import { useEffect, useMemo, useState, type ReactNode } from "react";
import { ConnectionTree, FieldLabel, LoadingFrame, MailServerSettingsPanel, PolicyLockedHint, PolicyPathHelp, PolicyRow, PolicySourcePath, PolicyTable, ToggleSwitch, hasMailImapSettings, mailImapSettingsPayload, mailServerSecurityOptions, mailSmtpSettingsPayload, mailTextOrNull, mailTransportCredentialsPayload, mergeDeltaRows, normalizeMailServerSecurity, normalizePolicySourcePathItems, useDeltaWatermarks, type ConnectionTreeColumn, type MailServerConnectionTestResult, type MailServerCredentialSettings, type MailServerImapSettings, type MailServerSmtpSettings, type NormalizedPolicySourcePathItem, type PolicySourcePathItem } from "@govoplan/core-webui";
import { Pencil, Plus, Trash2 } from "lucide-react";
import type { ApiSettings } from "../../types";
import {
  createMailServerProfile,
  deactivateMailServerProfile,
  fetchMailSettingsDelta,
  getMailProfilePolicy,
  mailProfilePatternKeys,
  mailProfilePolicyLimitKeys,
  updateMailProfilePolicy,
  testImapSettings,
  testMailProfileImap,
  testMailProfileSmtp,
  testSmtpSettings,
  updateMailServerProfile,
  type MailCredentialPolicy,
  type MailImapTestPayload,
  type MailProfilePatternKey,
  type MailProfilePatternRules,
  type MailProfilePolicy,
  type MailProfilePolicyLimitKey,
  type MailProfileScope,
  type MailSecurity,
  type MailServerProfile,
  type MailServerProfilePayload,
  type MailServerProfileUpdatePayload,
  type MailSmtpTestPayload } from
"../../api/mail";
import { validateMailPolicy } from "./mailPolicyValidation";
import { Button } from "@govoplan/core-webui";
import { Card } from "@govoplan/core-webui";
import { ConfirmDialog } from "@govoplan/core-webui";
import { Dialog } from "@govoplan/core-webui";
import { DismissibleAlert } from "@govoplan/core-webui";
import { FormField, i18nMessage, useUnsavedDraftGuard } from "@govoplan/core-webui";
import {
  mailProfileChildDescriptors,
  mailProfileEditTargetInitialSection,
  mailProfileEditTargetPanelMode,
  mailProfileEditTargetShowsProfileFields,
  mailProfileEditTargetShowsSettingsPanel,
  mailProfileEditTargetVisibleSections,
  type MailProfileEditTarget,
  type MailProfileProtocol
} from "./mailProfileEditorModel";
export type MailProfileTargetOption = {
  id: string;
  label: string;
  secondary?: string | null;
};

type ProfileDraft = {
  name: string;
  slug: string;
  description: string;
  isActive: boolean;
  smtpHost: string;
  smtpPort: string;
  smtpSecurity: MailSecurity;
  smtpUsername: string;
  smtpPassword: string;
  smtpTimeout: string;
  imapHost: string;
  imapPort: string;
  imapSecurity: MailSecurity;
  imapUsername: string;
  imapPassword: string;
  imapSentFolder: string;
  imapTimeout: string;
};

type MailProfileScopeManagerProps = {
  settings: ApiSettings;
  scopeType: MailProfileScope;
  scopeId?: string | null;
  targetOptions?: MailProfileTargetOption[];
  targetLabel?: string;
  profileTitle?: string;
  policyTitle?: string;
  canWriteProfiles: boolean;
  canManageCredentials: boolean;
  canWritePolicy: boolean;
};

type MailProfilePolicyEditorProps = {
  settings: ApiSettings;
  scopeType: MailProfileScope;
  scopeId?: string | null;
  campaignId?: string | null;
  profiles: MailServerProfile[];
  ownerUserId?: string | null;
  ownerGroupId?: string | null;
  canWrite: boolean;
  locked?: boolean;
  title?: string;
  description?: string;
  onSaved?: () => void | Promise<void>;
};

type EditingProfile = MailServerProfile | "new" | null;
type PolicyFlagValue = "inherit" | "allow" | "deny";
type CredentialInheritanceValue = "inherit" | "profile" | "local";
type MailProfileTreeRow =
{kind: "profile";id: string;profile: MailServerProfile;} |
{kind: "server";id: string;profile: MailServerProfile;protocol: MailProfileProtocol;} |
{kind: "credential";id: string;profile: MailServerProfile;protocol: MailProfileProtocol;};

const securityOptions = mailServerSecurityOptions as readonly MailSecurity[];

const patternLabels: Record<MailProfilePatternKey, string> = {
  smtp_hosts: "i18n:govoplan-mail.smtp_hostnames.36eb51d8",
  imap_hosts: "i18n:govoplan-mail.imap_hostnames.ac9c1d78",
  envelope_senders: "i18n:govoplan-mail.envelope_senders.269065cd",
  from_headers: "i18n:govoplan-mail.from_headers.b3ea473b",
  recipient_domains: "i18n:govoplan-mail.recipient_domains.cb9b7b44"
};

const blankPolicy: MailProfilePolicy = {
  allowed_profile_ids: [],
  allow_user_profiles: null,
  allow_group_profiles: null,
  allow_campaign_profiles: null,
  smtp_credentials: {},
  imap_credentials: {},
  whitelist: {},
  blacklist: {},
  allow_lower_level_limits: {}
};

export function MailProfileScopeManager({
  settings,
  scopeType,
  scopeId = null,
  targetOptions = [],
  targetLabel = "i18n:govoplan-mail.target.61ad50a9",
  profileTitle = "i18n:govoplan-mail.mail_server_profiles.b1726682",
  policyTitle = "i18n:govoplan-mail.mail_profile_policy.f2ac4b92",
  canWriteProfiles,
  canManageCredentials,
  canWritePolicy
}: MailProfileScopeManagerProps) {
  const [profiles, setProfiles] = useState<MailServerProfile[]>([]);
  const [selectedTargetId, setSelectedTargetId] = useState(scopeId || targetOptions[0]?.id || "");
  const [editing, setEditing] = useState<EditingProfile>(null);
  const [editingTarget, setEditingTarget] = useState<MailProfileEditTarget>({ kind: "create" });
  const [deactivating, setDeactivating] = useState<MailServerProfile | null>(null);
  const [draft, setDraft] = useState<ProfileDraft>(emptyProfileDraft());
  const [savedProfileDraftKey, setSavedProfileDraftKey] = useState(profileDraftKey(emptyProfileDraft()));
  const [loading, setLoading] = useState(true);
  const [busy, setBusy] = useState(false);
  const [error, setError] = useState("");
  const [success, setSuccess] = useState("");
  const [profileEffectivePolicy, setProfileEffectivePolicy] = useState<MailProfilePolicy | null>(null);
  const { getDeltaWatermark, setDeltaWatermark, resetDeltaWatermark } = useDeltaWatermarks();

  const requiresTarget = scopeType === "user" || scopeType === "group" || scopeType === "campaign";
  const targetSelectionRequired = requiresTarget && !scopeId;
  const hasSelectableTarget = targetOptions.length > 0;
  const activeScopeId = scopeId || selectedTargetId || null;
  const deltaKey = `mail:settings:${scopeType}:${activeScopeId ?? ""}`;
  const scopeReady = !requiresTarget || Boolean(activeScopeId);
  const targetEmptyText = i18nMessage("i18n:govoplan-mail.no_value_available", { value0: targetPluralLabel(scopeType, targetLabel) });
  const profileDirty = editing !== null && profileDraftKey(draft) !== savedProfileDraftKey;

  useUnsavedDraftGuard({
    dirty: profileDirty,
    onSave: saveProfile,
    onDiscard: closeProfileEditor
  });

  useEffect(() => {
    if (scopeId) {
      setSelectedTargetId(scopeId);
      return;
    }
    if (targetOptions.length > 0 && !targetOptions.some((option) => option.id === selectedTargetId)) {
      setSelectedTargetId(targetOptions[0].id);
      return;
    }
    if (targetOptions.length === 0 && selectedTargetId) setSelectedTargetId("");
  }, [scopeId, selectedTargetId, targetOptions]);

  useEffect(() => {
    resetDeltaWatermark(deltaKey);
    void loadProfiles(true);
  }, [deltaKey, scopeReady, settings.accessToken, settings.apiBaseUrl, settings.apiKey, resetDeltaWatermark]);

  async function loadProfiles(forceFull = false) {
    setLoading(true);
    setError("");
    if (!scopeReady) {
      setProfiles([]);
      setProfileEffectivePolicy(null);
      resetDeltaWatermark(deltaKey);
      setLoading(false);
      return;
    }
    try {
      let nextProfiles = forceFull ? [] : profiles;
      let nextEffectivePolicy = forceFull ? null : profileEffectivePolicy;
      let nextWatermark = forceFull ? null : getDeltaWatermark(deltaKey);
      let hasMore = false;
      do {
        const response = await fetchMailSettingsDelta(settings, {
          scope_type: scopeType,
          scope_id: activeScopeId,
          include_inactive: true,
          since: nextWatermark
        });
        nextProfiles = response.full ?
        response.profiles :
        mergeDeltaRows(nextProfiles, response.profiles, response.deleted, (profile) => profile.id, {
          deletedResourceType: "mail_profile",
          sort: sortMailProfiles
        });
        if (response.policy) {
          nextEffectivePolicy = response.policy.effective_policy ?? null;
        }
        nextWatermark = response.watermark ?? null;
        hasMore = response.has_more;
      } while (hasMore);
      setProfiles(nextProfiles);
      setProfileEffectivePolicy(nextEffectivePolicy);
      setDeltaWatermark(deltaKey, nextWatermark);
    } catch (err) {
      setProfiles([]);
      setProfileEffectivePolicy(null);
      resetDeltaWatermark(deltaKey);
      setError(errorMessage(err));
    } finally {
      setLoading(false);
    }
  }

  const scopedProfiles = useMemo(
    () => profiles.filter((profile) => profileBelongsToEditableScope(profile, scopeType, activeScopeId)),
    [activeScopeId, profiles, scopeType]
  );

  function openCreate() {
    const nextDraft = emptyProfileDraft();
    setDraft(nextDraft);
    setSavedProfileDraftKey(profileDraftKey(nextDraft));
    setEditingTarget({ kind: "create" });
    setEditing("new");
    setError("");
    setSuccess("");
  }

  function openEdit(profile: MailServerProfile, target: MailProfileEditTarget = { kind: "profile" }) {
    const nextDraft = profileToDraft(profile);
    setDraft(nextDraft);
    setSavedProfileDraftKey(profileDraftKey(nextDraft));
    setEditingTarget(target);
    setEditing(profile);
    setError("");
    setSuccess("");
  }

  function closeProfileEditor() {
    setEditing(null);
    const nextDraft = emptyProfileDraft();
    setDraft(nextDraft);
    setSavedProfileDraftKey(profileDraftKey(nextDraft));
    setEditingTarget({ kind: "create" });
  }

  async function saveProfile(): Promise<boolean> {
    if (!editing || !scopeReady) return false;
    setBusy(true);
    setError("");
    setSuccess("");
    try {
      if (editing === "new") {
        const payload = createProfilePayload(draft, scopeType, activeScopeId);
        const created = await createMailServerProfile(settings, payload);
        setSuccess(i18nMessage("i18n:govoplan-mail.profile_value_created.2a088d8d", { value0: created.name }));
      } else {
        const payload = updateProfilePayload(draft, editing);
        const updated = await updateMailServerProfile(settings, editing.id, payload);
        setSuccess(i18nMessage("i18n:govoplan-mail.profile_value_updated.fdbad0ea", { value0: updated.name }));
      }
      setEditing(null);
      await loadProfiles();
      return true;
    } catch (err) {
      setError(errorMessage(err));
      return false;
    } finally {
      setBusy(false);
    }
  }

  async function deactivateProfile() {
    if (!deactivating) return;
    setBusy(true);
    setError("");
    setSuccess("");
    try {
      await deactivateMailServerProfile(settings, deactivating.id);
      setSuccess(i18nMessage("i18n:govoplan-mail.profile_value_deactivated.fa7fcc1a", { value0: deactivating.name }));
      setDeactivating(null);
      await loadProfiles();
    } catch (err) {
      setError(errorMessage(err));
    } finally {
      setBusy(false);
    }
  }

  const treeRows = useMemo<MailProfileTreeRow[]>(
    () => scopedProfiles.map((profile) => ({ kind: "profile", id: `profile:${profile.id}`, profile })),
    [scopedProfiles]
  );
  const columns = useMemo<ConnectionTreeColumn<MailProfileTreeRow>[]>(() => [
  {
    id: "profile",
    header: "i18n:govoplan-mail.server_credential.7fb9a24e",
    width: "minmax(260px, 1.4fr)",
    render: (row) => row.kind === "profile" ?
    <div className="connection-tree-main"><strong>{row.profile.name}</strong><div className="connection-tree-muted-line">{row.profile.slug} · {scopeLabel(row.profile)}</div></div> :
    row.kind === "server" ?
    <MailServerTreeCell profile={row.profile} protocol={row.protocol} /> :
    <MailCredentialTreeCell profile={row.profile} protocol={row.protocol} />
  },
  {
    id: "transport",
    header: "i18n:govoplan-mail.transport.c10d76c9",
    width: "minmax(220px, 1fr)",
    render: (row) => row.kind === "profile" ?
    <span>{transportLabel(row.profile.smtp)}{row.profile.imap ? i18nMessage("i18n:govoplan-mail.value.48afe802", { value0: transportLabel(row.profile.imap) }) : ""}</span> :
    <TransportCell profile={row.profile} protocol={row.protocol} />
  },
  {
    id: "policy",
    header: "i18n:govoplan-mail.policy.bb9cf141",
    width: "minmax(150px, 0.8fr)",
    render: (row) => row.kind === "profile" ? scopeLabel(row.profile) : row.kind === "server" ? row.protocol.toUpperCase() : mailCredentialPolicySummary(profileEffectivePolicy, row.protocol)
  },
  {
    id: "status",
    header: "i18n:govoplan-mail.status.bae7d5be",
    width: "110px",
    render: (row) => row.kind === "profile" ?
    <span className={`status-badge ${row.profile.is_active ? "success" : "neutral"}`}>{row.profile.is_active ? "i18n:govoplan-mail.active.a733b809" : "i18n:govoplan-mail.inactive.09af574c"}</span> :
    row.kind === "server" ?
    <span className={`status-badge ${transportConfigured(row.profile, row.protocol) ? "success" : "neutral"}`}>{transportConfigured(row.profile, row.protocol) ? "i18n:govoplan-core.configured.668c5fff" : "i18n:govoplan-core.not_configured.811931bb"}</span> :
    <span className={`status-badge ${mailCredentialConfigured(row.profile, row.protocol) ? "success" : "neutral"}`}>{mailCredentialConfigured(row.profile, row.protocol) ? "i18n:govoplan-mail.saved.c0ae8f6e" : "i18n:govoplan-mail.local.dc99d54d"}</span>
  }],
  [profileEffectivePolicy]);

  function mailProfileChildren(row: MailProfileTreeRow): MailProfileTreeRow[] {
    if (row.kind !== "profile") return [];
    const children: MailProfileTreeRow[] = [
      ...mailProfileChildDescriptors(row.profile).map((child) => ({ ...child, profile: row.profile }))
    ];
    return children;
  }

  function renderMailProfileActions(row: MailProfileTreeRow) {
    if (row.kind === "server") {
      const label = `Edit ${row.protocol.toUpperCase()} server`;
      return (
        <div className="admin-icon-actions">
          <Button type="button" className="admin-icon-button" title={label} aria-label={label} onClick={() => openEdit(row.profile, { kind: "server", protocol: row.protocol })} disabled={!canWriteProfiles || busy}><Pencil size={16} /></Button>
        </div>);

    }
    if (row.kind === "credential") {
      return (
        <div className="admin-icon-actions">
          <Button type="button" className="admin-icon-button" title={i18nMessage("i18n:govoplan-mail.edit_value_credentials.1e2dc4f6", { value0: row.protocol.toUpperCase() })} aria-label={i18nMessage("i18n:govoplan-mail.edit_value_credentials.1e2dc4f6", { value0: row.protocol.toUpperCase() })} onClick={() => openEdit(row.profile, { kind: "credentials", protocol: row.protocol })} disabled={!canWriteProfiles || busy}><Pencil size={16} /></Button>
        </div>);

    }
    return (
      <div className="admin-icon-actions">
        <Button type="button" className="admin-icon-button" title={i18nMessage("i18n:govoplan-mail.edit_value.fad75899", { value0: row.profile.name })} aria-label={i18nMessage("i18n:govoplan-mail.edit_value.fad75899", { value0: row.profile.name })} onClick={() => openEdit(row.profile)} disabled={!canWriteProfiles || busy}><Pencil size={16} /></Button>
        <Button type="button" variant="danger" className="admin-icon-button" title={i18nMessage("i18n:govoplan-mail.deactivate_value.a276a667", { value0: row.profile.name })} aria-label={i18nMessage("i18n:govoplan-mail.deactivate_value.a276a667", { value0: row.profile.name })} onClick={() => setDeactivating(row.profile)} disabled={!canWriteProfiles || busy || !row.profile.is_active}><Trash2 size={16} /></Button>
      </div>);

  }

  return (
    <div className="mail-profile-manager">
      {targetSelectionRequired &&
      <Card title={i18nMessage("i18n:govoplan-mail.value_scope", { value0: targetLabel })}>
          <div className="mail-profile-target-row">
            <FormField label={targetLabel}>
              <select value={selectedTargetId} onChange={(event) => setSelectedTargetId(event.target.value)} disabled={loading || busy || !hasSelectableTarget}>
                {!hasSelectableTarget && <option value="">{targetEmptyText}</option>}
                {targetOptions.map((option) => <option key={option.id} value={option.id}>{option.secondary ? i18nMessage("i18n:govoplan-mail.value_value.c189e8bc", { value0: option.label, value1: option.secondary }) : option.label}</option>)}
              </select>
            </FormField>
          </div>
        </Card>
      }

      {scopeReady &&
      <>
          <Card
          title={profileTitle}
          actions={
          <div className="button-row compact-actions">
                <Button onClick={() => void loadProfiles()} disabled={loading}>{loading ? "i18n:govoplan-mail.loading.33ce4174" : "i18n:govoplan-mail.reload.cce71553"}</Button>
                <Button variant="primary" onClick={openCreate} disabled={!canWriteProfiles || busy}><span className="button-icon-label"><Plus size={16} />i18n:govoplan-mail.new_profile.ca36da25</span></Button>
              </div>
          }>

            <LoadingFrame loading={loading} label="i18n:govoplan-mail.loading_mail_profiles.87de3560">
              <ConnectionTree
            rows={treeRows}
            columns={columns}
            getRowKey={(row) => row.id}
            getChildren={mailProfileChildren}
            renderActions={renderMailProfileActions}
            emptyText="i18n:govoplan-mail.no_profiles_in_this_scope.302b21d8" />
            </LoadingFrame>

          </Card>
          <MailProfilePolicyEditor
          settings={settings}
          scopeType={scopeType}
          scopeId={activeScopeId}
          profiles={profiles}
          canWrite={canWritePolicy}
          title={policyTitle}
          onSaved={loadProfiles} />

        </>
      }

      {error && <DismissibleAlert tone="danger" resetKey={error} floating>{error}</DismissibleAlert>}
      {success && <DismissibleAlert tone="success" resetKey={success} floating>{success}</DismissibleAlert>}

      <Dialog
        open={editing !== null}
        title={profileDialogTitle(editing, editingTarget)}
        onClose={() => !busy && closeProfileEditor()}
        className="admin-dialog admin-dialog-wide mail-profile-dialog"
        closeDisabled={busy}
        footer={<><Button onClick={closeProfileEditor} disabled={busy}>i18n:govoplan-mail.cancel.77dfd213</Button><Button variant="primary" onClick={() => void saveProfile()} disabled={!canWriteProfiles || busy || !draft.name.trim() || !scopeReady}>{busy ? "i18n:govoplan-mail.saving.56a2285c" : "i18n:govoplan-mail.save_profile.f597c0e8"}</Button></>}>

        <ProfileForm settings={settings} draft={draft} setDraft={setDraft} editing={editing} busy={busy} canWrite={canWriteProfiles} canManageCredentials={canManageCredentials} effectivePolicy={profileEffectivePolicy} editTarget={editingTarget} />
      </Dialog>

      <ConfirmDialog
        open={Boolean(deactivating)}
        title="i18n:govoplan-mail.deactivate_mail_profile.0e0fd0b8"
        message={i18nMessage("i18n:govoplan-mail.deactivate_value_campaign_drafts_using_it_will_n.656f1b9e", { value0: deactivating?.name || "i18n:govoplan-mail.this_profile.5fd9cdf1" })}
        confirmLabel="i18n:govoplan-mail.deactivate.d65ded94"
        tone="danger"
        busy={busy}
        onCancel={() => setDeactivating(null)}
        onConfirm={() => void deactivateProfile()} />

    </div>);

}

export function MailProfilePolicyEditor({
  settings,
  scopeType,
  scopeId = null,
  campaignId = null,
  profiles,
  ownerUserId = null,
  ownerGroupId = null,
  canWrite,
  locked = false,
  title = "i18n:govoplan-mail.mail_profile_policy.f2ac4b92",
  description = "i18n:govoplan-mail.allowed_profiles_and_wildcard_rules_for_this_sco.0f82b3e4",
  onSaved
}: MailProfilePolicyEditorProps) {
  const [policy, setPolicy] = useState<MailProfilePolicy>(blankPolicy);
  const [effectivePolicy, setEffectivePolicy] = useState<MailProfilePolicy | null>(null);
  const [parentPolicy, setParentPolicy] = useState<MailProfilePolicy | null>(null);
  const [effectivePolicySources, setEffectivePolicySources] = useState<PolicySourcePathItem[]>([]);
  const [savedPolicyKey, setSavedPolicyKey] = useState(policyDraftKey(blankPolicy));
  const [loading, setLoading] = useState(false);
  const [busy, setBusy] = useState(false);
  const [error, setError] = useState("");
  const [success, setSuccess] = useState("");
  const [profileEffectivePolicy, setProfileEffectivePolicy] = useState<MailProfilePolicy | null>(null);

  const requiresTarget = scopeType === "user" || scopeType === "group" || scopeType === "campaign";
  const scopeReady = !requiresTarget || Boolean(scopeId);
  const policyDirty = scopeReady && policyDraftKey(policy) !== savedPolicyKey;

  useUnsavedDraftGuard({
    dirty: policyDirty,
    onSave: savePolicy,
    onDiscard: () => setPolicy(JSON.parse(savedPolicyKey) as MailProfilePolicy)
  });

  useEffect(() => {void loadPolicy();}, [settings.accessToken, settings.apiBaseUrl, settings.apiKey, scopeType, scopeId, campaignId]);

  async function loadPolicy() {
    setError("");
    setSuccess("");
    if (!scopeReady) {
      setPolicy(blankPolicy);
      setSavedPolicyKey(policyDraftKey(blankPolicy));
      setEffectivePolicy(null);
      setParentPolicy(null);
      setEffectivePolicySources([]);
      return;
    }
    setLoading(true);
    try {
      const response = await getMailProfilePolicy(settings, scopeType, scopeId, campaignId);
      const loadedPolicy = normalizePolicy(response.policy);
      setPolicy(loadedPolicy);
      setSavedPolicyKey(policyDraftKey(loadedPolicy));
      setEffectivePolicy(response.effective_policy ? normalizePolicy(response.effective_policy) : null);
      setParentPolicy(response.parent_policy ? normalizePolicy(response.parent_policy) : null);
      setEffectivePolicySources(response.effective_policy_sources ?? []);
    } catch (err) {
      setPolicy(blankPolicy);
      setSavedPolicyKey(policyDraftKey(blankPolicy));
      setEffectivePolicy(null);
      setParentPolicy(null);
      setEffectivePolicySources([]);
      setError(errorMessage(err));
    } finally {
      setLoading(false);
    }
  }

  async function savePolicy(): Promise<boolean> {
    if (!scopeReady) return false;
    setBusy(true);
    setError("");
    setSuccess("");
    try {
      const response = await updateMailProfilePolicy(settings, scopeType, normalizePolicyForSave(policy, parentPolicy, scopeType), scopeId);
      const savedPolicy = normalizePolicy(response.policy);
      setPolicy(savedPolicy);
      setSavedPolicyKey(policyDraftKey(savedPolicy));
      setEffectivePolicy(response.effective_policy ? normalizePolicy(response.effective_policy) : null);
      setParentPolicy(response.parent_policy ? normalizePolicy(response.parent_policy) : null);
      setEffectivePolicySources(response.effective_policy_sources ?? []);
      setSuccess("i18n:govoplan-mail.mail_profile_policy_saved.666847bf");
      await onSaved?.();
      return true;
    } catch (err) {
      setError(errorMessage(err));
      return false;
    } finally {
      setBusy(false);
    }
  }

  const candidateProfiles = useMemo(
    () => profileCandidatesForPolicy(profiles, scopeType, scopeId, ownerUserId, ownerGroupId),
    [ownerGroupId, ownerUserId, profiles, scopeId, scopeType]
  );
  const isSystem = scopeType === "system";
  const displayPolicy = useMemo(() => isSystem ? concreteSystemPolicy(policy) : policy, [isSystem, policy]);
  const selectedProfileIds = new Set(policy.allowed_profile_ids ?? []);
  const disabled = locked || busy || loading || !canWrite || !scopeReady;
  const parentAllowedProfileIds = parentPolicy?.allowed_profile_ids?.length ? new Set(parentPolicy.allowed_profile_ids) : null;
  const parentBlocksUserProfiles = parentPolicy?.allow_user_profiles === false;
  const parentBlocksGroupProfiles = parentPolicy?.allow_group_profiles === false;
  const parentBlocksCampaignProfiles = parentPolicy?.allow_campaign_profiles === false;
  const smtpCredentialLocked = !parentAllowsMailLimit("smtp_credentials.inherit");
  const imapCredentialLocked = !parentAllowsMailLimit("imap_credentials.inherit");
  const showAllowColumn = scopeType !== "campaign";
  const showEffectiveColumn = !isSystem;
  const profileAllowListLocked = !parentAllowsMailLimit("allowed_profile_ids");
  const blockedProfileDefinitions = [
  parentBlocksUserProfiles ? "user" : "",
  parentBlocksGroupProfiles ? "group" : "",
  parentBlocksCampaignProfiles ? "i18n:govoplan-mail.campaign_local_settings.920ecb62" : ""].
  filter(Boolean).join(", ");
  const lockedCredentialKinds = [smtpCredentialLocked ? "i18n:govoplan-mail.smtp.efff9cca" : "", imapCredentialLocked ? "i18n:govoplan-mail.imap.271f9ef2" : ""].filter(Boolean).join(" and ");
  const effectivePolicyPath = effectivePolicySources.length > 0 ? effectivePolicySources : mailPolicySourcePath(scopeType);

  function patchPolicy(patch: Partial<MailProfilePolicy>) {
    setPolicy((current) => normalizePolicy({ ...current, ...patch }));
  }

  function toggleAllowedProfile(profileId: string, checked: boolean) {
    const next = new Set(policy.allowed_profile_ids ?? []);
    if (checked) next.add(profileId);else
    next.delete(profileId);
    patchPolicy({ allowed_profile_ids: [...next].sort() });
  }

  function setFlag(key: "allow_user_profiles" | "allow_group_profiles" | "allow_campaign_profiles", value: PolicyFlagValue) {
    patchPolicy({ [key]: flagToBoolean(value) });
  }

  function setCredentialPolicy(protocol: "smtp" | "imap", patch: Partial<MailCredentialPolicy>) {
    const key = protocol === "smtp" ? "smtp_credentials" : "imap_credentials";
    patchPolicy({ [key]: normalizeCredentialPolicy({ ...(policy[key] ?? {}), ...patch }) });
  }

  function setPattern(kind: "whitelist" | "blacklist", key: MailProfilePatternKey, text: string) {
    const nextRules = { ...(policy[kind] ?? {}) };
    const parsed = parsePatternList(text);
    if (parsed.length > 0) nextRules[key] = parsed;else
    delete nextRules[key];
    patchPolicy({ [kind]: nextRules });
  }

  function parentAllowsMailLimit(key: MailProfilePolicyLimitKey): boolean {
    return !parentPolicy || parentPolicy.allow_lower_level_limits?.[key] !== false;
  }

  function localAllowsMailLimit(key: MailProfilePolicyLimitKey): boolean {
    const localValue = policy.allow_lower_level_limits?.[key];
    if (localValue !== undefined) return localValue && parentAllowsMailLimit(key);
    return parentAllowsMailLimit(key);
  }

  function setAllowLowerLevelLimit(key: MailProfilePolicyLimitKey, allowed: boolean) {
    patchPolicy({ allow_lower_level_limits: { ...(policy.allow_lower_level_limits ?? {}), [key]: allowed } });
  }

  function lowerLevelLimitToggle(key: MailProfilePolicyLimitKey, label: ReactNode = "i18n:govoplan-mail.allow_override.ffa6e9a0"): ReactNode | undefined {
    if (!showAllowColumn) return undefined;
    const parentLocked = !parentAllowsMailLimit(key);
    return (
      <ToggleSwitch
        checked={localAllowsMailLimit(key)}
        disabled={disabled || parentLocked}
        onChange={(checked) => setAllowLowerLevelLimit(key, checked)}
        label={label} />);


  }

  return (
    <Card
      title={title}
      actions={
      <div className="button-row compact-actions">
          <Button onClick={() => void loadPolicy()} disabled={loading || !scopeReady}>{loading ? "i18n:govoplan-mail.loading.33ce4174" : "i18n:govoplan-mail.reload.cce71553"}</Button>
          <Button variant="primary" onClick={() => void savePolicy()} disabled={disabled}>{busy ? "i18n:govoplan-mail.saving.56a2285c" : "i18n:govoplan-mail.save_policy.77d67ce3"}</Button>
        </div>
      }>

      <LoadingFrame loading={loading} label="i18n:govoplan-mail.loading_mail_profile_policy.b746a2e8">
      <div className="mail-policy-editor">
        {description && <p className="muted small-note mail-policy-description">{description}</p>}
        {error && <DismissibleAlert tone="danger" resetKey={error} floating>{error}</DismissibleAlert>}
        {success && <DismissibleAlert tone="success" resetKey={success} floating>{success}</DismissibleAlert>}

        <section className="mail-policy-section policy-section">
          <div className="subsection-heading split">
            <h3>i18n:govoplan-mail.profile_allow_list.507dfe6c</h3>
            <div className="button-row compact-actions">
              {lowerLevelLimitToggle("allowed_profile_ids")}
              <Button onClick={() => patchPolicy({ allowed_profile_ids: [] })} disabled={disabled || profileAllowListLocked || selectedProfileIds.size === 0}>i18n:govoplan-mail.clear_allow_list.f69c8c67</Button>
            </div>
          </div>
          <p className="muted small-note">{selectedProfileIds.size === 0 ? "i18n:govoplan-mail.no_local_profile_allow_list_is_set.31072e39" : i18nMessage("i18n:govoplan-mail.value_profile_s_allowed_by_this_scope.6fe9ba44", { value0: selectedProfileIds.size })}</p>
          <div className="mail-profile-checkbox-grid">
            {candidateProfiles.map((profile) =>
            <label className="mail-profile-checkbox" key={profile.id}>
                <input type="checkbox" checked={selectedProfileIds.has(profile.id)} disabled={disabled || profileAllowListLocked || Boolean(parentAllowedProfileIds && !parentAllowedProfileIds.has(profile.id) && !selectedProfileIds.has(profile.id))} onChange={(event) => toggleAllowedProfile(profile.id, event.target.checked)} />
                <span><strong>{profile.name}</strong><small>{scopeLabel(profile)} · {transportLabel(profile.smtp)}</small></span>
              </label>
            )}
            {candidateProfiles.length === 0 && <p className="muted small-note">i18n:govoplan-mail.no_profiles_are_visible_for_this_policy_scope.1ec7bd85</p>}
          </div>
          {parentAllowedProfileIds && <p className="muted small-note">i18n:govoplan-mail.an_ancestor_allow_list_limits_selectable_profile.499ec179 {parentAllowedProfileIds.size} i18n:govoplan-mail.profile_s.742e9200</p>}
        </section>

        <section className="mail-policy-section policy-section">
          <h3>i18n:govoplan-mail.lower_level_mail_definitions.d39a0a1d</h3>
          <PolicyTable className="mail-policy-table" rowClassName="mail-policy-row" headerClassName="mail-policy-row-header" fieldLabel="i18n:govoplan-mail.policy.bb9cf141" settingLabel={isSystem ? "i18n:govoplan-mail.value.8dce170d" : "i18n:govoplan-mail.local_setting.967607a9"} effectiveLabel="i18n:govoplan-mail.effective_policy.feedb950" lowerLevelLabel="i18n:govoplan-mail.lower_levels.940821ee" showAllowColumn={showAllowColumn} showEffectiveColumn={showEffectiveColumn}>
            <PolicyRow
              className="mail-policy-row"
              labelClassName="mail-policy-field-label"
              controlClassName="mail-policy-control"
              effectiveCellClassName="mail-policy-effective-cell"
              effectiveClassName="mail-policy-effective-value"
              label="i18n:govoplan-mail.user_profiles.57730285"
              help={policyHelp("i18n:govoplan-mail.controls_whether_user_scoped_mail_profiles_may_b.00c0e0e7")}
              control={<PolicyFlagControl value={booleanToFlag(displayPolicy.allow_user_profiles)} disabled={disabled} includeInherit={!isSystem} inheritOnly={!isSystem && !parentAllowsMailLimit("allow_user_profiles")} allowDisabled={parentBlocksUserProfiles} onChange={(value) => setFlag("allow_user_profiles", value)} />}
              effective={showEffectiveColumn ? effectiveBooleanLabel(effectivePolicy?.allow_user_profiles, effectivePolicy) : undefined}
              allowControl={showAllowColumn ? <div className="mail-policy-lower-cell policy-lower-cell">{lowerLevelLimitToggle("allow_user_profiles")}</div> : undefined}
              effectiveHelp={showEffectiveColumn ? mailBooleanPolicyPathHelp("allow_user_profiles", effectivePolicyPath) : undefined} />

            <PolicyRow
              className="mail-policy-row"
              labelClassName="mail-policy-field-label"
              controlClassName="mail-policy-control"
              effectiveCellClassName="mail-policy-effective-cell"
              effectiveClassName="mail-policy-effective-value"
              label="i18n:govoplan-mail.group_profiles.74568838"
              help={policyHelp("i18n:govoplan-mail.controls_whether_group_scoped_mail_profiles_may_.0b832ea4")}
              control={<PolicyFlagControl value={booleanToFlag(displayPolicy.allow_group_profiles)} disabled={disabled} includeInherit={!isSystem} inheritOnly={!isSystem && !parentAllowsMailLimit("allow_group_profiles")} allowDisabled={parentBlocksGroupProfiles} onChange={(value) => setFlag("allow_group_profiles", value)} />}
              effective={showEffectiveColumn ? effectiveBooleanLabel(effectivePolicy?.allow_group_profiles, effectivePolicy) : undefined}
              allowControl={showAllowColumn ? <div className="mail-policy-lower-cell policy-lower-cell">{lowerLevelLimitToggle("allow_group_profiles")}</div> : undefined}
              effectiveHelp={showEffectiveColumn ? mailBooleanPolicyPathHelp("allow_group_profiles", effectivePolicyPath) : undefined} />

            <PolicyRow
              className="mail-policy-row"
              labelClassName="mail-policy-field-label"
              controlClassName="mail-policy-control"
              effectiveCellClassName="mail-policy-effective-cell"
              effectiveClassName="mail-policy-effective-value"
              label="i18n:govoplan-mail.campaign_local_settings.eb0f1061"
              help={policyHelp("i18n:govoplan-mail.controls_whether_campaigns_may_use_inline_smtp_i.fa45cbbc")}
              control={<PolicyFlagControl value={booleanToFlag(displayPolicy.allow_campaign_profiles)} disabled={disabled} includeInherit={!isSystem} inheritOnly={!isSystem && !parentAllowsMailLimit("allow_campaign_profiles")} allowDisabled={parentBlocksCampaignProfiles} onChange={(value) => setFlag("allow_campaign_profiles", value)} />}
              effective={showEffectiveColumn ? effectiveBooleanLabel(effectivePolicy?.allow_campaign_profiles, effectivePolicy) : undefined}
              allowControl={showAllowColumn ? <div className="mail-policy-lower-cell policy-lower-cell">{lowerLevelLimitToggle("allow_campaign_profiles")}</div> : undefined}
              effectiveHelp={showEffectiveColumn ? mailBooleanPolicyPathHelp("allow_campaign_profiles", effectivePolicyPath) : undefined} />

          </PolicyTable>
          {blockedProfileDefinitions && <PolicyLockedHint>i18n:govoplan-mail.explicit_allow_is_unavailable_for.8d05fd4a {blockedProfileDefinitions} i18n:govoplan-mail.because_an_ancestor_policy_blocks_those_definiti.5de3e30d</PolicyLockedHint>}
        </section>

        <section className="mail-policy-section policy-section">
          <h3>i18n:govoplan-mail.credential_inheritance.ec8d7191</h3>
          <PolicyTable className="mail-policy-table" rowClassName="mail-policy-row" headerClassName="mail-policy-row-header" fieldLabel="i18n:govoplan-mail.policy.bb9cf141" settingLabel={isSystem ? "i18n:govoplan-mail.value.8dce170d" : "i18n:govoplan-mail.local_setting.967607a9"} effectiveLabel="i18n:govoplan-mail.effective_policy.feedb950" lowerLevelLabel="i18n:govoplan-mail.lower_levels.940821ee" showAllowColumn={showAllowColumn} showEffectiveColumn={showEffectiveColumn}>
            <PolicyRow
              className="mail-policy-row"
              labelClassName="mail-policy-field-label"
              controlClassName="mail-policy-control"
              effectiveCellClassName="mail-policy-effective-cell"
              effectiveClassName="mail-policy-effective-value"
              label="i18n:govoplan-mail.smtp_credentials.f73ef315"
              help={policyHelp("i18n:govoplan-mail.decides_whether_lower_scopes_inherit_saved_smtp_.93f1c4d0")}
              control={<CredentialInheritanceControl value={credentialInheritanceToValue(displayPolicy.smtp_credentials?.inherit)} disabled={disabled} includeInherit={!isSystem} inheritOnly={!isSystem && smtpCredentialLocked} onChange={(value) => setCredentialPolicy("smtp", { inherit: valueToCredentialInheritance(value) })} />}
              effective={showEffectiveColumn ? effectivePolicy ? credentialInheritanceLabel(effectivePolicy.smtp_credentials) : "i18n:govoplan-mail.loading.b04ba49f" : undefined}
              allowControl={showAllowColumn ? <div className="mail-policy-lower-cell policy-lower-cell">{lowerLevelLimitToggle("smtp_credentials.inherit")}</div> : undefined}
              effectiveHelp={showEffectiveColumn ? mailCredentialPolicyPathHelp("smtp_credentials", effectivePolicyPath) : undefined} />

            <PolicyRow
              className="mail-policy-row"
              labelClassName="mail-policy-field-label"
              controlClassName="mail-policy-control"
              effectiveCellClassName="mail-policy-effective-cell"
              effectiveClassName="mail-policy-effective-value"
              label="i18n:govoplan-mail.imap_credentials.da847469"
              help={policyHelp("i18n:govoplan-mail.decides_whether_lower_scopes_inherit_saved_imap_.ac607ee3")}
              control={<CredentialInheritanceControl value={credentialInheritanceToValue(displayPolicy.imap_credentials?.inherit)} disabled={disabled} includeInherit={!isSystem} inheritOnly={!isSystem && imapCredentialLocked} onChange={(value) => setCredentialPolicy("imap", { inherit: valueToCredentialInheritance(value) })} />}
              effective={showEffectiveColumn ? effectivePolicy ? credentialInheritanceLabel(effectivePolicy.imap_credentials) : "i18n:govoplan-mail.loading.b04ba49f" : undefined}
              allowControl={showAllowColumn ? <div className="mail-policy-lower-cell policy-lower-cell">{lowerLevelLimitToggle("imap_credentials.inherit")}</div> : undefined}
              effectiveHelp={showEffectiveColumn ? mailCredentialPolicyPathHelp("imap_credentials", effectivePolicyPath) : undefined} />

          </PolicyTable>
          {lockedCredentialKinds && <PolicyLockedHint>{lockedCredentialKinds} i18n:govoplan-mail.credential_inheritance_is_locked_by_an_ancestor_.1ee5d263</PolicyLockedHint>}
        </section>

        <section className="mail-policy-section policy-section">
          <h3>i18n:govoplan-mail.wildcard_rules.54fb3fc0</h3>
          <div className={`mail-policy-pattern-table policy-table${showAllowColumn ? " with-allow-column" : ""}`}>
            <div className="mail-policy-pattern-row policy-row mail-policy-row-header policy-row-header">
              <span>i18n:govoplan-mail.policy_target.a19dcee9</span>
              <span>i18n:govoplan-mail.whitelist.53c2ad30</span>
              <span>i18n:govoplan-mail.blacklist.7b2dd04c</span>
              {showAllowColumn && <span>i18n:govoplan-mail.lower_levels.940821ee</span>}
            </div>
            {mailProfilePatternKeys.map((key) =>
            <div className="mail-policy-pattern-row policy-row" key={key}>
                <div className="mail-policy-field-label policy-field-label">
                  <FieldLabel className="mail-policy-field-title policy-field-title" help={policyHelp(patternPolicyNote(key))}>{patternLabels[key]}</FieldLabel>
                </div>
                <PatternTextareaControl value={patternsToText(policy.whitelist?.[key])} disabled={disabled || !parentAllowsMailLimit(`whitelist.${key}` as MailProfilePolicyLimitKey)} onChange={(text) => setPattern("whitelist", key, text)} />
                <PatternTextareaControl value={patternsToText(policy.blacklist?.[key])} disabled={disabled || !parentAllowsMailLimit(`blacklist.${key}` as MailProfilePolicyLimitKey)} onChange={(text) => setPattern("blacklist", key, text)} />
                {showAllowColumn &&
              <div className="mail-policy-pattern-limits">
                    {lowerLevelLimitToggle(i18nMessage("i18n:govoplan-mail.whitelist_value.d4cc3755", { value0: key }) as MailProfilePolicyLimitKey, "i18n:govoplan-mail.whitelist.53c2ad30")}
                    {lowerLevelLimitToggle(i18nMessage("i18n:govoplan-mail.blacklist_value.556334d0", { value0: key }) as MailProfilePolicyLimitKey, "i18n:govoplan-mail.blacklist.7b2dd04c")}
                  </div>
              }
              </div>
            )}
          </div>
        </section>

        {showEffectiveColumn && effectivePolicy &&
        <section className="mail-policy-section policy-section mail-policy-effective">
            <h3>i18n:govoplan-mail.policy_path.1ba91ee5</h3>
            <PolicySourcePath items={effectivePolicyPath} />
            <p className="muted small-note">i18n:govoplan-mail.effective_values_are_shown_in_the_table_rows_abo.b27b900d</p>
          </section>
        }
      </div>
      </LoadingFrame>
    </Card>);

}

function ProfileForm({
  settings,
  draft,
  setDraft,
  editing,
  busy,
  canWrite,
  canManageCredentials,
  effectivePolicy,
  editTarget
}: {settings: ApiSettings;draft: ProfileDraft;setDraft: (draft: ProfileDraft) => void;editing: EditingProfile;busy: boolean;canWrite: boolean;canManageCredentials: boolean;effectivePolicy?: MailProfilePolicy | null;editTarget: MailProfileEditTarget;}) {
  const [smtpTestResult, setSmtpTestResult] = useState<MailServerConnectionTestResult | null>(null);
  const [imapTestResult, setImapTestResult] = useState<MailServerConnectionTestResult | null>(null);
  const [mailActionState, setMailActionState] = useState<"smtp" | "imap" | null>(null);

  const disabled = busy || !canWrite;
  const credentialDisabled = disabled || !canManageCredentials;
  const existingProfile = editing !== "new" ? editing : null;
  const initialSection = mailProfileEditTargetInitialSection(editTarget);
  const settingsPanelMode = mailProfileEditTargetPanelMode(editTarget);
  const visibleSections = mailProfileEditTargetVisibleSections(editTarget);
  const showProfileFields = mailProfileEditTargetShowsProfileFields(editTarget);
  const showSettingsPanel = mailProfileEditTargetShowsSettingsPanel(editTarget);
  const draftHasImap = hasDraftImapSettings(draft);
  const useSavedSmtpTest = Boolean(existingProfile && !draft.smtpPassword && existingProfile.smtp_password_configured);
  const useSavedImapTest = Boolean(existingProfile && !draft.imapPassword && existingProfile.imap_password_configured);
  const policyMessages = useMemo(() => validateMailPolicy(effectivePolicy, {
    smtpHost: draft.smtpHost,
    imapHost: draft.imapHost
  }), [draft.imapHost, draft.smtpHost, effectivePolicy]);

  useEffect(() => {
    setSmtpTestResult(null);
    setImapTestResult(null);
    setMailActionState(null);
  }, [editing, editTarget]);

  function patchSmtpSettings(patch: Partial<MailServerSmtpSettings>) {
    setDraft({
      ...draft,
      smtpHost: patch.host !== undefined ? String(patch.host ?? "") : draft.smtpHost,
      smtpPort: patch.port !== undefined ? String(patch.port ?? "") : draft.smtpPort,
      smtpSecurity: patch.security !== undefined ? readSecurity(String(patch.security || "starttls"), "starttls") : draft.smtpSecurity,
      smtpTimeout: patch.timeout_seconds !== undefined ? String(patch.timeout_seconds ?? "") : draft.smtpTimeout
    });
  }

  function patchImapSettings(patch: Partial<MailServerImapSettings>) {
    setDraft({
      ...draft,
      imapHost: patch.host !== undefined ? String(patch.host ?? "") : draft.imapHost,
      imapPort: patch.port !== undefined ? String(patch.port ?? "") : draft.imapPort,
      imapSecurity: patch.security !== undefined ? readSecurity(String(patch.security || "tls"), "tls") : draft.imapSecurity,
      imapSentFolder: patch.sent_folder !== undefined ? String(patch.sent_folder ?? "") : draft.imapSentFolder,
      imapTimeout: patch.timeout_seconds !== undefined ? String(patch.timeout_seconds ?? "") : draft.imapTimeout
    });
  }

  function patchSmtpCredentials(patch: Partial<MailServerCredentialSettings>) {
    setDraft({
      ...draft,
      smtpUsername: patch.username !== undefined ? String(patch.username ?? "") : draft.smtpUsername,
      smtpPassword: patch.password !== undefined ? String(patch.password ?? "") : draft.smtpPassword
    });
  }

  function patchImapCredentials(patch: Partial<MailServerCredentialSettings>) {
    setDraft({
      ...draft,
      imapUsername: patch.username !== undefined ? String(patch.username ?? "") : draft.imapUsername,
      imapPassword: patch.password !== undefined ? String(patch.password ?? "") : draft.imapPassword
    });
  }

  async function runSmtpTest() {
    setMailActionState("smtp");
    setSmtpTestResult(null);
    try {
      setSmtpTestResult(useSavedSmtpTest && existingProfile ?
      await testMailProfileSmtp(settings, existingProfile.id) :
      await testSmtpSettings(settings, rawSmtpPayload(draft, false)));
    } catch (err) {
      setSmtpTestResult({ ok: false, protocol: "smtp", message: errorMessage(err), details: {} });
    } finally {
      setMailActionState(null);
    }
  }

  async function runImapTest() {
    if (!draftHasImap) return;
    setMailActionState("imap");
    setImapTestResult(null);
    try {
      setImapTestResult(useSavedImapTest && existingProfile ?
      await testMailProfileImap(settings, existingProfile.id) :
      await testImapSettings(settings, rawImapPayload(draft, false)));
    } catch (err) {
      setImapTestResult({ ok: false, protocol: "imap", message: errorMessage(err), details: {} });
    } finally {
      setMailActionState(null);
    }
  }

  return (
    <div className="mail-profile-form">
      {showProfileFields &&
      <div className="admin-form-grid two-columns">
        <FormField label="i18n:govoplan-mail.name.709a2322"><input value={draft.name} disabled={disabled} onChange={(event) => setDraft({ ...draft, name: event.target.value })} /></FormField>
        <FormField label="i18n:govoplan-mail.slug.094da9b9"><input value={draft.slug} disabled={disabled} onChange={(event) => setDraft({ ...draft, slug: event.target.value })} placeholder="i18n:govoplan-mail.generated_from_name.33d69a91" /></FormField>
        <FormField label="i18n:govoplan-mail.status.bae7d5be"><select value={draft.isActive ? "active" : "inactive"} disabled={disabled} onChange={(event) => setDraft({ ...draft, isActive: event.target.value === "active" })}><option value="active">i18n:govoplan-mail.active.a733b809</option><option value="inactive">i18n:govoplan-mail.inactive.09af574c</option></select></FormField>
        <FormField label="i18n:govoplan-mail.description.55f8ebc8"><textarea rows={3} value={draft.description} disabled={disabled} onChange={(event) => setDraft({ ...draft, description: event.target.value })} /></FormField>
      </div>
      }

      {editTarget.kind === "profile" && existingProfile &&
      <ProfileTransportSummary profile={existingProfile} />
      }

      {policyMessages.length > 0 &&
      <DismissibleAlert tone="warning" resetKey={policyMessages.map((item) => `${item.key}:${item.value}`).join("|")} dismissible={false}>
          <strong>i18n:govoplan-mail.effective_mail_policy_blocks_the_current_profile.1b555820</strong>
          <ul>{policyMessages.map((item) => <li key={`${item.key}:${item.value}`}>{item.message}</li>)}</ul>
        </DismissibleAlert>
      }

      {showSettingsPanel && settingsPanelMode &&
      <MailServerSettingsPanel
        smtp={{ host: draft.smtpHost, port: draft.smtpPort, security: draft.smtpSecurity, timeout_seconds: draft.smtpTimeout }}
        imap={{ host: draft.imapHost, port: draft.imapPort, security: draft.imapSecurity, sent_folder: draft.imapSentFolder, timeout_seconds: draft.imapTimeout }}
        smtpCredentials={{ username: draft.smtpUsername, password: draft.smtpPassword }}
        imapCredentials={{ username: draft.imapUsername, password: draft.imapPassword }}
        onSmtpChange={patchSmtpSettings}
        onImapChange={patchImapSettings}
        onSmtpCredentialsChange={patchSmtpCredentials}
        onImapCredentialsChange={patchImapCredentials}
        smtpDisabled={disabled}
        smtpCredentialDisabled={credentialDisabled}
        smtpPasswordSaved={Boolean(existingProfile?.smtp_password_configured)}
        imapServerDisabled={disabled}
        imapCredentialDisabled={credentialDisabled}
        imapPasswordSaved={Boolean(existingProfile?.imap_password_configured)}
        imapActionDisabled={disabled || !draftHasImap}
        smtpTestLabel={useSavedSmtpTest ? "i18n:govoplan-mail.test_saved_smtp.008d8054" : "i18n:govoplan-mail.test_smtp.e5697981"}
        imapTestLabel={useSavedImapTest ? "i18n:govoplan-mail.test_saved_imap.923dbe4a" : "i18n:govoplan-mail.test_imap.ef1bd79c"}
        busyAction={mailActionState}
        onTestSmtp={() => void runSmtpTest()}
        onTestImap={() => void runImapTest()}
        smtpTestResult={smtpTestResult}
        imapTestResult={imapTestResult}
        initialSection={initialSection}
        visibleSections={visibleSections}
        mode={settingsPanelMode} />
      }

    </div>);

}

function PolicyFlagControl({ value, disabled, includeInherit = true, inheritOnly = false, allowDisabled = false, onChange }: {value: PolicyFlagValue;disabled: boolean;includeInherit?: boolean;inheritOnly?: boolean;allowDisabled?: boolean;onChange: (value: PolicyFlagValue) => void;}) {
  const selectedValue = inheritOnly ? "inherit" : value;
  return (
    <select value={selectedValue} disabled={disabled} onChange={(event) => onChange(event.target.value as PolicyFlagValue)}>
      {(includeInherit || inheritOnly) && <option value="inherit">i18n:govoplan-mail.inherit.18f99833</option>}
      {!inheritOnly && <option value="allow" disabled={allowDisabled}>i18n:govoplan-mail.explicit_allow.6a7946f8</option>}
      {!inheritOnly && <option value="deny">i18n:govoplan-mail.deny.53577bb5</option>}
    </select>);

}

function CredentialInheritanceControl({ value, disabled, includeInherit = true, inheritOnly = false, onChange }: {value: CredentialInheritanceValue;disabled: boolean;includeInherit?: boolean;inheritOnly?: boolean;onChange: (value: CredentialInheritanceValue) => void;}) {
  const selectedValue = inheritOnly ? "inherit" : value;
  return (
    <select value={selectedValue} disabled={disabled} onChange={(event) => onChange(event.target.value as CredentialInheritanceValue)}>
      {(includeInherit || inheritOnly) && <option value="inherit">i18n:govoplan-mail.inherit_parent_decision.42125bda</option>}
      {!inheritOnly && <option value="profile">i18n:govoplan-mail.inherit_profile_credentials.0034bac0</option>}
      {!inheritOnly && <option value="local">i18n:govoplan-mail.require_local_credentials.da7b1d7c</option>}
    </select>);

}

function PatternTextareaControl({ value, disabled, onChange }: {value: string;disabled: boolean;onChange: (value: string) => void;}) {
  return <textarea rows={3} value={value} disabled={disabled} onChange={(event) => onChange(event.target.value)} placeholder="*.example.org" />;
}

function targetPluralLabel(scopeType: MailProfileScope, fallback: string): string {
  if (scopeType === "user") return "i18n:govoplan-mail.users";
  if (scopeType === "group") return "i18n:govoplan-mail.groups";
  if (scopeType === "campaign") return "i18n:govoplan-mail.campaigns";
  return fallback;
}

function sortMailProfiles(left: MailServerProfile, right: MailServerProfile): number {
  return scopeOrder(left.scope_type) - scopeOrder(right.scope_type) || left.name.localeCompare(right.name) || left.slug.localeCompare(right.slug);
}

function MailCredentialTreeCell({ profile, protocol }: {profile: MailServerProfile;protocol: "smtp" | "imap";}) {
  const transport = protocol === "smtp" ? profile.smtp : profile.imap;
  const username = profile.credentials?.[protocol]?.username ?? transport?.username;
  return (
    <div className="connection-tree-main">
      <strong>{protocol.toUpperCase()} credentials</strong>
      <div className="connection-tree-muted-line">
        {username || "i18n:govoplan-mail.no_username.1c182624"} · {mailCredentialConfigured(profile, protocol) ? "i18n:govoplan-mail.password_saved.f6fab237" : "i18n:govoplan-mail.no_saved_password.32ce2b16"}
      </div>
    </div>);

}

function ProfileTransportSummary({ profile }: {profile: MailServerProfile;}) {
  return (
    <div className="mail-profile-transport-summary">
      <div>
        <span>SMTP server</span>
        <strong>{transportLabel(profile.smtp)}</strong>
        <small>{mailCredentialConfigured(profile, "smtp") ? "i18n:govoplan-mail.password_saved.f6fab237" : "i18n:govoplan-mail.no_saved_password.32ce2b16"}</small>
      </div>
      <div>
        <span>IMAP server</span>
        <strong>{transportLabel(profile.imap)}</strong>
        <small>{profile.imap ? mailCredentialConfigured(profile, "imap") ? "i18n:govoplan-mail.password_saved.f6fab237" : "i18n:govoplan-mail.no_saved_password.32ce2b16" : "i18n:govoplan-mail.not_configured.811931bb"}</small>
      </div>
    </div>);

}

function MailServerTreeCell({ profile, protocol }: {profile: MailServerProfile;protocol: "smtp" | "imap";}) {
  const transport = protocol === "smtp" ? profile.smtp : profile.imap;
  return (
    <div className="connection-tree-main">
      <strong>{protocol.toUpperCase()} server</strong>
      <div className="connection-tree-muted-line">{transportLabel(transport)}</div>
    </div>);

}

function TransportCell({ profile, protocol }: {profile: MailServerProfile;protocol: "smtp" | "imap";}) {
  const transport = protocol === "smtp" ? profile.smtp : profile.imap;
  if (!transport) return <span className="muted">i18n:govoplan-mail.not_configured.811931bb</span>;
  const hasPassword = protocol === "smtp" ? profile.smtp_password_configured : profile.imap_password_configured;
  return <div><strong>{transportLabel(transport)}</strong><div className="muted small-note">i18n:govoplan-mail.password.8be3c943 {hasPassword ? "configured" : "i18n:govoplan-mail.not_configured.67f2141f"}</div></div>;
}

function transportConfigured(profile: MailServerProfile, protocol: "smtp" | "imap"): boolean {
  const transport = protocol === "smtp" ? profile.smtp : profile.imap;
  return Boolean(transport?.host);
}

function mailCredentialConfigured(profile: MailServerProfile, protocol: "smtp" | "imap"): boolean {
  return protocol === "smtp" ? profile.smtp_password_configured : profile.imap_password_configured;
}

function mailCredentialPolicySummary(policy: MailProfilePolicy | null, protocol: "smtp" | "imap"): string {
  return credentialInheritanceLabel(protocol === "smtp" ? policy?.smtp_credentials : policy?.imap_credentials);
}

function profileDialogTitle(editing: EditingProfile, target: MailProfileEditTarget): string {
  if (editing === "new") return "i18n:govoplan-mail.create_mail_profile.4d2f8f9f";
  if (target.kind === "server") return `Edit ${target.protocol.toUpperCase()} server`;
  if (target.kind === "credentials") return i18nMessage("i18n:govoplan-mail.edit_value_credentials.1e2dc4f6", { value0: target.protocol.toUpperCase() });
  return "i18n:govoplan-mail.edit_mail_profile.95d1af9c";
}

function emptyProfileDraft(): ProfileDraft {
  return {
    name: "",
    slug: "",
    description: "",
    isActive: true,
    smtpHost: "",
    smtpPort: "587",
    smtpSecurity: "starttls",
    smtpUsername: "",
    smtpPassword: "",
    smtpTimeout: "30",
    imapHost: "",
    imapPort: "993",
    imapSecurity: "tls",
    imapUsername: "",
    imapPassword: "",
    imapSentFolder: "auto",
    imapTimeout: "30"
  };
}

function profileDraftKey(draft: ProfileDraft): string {
  return JSON.stringify(draft);
}

function profileToDraft(profile: MailServerProfile): ProfileDraft {
  return {
    name: profile.name,
    slug: profile.slug,
    description: profile.description || "",
    isActive: profile.is_active,
    smtpHost: stringValue(profile.smtp.host),
    smtpPort: stringValue(profile.smtp.port ?? 587),
    smtpSecurity: readSecurity(String(profile.smtp.security || "starttls"), "starttls"),
    smtpUsername: stringValue(profile.credentials?.smtp?.username ?? profile.smtp.username),
    smtpPassword: "",
    smtpTimeout: stringValue(profile.smtp.timeout_seconds ?? 30),
    imapHost: stringValue(profile.imap?.host),
    imapPort: stringValue(profile.imap?.port ?? 993),
    imapSecurity: readSecurity(String(profile.imap?.security || "tls"), "tls"),
    imapUsername: stringValue(profile.credentials?.imap?.username ?? profile.imap?.username),
    imapPassword: "",
    imapSentFolder: stringValue(profile.imap?.sent_folder || "auto"),
    imapTimeout: stringValue(profile.imap?.timeout_seconds ?? 30)
  };
}

function createProfilePayload(draft: ProfileDraft, scopeType: MailProfileScope, scopeId: string | null): MailServerProfilePayload {
  return {
    name: draft.name.trim(),
    slug: mailTextOrNull(draft.slug),
    description: mailTextOrNull(draft.description),
    is_active: draft.isActive,
    scope_type: scopeType,
    scope_id: scopeId,
    smtp: smtpServerPayload(draft),
    imap: hasDraftImapSettings(draft) ? imapServerPayload(draft) : null,
    credentials: profileCredentialsPayload(draft, false)
  };
}

function updateProfilePayload(draft: ProfileDraft, profile: MailServerProfile): MailServerProfileUpdatePayload {
  return {
    name: draft.name.trim(),
    slug: mailTextOrNull(draft.slug),
    description: draft.description.trim(),
    is_active: draft.isActive,
    smtp: smtpServerPayload(draft),
    imap: hasDraftImapSettings(draft) ? imapServerPayload(draft) : null,
    credentials: profileCredentialsPayload(draft, true),
    clear_imap: !hasDraftImapSettings(draft) && Boolean(profile.imap)
  };
}

function smtpServerPayload(draft: ProfileDraft): MailSmtpTestPayload {
  return mailSmtpSettingsPayload<MailSecurity>(
    { host: draft.smtpHost, port: draft.smtpPort, security: draft.smtpSecurity, timeout_seconds: draft.smtpTimeout },
    { fallbackSecurity: "starttls", allowedSecurity: securityOptions }
  );
}

function imapServerPayload(draft: ProfileDraft): MailImapTestPayload {
  return mailImapSettingsPayload<MailSecurity>(
    { host: draft.imapHost, port: draft.imapPort, security: draft.imapSecurity, sent_folder: draft.imapSentFolder, timeout_seconds: draft.imapTimeout },
    { fallbackSecurity: "tls", allowedSecurity: securityOptions }
  );
}

function profileCredentialsPayload(draft: ProfileDraft, preserveBlankPassword: boolean) {
  return {
    smtp: mailTransportCredentialsPayload(draft.smtpUsername, draft.smtpPassword, preserveBlankPassword),
    imap: mailTransportCredentialsPayload(draft.imapUsername, draft.imapPassword, preserveBlankPassword)
  };
}

function rawSmtpPayload(draft: ProfileDraft, preserveBlankPassword: boolean): MailSmtpTestPayload {
  return { ...smtpServerPayload(draft), ...mailTransportCredentialsPayload(draft.smtpUsername, draft.smtpPassword, preserveBlankPassword) };
}

function rawImapPayload(draft: ProfileDraft, preserveBlankPassword: boolean): MailImapTestPayload {
  return { ...imapServerPayload(draft), ...mailTransportCredentialsPayload(draft.imapUsername, draft.imapPassword, preserveBlankPassword) };
}

function hasDraftImapSettings(draft: ProfileDraft): boolean {
  return hasMailImapSettings([draft.imapHost]);
}

function normalizePolicy(value: MailProfilePolicy | null | undefined): MailProfilePolicy {
  return {
    allowed_profile_ids: [...(value?.allowed_profile_ids ?? [])].filter(Boolean),
    allow_user_profiles: value?.allow_user_profiles ?? null,
    allow_group_profiles: value?.allow_group_profiles ?? null,
    allow_campaign_profiles: value?.allow_campaign_profiles ?? null,
    smtp_credentials: normalizeCredentialPolicy(value?.smtp_credentials),
    imap_credentials: normalizeCredentialPolicy(value?.imap_credentials),
    whitelist: normalizeRules(value?.whitelist),
    blacklist: normalizeRules(value?.blacklist),
    allow_lower_level_limits: normalizeMailLowerLevelLimits(value?.allow_lower_level_limits)
  };
}

function policyDraftKey(policy: MailProfilePolicy): string {
  return JSON.stringify(normalizePolicy(policy));
}

function normalizePolicyForSave(policy: MailProfilePolicy, parentPolicy: MailProfilePolicy | null, scopeType: MailProfileScope): MailProfilePolicy {
  const normalized = normalizePolicy(policy);
  if (scopeType === "system") return concreteSystemPolicy(normalized);
  const localLimits = { ...(normalized.allow_lower_level_limits ?? {}) };
  const parentLimits = parentPolicy?.allow_lower_level_limits ?? null;

  function parentAllows(key: MailProfilePolicyLimitKey): boolean {
    return !parentLimits || parentLimits[key] !== false;
  }

  function clearLimit(key: MailProfilePolicyLimitKey) {
    delete localLimits[key];
  }

  if (!parentAllows("allowed_profile_ids")) {
    normalized.allowed_profile_ids = [];
    clearLimit("allowed_profile_ids");
  }
  for (const key of ["allow_user_profiles", "allow_group_profiles", "allow_campaign_profiles"] as const) {
    if (!parentAllows(key)) {
      normalized[key] = null;
      clearLimit(key);
    }
  }
  for (const protocol of ["smtp_credentials", "imap_credentials"] as const) {
    const credential = normalizeCredentialPolicy(normalized[protocol]);
    const inheritKey = `${protocol}.inherit` as MailProfilePolicyLimitKey;
    if (!parentAllows(inheritKey)) {
      credential.inherit = null;
      clearLimit(inheritKey);
    }
    normalized[protocol] = credential;
  }
  for (const key of mailProfilePatternKeys) {
    const whitelistKey = `whitelist.${key}` as MailProfilePolicyLimitKey;
    const blacklistKey = `blacklist.${key}` as MailProfilePolicyLimitKey;
    if (!parentAllows(whitelistKey)) {
      delete normalized.whitelist?.[key];
      clearLimit(whitelistKey);
    }
    if (!parentAllows(blacklistKey)) {
      delete normalized.blacklist?.[key];
      clearLimit(blacklistKey);
    }
  }
  if (scopeType === "campaign") {
    normalized.allow_lower_level_limits = {};
  } else {
    normalized.allow_lower_level_limits = localLimits;
  }
  return normalized;
}

function normalizeMailLowerLevelLimits(value: MailProfilePolicy["allow_lower_level_limits"]): Partial<Record<MailProfilePolicyLimitKey, boolean>> {
  const result: Partial<Record<MailProfilePolicyLimitKey, boolean>> = {};
  for (const key of mailProfilePolicyLimitKeys) {
    if (typeof value?.[key] === "boolean") result[key] = value[key];
  }
  return result;
}

function fullMailLowerLevelLimits(value: MailProfilePolicy["allow_lower_level_limits"]): Record<MailProfilePolicyLimitKey, boolean> {
  const result = {} as Record<MailProfilePolicyLimitKey, boolean>;
  for (const key of mailProfilePolicyLimitKeys) {
    result[key] = value?.[key] !== false;
  }
  return result;
}

function concreteSystemPolicy(policy: MailProfilePolicy): MailProfilePolicy {
  const normalized = normalizePolicy(policy);
  return {
    ...normalized,
    allow_user_profiles: normalized.allow_user_profiles ?? true,
    allow_group_profiles: normalized.allow_group_profiles ?? true,
    allow_campaign_profiles: normalized.allow_campaign_profiles ?? true,
    smtp_credentials: concreteSystemCredentialPolicy(normalized.smtp_credentials),
    imap_credentials: concreteSystemCredentialPolicy(normalized.imap_credentials),
    allow_lower_level_limits: fullMailLowerLevelLimits(normalized.allow_lower_level_limits)
  };
}

function concreteSystemCredentialPolicy(value: MailCredentialPolicy | null | undefined): MailCredentialPolicy {
  const normalized = normalizeCredentialPolicy(value);
  return { inherit: normalized.inherit ?? true };
}

function normalizeCredentialPolicy(value: MailCredentialPolicy | null | undefined): MailCredentialPolicy {
  return { inherit: typeof value?.inherit === "boolean" ? value.inherit : null };
}

function normalizeRules(value: MailProfilePatternRules | null | undefined): MailProfilePatternRules {
  const result: MailProfilePatternRules = {};
  for (const key of mailProfilePatternKeys) {
    const patterns = (value?.[key] ?? []).map((pattern) => pattern.trim()).filter(Boolean);
    if (patterns.length > 0) result[key] = patterns;
  }
  return result;
}

function profileBelongsToEditableScope(profile: MailServerProfile, scopeType: MailProfileScope, scopeId: string | null): boolean {
  if (profile.scope_type !== scopeType) return false;
  if (scopeType === "system") return true;
  if (scopeType === "tenant") return true;
  return Boolean(scopeId) && profile.scope_id === scopeId;
}

function profileCandidatesForPolicy(profiles: MailServerProfile[], scopeType: MailProfileScope, scopeId: string | null, ownerUserId: string | null, ownerGroupId: string | null): MailServerProfile[] {
  return profiles.
  filter((profile) => {
    if (scopeType === "system") return profile.scope_type === "system";
    if (profile.scope_type === "system" || profile.scope_type === "tenant") return true;
    if (scopeType === "user") return profile.scope_type === "user" && profile.scope_id === scopeId;
    if (scopeType === "group") return profile.scope_type === "group" && profile.scope_id === scopeId;
    if (scopeType === "campaign") {
      if (profile.scope_type === "campaign") return profile.scope_id === scopeId;
      if (profile.scope_type === "user") return Boolean(ownerUserId) && profile.scope_id === ownerUserId;
      if (profile.scope_type === "group") return Boolean(ownerGroupId) && profile.scope_id === ownerGroupId;
    }
    return false;
  }).
  sort((a, b) => `${scopeOrder(a.scope_type)}:${a.name}`.localeCompare(`${scopeOrder(b.scope_type)}:${b.name}`));
}

function scopeOrder(scopeType: MailProfileScope): number {
  if (scopeType === "system") return 0;
  if (scopeType === "tenant") return 1;
  if (scopeType === "user" || scopeType === "group") return 2;
  return 3;
}

function credentialInheritanceToValue(value: boolean | null | undefined): CredentialInheritanceValue {
  if (value === true) return "profile";
  if (value === false) return "local";
  return "inherit";
}

function valueToCredentialInheritance(value: CredentialInheritanceValue): boolean | null {
  if (value === "profile") return true;
  if (value === "local") return false;
  return null;
}

function policyHelp(description: string): ReactNode {
  return <span>{description}</span>;
}

function mailBooleanPolicyPathHelp(key: "allow_user_profiles" | "allow_group_profiles" | "allow_campaign_profiles", sources: PolicySourcePathItem[]): ReactNode {
  return <PolicyPathHelp lines={mailBooleanPolicyPathLines(key, normalizePolicySourcePathItems(sources))} />;
}

function mailCredentialPolicyPathHelp(protocol: "smtp_credentials" | "imap_credentials", sources: PolicySourcePathItem[]): ReactNode {
  return <PolicyPathHelp lines={mailCredentialPolicyPathLines(protocol, normalizePolicySourcePathItems(sources))} />;
}

function mailBooleanPolicyPathLines(key: "allow_user_profiles" | "allow_group_profiles" | "allow_campaign_profiles", items: NormalizedPolicySourcePathItem[]): string[] {
  if (items.length === 0) return ["i18n:govoplan-mail.system_allow.ed6744b1"];
  const lines: string[] = [];
  for (const [index, item] of items.entries()) {
    const policy = policySourceRecord(item);
    const rawValue = policy[key];
    const value = rawValue === true ? "i18n:govoplan-mail.allow.3ad0e369" : rawValue === false ? "i18n:govoplan-mail.deny.53577bb5" : "i18n:govoplan-mail.inherit.18f99833";
    const lowerLocked = asRecord(policy.allow_lower_level_limits)[key] === false;
    const stops = rawValue === false || lowerLocked;
    lines.push(`${policyPathPrefix(index)}${item.label}: ${stops ? `${value} without override` : value}`);
    if (stops) break;
  }
  return lines;
}

function mailCredentialPolicyPathLines(protocol: "smtp_credentials" | "imap_credentials", items: NormalizedPolicySourcePathItem[]): string[] {
  if (items.length === 0) return ["i18n:govoplan-mail.system_profile_inherited.f4b8b5ce"];
  const lines: string[] = [];
  for (const [index, item] of items.entries()) {
    const policy = policySourceRecord(item);
    const credential = asRecord(policy[protocol]);
    const rawValue = credential.inherit;
    const value = rawValue === false ? "i18n:govoplan-mail.local_required.1f5f4aba" : rawValue === true ? "i18n:govoplan-mail.profile_inherited.ea25d2e1" : "i18n:govoplan-mail.inherit.18f99833";
    const lowerLocked = asRecord(policy.allow_lower_level_limits)[`${protocol}.inherit`] === false;
    lines.push(`${policyPathPrefix(index)}${item.label}: ${lowerLocked ? `${value} without override` : value}`);
    if (lowerLocked) break;
  }
  return lines;
}

function policySourceRecord(item: NormalizedPolicySourcePathItem): Record<string, unknown> {
  return asRecord(item.policy);
}

function asRecord(value: unknown): Record<string, unknown> {
  return value && typeof value === "object" && !Array.isArray(value) ? value as Record<string, unknown> : {};
}

function policyPathPrefix(index: number): string {
  return index === 0 ? "" : `${"  ".repeat(index - 1)}> `;
}

function effectiveBooleanLabel(value: boolean | null | undefined, policy: MailProfilePolicy | null): string {
  if (!policy) return "i18n:govoplan-mail.loading.b04ba49f";
  return value ? "i18n:govoplan-mail.allowed.77c7b490" : "i18n:govoplan-mail.blocked.99613c74";
}

function credentialInheritanceLabel(value: MailCredentialPolicy | null | undefined): string {
  return value?.inherit === false ? "i18n:govoplan-mail.local_required.1f5f4aba" : "i18n:govoplan-mail.profile_inherited.ea25d2e1";
}

function patternPolicyNote(key: MailProfilePatternKey): string {
  if (key === "smtp_hosts") return "i18n:govoplan-mail.smtp_server_host_patterns.cf6120c3";
  if (key === "imap_hosts") return "i18n:govoplan-mail.imap_server_host_patterns.52b20b83";
  if (key === "envelope_senders") return "i18n:govoplan-mail.smtp_envelope_sender_patterns.8c1fd95e";
  if (key === "from_headers") return "i18n:govoplan-mail.visible_from_header_patterns.ea77d99d";
  return "i18n:govoplan-mail.recipient_domain_patterns.68466f5b";
}

function booleanToFlag(value: boolean | null | undefined): PolicyFlagValue {
  if (value === true) return "allow";
  if (value === false) return "deny";
  return "inherit";
}

function flagToBoolean(value: PolicyFlagValue): boolean | null {
  if (value === "allow") return true;
  if (value === "deny") return false;
  return null;
}

function parsePatternList(value: string): string[] {
  const seen = new Set<string>();
  const result: string[] = [];
  for (const item of value.split(/[\n,]+/)) {
    const pattern = item.trim();
    if (pattern && !seen.has(pattern)) {
      seen.add(pattern);
      result.push(pattern);
    }
  }
  return result;
}

function patternsToText(value: string[] | undefined): string {
  return (value ?? []).join("\n");
}

function effectiveProfileLabel(value: string[] | null | undefined): string {
  if (!value || value.length === 0) return "i18n:govoplan-mail.no_explicit_intersection.f2d62c71";
  return i18nMessage("i18n:govoplan-mail.value_profile_s.d6b9d0af", { value0: value.length });
}

function mailPolicySourcePath(scopeType: MailProfileScope): string[] {
  if (scopeType === "system") return ["i18n:govoplan-mail.system.bc0792d8"];
  if (scopeType === "tenant") return ["i18n:govoplan-mail.system.bc0792d8", "i18n:govoplan-mail.tenant.3ca93c78"];
  if (scopeType === "user") return ["i18n:govoplan-mail.system.bc0792d8", "i18n:govoplan-mail.tenant.3ca93c78", "i18n:govoplan-mail.user.9f8a2389"];
  if (scopeType === "group") return ["i18n:govoplan-mail.system.bc0792d8", "i18n:govoplan-mail.tenant.3ca93c78", "i18n:govoplan-mail.group.171a0606"];
  return ["i18n:govoplan-mail.system.bc0792d8", "i18n:govoplan-mail.tenant.3ca93c78", "i18n:govoplan-mail.owner_policy.1e8df143", "i18n:govoplan-mail.campaign.69390e16"];
}

function transportLabel(transport: MailSmtpTestPayload | MailImapTestPayload | null | undefined): string {
  if (!transport) return "i18n:govoplan-mail.not_configured.811931bb";
  const host = transport.host || "i18n:govoplan-mail.no_host.4c710d7d";
  const port = transport.port ? `:${transport.port}` : "";
  return `${host}${port}`;
}

function scopeLabel(profile: MailServerProfile): string {
  if (profile.scope_type === "system") return "i18n:govoplan-mail.system.bc0792d8";
  if (profile.scope_type === "tenant") return "i18n:govoplan-mail.tenant.3ca93c78";
  if (profile.scope_type === "user") return "i18n:govoplan-mail.user.9f8a2389";
  if (profile.scope_type === "group") return "i18n:govoplan-mail.group.171a0606";
  return "i18n:govoplan-mail.campaign.69390e16";
}

function readSecurity(value: string, fallback: MailSecurity): MailSecurity {
  return normalizeMailServerSecurity<MailSecurity>(value, { fallback, allowedSecurity: securityOptions });
}

function stringValue(value: unknown): string {
  if (value === null || value === undefined) return "";
  return String(value);
}

function errorMessage(err: unknown): string {
  return err instanceof Error ? err.message : String(err);
}
