T "BtnStart"
    $btnStopService.Text = T "BtnStop"
    $btnRestartService.Text = T "BtnRestart"
    $btnRefreshAll.Text = T "BtnRefresh"
    $btnLang.Text = T "LangToggle"

    $lblPath.Text = T "PathLabel"
    $btnBrowsePath.Text = T "BtnBrowse"
    $btnOpenFolder.Text = T "BtnOpenFolder"
    $btnOpenConfigFile.Text = T "BtnOpenConfig"
    Update-PathPanelLayout

    $tabBanned.Text = T "TabBanned"
    if ($tabStats) { $tabStats.Text = T "TabStats" }
    $tabSettings.Text = T "TabSettings"
    $tabLists.Text = T "TabLists"
    $tabLogs.Text = T "TabLogs"
    $tabSetup.Text = T "TabSetup"

    $lblSearch.Text = T "Search"
    $lblFilterType.Text = T "Filter"
    if ($cbRuleFilter -and $cbRuleFilter.Items.Count -ge 4) {
        $curIdx = $cbRuleFilter.SelectedIndex
        $cbRuleFilter.Items[0] = T "FilterBanned"
        $cbRuleFilter.Items[1] = T "FilterWhitelist"
        $cbRuleFilter.Items[2] = T "FilterBlacklist"
        $cbRuleFilter.Items[3] = T "FilterAllRules"
        if ($curIdx -ge 0) { $cbRuleFilter.SelectedIndex = $curIdx }
    }
    $btnUnbanSelected.Text = T "BtnUnbanSelected"
    $btnManualBan.Text = T "BtnManualBan"
    $btnUnbanAll.Text = T "BtnUnbanAll"
    $btnExportBanned.Text = T "BtnExport"

    if ($dgvBanned.Columns["Index"]) { $dgvBanned.Columns["Index"].HeaderText = T "ColIndex" }
    if ($dgvBanned.Columns["IPAddress"]) { $dgvBanned.Columns["IPAddress"].HeaderText = T "ColIP" }
    if ($dgvBanned.Columns["Country"]) { $dgvBanned.Columns["Country"].HeaderText = T "ColCountry" }
    if ($dgvBanned.Columns["BanDate"]) { $dgvBanned.Columns["BanDate"].HeaderText = T "ColBanTime" }
    if ($dgvBanned.Columns["UnbanDate"]) { $dgvBanned.Columns["UnbanDate"].HeaderText = T "ColUnbanTime" }

    if ($gbCountryStats) { $gbCountryStats.Text = T "GbCountryStats" }
    if ($gbTimeStats) { $gbTimeStats.Text = T "GbTimeStats" }
    if ($btnRefreshStats) { $btnRefreshStats.Text = T "BtnRefreshStats" }
    if ($lblCardTotalBannedTitle) { $lblCardTotalBannedTitle.Text = T "CardTotalBanned" }
    if ($lblCardUniqueCountriesTitle) { $lblCardUniqueCountriesTitle.Text = T "CardUniqueCountries" }
    if ($lblCardTopCountryTitle) { $lblCardTopCountryTitle.Text = T "CardTopCountry" }
    if ($lblCardPeakHourTitle) { $lblCardPeakHourTitle.Text = T "CardPeakHour" }
    if ($dgvCountryStats) {
        if ($dgvCountryStats.Columns["Rank"]) { $dgvCountryStats.Columns["Rank"].HeaderText = T "ColStatsRank" }
        if ($dgvCountryStats.Columns["Country"]) { $dgvCountryStats.Columns["Country"].HeaderText = T "ColStatsCountry" }
        if ($dgvCountryStats.Columns["Count"]) { $dgvCountryStats.Columns["Count"].HeaderText = T "ColStatsCount" }
        if ($dgvCountryStats.Columns["Share"]) { $dgvCountryStats.Columns["Share"].HeaderText = T "ColStatsShare" }
        if ($dgvCountryStats.Columns["Bar"]) { $dgvCountryStats.Columns["Bar"].HeaderText = T "ColStatsBar" }
    }
    if ($dgvTimeStats) {
        if ($dgvTimeStats.Columns["Hour"]) { $dgvTimeStats.Columns["Hour"].HeaderText = T "ColHour" }
        if ($dgvTimeStats.Columns["Count"]) { $dgvTimeStats.Columns["Count"].HeaderText = T "ColHourAttacks" }
        if ($dgvTimeStats.Columns["Bar"]) { $dgvTimeStats.Columns["Bar"].HeaderText = T "ColHourBar" }
    }

    $gbGeneral.Text = T "GbGeneral"
    $lblFailedAttempts.Text = T "LblFailedAttempts"
    $lblBanTime.Text = T "LblBanTime"
    $lblExpireTime.Text = T "LblExpireTime"
    $lblCycleTime.Text = T "LblCycleTime"
    $gbBehavior.Text = T "GbBehavior"
    $chkClearOnRestart.Text = T "ChkClearOnRestart"
    $chkClearOnSuccess.Text = T "ChkClearOnSuccess"
    $chkProcessInternal.Text = T "ChkProcessInternal"
    $chkResetUnbanned.Text = T "ChkResetUnbanned"
    if ($chkStartInTray) { $chkStartInTray.Text = T "ChkStartInTray" }

    if ($gbMonitoring) {
        $gbMonitoring.Text = T "GbMonitoring"
        $lblMonitoringDesc.Text = T "LblMonitoringDesc"
        foreach ($proto in $script:MonitoredProtocols) {
            $ctl = $script:ProtocolControls[$proto.Id]
            if ($ctl) {
                if ($ctl.CheckBox.Checked) {
                    $ctl.Badge.Text = "🟢 " + (T "StatusEnabled")
                } else {
                    $ctl.Badge.Text = "⚪ " + (T "StatusDisabledService")
                }
            }
        }
    }

    if ($gbAbuseIPDB) {
        $gbAbuseIPDB.Text = T "GbAbuseIPDB"
        $lblAbuseApiKey.Text = T "LblAbuseApiKey"
        $lblAbuseConfidence.Text = T "LblAbuseConfidence"
        $lblAbuseLimit.Text = T "LblAbuseLimit"
        $chkAbuseAutoReport.Text = T "ChkAbuseAutoReport"
        $btnFetchAbuse.Text = T "BtnFetchAbuse"
    }

    $btnSaveConfig.Text = T "BtnSaveConfig"
    $btnReloadConfig.Text = T "BtnReloadConfig"
    $btnRestoreBak.Text = T "BtnRestoreBak"

    $gbWhitelist.Text = T "GbWhitelist"
    $lblWhiteDesc.Text = T "LblWhiteDesc"
    $btnAddLocalIP.Text = T "BtnAddLocalIP"
    $btnAddPublicIP.Text = T "BtnAddPublicIP"
    $gbBlacklist.Text = T "GbBlacklist"
    $lblBlackDesc.Text = T "LblBlackDesc"
    $btnSaveLists.Text = T "BtnSaveLists"

    $rbIPBanLog.Text = T "RbIPBanLog"
    $rbEventLog.Text = T "RbEventLog"
    $btnRefreshLog.Text = T "BtnRefreshLog"
    $chkAutoRefreshLog.Text = T "ChkAutoRefresh"
    $btnClearLog.Text = T "BtnClearLog"
    if ($chkWordWrapLog) { $chkWordWrapLog.Text = T "ChkWordWrap" }

    if ($dgvEventLog.Columns["Time"]) { $dgvEventLog.Columns["Time"].HeaderText = T "ColTime" }
    if ($dgvEventLog.Columns["User"]) { $dgvEventLog.Columns["User"].HeaderText = T "ColUser" }
    if ($dgvEventLog.Columns["IPAddress"]) { $dgvEventLog.Columns["IPAddress"].HeaderText = T "ColIP" }
    if ($dgvEventLog.Columns["LogonType"]) { $dgvEventLog.Columns["LogonType"].HeaderText = T "ColLogonType" }
    if ($dgvEventLog.Columns["Workstation"]) { $dgvEventLog.Columns["Workstation"].HeaderText = T "ColWorkstation" }
    if ($dgvEventLog.Columns["Status"]) { $dgvEventLog.Columns["Status"].HeaderText = T "ColStatus" }

    if ($miCopyIP) { $miCopyIP.Text = T "MiCopyIP" }
    if ($miUnban) { $miUnban.Text = T "MiUnban" }
    if ($miWhitelist) { $miWhitelist.Text = T "MiWhitelist" }

    if ($miEventBan) { $miEventBan.Text = T "MiEventBan" }
    if ($miEventWhite) { $miEventWhite.Text = T "MiEventWhite" }
    if ($miEventCopy) { $miEventCopy.Text = T "MiEventCopy" }

    $gbSysStatus.Text = T "GbSysStatus"
    $btnBrowseZip.Text = T "BtnBrowseZip"
    $gbInstallActions.Text = T "GbInstallActions"
    $btnSetupAudit.Text = T "BtnSetupAudit"
    $lblAuditHint.Text = T "LblAuditHint"
    $btnInstallLocal.Text = T "BtnInstallLocal"
    $btnInstallWeb.Text = T "BtnInstallWeb"
    $btnUninstall.Text = T "BtnUninstallService"
    $gbLinks.Text = T "GbLinks"
    $llGithub.Text = T "LlGithub"
    $llWiki.Text = T "LlWiki"
    if ($btnCheckUpdate) { $btnCheckUpdate.Text = "🔍 " + (T "BtnCheckUpdate") }

    $statusLabel.Text = T "StatusReady"
    $statusAdmin.Text = if ($script:IsAdmin) { T "AdminYes" } else { T "AdminNo" }

    if ($script:tmiTitle) { $script:tmiTitle.Text = T "TrayTitle" }
    if ($script:tmiStart) { $script:tmiStart.Text = T "TrayStart" }
    if ($script:tmiStop) { $script:tmiStop.Text = T "TrayStop" }
    if ($script:tmiRestart) { $script:tmiRestart.Text = T "TrayRestart" }
    if ($script:tmiRefresh) { $script:tmiRefresh.Text = T "TrayRefresh" }
    if ($script:tmiShow) { $script:tmiShow.Text = T "TrayShow" }
    if ($script:tmiExit) { $script:tmiExit.Text = T "TrayExit" }
}

function Apply-Language([string]$lang) {
    $script:CurrentLang = $lang
    try {
        $regKey = "HKCU:\Software\IPBanControlCenter"
        if (-not (Test-Path $regKey)) { New-Item -Path $regKey -Force | Out-Null }
        Set-ItemProperty -Path $regKey -Name "Language" -Value $lang
    } catch {}

    Update-UILanguage
    Update-HeaderLayout
    Update-ServiceUI
    Filter-BannedGrid
    Refresh-LogsView
}

function Init-Tray {
    if ($script:TrayIcon) { return }

    $script:TrayIcon = New-Object System.Windows.Forms.NotifyIcon
    $script:TrayMenu = New-Object System.Windows.Forms.ContextMenuStrip
    $script:TrayMenu.Font = New-Object System.Drawing.Font("Segoe UI", 9)

    $script:tmiTitle = $script:TrayMenu.Items.Add((T "TrayTitle"))
    $script:tmiTitle.Font = New-Object System.Drawing.Font("Segoe UI", 9.5, [System.Drawing.FontStyle]::Bold)
    $script:tmiTitle.Enabled = $false

    [void]$script:TrayMenu.Items.Add("-")

    $script:tmiStatus = $script:TrayMenu.Items.Add((T "TrayStatusChecking"))
    $script:tmiStatus.Font = New-Object System.Drawing.Font("Segoe UI", 9)
    $script:tmiStatus.Enabled = $false

    $script:tmiBannedCount = $script:TrayMenu.Items.Add([string]::Format((T "TrayBannedCount"), 0))
    $script:tmiBannedCount.Font = New-Object System.Drawing.Font("Segoe UI", 9)
    $script:tmiBannedCount.Enabled = $false

    [void]$script:TrayMenu.Items.Add("-")

    $script:tmiStart = $script:TrayMenu.Items.Add((T "TrayStart"))
    $script:tmiStart.Add_Click({
        try {
            Start-Service -Name $script:ServiceName -ErrorAction Stop
            Start-Sleep -Seconds 1
            Update-ServiceUI
        } catch {
            [System.Windows.Forms.MessageBox]::Show("Не вдалося запустити службу: $_", "Помилка", [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Error)
        }
    })

    $script:tmiStop = $script:TrayMenu.Items.Add((T "TrayStop"))
    $script:tmiStop.Add_Click({
        try {
            Stop-Service -Name $script:ServiceName -Force -ErrorAction Stop
            Start-Sleep -Seconds 1
            Update-ServiceUI
        } catch {
            [System.Windows.Forms.MessageBox]::Show("Не вдалося зупинити службу: $_", "Помилка", [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Error)
        }
    })

    $script:tmiRestart = $script:TrayMenu.Items.Add((T "TrayRestart"))
    $script:tmiRestart.Add_Click({
        Restart-ServiceAction
    })

    $script:tmiRefresh = $script:TrayMenu.Items.Add((T "TrayRefresh"))
    $script:tmiRefresh.Add_Click({
        Update-ServiceUI
        Refresh-BannedIPs
        Refresh-LogsView
    })

    [void]$script:TrayMenu.Items.Add("-")

    $script:tmiShow = $script:TrayMenu.Items.Add((T "TrayShow"))
    $script:tmiShow.Font = New-Object System.Drawing.Font("Segoe UI", 9, [System.Drawing.FontStyle]::Bold)
    $script:tmiShow.Add_Click({
        $form.Show()
        $form.WindowState = [System.Windows.Forms.FormWindowState]::Normal
        $form.Activate()
    })

    $script:tmiExit = $script:TrayMenu.Items.Add((T "TrayExit"))
    $script:tmiExit.Add_Click({
        $script:IsExiting = $true
        $form.Close()
        if ($script:AppContext) { $script:AppContext.ExitThread() }
        [System.Windows.Forms.Application]::Exit()
    })

    $script:TrayIcon.ContextMenuStrip = $script:TrayMenu
    $script:TrayIcon.Visible = $true

    # Клік лівою кнопкою відкриває вікно
    $script:TrayIcon.Add_Click({
        param($s, $e)
        if ($e.Button -eq [System.Windows.Forms.MouseButtons]::Left) {
            if (-not $form.Visible -or $form.WindowState -eq [System.Windows.Forms.FormWindowState]::Minimized) {
                $form.Show()
                $form.WindowState = [System.Windows.Forms.FormWindowState]::Normal
                $form.Activate()
            }
        }
    })

    # Подвійний клік перемикає згортання/розгортання
    $script:TrayIcon.Add_DoubleClick({
        if ($form.Visible -and $form.WindowState -ne [System.Windows.Forms.FormWindowState]::Minimized) {
            $form.WindowState = [System.Windows.Forms.FormWindowState]::Minimized
            $form.Hide()
        } else {
            $form.Show()
            $form.WindowState = [System.Windows.Forms.FormWindowState]::Normal
            $form.Activate()
        }
    })

    # Фоновий таймер моніторингу статусу та нових блокувань (кожні 10 сек)
    $script:TrayMonitorTimer = New-Object System.Windows.Forms.Timer
    $script:TrayMonitorTimer.Interval = 10000
    $script:TrayMonitorTimer.Add_Tick({
        try {
            $ips = Get-FirewallBannedIPs
            $script:LastBannedIPs = $ips
            $blockCount = @($ips | Where-Object { $_.ActionType -eq "Block" }).Count
            if ($script:PreviousBannedCount -ge 0 -and $blockCount -gt $script:PreviousBannedCount) {
                $diff = $blockCount - $script:PreviousBannedCount
                $script:AlertActive = $true
                Update-TrayIndicator -forceState "Alert" -alertMessage "УВАГА: Заблоковано нових IP-адрес: +$diff! (Загалом: $blockCount)"
                if ($script:AlertResetTimer) { $script:AlertResetTimer.Stop(); $script:AlertResetTimer.Dispose() }
                $script:AlertResetTimer = New-Object System.Windows.Forms.Timer
                $script:AlertResetTimer.Interval = 15000
                $script:AlertResetTimer.Add_Tick({
                    $script:AlertActive = $false
                    $script:AlertResetTimer.Stop()
                    Update-TrayIndicator
                })
                $script:AlertResetTimer.Start()

                # Якщо ввімкнено авто-репорт в AbuseIPDB
                try {
                    $ips | Where-Object { $_.ActionType -eq "Block" -and $_.IPAddress -notlike "255.255.255.255*" } | ForEach-Object {
                        Send-AbuseIPDBReport -ip $_.IPAddress
                    }
                } catch {}

                # Автоматично оновлюємо таблицю блокувань та статистику у відкритому вікні
                try {
                    if ($form -and $form.Visible -and -not $form.IsDisposed) {
                        Filter-BannedGrid
                        Update-StatsUI
                    }
                } catch {}
            } else {
                Update-TrayIndicator
            }
            $script:PreviousBannedCount = $blockCount
        } catch {}
    })
    $script:TrayMonitorTimer.Start()

    Update-TrayIndicator
}

function Update-TrayIndicator {
    param([string]$forceState = $null, [string]$alertMessage = $null)

    if (-not $script:TrayIcon) { return }

    $svcStatus = Get-IPBanServiceStatus
    $blockCount = @($script:LastBannedIPs | Where-Object { $_.ActionType -eq "Block" }).Count

    $targetState = if ($forceState) {
        $forceState
    } elseif ($script:AlertActive) {
        "Alert"
    } elseif ($svcStatus -eq "Running") {
        "Running"
    } else {
        "Stopped"
    }

    if ($targetState -ne $script:CurrentTrayState) {
        $newIco = Get-AppTrayIcon $targetState
        $oldIco = $script:TrayIcon.Icon
        $script:TrayIcon.Icon = $newIco
        $form.Icon = $newIco
        if ($oldIco) { $oldIco.Dispose() }
        $script:CurrentTrayState = $targetState
    }

    $tipText = if ($targetState -eq "Alert") {
        "IPBan: ⚠ УВАГА! Нове блокування / загроза!"
    } elseif ($svcStatus -eq "Running") {
        "IPBan: Захист активний | Заблоковано: $blockCount IP"
    } elseif ($svcStatus -eq "Stopped") {
        "IPBan: Службу зупинено!"
    } else {
        "IPBan: Служба не встановлена"
    }
    if ($tipText.Length -gt 63) { $tipText = $tipText.Substring(0, 60) + "..." }
    $script:TrayIcon.Text = $tipText

    if ($script:tmiStatus) {
        if ($svcStatus -eq "Running") {
            $script:tmiStatus.Text = "Статус: 🟢 Працює (Running)"
            $script:tmiStart.Enabled = $false
            $script:tmiStop.Enabled = $true
            $script:tmiRestart.Enabled = $true
        } elseif ($svcStatus -eq "Stopped") {
            $script:tmiStatus.Text = "Статус: 🔴 Зупинено (Stopped)"
            $script:tmiStart.Enabled = $true
            $script:tmiStop.Enabled = $false
            $script:tmiRestart.Enabled = $false
        } else {
            $script:tmiStatus.Text = "Статус: ⚪ Не встановлено"
            $script:tmiStart.Enabled = $false
            $script:tmiStop.Enabled = $false
            $script:tmiRestart.Enabled = $false
        }
    }

    if ($script:tmiBannedCount) {
        $script:tmiBannedCount.Text = "Заблоковано в брандмауері: $blockCount IP"
    }

    if ($alertMessage) {
        $script:TrayIcon.ShowBalloonTip(4000, "IPBan Control Center", $alertMessage, [System.Windows.Forms.ToolTipIcon]::Warning)
    }
}

function Update-ServiceUI {
    $status = Get-IPBanServiceStatus
    switch ($status) {
        "Running" {
            $lblStatusBadge.Text = T "StatusRunning"
            $lblStatusBadge.BackColor = [System.Drawing.Color]::FromArgb(22, 163, 74)
            $btnStartService.Enabled = $false
            $btnStopService.Enabled = $true
            $btnRestartService.Enabled = $true
            $lblSvcStatusText.Text = T "SvcRunning"
            $lblSvcStatusText.ForeColor = [System.Drawing.Color]::FromArgb(22, 101, 52)
        }
        "Stopped" {
            $lblStatusBadge.Text = T "StatusStopped"
            $lblStatusBadge.BackColor = [System.Drawing.Color]::FromArgb(220, 38, 38)
            $btnStartService.Enabled = $true
            $btnStopService.Enabled = $false
            $btnRestartService.Enabled = $false
            $lblSvcStatusText.Text = T "SvcStopped"
            $lblSvcStatusText.ForeColor = [System.Drawing.Color]::FromArgb(185, 28, 28)
        }
        default {
            $lblStatusBadge.Text = T "StatusNotInstalled"
            $lblStatusBadge.BackColor = [System.Drawing.Color]::FromArgb(100, 116, 139)
            $btnStartService.Enabled = $false
            $btnStopService.Enabled = $false
            $btnRestartService.Enabled = $false
            $lblSvcStatusText.Text = T "SvcNotInstalled"
            $lblSvcStatusText.ForeColor = [System.Drawing.Color]::FromArgb(100, 116, 139)
        }
    }

    $foundZip = Find-LocalIPBanZip
    if ($foundZip) {
        $script:LocalZipBackup = $foundZip
        $foundMsg = if ($script:CurrentLang -eq "EN") { "Local IPBan Archive: Found ($foundZip)" } else { "Локальний архів IPBan: Знайдено ($foundZip)" }
        $lblZipStatusText.Text = $foundMsg
        $lblZipStatusText.ForeColor = [System.Drawing.Color]::FromArgb(22, 101, 52)
        $btnInstallLocal.Enabled = $true
        $btnInstallLocal.Text = T "BtnInstallLocal"
    } else {
        $notFoundMsg = if ($script:CurrentLang -eq "EN") { "Local IPBan Archive: Not found (select file or download from GitHub)" } else { "Локальний архів IPBan: Не знайдено (оберіть файл або завантажте з GitHub)" }
        $lblZipStatusText.Text = $notFoundMsg
        $lblZipStatusText.ForeColor = [System.Drawing.Color]::FromArgb(100, 116, 139)
        $btnInstallLocal.Enabled = $true
        $btnInstallLocal.Text = if ($script:CurrentLang -eq "EN") { "Choose ZIP Archive & Install..." } else { "Обрати ZIP-архів та встановити..." }
    }

    try {
        $auditCheck = & auditpol.exe /get /category:"Logon/Logoff" 2>$null
        if ($auditCheck -match "Success and Failure|Успех и отказ|Успіх та відмова") {
            $auditOk = if ($script:CurrentLang -eq "EN") { "Windows Security Audit (AuditPol): Enabled (Success and Failure)" } else { "Аудит невдалих спроб входу (AuditPol): Увімкнено (Success and Failure)" }
            $lblAuditStatusText.Text = $auditOk
            $lblAuditStatusText.ForeColor = [System.Drawing.Color]::FromArgb(22, 101, 52)
        } else {
            $auditWarn = if ($script:CurrentLang -eq "EN") { "Windows Security Audit (AuditPol): May not be fully enabled" } else { "Аудит невдалих спроб входу (AuditPol): Можливо не налаштовано повністю" }
            $lblAuditStatusText.Text = $auditWarn
            $lblAuditStatusText.ForeColor = [System.Drawing.Color]::FromArgb(194, 65, 12)
        }
    } catch {
        $auditErr = if ($script:CurrentLang -eq "EN") { "Windows Security Audit (AuditPol): Permission denied to check" } else { "Аудит невдалих спроб входу (AuditPol): Немає доступу для перевірки" }
        $lblAuditStatusText.Text = $auditErr
    }

    Update-TrayIndicator
}

function Refresh-BannedIPs {
    $statusLabel.Text = T "StatusRulesLoading"
    $form.Cursor = [System.Windows.Forms.Cursors]::WaitCursor
    try {
        $script:LastBannedIPs = Get-FirewallBannedIPs
        Filter-BannedGrid
        Update-StatsUI
        if ($script:GeoIPPending.Count -gt 0) {
            Resolve-NextPendingGeoIP
        }
        $blockCount = @($script:LastBannedIPs | Where-Object { $_.ActionType -eq "Block" }).Count
        $allowCount = @($script:LastBannedIPs | Where-Object { $_.ActionType -eq "Allow" }).Count
        $blackCount = @($script:LastBannedIPs | Where-Object { $_.ActionType -eq "Blacklist" }).Count
        $statusLabel.Text = [string]::Format((T "StatusRulesRefreshed"), $blockCount, $allowCount, $blackCount)

        # Перевірка на новий бан для тривоги (Alert) - тільки локальні блокування!
        if ($script:PreviousBannedCount -ge 0 -and $blockCount -gt $script:PreviousBannedCount) {
            $diff = $blockCount - $script:PreviousBannedCount
            $script:AlertActive = $true
            $alertMsg = if ($script:CurrentLang -eq "EN") { "IPBan banned new IP addresses: +$diff! (Local total: $blockCount)" } else { "IPBan заблокував нових адрес: +$diff! (Локально: $blockCount)" }
            Update-TrayIndicator -forceState "Alert" -alertMessage $alertMsg
            if ($script:AlertResetTimer) { $script:AlertResetTimer.Stop(); $script:AlertResetTimer.Dispose() }
            $script:AlertResetTimer = New-Object System.Windows.Forms.Timer
            $script:AlertResetTimer.Interval = 15000
            $script:AlertResetTimer.Add_Tick({
                $script:AlertActive = $false
                $script:AlertResetTimer.Stop()
                Update-TrayIndicator
            })
            $script:AlertResetTimer.Start()
        } else {
            Update-TrayIndicator
        }
        $script:PreviousBannedCount = $blockCount
    } catch {
        $errMsg = if ($script:CurrentLang -eq "EN") { "Error loading rules: $_" } else { "Помилка завантаження правил: $_" }
        $statusLabel.Text = $errMsg
    } finally {
        $form.Cursor = [System.Windows.Forms.Cursors]::Default
    }
}

function Filter-BannedGrid {
    $dgvBanned.Rows.Clear()
    $filter = $txtSearchBanned.Text.Trim()
    $filterMode = if ($cbRuleFilter -and $cbRuleFilter.SelectedIndex -ge 0) { $cbRuleFilter.SelectedIndex } else { 0 }

    $allList = @($script:LastBannedIPs)
    $blockCount = @($allList | Where-Object { $_.ActionType -eq "Block" }).Count
    $allowCount = @($allList | Where-Object { $_.ActionType -eq "Allow" }).Count
    $blackCount = @($allList | Where-Object { $_.ActionType -eq "Blacklist" }).Count

    # Отримуємо карту часу блокувань із БД / логів
    $timesMap = Get-IPBanTimesMap

    # Фільтруємо записи згідно з вибором
    $filteredItems = @()
    foreach ($item in $allList) {
        if ($filterMode -eq 0 -and $item.ActionType -ne "Block") { continue }
        if ($filterMode -eq 1 -and $item.ActionType -ne "Allow") { continue }
        if ($filterMode -eq 2 -and $item.ActionType -ne "Blacklist") { continue }

        if ([string]::IsNullOrEmpty($filter) -or $item.IPAddress.Contains($filter) -or $item.RuleName.Contains($filter)) {
            $filteredItems += $item
        }
    }

    # Сортуємо список: найновіші блокування (за датою BanDate) зверху
    $sortedItems = $filteredItems | Sort-Object -Descending {
        $clean = $_.IPAddress.Trim().Replace("/255.255.255.255", "").Replace("/32", "")
        $info = $timesMap[$clean]
        if (-not $info) { $info = $timesMap[$_.IPAddress] }
        if ($info -and $info.BanDate) { $info.BanDate } else { [DateTime]::MinValue }
    }

    $idx = 1
    foreach ($item in $sortedItems) {
        $cleanIp = $item.IPAddress.Trim().Replace("/255.255.255.255", "").Replace("/32", "")
        $isBlock = ($item.ActionType -eq "Block")
        $isBlacklist = ($item.ActionType -eq "Blacklist")

        $banDateStr = "—"
        $unbanDateStr = "—"

        if ($isBlock) {
            $info = $timesMap[$cleanIp]
            if (-not $info) { $info = $timesMap[$item.IPAddress] }

            if ($info -and $info.BanDate) {
                $banDateStr = $info.BanDate.ToString("dd.MM.yyyy HH:mm:ss")
                if ($info.UnbanDate) {
                    $unbanDateStr = $info.UnbanDate.ToString("dd.MM.yyyy HH:mm:ss")
                } else {
                    $durStr = if ($info.Duration) { $info.Duration } else { $script:CurrentBanTimeSetting }
                    if ($durStr -eq "00:00:00:00" -or $durStr -eq "0.00:00:00") {
                        $unbanDateStr = (T "BanPermanent")
                    } else {
                        try {
                            $ts = [TimeSpan]::Parse($durStr)
                            $unbanDateStr = $info.BanDate.Add($ts).ToString("dd.MM.yyyy HH:mm:ss")
                        } catch {
                            $unbanDateStr = (T "BanPerConfig")
                        }
                    }
                }
            } else {
                $banDateStr = (T "BanTimeUnknown")
                $durStr = $script:CurrentBanTimeSetting
                if ($durStr -eq "00:00:00:00" -or $durStr -eq "0.00:00:00") {
                    $unbanDateStr = (T "BanPermanent")
                } else {
                    $unbanDateStr = (T "BanPerConfig")
                }
            }
        } elseif ($isBlacklist) {
            $banDateStr = (T "BlacklistNote")
            $unbanDateStr = (T "BanPermanent")
        } else {
            $banDateStr = (T "WhitelistNote")
            $unbanDateStr = "—"
        }

        $countryStr = "—"
        if ($isBlock -or $isBlacklist) {
            $geo = Get-IPCountryInfo $cleanIp
            if ($geo) {
                $countryStr = Format-CountryDisplay $geo.Code $geo.Name
            } else {
                $countryStr = (T "ResolvingCountry")
                $script:GeoIPPending.Add($cleanIp) | Out-Null
            }
        }

        $rowIdx = $dgvBanned.Rows.Add(
                $idx,
                $item.IPAddress,
                $countryStr,
                $banDateStr,
                $unbanDateStr
            )
            $row = $dgvBanned.Rows[$rowIdx]
            $row.Tag = $item.ActionType

            # Розділення кольором:
            # - блідо-червоний для локально заблокованих
            # - блідо-фіолетовий/темно-червоний для чорного списку (Blacklist)
            # - блідо-зелений для білого списку
            if ($isBlock) {
                $row.DefaultCellStyle.BackColor = [System.Drawing.Color]::FromArgb(254, 242, 242)
                $row.DefaultCellStyle.ForeColor = [System.Drawing.Color]::FromArgb(153, 27, 27)
                $row.DefaultCellStyle.SelectionBackColor = [System.Drawing.Color]::FromArgb(254, 202, 202)
                $row.DefaultCellStyle.SelectionForeColor = [System.Drawing.Color]::FromArgb(153, 27, 27)
            } elseif ($isBlacklist) {
                $row.DefaultCellStyle.BackColor = [System.Drawing.Color]::FromArgb(243, 244, 246)
                $row.DefaultCellStyle.ForeColor = [System.Drawing.Color]::FromArgb(31, 41, 55)
                $row.DefaultCellStyle.SelectionBackColor = [System.Drawing.Color]::FromArgb(229, 231, 235)
                $row.DefaultCellStyle.SelectionForeColor = [System.Drawing.Color]::FromArgb(17, 24, 39)
            } else {
                $row.DefaultCellStyle.BackColor = [System.Drawing.Color]::FromArgb(240, 253, 244)
                $row.DefaultCellStyle.ForeColor = [System.Drawing.Color]::FromArgb(22, 101, 52)
                $row.DefaultCellStyle.SelectionBackColor = [System.Drawing.Color]::FromArgb(187, 247, 208)
                $row.DefaultCellStyle.SelectionForeColor = [System.Drawing.Color]::FromArgb(22, 101, 52)
            }

            $idx++
        }

    if ($filterMode -eq 0) {
        if ($blockCount -eq 0) {
            $lblBannedCount.Text = [string]::Format((T "LblNoBans"), $allowCount, $blackCount)
            $lblBannedCount.ForeColor = [System.Drawing.Color]::FromArgb(22, 101, 52)
        } else {
            $lblBannedCount.Text = [string]::Format((T "LblBansCount"), $blockCount, $dgvBanned.Rows.Count, $blackCount, $allowCount)
            $lblBannedCount.ForeColor = [System.Drawing.Color]::FromArgb(185, 28, 28)
        }
    } elseif ($filterMode -eq 1) {
        $lblBannedCount.Text = [string]::Format((T "LblWhiteCount"), $allowCount, $dgvBanned.Rows.Count, $blockCount)
        $lblBannedCount.ForeColor = [System.Drawing.Color]::FromArgb(37, 99, 235)
    } elseif ($filterMode -eq 2) {
        $lblBannedCount.Text = [string]::Format((T "LblBlackCount"), $blackCount, $dgvBanned.Rows.Count, $blockCount)
        $lblBannedCount.ForeColor = [System.Drawing.Color]::FromArgb(55, 65, 81)
    } else {
        $lblBannedCount.Text = [string]::Format((T "LblAllRulesCount"), $allList.Count, $dgvBanned.Rows.Count)
        $lblBannedCount.ForeColor = [System.Drawing.Color]::FromArgb(51, 65, 85)
    }
}

function Update-StatsUI {
    param([bool]$forceRefreshHeavy = $false)
    if (-not $dgvCountryStats -or -not $dgvTimeStats) { return }

    $allList = @($script:LastBannedIPs | Where-Object { $_.ActionType -eq "Block" })
    $totalBanned = $allList.Count

    # 1. Розподіл по країнах (групуємо за кодом країни)
    $countryMap = @{}

    foreach ($item in $allList) {
        $clean = $item.IPAddress.Trim().Replace("/255.255.255.255", "").Replace("/32", "")
        if (Test-IsPrivateIP $clean) {
            $key = "LAN"
            if (-not $countryMap.ContainsKey($key)) {
                $countryMap[$key] = [PSCustomObject]@{
                    Code        = "LAN"
                    DisplayName = "🏠 LAN - " + (T "LocalNetwork")
                    ShortName   = "LAN - " + (T "LocalNetwork")
                    AttackCount = 0
                }
            }
            $countryMap[$key].AttackCount++
            continue
        }

        if ($script:GeoIPCache.ContainsKey($clean)) {
            $geo = $script:GeoIPCache[$clean]
            $code = if ($geo.Code) { $geo.Code.ToUpper().Trim() } else { "??" }
            $name = if ($geo.Name -and $geo.Name.Trim() -ne $code) { $geo.Name.Trim() } else { "" }
            $key = $code

            if (-not $countryMap.ContainsKey($key)) {
                $display = Format-CountryDisplay $code $name
                $countryMap[$key] = [PSCustomObject]@{
                    Code        = $code
                    DisplayName = $display
                    ShortName   = $display
                    AttackCount = 0
                }
            } elseif ($name -and $countryMap[$key].DisplayName -eq $code) {
                $display = Format-CountryDisplay $code $name
                $countryMap[$key].DisplayName = $display
                $countryMap[$key].ShortName   = $display
            }
            $countryMap[$key].AttackCount++
        } else {
            $key = "??"
            if (-not $countryMap.ContainsKey($key)) {
                $display = "🌐 ?? - " + (T "UnknownCountry")
                $countryMap[$key] = [PSCustomObject]@{
                    Code        = "??"
                    DisplayName = $display
                    ShortName   = (T "UnknownCountry")
                    AttackCount = 0
                }
            }
            $countryMap[$key].AttackCount++
        }
    }

    $sortedCountries = @($countryMap.Values | Sort-Object -Property AttackCount -Descending)
    $dgvCountryStats.Rows.Clear()
    $rank = 1
    $topCountryText = "—"
    $topCountryShare = 0.0

    if ($sortedCountries.Count -eq 0) {
        [void]$dgvCountryStats.Rows.Add("—", (T "NoActiveBans"), "0", "0%", "—")
    } else {
        foreach ($entry in $sortedCountries) {
            $share = if ($totalBanned -gt 0) { [Math]::Round(($entry.AttackCount / [double]$totalBanned) * 100.0, 1) } else { 0.0 }
            $bar = Get-VisualBar $share 12
            if ($rank -eq 1 -and $totalBanned -gt 0) {
                $topCountryText = $entry.ShortName
                $topCountryShare = $share
            }
            $rIdx = $dgvCountryStats.Rows.Add(
                $rank,
                $entry.DisplayName,
                $entry.AttackCount,
                "$share%",
                $bar
            )
            $rank++
        }
    }

    # 2. Розподіл за 24 годинами (00:00 - 23:00)
    # Кешуємо запити дискових логів та журналу Windows 4625 на 60 секунд, щоб не блокувати інтерфейс
    $now = Get-Date
    if ($forceRefreshHeavy -or -not $script:CachedHourCounts -or -not $script:LastHourCountsTime -or ($now - $script:LastHourCountsTime).TotalSeconds -gt 60) {
        $hourCounts = @{}
        for ($h = 0; $h -lt 24; $h++) { $hourCounts[$h] = 0 }

        # Додаємо час блокувань із кешу SQLite/логів
        $timesMap = Get-IPBanTimesMap
        foreach ($entry in $timesMap.Values) {
            if ($entry -and $entry.BanDate) {
                $h = $entry.BanDate.Hour
                if ($h -ge 0 -and $h -lt 24) { $hourCounts[$h]++ }
            }
        }

        # Враховуємо останні події 4625 невдалих входів Windows (до 50 записів)
        try {
            $recentFailed = Get-WindowsFailedLogins -maxEvents 50
            foreach ($ev in $recentFailed) {
                if ($ev.TimeCreated) {
                    try {
                        $dt = [DateTime]::Parse($ev.TimeCreated)
                        $h = $dt.Hour
                        if ($h -ge 0 -and $h -lt 24) { $hourCounts[$h]++ }
                    } catch {}
                }
            }
        } catch {}

        $script:CachedHourCounts = $hourCounts
        $script:LastHourCountsTime = $now
    } else {
        $hourCounts = $script:CachedHourCounts
    }

    $maxHourCount = 0
    $peakHour = 0
    for ($h = 0; $h -lt 24; $h++) {
        if ($hourCounts[$h] -gt $maxHourCount) {
            $maxHourCount = $hourCounts[$h]
            $peakHour = $h
        }
    }

    $dgvTimeStats.Rows.Clear()
    for ($h = 0; $h -lt 24; $h++) {
        $cnt = $hourCounts[$h]
        $pct = if ($maxHourCount -gt 0) { ($cnt / [double]$maxHourCount) * 100.0 } else { 0.0 }
        $bar = Get-VisualBar $pct 16
        $label = "{0:D2}:00 - {1:D2}:00" -f $h, (($h + 1) % 24)
        $rIdx = $dgvTimeStats.Rows.Add($label, $cnt, $bar)
        if ($cnt -eq $maxHourCount -and $maxHourCount -gt 0) {
            $row = $dgvTimeStats.Rows[$rIdx]
            $row.DefaultCellStyle.BackColor = [System.Drawing.Color]::FromArgb(254, 242, 242)
            $row.DefaultCellStyle.ForeColor = [System.Drawing.Color]::FromArgb(185, 28, 28)
            $row.DefaultCellStyle.Font = New-Object System.Drawing.Font("Segoe UI", 9, [System.Drawing.FontStyle]::Bold)
        }
    }

    # Оновлення KPI карток
    $lblCardTotalBannedVal.Text = $totalBanned.ToString()
    $lblCardUniqueCountriesVal.Text = $sortedCountries.Count.ToString()
    $topStr = if ($totalBanned -gt 0) { "$topCountryText ($topCountryShare%)" } else { "—" }
    $lblCardTopCountryVal.Text = $topStr
    if ($topStr.Length -gt 24) {
        $lblCardTopCountryVal.Font = New-Object System.Drawing.Font("Segoe UI", 9.5, [System.Drawing.FontStyle]::Bold)
    } elseif ($topStr.Length -gt 17) {
        $lblCardTopCountryVal.Font = New-Object System.Drawing.Font("Segoe UI", 10.5, [System.Drawing.FontStyle]::Bold)
    } else {
        $lblCardTopCountryVal.Font = New-Object System.Drawing.Font("Segoe UI", 11.5, [System.Drawing.FontStyle]::Bold)
    }
    $lblCardPeakHourVal.Text = if ($maxHourCount -gt 0) { "{0:D2}:00 - {1:D2}:00" -f $peakHour, (($peakHour + 1) % 24) } else { "—" }

    # Повідомлення про пік
    if ($maxHourCount -gt 0) {
        $nextH = ($peakHour + 1) % 24
        $lblPeakBanner.MaximumSize = New-Object System.Drawing.Size([Math]::Max(100, ($gbTimeStats.ClientSize.Width - 16)), 0)
        $lblPeakBanner.Text = [string]::Format((T "PeakNotice"), ("{0:D2}" -f $peakHour), ("{0:D2}" -f $nextH), $maxHourCount)
        $lblPeakBanner.Visible = $true
    } else {
        $lblPeakBanner.Visible = $false
    }
}

$script:IsLoadingSettings = $false

function Save-PersistentAppSettings {
    if ($script:IsLoadingSettings) { return }
    try {
        $settingsDir = Join-Path $env:ProgramData "IPBanControlCenter"
        if (-not (Test-Path $settingsDir)) {
            New-Item -ItemType Directory -Path $settingsDir -Force | Out-Null
        }
        $settingsFile = Join-Path $settingsDir "settings.json"

        # Формуємо об'єкт протоколів
        $protoHash = [ordered]@{}
        if ($script:ProtocolControls) {
            foreach ($proto in $script:MonitoredProtocols) {
                $ctl = $script:ProtocolControls[$proto.Id]
                if ($ctl -and $ctl.CheckBox) {
                    $protoHash[$proto.Id] = [bool]$ctl.CheckBox.Checked
                }
            }
        }

        $apiKeyVal = if ($txtAbuseApiKey) { $txtAbuseApiKey.Text.Trim() } else { "" }
        $confVal = if ($numAbuseConfidence) { [int]$numAbuseConfidence.Value } else { 100 }
        $limVal = if ($numAbuseLimit) { [int]$numAbuseLimit.Value } else { 1000 }
        $autoVal = if ($chkAbuseAutoReport) { [bool]$chkAbuseAutoReport.Checked } else { $false }
        $trayVal = if ($chkStartInTray) { [bool]$chkStartInTray.Checked } else { $true }
        $pathVal = if ($txtInstallPath) { $txtInstallPath.Text.Trim() } else { "C:\Program Files\IPBan" }

        $settingsData = [ordered]@{
            "AbuseIPDB" = [ordered]@{
                "ApiKey" = $apiKeyVal
                "Confidence" = $confVal
                "Limit" = $limVal
                "AutoReport" = $autoVal
            }
            "Protocols" = $protoHash
            "General" = [ordered]@{
                "Language" = $script:CurrentLang
                "StartInTray" = $trayVal
                "IPBanPath" = $pathVal
            }
        }

        # 1. Зберігаємо у ProgramData JSON
        $json = $settingsData | ConvertTo-Json -Depth 4
        $utf8WithBom = New-Object System.Text.UTF8Encoding($true)
        [System.IO.File]::WriteAllText($settingsFile, $json, $utf8WithBom)

        # 2. Зберігаємо у реєстр HKCU та HKLM
        foreach ($root in @("HKCU:\SOFTWARE\IPBanControlCenter", "HKLM:\SOFTWARE\IPBanControlCenter")) {
            try {
                if (-not (Test-Path $root)) { New-Item -Path $root -Force | Out-Null }
                Set-ItemProperty -Path $root -Name "Language" -Value $script:CurrentLang -Force
                Set-ItemProperty -Path $root -Name "StartInTray" -Value (if ($trayVal) { 1 } else { 0 }) -Force
                Set-ItemProperty -Path $root -Name "IPBanPath" -Value $pathVal -Force

                $regAbuse = "$root\AbuseIPDB"
                if (-not (Test-Path $regAbuse)) { New-Item -Path $regAbuse -Force | Out-Null }
                Set-ItemProperty -Path $regAbuse -Name "ApiKey" -Value $apiKeyVal -Force
                Set-ItemProperty -Path $regAbuse -Name "Confidence" -Value $confVal -Force
                Set-ItemProperty -Path $regAbuse -Name "Limit" -Value $limVal -Force
                Set-ItemProperty -Path $regAbuse -Name "AutoReport" -Value (if ($autoVal) { 1 } else { 0 }) -Force

                $regProto = "$root\Protocols"
                if (-not (Test-Path $regProto)) { New-Item -Path $regProto -Force | Out-Null }
                foreach ($pKey in $protoHash.Keys) {
                    Set-ItemProperty -Path $regProto -Name $pKey -Value (if ($protoHash[$pKey]) { 1 } else { 0 }) -Force
                }
            } catch {}
        }
    } catch {}
}

function Load-PersistentAppSettings {
    $script:IsLoadingSettings = $true
    try {
        $settingsDir = Join-Path $env:ProgramData "IPBanControlCenter"
        $settingsFile = Join-Path $settingsDir "settings.json"
        $loadedData = $null

        # 1. Спроба завантажити з ProgramData JSON
        if (Test-Path $settingsFile) {
            try {
                $jsonRaw = Get-Content -Path $settingsFile -Raw -Encoding UTF8
                $loadedData = $jsonRaw | ConvertFrom-Json
            } catch {}
        }

        # 2. Реєстр як джерело/резерв
        $regAbuse = "HKCU:\SOFTWARE\IPBanControlCenter\AbuseIPDB"
        $regProto = "HKCU:\SOFTWARE\IPBanControlCenter\Protocols"
        $regU = "HKCU:\SOFTWARE\IPBanControlCenter"

        # AbuseIPDB
        $apiKey = $null
        $confidence = $null
        $limit = $null
        $autoReport = $null

        if ($loadedData -and $loadedData.AbuseIPDB) {
            $apiKey = $loadedData.AbuseIPDB.ApiKey
            if ($null -ne $loadedData.AbuseIPDB.Confidence) { $confidence = [int]$loadedData.AbuseIPDB.Confidence }
            if ($null -ne $loadedData.AbuseIPDB.Limit) { $limit = [int]$loadedData.AbuseIPDB.Limit }
            if ($null -ne $loadedData.AbuseIPDB.AutoReport) { $autoReport = [bool]$loadedData.AbuseIPDB.AutoReport }
        }
        
        if (-not $apiKey -and (Test-Path $regAbuse)) {
            try {
                $p = Get-ItemProperty -Path $regAbuse -ErrorAction SilentlyContinue
                if ($p.ApiKey) { $apiKey = $p.ApiKey }
                if ($null -ne $p.Confidence) { $confidence = [int]$p.Confidence }
                if ($null -ne $p.Limit) { $limit = [int]$p.Limit }
                if ($null -ne $p.AutoReport) { $autoReport = ([int]$p.AutoReport -eq 1) }
            } catch {}
        }

        if ($apiKey -and $txtAbuseApiKey) { $txtAbuseApiKey.Text = $apiKey }
        if ($null -ne $confidence -and $numAbuseConfidence) { $numAbuseConfidence.Value = [Math]::Max(1, [Math]::Min(100, $confidence)) }
        if ($null -ne $limit -and $numAbuseLimit) { $numAbuseLimit.Value = [Math]::Max(50, [Math]::Min(10000, $limit)) }
        if ($null -ne $autoReport -and $chkAbuseAutoReport) { $chkAbuseAutoReport.Checked = $autoReport }

        # Протоколи моніторингу
        $protoSettingsFound = $false
        if ($loadedData -and $loadedData.Protocols) {
            foreach ($proto in $script:MonitoredProtocols) {
                $ctl = $script:ProtocolControls[$proto.Id]
                if ($ctl -and $ctl.CheckBox) {
                    $pVal = $loadedData.Protocols.$($proto.Id)
                    if ($null -ne $pVal) {
                        $ctl.CheckBox.Checked = [bool]$pVal
                        $protoSettingsFound = $true
                    }
                }
            }
        }
        
        if (-not $protoSettingsFound -and (Test-Path $regProto)) {
            try {
                $pProps = Get-ItemProperty -Path $regProto -ErrorAction SilentlyContinue
                foreach ($proto in $script:MonitoredProtocols) {
                    $ctl = $script:ProtocolControls[$proto.Id]
                    if ($ctl -and $ctl.CheckBox) {
                        $pVal = $pProps.$($proto.Id)
                        if ($null -ne $pVal) {
                            $ctl.CheckBox.Checked = ([int]$pVal -ne 0)
                        }
                    }
                }
            } catch {}
        }

        # Загальні налаштування
        if ($loadedData -and $loadedData.General) {
            if ($null -ne $loadedData.General.StartInTray -and $chkStartInTray) {
                $chkStartInTray.Checked = [bool]$loadedData.General.StartInTray
            }
        } elseif (Test-Path $regU) {
            try {
                $vTray = (Get-ItemProperty -Path $regU -Name "StartInTray" -ErrorAction SilentlyContinue).StartInTray
                if ($null -ne $vTray -and $chkStartInTray) {
                    $chkStartInTray.Checked = ([int]$vTray -ne 0)
                }
            } catch {}
        }
    } finally {
        $script:IsLoadingSettings = $false
    }
}

function Load-ConfigData {
    # 1. Завжди завантажуємо збережені налаштування користувача (AbuseIPDB, протоколи, трей)
    Load-PersistentAppSettings

    $configFile = Get-IPBanConfigFile
    if (-not (Test-Path $configFile)) {
        $statusLabel.Text = [string]::Format((T "StatusConfigNotFound"), $configFile)
        return
    }

    try {
        [xml]$xml = Get-Content -Path $configFile -Encoding UTF8 -Raw

        function Get-XmlKey([string]$key) {
            $node = $xml.SelectSingleNode("//appSettings/add[@key='$key']")
            if ($null -ne $node -and $node.HasAttribute("value")) {
                return $node.GetAttribute("value")
            }
            return $null
        }

        $valAttempts = Get-XmlKey "FailedLoginAttemptsBeforeBan"
        if ($valAttempts) { $numFailedAttempts.Value = [int]$valAttempts }

        $valBanTime = Get-XmlKey "BanTime"
        if ($valBanTime) {
            $script:CurrentBanTimeSetting = $valBanTime
            $txtBanTimeCustom.Text = $valBanTime
            $foundIndex = -1
            for ($i = 0; $i -lt $cbBanTimePreset.Items.Count; $i++) {
                if ($cbBanTimePreset.Items[$i].ToString().StartsWith($valBanTime)) {
                    $foundIndex = $i
                    break
                }
            }
            if ($foundIndex -ge 0) { $cbBanTimePreset.SelectedIndex = $foundIndex }
        }

        $valExpire = Get-XmlKey "ExpireTime"
        if ($valExpire) { $txtExpireTime.Text = $valExpire }

        $valCycle = Get-XmlKey "CycleTime"
        if ($valCycle) { $txtCycleTime.Text = $valCycle }

        $valClearRestart = Get-XmlKey "ClearBannedIPAddressesOnRestart"
        $chkClearOnRestart.Checked = ($valClearRestart -eq "true")

        $valClearSuccess = Get-XmlKey "ClearFailedLoginsOnSuccessfulLogin"
        $chkClearOnSuccess.Checked = ($valClearSuccess -eq "true")

        $valProcessInternal = Get-XmlKey "ProcessInternalIPAddresses"
        $chkProcessInternal.Checked = ($valProcessInternal -eq "true")

        $valResetUnbanned = Get-XmlKey "ResetFailedLoginCountForUnbannedIPAddresses"
        $chkResetUnbanned.Checked = ($valResetUnbanned -eq "true")

        try {
            $regU = "HKCU:\SOFTWARE\IPBanControlCenter"
            if (Test-Path $regU) {
                $valTray = (Get-ItemProperty -Path $regU -Name "StartInTray" -ErrorAction SilentlyContinue).StartInTray
                $chkStartInTray.Checked = ($null -eq $valTray -or [int]$valTray -ne 0)
            } else {
                $chkStartInTray.Checked = $true
            }
        } catch {
            $chkStartInTray.Checked = $true
        }

        # Whitelist & Blacklist
        $valWhite = Get-XmlKey "Whitelist"
        if ($valWhite) {
            $whiteItems = ($valWhite -split ",") | ForEach-Object { $_.Trim() } | Where-Object { $_ }
            $txtWhitelist.Text = ($whiteItems -join "`r`n")
        } else {
            $txtWhitelist.Text = ""
        }

        $valBlack = Get-XmlKey "Blacklist"
        if ($valBlack) {
            $blackItems = ($valBlack -split ",") | ForEach-Object { $_.Trim() } | Where-Object { $_ }
            $txtBlacklist.Text = ($blackItems -join "`r`n")
        } else {
            $txtBlacklist.Text = ""
        }

        # AbuseIPDB налаштування: якщо в UI пусто, спробувати з реєстру
        if (-not $txtAbuseApiKey.Text.Trim()) {
            try {
                $regAbuse = "HKCU:\SOFTWARE\IPBanControlCenter\AbuseIPDB"
                if (Test-Path $regAbuse) {
                    $p = Get-ItemProperty -Path $regAbuse -ErrorAction SilentlyContinue
                    if ($p.ApiKey) { $txtAbuseApiKey.Text = $p.ApiKey }
                    if ($p.Confidence) { $numAbuseConfidence.Value = [int]$p.Confidence }
                    if ($p.Limit) { $numAbuseLimit.Value = [int]$p.Limit }
                    if ($null -ne $p.AutoReport) { $chkAbuseAutoReport.Checked = ([int]$p.AutoReport -eq 1) }
                }
            } catch {}
        }

        # Моніторинг сервісів: якщо немає збережених налаштувань, зчитуємо з ipban.config
        $settingsFile = Join-Path $env:ProgramData "IPBanControlCenter\settings.json"
        $hasCustomProto = (Test-Path $settingsFile) -or (Test-Path "HKCU:\SOFTWARE\IPBanControlCenter\Protocols")
        if (-not $hasCustomProto) {
            try {
                $existingSources = @{}
                $xml.SelectNodes("//ExpressionsToBlock//Group/Source") | ForEach-Object {
                    if ($_.InnerText) { $existingSources[$_.InnerText.Trim().ToUpper()] = $true }
                }
                $xml.SelectNodes("//LogFilesToParse//LogFile/Source") | ForEach-Object {
                    if ($_.InnerText) { $existingSources[$_.InnerText.Trim().ToUpper()] = $true }
                }

                foreach ($proto in $script:MonitoredProtocols) {
                    $ctl = $script:ProtocolControls[$proto.Id]
                    if ($ctl -and $ctl.CheckBox) {
                        $pidUpper = $proto.Id.ToUpper()
                        $hasConfig = ($existingSources.ContainsKey($pidUpper) -or ($pidUpper -eq "RDP"))
                        $ctl.CheckBox.Checked = $hasConfig
                    }
                }
            } catch {}
        }

        $statusLabel.Text = [string]::Format((T "StatusConfigLoaded"), [System.IO.Path]::GetFileName($configFile))
    } catch {
        [System.Windows.Forms.MessageBox]::Show("Помилка читання конфігурації: $_", "Помилка", [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Error)
    }
}

function Save-ConfigData {
    $configFile = Get-IPBanConfigFile
    $configDir = [System.IO.Path]::GetDirectoryName($configFile)

    if (-not (Test-Path $configDir)) {
        try {
            New-Item -ItemType Directory -Path $configDir -Force | Out-Null
        } catch {
            [System.Windows.Forms.MessageBox]::Show("Не вдалося створити папку: $configDir`n$_", "Помилка", [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Error)
            return
        }
    }

    try {
        [xml]$xml = $null
        if (Test-Path $configFile) {
            $bakFile = "$configFile.bak"
            Copy-Item -Path $configFile -Destination $bakFile -Force
            [xml]$xml = Get-Content -Path $configFile -Encoding UTF8 -Raw
        } else {
            [xml]$xml = @"
<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <appSettings>
  </appSettings>
</configuration>
"@
        }

        $appSettingsNode = $xml.SelectSingleNode("//appSettings")
        if ($null -eq $appSettingsNode) {
            $configNode = $xml.SelectSingleNode("//configuration")
            if ($null -eq $configNode) {
                $configNode = $xml.AppendChild($xml.CreateElement("configuration"))
            }
            $appSettingsNode = $configNode.AppendChild($xml.CreateElement("appSettings"))
        }

        function Set-XmlKey([string]$key, [string]$val) {
            $node = $xml.SelectSingleNode("//appSettings/add[@key='$key']")
            if ($null -ne $node) {
                $node.SetAttribute("value", $val)
            } else {
                $newNode = $xml.CreateElement("add")
                $newNode.SetAttribute("key", $key)
                $newNode.SetAttribute("value", $val)
                $appSettingsNode.AppendChild($newNode) | Out-Null
            }
        }

        Set-XmlKey "FailedLoginAttemptsBeforeBan" $numFailedAttempts.Value.ToString()
        Set-XmlKey "BanTime" $txtBanTimeCustom.Text.Trim()
        Set-XmlKey "ExpireTime" $txtExpireTime.Text.Trim()
        Set-XmlKey "CycleTime" $txtCycleTime.Text.Trim()
        Set-XmlKey "ClearBannedIPAddressesOnRestart" ($chkClearOnRestart.Checked.ToString().ToLower())
        Set-XmlKey "ClearFailedLoginsOnSuccessfulLogin" ($chkClearOnSuccess.Checked.ToString().ToLower())
        Set-XmlKey "ProcessInternalIPAddresses" ($chkProcessInternal.Checked.ToString().ToLower())
        Set-XmlKey "ResetFailedLoginCountForUnbannedIPAddresses" ($chkResetUnbanned.Checked.ToString().ToLower())

        $whiteListFormatted = ($txtWhitelist.Lines | ForEach-Object { $_.Trim() } | Where-Object { $_ }) -join ","
        Set-XmlKey "Whitelist" $whiteListFormatted

        $blackListFormatted = ($txtBlacklist.Lines | ForEach-Object { $_.Trim() } | Where-Object { $_ }) -join ","
        Set-XmlKey "Blacklist" $blackListFormatted

        try {
            $regU = "HKCU:\SOFTWARE\IPBanControlCenter"
            if (-not (Test-Path $regU)) { New-Item -Path $regU -Force | Out-Null }
            $v = if ($chkStartInTray.Checked) { 1 } else { 0 }
            Set-ItemProperty -Path $regU -Name "StartInTray" -Value $v -Force

            $regAbuse = "HKCU:\SOFTWARE\IPBanControlCenter\AbuseIPDB"
            if (-not (Test-Path $regAbuse)) { New-Item -Path $regAbuse -Force | Out-Null }
            Set-ItemProperty -Path $regAbuse -Name "ApiKey" -Value $txtAbuseApiKey.Text.Trim() -Force
            Set-ItemProperty -Path $regAbuse -Name "Confidence" -Value ([int]$numAbuseConfidence.Value) -Force
            Set-ItemProperty -Path $regAbuse -Name "Limit" -Value ([int]$numAbuseLimit.Value) -Force
            Set-ItemProperty -Path $regAbuse -Name "AutoReport" -Value (if ($chkAbuseAutoReport.Checked) { 1 } else { 0 }) -Force
        } catch {}

        # Оновлення моніторингу сервісів у конфігурації
        try {
            $expNode = $xml.SelectSingleNode("//ExpressionsToBlock/Groups")
            if ($null -eq $expNode) {
                $expRoot = $xml.SelectSingleNode("//ExpressionsToBlock")
                if ($null -eq $expRoot) {
                    $expRoot = $xml.configuration.AppendChild($xml.CreateElement("ExpressionsToBlock"))
                }
                $expNode = $expRoot.AppendChild($xml.CreateElement("Groups"))
            }

            # Шаблони правил для сервісів
            $protoTemplates = @{
                "MSSQL" = @'
<Group>
  <Source>MSSQL</Source>
  <Keywords>0x90000000000000</Keywords>
  <Path>Application</Path>
  <FailedLoginThreshold>0</FailedLoginThreshold>
  <Expressions>
    <Expression>
      <XPath>//Provider[contains(@Name,'MSSQL')]</XPath>
      <Regex></Regex>
    </Expression>
    <Expression>
      <XPath>//EventID</XPath>
      <Regex><![CDATA[^(?<log>18456)$]]></Regex>
    </Expression>
    <Expression>
      <XPath>(//Data)[1]</XPath>
      <Regex><![CDATA[^(\s+)?(?<username>.+)$]]></Regex>
    </Expression>
    <Expression>
      <XPath>(//Data)[3]</XPath>
      <Regex><![CDATA[\[CLIENTE?\s?:\s?(?<ipaddress>[^\]]+)\]]]></Regex>
    </Expression>
  </Expressions>
</Group>
'@
                "MySQL" = @'
<Group>
  <Source>MySQL</Source>
  <Keywords>0x80000000000000</Keywords>
  <Path>Application</Path>
  <FailedLoginThreshold>0</FailedLoginThreshold>
  <Expressions>
    <Expression>
      <XPath>//Provider[@Name='MySQL' or @Name='MariaDB']</XPath>
      <Regex></Regex>
    </Expression>
    <Expression>
      <XPath>//Data</XPath>
      <Regex><![CDATA[(?<log>Access denied for user) '?(?<username>[^']+)'@'?(?<ipaddress>[^']+)']]></Regex>
    </Expression>
  </Expressions>
</Group>
'@
                "SSH" = @'
<Group>
  <Source>SSH</Source>
  <Keywords>0x4000000000000000</Keywords>
  <Path>OpenSSH/Operational</Path>
  <FailedLoginThreshold>0</FailedLoginThreshold>
  <Expressions>
    <Expression>
      <XPath>//Data[@Name='payload']</XPath>
      <Regex><![CDATA[(?<log>failed\s+password)\s+for\s+(invalid\s+user\s+)?(?<username>[^\s]+)\s+from\s+(?<ipaddress>[^\s]+)]]></Regex>
    </Expression>
  </Expressions>
</Group>
'@
                "VNC" = @'
<Group>
  <Source>VNC</Source>
  <Keywords>0x80000000000000</Keywords>
  <Path>Application</Path>
  <FailedLoginThreshold>0</FailedLoginThreshold>
  <Expressions>
    <Expression>
      <XPath>//EventID</XPath>
      <Regex>^258$</Regex>
    </Expression>
    <Expression>
      <XPath>//Data</XPath>
      <Regex><![CDATA[(?<log>Authentication\sfailed)\sfrom\s+(?<ipaddress>[0-9a-fA-F\.:]+)]]></Regex>
    </Expression>
  </Expressions>
</Group>
'@
                "RRAS" = @'
<Group>
  <Source>RRAS</Source>
  <Keywords>0x80000000000000</Keywords>
  <Path>System</Path>
  <FailedLoginThreshold>0</FailedLoginThreshold>
  <Expressions>
    <Expression>
      <XPath>//EventID</XPath>
      <Regex>^20271$</Regex>
    </Expression>
    <Expression>
      <XPath>(//Data)[2]</XPath>
      <Regex><![CDATA[(?<username>.*)]]></Regex>
    </Expression>
    <Expression>
      <XPath>(//Data)[3]</XPath>
      <Regex><![CDATA[(?<ipaddress>.+)]]></Regex>
    </Expression>
  </Expressions>
</Group>
'@
                "RDWeb" = @'
<Group>
  <Source>RDWeb</Source>
  <Keywords>0x80000000000000</Keywords>
  <Path>Application</Path>
  <FailedLoginThreshold>0</FailedLoginThreshold>
  <Expressions>
    <Expression>
      <XPath>//Provider[@Name='Microsoft-Windows-RemoteDesktopServices-RDWeb-Filter']</XPath>
      <Regex></Regex>
    </Expression>
    <Expression>
      <XPath>//EventID</XPath>
      <Regex>^(1000|1001)$</Regex>
    </Expression>
    <Expression>
      <XPath>//Data</XPath>
      <Regex><![CDATA[(?<ipaddress>[0-9a-fA-F\.:]+)]]></Regex>
    </Expression>
  </Expressions>
</Group>
'@
                "FTP" = @'
<Group>
  <Source>FTP</Source>
  <Keywords>0x80000000000000</Keywords>
  <Path>System</Path>
  <FailedLoginThreshold>0</FailedLoginThreshold>
  <Expressions>
    <Expression>
      <XPath>//Provider[@Name='MSFTPSVC']</XPath>
      <Regex></Regex>
    </Expression>
    <Expression>
      <XPath>//EventID</XPath>
      <Regex>^100$</Regex>
    </Expression>
  </Expressions>
</Group>
'@
                "HTTP" = @'
<Group>
  <Source>HTTP</Source>
  <Keywords>0x80000000000000</Keywords>
  <Path>System</Path>
  <FailedLoginThreshold>0</FailedLoginThreshold>
  <Expressions>
    <Expression>
      <XPath>//Provider[@Name='Microsoft-Windows-HttpService']</XPath>
      <Regex></Regex>
    </Expression>
    <Expression>
      <XPath>//EventID</XPath>
      <Regex>^(1|2)$</Regex>
    </Expression>
  </Expressions>
</Group>
'@
                "SMTP" = @'
<Group>
  <Source>SMTP</Source>
  <Keywords>0x80000000000000</Keywords>
  <Path>Application</Path>
  <FailedLoginThreshold>0</FailedLoginThreshold>
  <Expressions>
    <Expression>
      <XPath>//Provider[@Name='SMTPSVC' or @Name='MSExchangeTransport']</XPath>
      <Regex></Regex>
    </Expression>
    <Expression>
      <XPath>//EventID</XPath>
      <Regex>^(1000|1706)$</Regex>
    </Expression>
  </Expressions>
</Group>
'@
                "IMAP" = @'
<Group>
  <Source>IMAP</Source>
  <Keywords>0x80000000000000</Keywords>
  <Path>Application</Path>
  <FailedLoginThreshold>0</FailedLoginThreshold>
  <Expressions>
    <Expression>
      <XPath>//Provider[@Name='MSExchangeIS' or @Name='IMAP4']</XPath>
      <Regex></Regex>
    </Expression>
    <Expression>
      <XPath>//EventID</XPath>
      <Regex>^1000$</Regex>
    </Expression>
  </Expressions>
</Group>
'@
                "POP3" = @'
<Group>
  <Source>POP3</Source>
  <Keywords>0x80000000000000</Keywords>
  <Path>Application</Path>
  <FailedLoginThreshold>0</FailedLoginThreshold>
  <Expressions>
    <Expression>
      <XPath>//Provider[@Name='POP3SVC' or @Name='POP3']</XPath>
      <Regex></Regex>
    </Expression>
    <Expression>
      <XPath>//EventID</XPath>
      <Regex>^1000$</Regex>
    </Expression>
  </Expressions>
</Group>
'@
            }

            foreach ($pKey in $protoTemplates.Keys) {
                $ctl = $script:ProtocolControls[$pKey]
                if ($ctl) {
                    $existingGroup = $xml.SelectSingleNode("//ExpressionsToBlock//Group[Source='$pKey']")
                    if ($ctl.CheckBox.Checked) {
                        if ($null -eq $existingGroup) {
                            $frag = $xml.CreateDocumentFragment()
                            $frag.InnerXml = $protoTemplates[$pKey]
                            $expNode.AppendChild($frag) | Out-Null
                        }
                    } else {
                        if ($null -ne $existingGroup) {
                            $existingGroup.ParentNode.RemoveChild($existingGroup) | Out-Null
                        }
                    }
                }
            }
        } catch {}

        $xml.Save($configFile)
        Save-PersistentAppSettings
        $statusLabel.Text = [string]::Format((T "StatusConfigSaved"), $configFile)

        $resp = [System.Windows.Forms.MessageBox]::Show("Налаштування збережено у файл:`n$configFile`n`nБажаєте перезапустити службу IPBan зараз, щоб застосувати зміни?", "Збережено", [System.Windows.Forms.MessageBoxButtons]::YesNo, [System.Windows.Forms.MessageBoxIcon]::Question)
        if ($resp -eq [System.Windows.Forms.DialogResult]::Yes) {
            Restart-ServiceAction
        }
    } catch {
        [System.Windows.Forms.MessageBox]::Show("Помилка збереження файлу конфігурації: $_", "Помилка", [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Error)
    }
}

function Refresh-LogsView {
    if ($rbIPBanLog.Checked) {
        $dgvEventLog.Visible = $false
        $txtIPBanLog.Visible = $true
        $path = Get-IPBanPath
        $logFile = Join-Path $path "logfile.txt"
        if (Test-Path $logFile) {
            try {
                $lines = Get-Content -Path $logFile -Tail 250 -Encoding UTF8 -ErrorAction Stop
                $txtIPBanLog.Text = ($lines -join "`r`n")
                $txtIPBanLog.SelectionStart = $txtIPBanLog.Text.Length
                $txtIPBanLog.ScrollToCaret()
                $statusLabel.Text = [string]::Format((T "StatusLogUpdated"), $lines.Count)
            } catch {
                $txtIPBanLog.Text = [string]::Format((T "LogReadError"), $_)
            }
        } else {
            $txtIPBanLog.Text = [string]::Format((T "LogNotFound"), $logFile)
        }
    } else {
        $txtIPBanLog.Visible = $false
        $dgvEventLog.Visible = $true
        $statusLabel.Text = T "StatusPollingEvents"
        $form.Cursor = [System.Windows.Forms.Cursors]::WaitCursor
        try {
            $events = Get-WindowsFailedLogins -maxEvents 50
            $dgvEventLog.Rows.Clear()
            foreach ($e in $events) {
                [void]$dgvEventLog.Rows.Add(
                    $e.TimeCreated,
                    $e.TargetUser,
                    $e.IPAddress,
                    $e.LogonType,
                    $e.Workstation,
                    $e.Status
                )
            }
            $statusLabel.Text = [string]::Format((T "StatusEventsLoaded"), $events.Count)
        } catch {
            $statusLabel.Text = [string]::Format((T "StatusEventsError"), $_)
        } finally {
            $form.Cursor = [System.Windows.Forms.Cursors]::Default
        }
    }
}

function Restart-ServiceAction {
    $statusLabel.Text = T "StatusServiceRestarting"
    $form.Cursor = [System.Windows.Forms.Cursors]::WaitCursor
    try {
        Restart-Service -Name $script:ServiceName -Force -ErrorAction Stop
        Start-Sleep -Seconds 1
        Update-ServiceUI
        $statusLabel.Text = T "StatusServiceRestarted"
    } catch {
        [System.Windows.Forms.MessageBox]::Show("Помилка перезапуску служби: $_", "Помилка", [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Error)
        $statusLabel.Text = T "StatusServiceRestartError"
    } finally {
        $form.Cursor = [System.Windows.Forms.Cursors]::Default
    }
}

# ------------------------------------------------------------------------------
# Прив'язка подій елементів керування
# ------------------------------------------------------------------------------

# Кнопки Header
$btnStartService.Add_Click({
    try {
        $statusLabel.Text = T "StatusServiceStarting"
        Start-Service -Name $script:ServiceName -ErrorAction Stop
        Start-Sleep -Seconds 1
        Update-ServiceUI
        $statusLabel.Text = T "StatusServiceStarted"
    } catch {
        [System.Windows.Forms.MessageBox]::Show("Не вдалося запустити службу: $_", "Помилка", [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Error)
    }
})

$btnStopService.Add_Click({
    try {
        $statusLabel.Text = T "StatusServiceStopping"
        Stop-Service -Name $script:ServiceName -Force -ErrorAction Stop
        Start-Sleep -Seconds 1
        Update-ServiceUI
        $statusLabel.Text = T "StatusServiceStopped"
    } catch {
        [System.Windows.Forms.MessageBox]::Show("Не вдалося зупинити службу: $_", "Помилка", [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Error)
    }
})

$btnRestartService.Add_Click({ Restart-ServiceAction })

$btnRefreshAll.Add_Click({
    Update-ServiceUI
    Refresh-BannedIPs
    Refresh-LogsView
    Load-ConfigData
})

# Path Bar
$btnBrowsePath.Add_Click({
    $fbd = New-Object System.Windows.Forms.FolderBrowserDialog
    $fbd.SelectedPath = $txtInstallPath.Text
    $fbd.Description = "Виберіть папку встановлення IPBan"
    if ($fbd.ShowDialog() -eq [System.Windows.Forms.DialogResult]::OK) {
        $txtInstallPath.Text = $fbd.SelectedPath
        $script:CurrentInstallPath = $fbd.SelectedPath
        Update-ServiceUI
        Load-ConfigData
    }
})

$btnOpenFolder.Add_Click({
    $path = Get-IPBanPath
    if (Test-Path $path) {
        [System.Diagnostics.Process]::Start("explorer.exe", $path)
    } else {
        [System.Windows.Forms.MessageBox]::Show("Папка не існує: $path", "Увага", [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Warning)
    }
})

$btnOpenConfigFile.Add_Click({
    $cfg = Get-IPBanConfigFile
    if (Test-Path $cfg) {
        [System.Diagnostics.Process]::Start("notepad.exe", $cfg)
    } else {
        [System.Windows.Forms.MessageBox]::Show("Файл конфігурації не існує: $cfg", "Увага", [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Warning)
    }
})

# Tab 1: Banned IPs
$txtSearchBanned.Add_TextChanged({ Filter-BannedGrid })
$cbRuleFilter.Add_SelectedIndexChanged({ Filter-BannedGrid })

$btnUnbanSelected.Add_Click({
    if ($dgvBanned.SelectedRows.Count -eq 0) {
        [System.Windows.Forms.MessageBox]::Show("Оберіть один або декілька рядків з IP для розблокування.", "Увага", [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Information)
        return
    }

    $ipsToUnban = @()
    $whitelistIps = @()
    foreach ($row in $dgvBanned.SelectedRows) {
        $ip = $row.Cells["IPAddress"].Value.ToString()
        if ($row.Tag -eq "Allow") {
            $whitelistIps += $ip
        } else {
            $ipsToUnban += $ip
        }
    }

    if ($whitelistIps.Count -gt 0 -and $ipsToUnban.Count -eq 0) {
        [System.Windows.Forms.MessageBox]::Show("Обрані IP ($($whitelistIps -join ', ') ) знаходяться у Білому списку (дозволено), а не в блокуванні!`n`nЩоб прибрати адресу з білого списку, перейдіть на вкладку 'Білий / Чорний списки'.", "Інформація", [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Information)
        return
    }

    if ($ipsToUnban.Count -gt 0) {
        $msg = "Ви впевнені, що хочете розблокувати наступні IP ($($ipsToUnban.Count)):`n`n" + ($ipsToUnban -join ", ")
        $ans = [System.Windows.Forms.MessageBox]::Show($msg, "Підтвердження розблокування", [System.Windows.Forms.MessageBoxButtons]::YesNo, [System.Windows.Forms.MessageBoxIcon]::Question)
        if ($ans -eq [System.Windows.Forms.DialogResult]::Yes) {
            foreach ($ip in $ipsToUnban) {
                Unban-IPAddress -ip $ip
            }
            [System.Windows.Forms.MessageBox]::Show("Запит на розблокування відправлено до IPBan та брандмауера!", "Успіх", [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Information)
            Start-Sleep -Milliseconds 500
            Refresh-BannedIPs
        }
    }
})

$btnManualBan.Add_Click({
    $inputForm = New-Object System.Windows.Forms.Form
    $inputForm.Text = "Ручне блокування IP-адреси"
    $inputForm.Size = New-Object System.Drawing.Size(420, 200)
    $inputForm.StartPosition = "CenterParent"
    $inputForm.FormBorderStyle = [System.Windows.Forms.FormBorderStyle]::FixedDialog
    $inputForm.MaximizeBox = $false
    $inputForm.MinimizeBox = $false

    $lblInput = New-Object System.Windows.Forms.Label
    $lblInput.Text = "Введіть IP-адресу для негайного блокування:"
    $lblInput.Location = New-Object System.Drawing.Point(20, 20)
    $lblInput.AutoSize = $true
    $inputForm.Controls.Add($lblInput)

    $txtInputIP = New-Object System.Windows.Forms.TextBox
    $txtInputIP.Location = New-Object System.Drawing.Point(20, 50)
    $txtInputIP.Size = New-Object System.Drawing.Size(360, 25)
    $inputForm.Controls.Add($txtInputIP)

    $btnOk = New-Object System.Windows.Forms.Button
    $btnOk.Text = "Заблокувати"
    $btnOk.DialogResult = [System.Windows.Forms.DialogResult]::OK
    $btnOk.Location = New-Object System.Drawing.Point(180, 100)
    $btnOk.Size = New-Object System.Drawing.Size(100, 30)
    $inputForm.Controls.Add($btnOk)

    $btnCancel = New-Object System.Windows.Forms.Button
    $btnCancel.Text = "Скасувати"
    $btnCancel.DialogResult = [System.Windows.Forms.DialogResult]::Cancel
    $btnCancel.Location = New-Object System.Drawing.Point(290, 100)
    $btnCancel.Size = New-Object System.Drawing.Size(90, 30)
    $inputForm.Controls.Add($btnCancel)
    $inputForm.AcceptButton = $btnOk

    if ($inputForm.ShowDialog() -eq [System.Windows.Forms.DialogResult]::OK) {
        $ipToBlock = $txtInputIP.Text.Trim()
        if ($ipToBlock) {
            Ban-IPAddressManual -ip $ipToBlock
            Refresh-BannedIPs
        }
    }
})

$btnUnbanAll.Add_Click({
    $confirm = [System.Windows.Forms.MessageBox]::Show("УВАГА! Ви дійсно хочете розблокувати ВСІ локально заблоковані IP-адреси у правилах IPBan?`n`nПравила Білого списку (Whitelist) та Чорного списку (Blacklist) НЕ будуть видалені.", "Очищення локальних блокувань", [System.Windows.Forms.MessageBoxButtons]::YesNo, [System.Windows.Forms.MessageBoxIcon]::Warning)
    if ($confirm -eq [System.Windows.Forms.DialogResult]::Yes) {
        try {
            $allBannedIps = @($script:LastBannedIPs | Where-Object { $_.ActionType -eq "Block" -and $_.IPAddress -notlike "255.255.255.255*" } | ForEach-Object { $_.IPAddress })

            $fw = New-Object -ComObject HNetCfg.FwPolicy2
            foreach ($rule in $fw.Rules) {
                if ($rule.Name -like "IPBan*" -and $rule.Name -notlike "*Whitelist*" -and $rule.Name -notlike "*Blacklist*" -and $rule.Action -eq 0) {
                    $rule.RemoteAddresses = "255.255.255.255"
                    $rule.Enabled = $true
                }
            }
            try {
                $manualRule = $fw.Rules | Where-Object { $_.Name -eq "IPBan_Manual_Block" } | Select-Object -First 1
                if ($manualRule) {
                    $manualRule.RemoteAddresses = "255.255.255.255"
                    $manualRule.Enabled = $true
                }
            } catch {}

            $path = Get-IPBanPath
            if (Test-Path $path) {
                $unbanFile = Join-Path $path "unban.txt"
                if ($allBannedIps.Count -gt 0) {
                    $allBannedIps | Set-Content -Path $unbanFile -Encoding UTF8
                }
            }
            [System.Windows.Forms.MessageBox]::Show("Всі локальні правила блокування успішно очищено!", "Успіх", [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Information)
            Refresh-BannedIPs
        } catch {
            [System.Windows.Forms.MessageBox]::Show("Помилка очищення: $_", "Помилка", [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Error)
        }
    }
})

$btnExportBanned.Add_Click({
    $sfd = New-Object System.Windows.Forms.SaveFileDialog
    $sfd.Filter = "Text Files (*.txt)|*.txt|CSV Files (*.csv)|*.csv"
    $sfd.FileName = "IPBan_IPs_$(Get-Date -Format 'yyyyMMdd_HHmm').txt"
    if ($sfd.ShowDialog() -eq [System.Windows.Forms.DialogResult]::OK) {
        try {
            $isCsv = $sfd.FileName.EndsWith(".csv", [System.StringComparison]::OrdinalIgnoreCase)
            $exportList = @()
            if ($isCsv) {
                $exportList += "Index,IPAddress,Country,BanDate,UnbanDate,Type"
                for ($r = 0; $r -lt $dgvBanned.Rows.Count; $r++) {
                    $row = $dgvBanned.Rows[$r]
                    $exportList += "$($row.Cells['Index'].Value),`"$($row.Cells['IPAddress'].Value)`",`"$($row.Cells['Country'].Value)`",`"$($row.Cells['BanDate'].Value)`",`"$($row.Cells['UnbanDate'].Value)`",`"$($row.Tag)`""
                }
            } else {
                for ($r = 0; $r -lt $dgvBanned.Rows.Count; $r++) {
                    $row = $dgvBanned.Rows[$r]
                    $exportList += "$($row.Cells['IPAddress'].Value)`t$($row.Cells['Country'].Value)`t$($row.Cells['BanDate'].Value)`t$($row.Cells['UnbanDate'].Value)"
                }
            }
            $exportList | Set-Content -Path $sfd.FileName -Encoding UTF8
            [System.Windows.Forms.MessageBox]::Show("Список успішно збережено у файл!`n$($sfd.FileName)", "Експорт завершено", [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Information)
        } catch {
            [System.Windows.Forms.MessageBox]::Show("Помилка експорту: $_", "Помилка", [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Error)
        }
    }
})

# Контекстне меню таблиці блокувань
$miCopyIP.Add_Click({
    if ($dgvBanned.SelectedRows.Count -gt 0) {
        $ip = $dgvBanned.SelectedRows[0].Cells["IPAddress"].Value.ToString()
        [System.Windows.Forms.Clipboard]::SetText($ip)
    }
})

$miUnban.Add_Click({
    $btnUnbanSelected.PerformClick()
})

$miWhitelist.Add_Click({
    if ($dgvBanned.SelectedRows.Count -gt 0) {
        $ip = $dgvBanned.SelectedRows[0].Cells["IPAddress"].Value.ToString()
        $current = $txtWhitelist.Text.Trim()
        if ($current -notmatch [regex]::Escape($ip)) {
            if ($current) { $txtWhitelist.Text += "`r`n$ip" } else { $txtWhitelist.Text = $ip }
            $msg = if ($script:CurrentLang -eq "EN") { "IP address $ip added to 'Whitelist' tab. Remember to click 'Save' on the lists tab!" } else { "IP-адресу $ip додано до вкладки 'Білий список'. Не забудьте натиснути 'Зберегти' на вкладці списків!" }
            $title = if ($script:CurrentLang -eq "EN") { "Added" } else { "Додано" }
            [System.Windows.Forms.MessageBox]::Show($msg, $title, [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Information)
            $tabControl.SelectedTab = $tabLists
        } else {
            $msg = if ($script:CurrentLang -eq "EN") { "IP $ip is already in the whitelist." } else { "IP $ip вже присутня у білому списку." }
            $title = if ($script:CurrentLang -eq "EN") { "Information" } else { "Інформація" }
            [System.Windows.Forms.MessageBox]::Show($msg, $title, [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Information)
        }
    }
})

# Tab 2: Settings
$cbBanTimePreset.Add_SelectedIndexChanged({
    $sel = $cbBanTimePreset.SelectedItem.ToString()
    $match = [regex]::Match($sel, "^\d{2}:\d{2}:\d{2}:\d{2}")
    if ($match.Success) {
        $txtBanTimeCustom.Text = $match.Value
    }
})

$btnSaveConfig.Add_Click({ Save-ConfigData })
$btnReloadConfig.Add_Click({ Load-ConfigData })

# Автоматичне збереження налаштувань при зміні
$txtAbuseApiKey.Add_TextChanged({ Save-PersistentAppSettings })
$numAbuseConfidence.Add_ValueChanged({ Save-PersistentAppSettings })
$numAbuseLimit.Add_ValueChanged({ Save-PersistentAppSettings })
$chkAbuseAutoReport.Add_CheckedChanged({ Save-PersistentAppSettings })
$chkStartInTray.Add_CheckedChanged({ Save-PersistentAppSettings })

$btnFetchAbuse.Add_Click({
    $apiKey = $txtAbuseApiKey.Text.Trim()
    if (-not $apiKey) {
        [System.Windows.Forms.MessageBox]::Show("Введіть API Ключ AbuseIPDB для завантаження бази.`nКлюч можна отримати безкоштовно на https://www.abuseipdb.com/account/api", "Потрібен API Ключ", [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Warning)
        return
    }

    $btnFetchAbuse.Enabled = $false
    $lblAbuseStatus.Text = "⏳ Завантаження чорного списку з AbuseIPDB..."
    [System.Windows.Forms.Application]::DoEvents()

    try {
        [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 -bor [System.Net.SecurityProtocolType]::Tls13
        $conf = [int]$numAbuseConfidence.Value
        $limit = [int]$numAbuseLimit.Value
        $apiUrl = "https://api.abuseipdb.com/api/v2/blacklist?confidenceMinimum=$conf&limit=$limit&plaintext=true"

        $headers = @{
            "Key" = $apiKey
            "Accept" = "text/plain"
        }

        $res = Invoke-RestMethod -Uri $apiUrl -Headers $headers -Method Get -TimeoutSec 30
        $lines = @($res -split "`r?`n" | ForEach-Object { $_.Trim() } | Where-Object { $_ -match '^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$' })

        if ($lines.Count -gt 0) {
            # Додаємо отримані IP до поля Blacklist на вкладці Списків
            $currentBlack = @($txtBlacklist.Lines | ForEach-Object { $_.Trim() } | Where-Object { $_ })
            $blackSet = New-Object 'System.Collections.Generic.HashSet[string]'
            foreach ($ip in $currentBlack) { [void]$blackSet.Add($ip) }

            $newCount = 0
            foreach ($ip in $lines) {
                if ($blackSet.Add($ip)) {
                    $newCount++
                }
            }

            $txtBlacklist.Text = ($blackSet -join "`r`n")
            $lblAbuseStatus.Text = "✅ Отримано: $($lines.Count) IP (Нових додано: $newCount)"
            $statusLabel.Text = [string]::Format((T "StatusAbuseDownloaded"), $lines.Count)

            # Зберігаємо оновлений API ключ та налаштування
            try {
                $regAbuse = "HKCU:\SOFTWARE\IPBanControlCenter\AbuseIPDB"
                if (-not (Test-Path $regAbuse)) { New-Item -Path $regAbuse -Force | Out-Null }
                Set-ItemProperty -Path $regAbuse -Name "ApiKey" -Value $apiKey -Force
                Set-ItemProperty -Path $regAbuse -Name "Confidence" -Value $conf -Force
                Set-ItemProperty -Path $regAbuse -Name "Limit" -Value $limit -Force
            } catch {}

            $msg = "Успішно завантажено $($lines.Count) активних шкідливих IP-адрес із AbuseIPDB (Confidence: $conf%+)`n`nНових адрес додано у Чорний список: $newCount.`n`nБажаєте зберегти оновлений чорний список у конфігурацію та застосувати блокування зараз?"
            $ans = [System.Windows.Forms.MessageBox]::Show($msg, "AbuseIPDB Синхронізація", [System.Windows.Forms.MessageBoxButtons]::YesNo, [System.Windows.Forms.MessageBoxIcon]::Information)
            if ($ans -eq [System.Windows.Forms.DialogResult]::Yes) {
                Save-ConfigData
            }
        } else {
            $lblAbuseStatus.Text = "⚠️ Відповідь не містить IP-адрес"
            [System.Windows.Forms.MessageBox]::Show("Сервер AbuseIPDB повернув порожній список. Перевірте ключ або налаштування.", "Увага", [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Warning)
        }
    } catch {
        $lblAbuseStatus.Text = "❌ Помилка запиту"
        [System.Windows.Forms.MessageBox]::Show("Помилка звернення до API AbuseIPDB:`n$($_.Exception.Message)", "Помилка API", [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Error)
    } finally {
        $btnFetchAbuse.Enabled = $true
    }
})

$btnRestoreBak.Add_Click({
    $cfg = Get-IPBanConfigFile
    $bak = "$cfg.bak"
    if (Test-Path $bak) {
        $ans = [System.Windows.Forms.MessageBox]::Show("Відновити конфігурацію з $bak ?", "Підтвердження", [System.Windows.Forms.MessageBoxButtons]::YesNo, [System.Windows.Forms.MessageBoxIcon]::Question)
        if ($ans -eq [System.Windows.Forms.DialogResult]::Yes) {
            Copy-Item -Path $bak -Destination $cfg -Force
            Load-ConfigData
            [System.Windows.Forms.MessageBox]::Show("Конфігурацію відновлено з бекапу!", "Успіх", [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Information)
        }
    } else {
        [System.Windows.Forms.MessageBox]::Show("Резервної копії не знайдено: $bak", "Помилка", [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Warning)
    }
})

# Tab 3: Lists (Whitelist / Blacklist)
$btnAddLocalIP.Add_Click({
    try {
        $localIPs = (Get-NetIPAddress -AddressFamily IPv4 -ErrorAction SilentlyContinue | Where-Object { $_.IPAddress -notlike "127.*" -and $_.IPAddress -notlike "169.254.*" }).IPAddress
        if ($localIPs) {
            foreach ($ip in $localIPs) {
                if ($txtWhitelist.Text -notmatch [regex]::Escape($ip)) {
                    if ($txtWhitelist.Text.Trim()) { $txtWhitelist.Text += "`r`n$ip" } else { $txtWhitelist.Text = $ip }
                }
            }
            [System.Windows.Forms.MessageBox]::Show("Локальну IP ($($localIPs -join ', ')) додано до списку!", "Додано", [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Information)
        }
    } catch {
        [System.Windows.Forms.MessageBox]::Show("Помилка отримання IP: $_", "Помилка", [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Error)
    }
})

$btnAddPublicIP.Add_Click({
    $btnAddPublicIP.Enabled = $false
    $statusLabel.Text = T "StatusGettingPublicIP"
    try {
        $wanIP = (Invoke-RestMethod -Uri "https://api.ipify.org" -TimeoutSec 3).Trim()
        if ($wanIP -and $wanIP -match '^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$') {
            if ($txtWhitelist.Text -notmatch [regex]::Escape($wanIP)) {
                if ($txtWhitelist.Text.Trim()) { $txtWhitelist.Text += "`r`n$wanIP" } else { $txtWhitelist.Text = $wanIP }
                [System.Windows.Forms.MessageBox]::Show("Зовнішню публічну IP ($wanIP) додано до Whitelist!", "Успіх", [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Information)
            } else {
                [System.Windows.Forms.MessageBox]::Show("Зовнішня IP ($wanIP) вже присутня у списку.", "Інформація", [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Information)
            }
        }
    } catch {
        [System.Windows.Forms.MessageBox]::Show("Не вдалося автоматично визначити зовнішню IP: $_", "Увага", [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Warning)
    } finally {
        $btnAddPublicIP.Enabled = $true
        $statusLabel.Text = T "StatusReady"
    }
})

$btnSaveLists.Add_Click({
    Save-ConfigData
})

# Tab 4: Logs
$rbIPBanLog.Add_CheckedChanged({ Refresh-LogsView })
$rbEventLog.Add_CheckedChanged({ Refresh-LogsView })
$btnRefreshLog.Add_Click({ Refresh-LogsView })

$btnClearLog.Add_Click({
    $path = Get-IPBanPath
    $logFile = Join-Path $path "logfile.txt"
    if (Test-Path $logFile) {
        $ans = [System.Windows.Forms.MessageBox]::Show("Ви дійсно хочете очистити logfile.txt?", "Очищення логу", [System.Windows.Forms.MessageBoxButtons]::YesNo, [System.Windows.Forms.MessageBoxIcon]::Question)
        if ($ans -eq [System.Windows.Forms.DialogResult]::Yes) {
            try {
                Clear-Content -Path $logFile -Force
                $txtIPBanLog.Text = ""
                $statusLabel.Text = T "StatusLogCleared"
            } catch {
                [System.Windows.Forms.MessageBox]::Show("Не вдалося очистити лог: $_", "Помилка", [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Error)
            }
        }
    }
})

if ($chkWordWrapLog) {
    $chkWordWrapLog.Add_CheckedChanged({
        $txtIPBanLog.WordWrap = $chkWordWrapLog.Checked
    })
}
if ($btnZoomInLog) {
    $btnZoomInLog.Add_Click({
        try {
            if ($txtIPBanLog.ZoomFactor -lt 3.0) {
                $txtIPBanLog.ZoomFactor = [Math]::Min(3.0, [Math]::Round($txtIPBanLog.ZoomFactor + 0.15, 2))
                $lblZoomLog.Text = "$([int]($txtIPBanLog.ZoomFactor * 100))%"
            }
        } catch {}
    })
}
if ($btnZoomOutLog) {
    $btnZoomOutLog.Add_Click({
        try {
            if ($txtIPBanLog.ZoomFactor -gt 0.6) {
                $txtIPBanLog.ZoomFactor = [Math]::Max(0.6, [Math]::Round($txtIPBanLog.ZoomFactor - 0.15, 2))
                $lblZoomLog.Text = "$([int]($txtIPBanLog.ZoomFactor * 100))%"
            }
        } catch {}
    })
}
if ($lblZoomLog) {
    $lblZoomLog.Add_Click({
        try {
            $txtIPBanLog.ZoomFactor = 1.0
            $lblZoomLog.Text = "100%"
        } catch {}
    })
}

# Контекстне меню Event Log
$miEventBan.Add_Click({
    if ($dgvEventLog.SelectedRows.Count -gt 0) {
        $ip = $dgvEventLog.SelectedRows[0].Cells["IPAddress"].Value.ToString()
        if ($ip -and $ip -notlike "*Локальн*") {
            Ban-IPAddressManual -ip $ip
            Refresh-BannedIPs
        }
    }
})

$miEventWhite.Add_Click({
    if ($dgvEventLog.SelectedRows.Count -gt 0) {
        $ip = $dgvEventLog.SelectedRows[0].Cells["IPAddress"].Value.ToString()
        if ($ip -and $ip -notlike "*Локальн*") {
            if ($txtWhitelist.Text.Trim()) { $txtWhitelist.Text += "`r`n$ip" } else { $txtWhitelist.Text = $ip }
            $tabControl.SelectedTab = $tabLists
        }
    }
})

$miEventCopy.Add_Click({
    if ($dgvEventLog.SelectedRows.Count -gt 0) {
        $ip = $dgvEventLog.SelectedRows[0].Cells["IPAddress"].Value.ToString()
        [System.Windows.Forms.Clipboard]::SetText($ip)
    }
})

# Таймер автооновлення логів
$script:AutoRefreshTimer = New-Object System.Windows.Forms.Timer
$script:AutoRefreshTimer.Interval = 5000
$script:AutoRefreshTimer.Add_Tick({
    if ($chkAutoRefreshLog.Checked) {
        Refresh-LogsView
    }
})

$chkAutoRefreshLog.Add_CheckedChanged({
    if ($chkAutoRefreshLog.Checked) {
        $script:AutoRefreshTimer.Start()
    } else {
        $script:AutoRefreshTimer.Stop()
    }
})

# Tab 5: Setup & Maintenance
$btnSetupAudit.Add_Click({
    $statusLabel.Text = T "StatusAuditConfiguring"
    $form.Cursor = [System.Windows.Forms.Cursors]::WaitCursor
    try {
        & auditpol.exe /set /category:"{69979849-797A-11D9-BED3-505054503030}" /success:enable /failure:enable
        & auditpol.exe /set /category:"{69979850-797A-11D9-BED3-505054503030}" /success:enable /failure:enable
        Update-ServiceUI
        [System.Windows.Forms.MessageBox]::Show("Аудит успішних та невдалих спроб входу успішно увімкнено!", "Успіх", [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Information)
    } catch {
        [System.Windows.Forms.MessageBox]::Show("Помилка налаштування аудиту: $_`nПереконайтеся, що програму запущено з правами адміністратора.", "Помилка", [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Error)
    } finally {
        $form.Cursor = [System.Windows.Forms.Cursors]::Default
        $statusLabel.Text = T "StatusReady"
    }
})

$btnInstallLocal.Add_Click({
    $zipPath = $script:LocalZipBackup
    if (-not $zipPath -or -not (Test-Path $zipPath)) {
        $zipPath = Find-LocalIPBanZip
    }

    if (-not $zipPath -or -not (Test-Path $zipPath)) {
        $ofd = New-Object System.Windows.Forms.OpenFileDialog
        $ofd.Filter = "IPBan Zip Архів (*.zip)|*.zip|Всі файли (*.*)|*.*"
        $ofd.Title = "Оберіть архів інсталятора IPBan для встановлення"
        if ($ofd.ShowDialog() -eq [System.Windows.Forms.DialogResult]::OK) {
            $zipPath = $ofd.FileName
            $script:LocalZipBackup = $zipPath
            Update-ServiceUI
        } else {
            return
        }
    }

    $destPath = $txtInstallPath.Text.Trim()
    if ([string]::IsNullOrWhiteSpace($destPath)) {
        $destPath = "C:\Program Files\IPBan"
        $txtInstallPath.Text = $destPath
    }

    $confirm = [System.Windows.Forms.MessageBox]::Show("Встановити IPBan з архіву:`n`"$zipPath`"`nу папку:`n`"$destPath`"?`n`nБуде налаштовано службу IPBan та аудит Windows.", "Підтвердження інсталяції", [System.Windows.Forms.MessageBoxButtons]::YesNo, [System.Windows.Forms.MessageBoxIcon]::Question)
    if ($confirm -ne [System.Windows.Forms.DialogResult]::Yes) { return }

    $statusLabel.Text = T "StatusInstallLocal"
    $form.Cursor = [System.Windows.Forms.Cursors]::WaitCursor
    try {
        Install-IPBanFromArchive -zipPath $zipPath -destPath $destPath

        Update-ServiceUI
        Load-ConfigData
        Refresh-BannedIPs

        [System.Windows.Forms.MessageBox]::Show("IPBan успішно встановлено та запущено як службу Windows!", "Інсталяція завершена", [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Information)
    } catch {
        [System.Windows.Forms.MessageBox]::Show("Помилка під час встановлення: $_", "Помилка", [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Error)
    } finally {
        $form.Cursor = [System.Windows.Forms.Cursors]::Default
        $statusLabel.Text = T "StatusReady"
    }
})

$btnInstallWeb.Add_Click({
    $destPath = $txtInstallPath.Text.Trim()
    if ([string]::IsNullOrWhiteSpace($destPath)) {
        $destPath = "C:\Program Files\IPBan"
        $txtInstallPath.Text = $destPath
    }

    $confirm = [System.Windows.Forms.MessageBox]::Show(
        "Завантажити найновішу версію IPBan з офіційного GitHub та встановити у папку:`n`"$destPath`"?`n`nБуде завантажено інсталяційний архів, налаштовано службу Windows та активовано аудит невдалих спроб входу.",
        "Встановлення IPBan з GitHub",
        [System.Windows.Forms.MessageBoxButtons]::YesNo,
        [System.Windows.Forms.MessageBoxIcon]::Question
    )
    if ($confirm -ne [System.Windows.Forms.DialogResult]::Yes) { return }

    $dlg = New-Object System.Windows.Forms.Form
    $dlg.Text = "Встановлення IPBan з GitHub"
    $dlg.Size = New-Object System.Drawing.Size(520, 185)
    $dlg.StartPosition = "CenterParent"
    $dlg.FormBorderStyle = [System.Windows.Forms.FormBorderStyle]::FixedDialog
    $dlg.MaximizeBox = $false
    $dlg.MinimizeBox = $false
    $dlg.ControlBox = $false
    $dlg.TopMost = $true

    $lblProgress = New-Object System.Windows.Forms.Label
    $lblProgress.Text = "Отримання інформації про реліз з GitHub..."
    $lblProgress.Font = New-Object System.Drawing.Font("Segoe UI", 9.5, [System.Drawing.FontStyle]::Bold)
    $lblProgress.Location = New-Object System.Drawing.Point(20, 18)
    $lblProgress.Size = New-Object System.Drawing.Size(465, 24)
    $dlg.Controls.Add($lblProgress)

    $pb = New-Object System.Windows.Forms.ProgressBar
    $pb.Location = New-Object System.Drawing.Point(20, 48)
    $pb.Size = New-Object System.Drawing.Size(465, 24)
    $pb.Minimum = 0
    $pb.Maximum = 100
    $pb.Value = 0
    $dlg.Controls.Add($pb)

    $lblDetails = New-Object System.Windows.Forms.Label
    $lblDetails.Text = "З'єднання з сервером GitHub..."
    $lblDetails.Font = New-Object System.Drawing.Font("Segoe UI", 8.5)
    $lblDetails.Location = New-Object System.Drawing.Point(20, 80)
    $lblDetails.Size = New-Object System.Drawing.Size(465, 20)
    $lblDetails.ForeColor = [System.Drawing.Color]::FromArgb(100, 116, 139)
    $dlg.Controls.Add($lblDetails)

    $dlg.Show($form)
    [System.Windows.Forms.Application]::DoEvents()

    $statusLabel.Text = T "StatusInstallWeb"
    $form.Cursor = [System.Windows.Forms.Cursors]::WaitCursor

    try {
        [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

        $arch = if ([System.Environment]::Is64BitOperatingSystem) { "x64" } else { "x86" }
        $downloadUrl = $null
        $versionTag = "latest"

        # 1. Пошук файлу через GitHub Releases API
        try {
            $headers = @{ "User-Agent" = "IPBan-GUI-Installer" }
            $rel = Invoke-RestMethod -Uri "https://api.github.com/repos/DigitalRuby/IPBan/releases/latest" -Headers $headers -TimeoutSec 15
            $versionTag = $rel.tag_name
            $asset = $rel.assets | Where-Object { $_.name -like "*Windows-$arch*.zip" } | Select-Object -First 1
            if ($asset) {
                $downloadUrl = $asset.browser_download_url
            }
        } catch {}

        # Fallback 1: парсинг офіційної сторінки релізів
        if (-not $downloadUrl) {
            try {
                $wcWeb = New-Object System.Net.WebClient
                $wcWeb.Headers.Add("User-Agent", "IPBan-GUI-Installer")
                $html = $wcWeb.DownloadString("https://github.com/DigitalRuby/IPBan/releases/latest")
                if ($html -match 'href="([^"]+IPBan-Windows-' + $arch + '[^"]+\.zip)"') {
                    $downloadUrl = "https://github.com" + $matches[1]
                }
            } catch {}
        }

        # Fallback 2: пряме стабільне посилання
        if (-not $downloadUrl) {
            $downloadUrl = "https://github.com/DigitalRuby/IPBan/releases/download/4.1.0/IPBan-Windows-${arch}_4_1_0.zip"
            $versionTag = "4.1.0"
        }

        # Шлях для збереження ZIP архіву
        $saveDir = [System.IO.Path]::Combine($env:USERPROFILE, "Downloads")
        if (-not (Test-Path $saveDir)) {
            $saveDir = [System.IO.Path]::GetTempPath()
        }
        $zipFileName = [System.IO.Path]::GetFileName($downloadUrl)
        if ([string]::IsNullOrWhiteSpace($zipFileName) -or -not $zipFileName.EndsWith(".zip")) {
            $zipFileName = "IPBan-Windows-$arch-$versionTag.zip"
        }
        $targetZip = Join-Path $saveDir $zipFileName

        $lblProgress.Text = "Завантаження IPBan v$versionTag..."
        $lblDetails.Text = "Підготовка до завантаження $zipFileName..."
        [System.Windows.Forms.Application]::DoEvents()

        # 2. Завантаження через WebClient з відображенням прогресу
        $wc = New-Object System.Net.WebClient
        $wc.Headers.Add("User-Agent", "IPBan-GUI-Installer")
        $script:dlComplete = $false
        $script:dlError = $null

        $wc.add_DownloadProgressChanged({
            param($s, $e)
            $pb.Value = [Math]::Min(100, [Math]::Max(0, $e.ProgressPercentage))
            $recMB = [Math]::Round($e.BytesReceived / 1MB, 1)
            $totMB = [Math]::Round($e.TotalBytesToReceive / 1MB, 1)
            $lblDetails.Text = "Завантажено: $recMB MB з $totMB MB ($($e.ProgressPercentage)%)"
            [System.Windows.Forms.Application]::DoEvents()
        })

        $wc.add_DownloadFileCompleted({
            param($s, $e)
            if ($e.Error) { $script:dlError = $e.Error }
            $script:dlComplete = $true
        })

        $wc.DownloadFileAsync((New-Object System.Uri($downloadUrl)), $targetZip)

        while (-not $script:dlComplete) {
            [System.Windows.Forms.Application]::DoEvents()
            Start-Sleep -Milliseconds 50
        }

        if ($script:dlError) {
            throw $script:dlError
        }

        $script:LocalZipBackup = $targetZip

        # 3. Інсталяція
        $lblProgress.Text = "Встановлення та реєстрація служби IPBan..."
        $pb.Style = [System.Windows.Forms.ProgressBarStyle]::Marquee
        [System.Windows.Forms.Application]::DoEvents()

        Install-IPBanFromArchive -zipPath $targetZip -destPath $destPath -progressLabel $lblProgress -detailsLabel $lblDetails

        $dlg.Close()

        Update-ServiceUI
        Load-ConfigData
        Refresh-BannedIPs

        [System.Windows.Forms.MessageBox]::Show(
            "IPBan v$versionTag успішно завантажено та встановлено у:`n$destPath`n`nСлужбу запущено, аудит безпеки активовано!",
            "Інсталяція завершена",
            [System.Windows.Forms.MessageBoxButtons]::OK,
            [System.Windows.Forms.MessageBoxIcon]::Information
        )
    } catch {
        if ($dlg) { $dlg.Close() }
        [System.Windows.Forms.MessageBox]::Show(
            "Помилка під час завантаження або встановлення IPBan:`n$_`n`nПеревірте інтернет-з'єднання та запуск програми від імені адміністратора.",
            "Помилка встановлення",
            [System.Windows.Forms.MessageBoxButtons]::OK,
            [System.Windows.Forms.MessageBoxIcon]::Error
        )
    } finally {
        if ($dlg) { $dlg.Dispose() }
        $form.Cursor = [System.Windows.Forms.Cursors]::Default
        $statusLabel.Text = T "StatusReady"
    }
})

$btnUninstall.Add_Click({
    $confirm = [System.Windows.Forms.MessageBox]::Show("УВАГА! Ви дійсно бажаєте зупинити та видалити службу IPBan?", "Видалення IPBan", [System.Windows.Forms.MessageBoxButtons]::YesNo, [System.Windows.Forms.MessageBoxIcon]::Warning)
    if ($confirm -eq [System.Windows.Forms.DialogResult]::Yes) {
        try {
            if (Get-Service $script:ServiceName -ErrorAction SilentlyContinue) {
                try { Stop-Service $script:ServiceName -Force } catch {}
                & sc.exe delete $script:ServiceName
            }
            Update-ServiceUI
            [System.Windows.Forms.MessageBox]::Show("Службу IPBan видалено із системи.", "Видалено", [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Information)
        } catch {
            [System.Windows.Forms.MessageBox]::Show("Помилка видалення служби: $_", "Помилка", [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Error)
        }
    }
})

$llGithub.Add_LinkClicked({
    [System.Diagnostics.Process]::Start("https://github.com/DigitalRuby/IPBan")
})

$llWiki.Add_LinkClicked({
    [System.Diagnostics.Process]::Start("https://github.com/DigitalRuby/IPBan/wiki/Configuration")
})

function Check-AppUpdate([bool]$silentIfLatest = $false) {
    try {
        [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 -bor [Net.SecurityProtocolType]::Tls13
        $headers = @{ "User-Agent" = "IPBanControlCenter-Updater" }
        $apiUrl = "https://api.github.com/repos/MeXaHiK-7/IPBanGUI/releases/latest"
        $rel = Invoke-RestMethod -Uri $apiUrl -Headers $headers -TimeoutSec 10

        $latestTag = $rel.tag_name # e.g. "v2.2.0"
        $currentTag = $script:AppVersion # e.g. "v2.2.0"

        $parseVer = {
            param([string]$t)
            $clean = $t.TrimStart("v").Trim()
            $parts = $clean.Split(".")
            $major = if ($parts.Length -ge 1) { [int]$parts[0] } else { 0 }
            $minor = if ($parts.Length -ge 2) { [int]$parts[1] } else { 0 }
            $build = if ($parts.Length -ge 3) { [int]$parts[2] } else { 0 }
            return New-Object System.Version($major, $minor, $build)
        }

        $vLatest = & $parseVer $latestTag
        $vCurrent = & $parseVer $currentTag

        if ($vLatest -gt $vCurrent) {
            $msg = [string]::Format((T "UpdateAvailableMsg"), $latestTag, $currentTag)
            $title = [string]::Format((T "UpdateAvailableTitle"), $latestTag)
            $ans = [System.Windows.Forms.MessageBox]::Show($form, $msg, $title, [System.Windows.Forms.MessageBoxButtons]::YesNo, [System.Windows.Forms.MessageBoxIcon]::Information)
            if ($ans -eq [System.Windows.Forms.DialogResult]::Yes) {
                $targetUrl = if ($rel.html_url) { $rel.html_url } else { "https://github.com/MeXaHiK-7/IPBanGUI/releases" }
                [System.Diagnostics.Process]::Start($targetUrl)
            }
        } else {
            if (-not $silentIfLatest) {
                $msg = [string]::Format((T "UpdateLatest"), $currentTag)
                [System.Windows.Forms.MessageBox]::Show($form, $msg, (T "BtnCheckUpdate"), [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Information)
            }
        }
    } catch {
        if (-not $silentIfLatest) {
            [System.Windows.Forms.MessageBox]::Show($form, "Не вдалося перевірити оновлення на GitHub:`n$($_.Exception.Message)", "Помилка оновлення", [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Warning)
        }
    }
}

$btnCheckUpdate.Add_Click({
    $statusLabel.Text = T "UpdateChecking"
    Check-AppUpdate -silentIfLatest $false
    $statusLabel.Text = T "StatusReady"
})

# Перемикання вкладок
$tabControl.Add_SelectedIndexChanged({
    if ($tabControl.SelectedTab -eq $tabStats) {
        Update-StatsUI
    }
})

# Ініціалізація компонентів та автоконтроль служби
function Initialize-App {
    Load-GeoIPCache
    Update-UILanguage
    Update-HeaderLayout
    Init-Tray

    # Автоматичний контроль служби:
    # 1. Переконуємося, що служба налаштована на автоматичний запуск разом із Windows (start= auto)
    # 2. Якщо після перезавантаження сервера служба вимкнена або зупинена - автоматично запускаємо її!
    try {
        $svc = Get-Service -Name $script:ServiceName -ErrorAction SilentlyContinue
        if ($svc) {
            $wmi = Get-CimInstance Win32_Service -Filter "Name='$($script:ServiceName)'" -ErrorAction SilentlyContinue
            if ($wmi -and ($wmi.StartMode -ne 'Auto' -or $wmi.DelayedAuto)) {
                & sc.exe config $script:ServiceName start= auto | Out-Null
            }
            if ($svc.Status -ne 'Running') {
                Start-Service -Name $script:ServiceName -ErrorAction SilentlyContinue
                & sc.exe failure $script:ServiceName reset= 86400 actions= restart/60000/restart/60000/restart/60000 | Out-Null
                Start-Sleep -Milliseconds 600
            }
        }
    } catch {}

    Update-ServiceUI
    Refresh-BannedIPs
    Load-ConfigData
    Refresh-LogsView

    # Запуск таймера для асинхронного виявлення країн GeoIP
    if (-not $script:GeoIPTimer) {
        $script:GeoIPTimer = New-Object System.Windows.Forms.Timer
        $script:GeoIPTimer.Interval = 350
        $script:GeoIPTimer.Add_Tick({ Resolve-NextPendingGeoIP })
        $script:GeoIPTimer.Start()
    }

    # Фонова перевірка оновлень IPBan Control Center при відкритті програми
    $script:UpdateCheckTimer = New-Object System.Windows.Forms.Timer
    $script:UpdateCheckTimer.Interval = 4000
    $script:UpdateCheckTimer.Add_Tick({
        $script:UpdateCheckTimer.Stop()
        $script:UpdateCheckTimer.Dispose()
        Check-AppUpdate -silentIfLatest $true
    })
    $script:UpdateCheckTimer.Start()
}

$form.Add_Shown({
    Update-HeaderLayout
    Update-PathPanelLayout
    Update-ServiceUI
    Refresh-BannedIPs

    # Якщо служба IPBan не встановлена - відкриваємо майстер налаштувань (лише якщо вікно явно відкрите)
    $svcStatus = Get-IPBanServiceStatus
    if ($svcStatus -eq "NotInstalled" -and -not $script:StartInTray) {
        $tabControl.SelectedTab = $tabSetup
        $msg = T "PromptInstallText"
        $title = T "PromptInstallTitle"
        $ans = [System.Windows.Forms.MessageBox]::Show(
            $form,
            $msg,
            $title,
            [System.Windows.Forms.MessageBoxButtons]::YesNo,
            [System.Windows.Forms.MessageBoxIcon]::Question
        )
        if ($ans -eq [System.Windows.Forms.DialogResult]::Yes) {
            $btnInstallWeb.PerformClick()
        }
    }
})

# Закриття або згортання форми у системний трей
$form.Add_FormClosing({
    param($s, $e)
    if (-not $script:IsExiting) {
        $e.Cancel = $true
        $form.Hide()
        if ($script:TrayIcon) {
            $script:TrayIcon.ShowBalloonTip(2000, "IPBan Control Center", "Програму згорнуто у системний трей. Клікніть значок для відновлення.", [System.Windows.Forms.ToolTipIcon]::Info)
        }
    } else {
        if ($script:GeoIPTimer) {
            $script:GeoIPTimer.Stop()
            $script:GeoIPTimer.Dispose()
        }
        Save-GeoIPCache
        if ($script:AutoRefreshTimer) {
            $script:AutoRefreshTimer.Stop()
            $script:AutoRefreshTimer.Dispose()
        }
        if ($script:AlertResetTimer) {
            $script:AlertResetTimer.Stop()
            $script:AlertResetTimer.Dispose()
        }
        if ($script:TrayMonitorTimer) {
            $script:TrayMonitorTimer.Stop()
            $script:TrayMonitorTimer.Dispose()
        }
        if ($script:TrayIcon) {
            $script:TrayIcon.Visible = $false
            $script:TrayIcon.Dispose()
        }
        if ($script:AppContext) {
            $script:AppContext.ExitThread()
        }
        [System.Windows.Forms.Application]::Exit()
    }
})

# ------------------------------------------------------------------------------
# Запуск
# ------------------------------------------------------------------------------
Initialize-App

# Збереження WindowHandle для активації форми при повторному запуску
try {
    $regU = "HKCU:\SOFTWARE\IPBanControlCenter"
    if (-not (Test-Path $regU)) { New-Item -Path $regU -Force | Out-Null }
    Set-ItemProperty -Path $regU -Name "WindowHandle" -Value $form.Handle.ToInt64() -Force
} catch {}

$script:AppContext = New-Object System.Windows.Forms.ApplicationContext

if ($script:StartInTray) {
    if ($script:TrayIcon) {
        $tipMsg = if ($script:CurrentLang -eq "EN") { "IPBan Control Center is running in the background tray." } else { "IPBan Control Center працює у системному треї. Клікніть значок для відкриття." }
        $script:TrayIcon.ShowBalloonTip(2000, "IPBan Control Center", $tipMsg, [System.Windows.Forms.ToolTipIcon]::Info)
    }
} else {
    $form.Show()
}

[System.Windows.Forms.Application]::Run($script:AppContext)