app.py

"""
PhishGuard - AI-Powered Adaptive Phishing Defense
Streamlit Dashboard for Gmail Email Analysis and Phishing Detection
"""

import streamlit as st
from datetime import datetime, timedelta
import re
import time
from typing import Dict, List, Optional
from gmail_client import GmailClient
from parser_heuristics import EmailParser, PhishingHeuristics
from gemini_engine import analyze_email, is_mock_mode, set_mock_mode
from policy import map_score_to_label, merge_heuristic_and_ai_scores
from crypto_simple import load_encrypted
from signing import verify_analysis, sign_analysis
from storage import insert_analysis, load_analyses, count_analyses, mark_signature_as_valid

# Page configuration
st.set_page_config(
    page_title="PhishGuard - Email Security",
    page_icon="🛡️",
    layout="wide",
    initial_sidebar_state="expanded"
)

# Custom CSS - Clean Dark Theme
st.markdown("""
<style>
    /* Dark theme base */
    .stApp {
        background-color: #0e1117;
    }
    
    .main {
        background-color: #0e1117;
    }
    
    .block-container {
        padding: 2rem 3rem;
        max-width: 100%;
    }
    
    /* Top bar / Header - Make it dark */
    header[data-testid="stHeader"] {
        background-color: #0e1117 !important;
    }
    
    /* Toolbar */
    [data-testid="stToolbar"] {
        background-color: #0e1117 !important;
    }
    
    /* Sidebar dark theme */
    [data-testid="stSidebar"] {
        background-color: #1a1d24;
        border-right: 1px solid #2d3139;
    }
    
    [data-testid="stSidebar"] h2, 
    [data-testid="stSidebar"] h3,
    [data-testid="stSidebar"] p,
    [data-testid="stSidebar"] label,
    [data-testid="stSidebar"] .stMarkdown {
        color: #e8e8e8 !important;
    }
    
    /* Main content text */
    h1, h2, h3, h4, h5, h6 {
        color: #ffffff !important;
        font-weight: 600 !important;
    }
    
    p, span, label, div {
        color: #c9d1d9 !important;
    }
    
    /* Buttons - Sidebar only green */
    [data-testid="stSidebar"] .stButton>button {
        background-color: #238636;
        color: #ffffff !important;
        border: 1px solid #2ea043;
        border-radius: 6px;
        padding: 0.5rem 1rem;
        font-weight: 600;
        transition: all 0.2s;
    }
    
    [data-testid="stSidebar"] .stButton>button:hover {
        background-color: #2ea043;
        border-color: #3fb950;
    }
    
    /* Override ALL main area buttons to dark theme */
    .main .stButton>button,
    .main button,
    button[kind="secondary"],
    button[kind="primary"] {
        background-color: #21262d !important;
        color: #c9d1d9 !important;
        border: 1px solid #30363d !important;
    }
    
    .main .stButton>button:hover,
    .main button:hover {
        background-color: #30363d !important;
    }
    
    /* Email list buttons - Force dark theme, no green */
    div[data-testid="column"]:first-child button,
    div[data-testid="column"]:first-child button[kind="secondary"],
    div[data-testid="column"]:first-child button[kind="primary"],
    div[data-testid="column"]:first-child div[data-testid="column"] button {
        background: #21262d !important;
        color: #e8e8e8 !important;
        border: 1px solid #30363d !important;
        border-radius: 8px !important;
        padding: 1rem !important;
        text-align: left !important;
        margin-bottom: 0.6rem !important;
        transition: all 0.2s ease !important;
        width: 100% !important;
        box-shadow: none !important;
        border-left: 3px solid #30363d !important;
    }
    
    div[data-testid="column"]:first-child button:hover,
    div[data-testid="column"]:first-child button[kind="secondary"]:hover,
    div[data-testid="column"]:first-child div[data-testid="column"] button:hover {
        background: #30363d !important;
        border-left-color: #58a6ff !important;
        transform: translateX(3px) !important;
        box-shadow: 0 2px 8px rgba(88, 166, 255, 0.15) !important;
    }
    
    div[data-testid="column"]:first-child button[kind="primary"] {
        background: #0d1117 !important;
        border-color: #58a6ff !important;
        border-left: 4px solid #58a6ff !important;
        box-shadow: 0 2px 8px rgba(88, 166, 255, 0.2) !important;
    }
    
    div[data-testid="column"]:first-child button p,
    div[data-testid="column"]:first-child div[data-testid="column"] button p {
        color: #e8e8e8 !important;
        margin: 0.25rem 0 !important;
        font-size: 14px !important;
        line-height: 1.4 !important;
    }
    
    div[data-testid="column"]:first-child button p strong {
        font-weight: 600 !important;
        font-size: 15px !important;
        color: #ffffff !important;
    }
    
    /* Metrics */
    [data-testid="stMetricValue"] {
        color: #58a6ff !important;
        font-size: 1.8rem !important;
        font-weight: 700 !important;
    }
    
    [data-testid="stMetricLabel"] {
        color: #8b949e !important;
    }
    
    /* Text input and text area */
    textarea, input {
        background-color: #0d1117 !important;
        color: #c9d1d9 !important;
        border: 1px solid #30363d !important;
        border-radius: 6px !important;
    }
    
    /* Code blocks */
    code {
        background-color: #161b22 !important;
        color: #79c0ff !important;
        padding: 0.2rem 0.4rem !important;
        border-radius: 4px !important;
        border: 1px solid #30363d !important;
    }
    
    pre {
        background-color: #161b22 !important;
        border: 1px solid #30363d !important;
        border-radius: 6px !important;
    }
    
    /* Info/warning boxes */
    .stAlert {
        background-color: #21262d !important;
        color: #c9d1d9 !important;
        border: 1px solid #30363d !important;
        border-radius: 6px !important;
    }
    
    /* Divider */
    hr {
        border-color: #21262d !important;
        margin: 1rem 0 !important;
    }
    
    /* Toggle switch */
    .stCheckbox label {
        color: #c9d1d9 !important;
    }
    
    /* Slider */
    .stSlider label {
        color: #c9d1d9 !important;
    }
    
    /* Severity badges */
    .badge {
        display: inline-block;
        padding: 0.25rem 0.75rem;
        border-radius: 12px;
        font-size: 12px;
        font-weight: 600;
        margin-right: 0.5rem;
    }
    
    .badge-safe {
        background-color: #1a7f37;
        color: #ffffff;
    }
    
    .badge-review {
        background-color: #9e6a03;
        color: #ffffff;
    }
    
    .badge-high {
        background-color: #da3633;
        color: #ffffff;
    }
    
    /* Stats card */
    .stats-card {
        background-color: #161b22;
        border: 1px solid #30363d;
        border-radius: 8px;
        padding: 1rem;
        margin: 0.5rem 0;
    }
    
    /* Indicator card */
    .indicator-card {
        background-color: #21262d;
        border-left: 3px solid #58a6ff;
        padding: 0.75rem;
        margin: 0.5rem 0;
        border-radius: 4px;
        color: #c9d1d9 !important;
    }
    
    /* Email detail card */
    .detail-card {
        background-color: #161b22;
        border: 1px solid #30363d;
        border-radius: 8px;
        padding: 1.5rem;
        margin: 1rem 0;
    }
    
    /* Header card */
    .header-card {
        background-color: #161b22;
        border: 1px solid #30363d;
        border-radius: 8px;
        padding: 1rem 1.5rem;
        margin-bottom: 1.5rem;
    }
</style>
""", unsafe_allow_html=True)

# Initialize session state for caching
if 'emails' not in st.session_state:
    st.session_state.emails = []
if 'selected_email_id' not in st.session_state:
    st.session_state.selected_email_id = None
if 'gmail_client' not in st.session_state:
    st.session_state.gmail_client = None
if 'scanning_complete' not in st.session_state:
    st.session_state.scanning_complete = False
if 'auto_refresh_enabled' not in st.session_state:
    st.session_state.auto_refresh_enabled = False
if 'last_refresh_time' not in st.session_state:
    st.session_state.last_refresh_time = None
if 'refresh_interval' not in st.session_state:
    st.session_state.refresh_interval = 30
if 'last_fetch_count' not in st.session_state:
    st.session_state.last_fetch_count = 30
if 'secrets' not in st.session_state:
    st.session_state.secrets = None
if 'secrets_loaded' not in st.session_state:
    st.session_state.secrets_loaded = False
if 'app_start_time' not in st.session_state:
    st.session_state.app_start_time = datetime.now()
if 'mongo_enabled' not in st.session_state:
    st.session_state.mongo_enabled = False

def initialize_gmail_client():
    """
    Initialize Gmail API client
    Handles authentication and creates client instance
    """
    try:
        if st.session_state.gmail_client is None:
            with st.spinner('🔐 Authenticating with Gmail API...'):
                st.session_state.gmail_client = GmailClient()
        return True
    except Exception as e:
        st.error(f"❌ Authentication failed: {str(e)}")
        st.info("📝 Make sure Gmail_Credentials.json is in the project root and complete the OAuth flow.")
        return False

def fetch_and_scan_emails(max_results=30, is_auto_refresh=False):
    """
    Fetch emails from Gmail and scan for phishing indicators
    Accumulates new emails instead of replacing existing ones
    
    Args:
        max_results: Number of recent emails to fetch
        is_auto_refresh: If True, only adds new emails not already in the list
    """
    if not st.session_state.gmail_client:
        st.error("Gmail client not initialized")
        return
    
    with st.spinner(f'📧 Fetching {max_results} recent emails...'):
        # Fetch email list
        email_list = st.session_state.gmail_client.list_recent(max_results=max_results)
        
        if not email_list:
            st.warning("No emails found in inbox")
            return
        
        # Get existing email IDs to avoid duplicates
        existing_ids = {email['id'] for email in st.session_state.emails}
        
        # Filter out emails we already have
        new_emails = [email for email in email_list if email['id'] not in existing_ids]
        
        if not new_emails:
            if is_auto_refresh:
                status_text = st.empty()
                status_text.info("✓ No new emails")
                time.sleep(1)
                status_text.empty()
            else:
                st.info("All fetched emails are already in the list")
            return
        
        # Show AI mode
        mode_status = "🤖 Mock AI" if is_mock_mode() else "🤖 Live AI (Gemini)"
        st.info(f"Found {len(new_emails)} new emails. Analyzing with {mode_status}...")
        
        # Progress bar for scanning
        progress_bar = st.progress(0)
        status_text = st.empty()
        
        scanned_emails = []
        
        for idx, email_meta in enumerate(new_emails):
            # Update progress
            progress = (idx + 1) / len(new_emails)
            progress_bar.progress(progress)
            status_text.text(f"Scanning email {idx + 1}/{len(new_emails)}: {email_meta['subject'][:50]}...")
            
            # Fetch full raw email
            raw_bytes = st.session_state.gmail_client.get_raw(email_meta['id'])
            
            if raw_bytes:
                # Parse email
                parsed = EmailParser.parse_raw(raw_bytes)
                
                # Run heuristic analysis
                heuristics = PhishingHeuristics.extract_indicators(parsed)
                
                # Run AI analysis with error handling
                try:
                    ai_result = analyze_email(parsed, heuristics['indicators'])
                    
                    # Check if API failed and fell back to mock
                    if ai_result.get('error') or ai_result.get('fallback'):
                        if not is_mock_mode():  # Only show error if we expected live mode
                            st.warning(f"⚠️ Gemini API error: {ai_result.get('error', 'Unknown error')}. Using mock mode.")
                except Exception as e:
                    st.error(f"❌ AI Analysis failed: {str(e)}")
                    # Create fallback result
                    ai_result = {
                        'risk_score': heuristics['risk_score'] * 10,
                        'intents': ['unknown'],
                        'indicators': [],
                        'safe_summary': 'AI analysis unavailable',
                        'recommendations': ['Manual review required'],
                        'processed_at': datetime.now().isoformat(),
                        'mock_mode': True,
                        'error': str(e)
                    }
                
                # Merge scores: heuristic (0-10) to (0-100) + AI (0-100)
                heuristic_score_normalized = heuristics['risk_score'] * 10
                final_score = merge_heuristic_and_ai_scores(
                    heuristic_score=heuristic_score_normalized,
                    ai_score=ai_result['risk_score'],
                    ai_weight=0.7  # 70% AI, 30% heuristics
                )
                
                # Map to policy category
                policy = map_score_to_label(final_score)
                
                # Combine metadata with analysis
                email_data = {
                    **email_meta,
                    'parsed': parsed,
                    'heuristics': heuristics,
                    'ai_analysis': ai_result,
                    'policy': policy,
                    'final_risk_score': final_score
                }
                
                scanned_emails.append(email_data)
                
                # Save to MongoDB (M4) - non-blocking
                save_analysis_to_mongo(email_data)
        
        # Clear progress indicators
        progress_bar.empty()
        status_text.empty()
        
        # ACCUMULATE emails: prepend new emails to existing list (newest first)
        st.session_state.emails = scanned_emails + st.session_state.emails
        st.session_state.scanning_complete = True
        
        # Show summary
        ai_high_risk = sum(1 for e in scanned_emails if e['policy']['category'] == 'HIGH_RISK')
        if is_auto_refresh:
            st.success(f"✅ Auto-refresh: Added {len(scanned_emails)} new email(s). {ai_high_risk} high-risk. Total: {len(st.session_state.emails)}")
        else:
            st.success(f"✅ Analysis complete. Analyzed {len(scanned_emails)} new emails. {ai_high_risk} high-risk. Total: {len(st.session_state.emails)}")

def format_date(date_str):
    """
    Format email date for display
    
    Args:
        date_str: Raw date string from email
        
    Returns:
        Formatted date string
    """
    try:
        # Try to parse and format date
        if date_str:
            # Simple display of first part before timezone info
            return date_str.split('(')[0].strip()
        return "Unknown Date"
    except:
        return date_str[:50] if date_str else "Unknown Date"

def generate_analysis_json(email_data):
    """
    Generate standardized analysis JSON for M3 handoff
    
    Args:
        email_data: Complete email data dict with AI analysis
        
    Returns:
        dict: Standardized analysis JSON
    """
    ai_analysis = email_data.get('ai_analysis', {})
    heuristics = email_data.get('heuristics', {})
    policy = email_data.get('policy', {})
    
    return {
        "email_id": email_data.get('id'),
        "metadata": {
            "subject": email_data.get('subject'),
            "from": email_data.get('sender'),
            "date": email_data.get('date'),
            "has_attachments": len(email_data.get('parsed', {}).get('attachments', [])) > 0,
            "attachment_count": len(email_data.get('parsed', {}).get('attachments', []))
        },
        "analysis": {
            "final_risk_score": email_data.get('final_risk_score', 0),
            "ai_risk_score": ai_analysis.get('risk_score', 0),
            "heuristic_risk_score": heuristics.get('risk_score', 0) * 10,
            "category": policy.get('category', 'UNKNOWN'),
            "gmail_label": policy.get('label', ''),
            "severity_level": policy.get('severity_level', 2)
        },
        "ai_insights": {
            "intents": ai_analysis.get('intents', []),
            "indicators": ai_analysis.get('indicators', []),
            "safe_summary": ai_analysis.get('safe_summary', ''),
            "recommendations": ai_analysis.get('recommendations', []),
            "processed_at": ai_analysis.get('processed_at', '')
        },
        "heuristic_findings": {
            "indicators": heuristics.get('indicators', []),
            "urgency_found": heuristics.get('urgency_found', False),
            "credential_found": heuristics.get('credential_found', False),
            "severity": heuristics.get('severity', 'unknown')
        },
        "parsed_content": {
            "links_count": len(email_data.get('parsed', {}).get('all_links', [])),
            "has_html": email_data.get('parsed', {}).get('body_html') is not None,
            "body_length": len(email_data.get('parsed', {}).get('body_text', ''))
        },
        "timestamp": ai_analysis.get('processed_at', datetime.now().isoformat())
    }

def save_analysis_to_mongo(email_data):
    """
    Save signed analysis to MongoDB (M4 integration)
    
    Args:
        email_data: Complete email data dict with AI analysis
        
    Returns:
        bool: True if saved successfully, False otherwise
    """
    # Check if secrets are loaded
    if not st.session_state.secrets_loaded or not st.session_state.secrets:
        return False
    
    try:
        # Get MongoDB URI and signing secret from decrypted secrets
        mongo_uri = st.session_state.secrets.get('MONGO_URI')
        signing_secret = st.session_state.secrets.get('SIGNING_SECRET')
        
        if not mongo_uri or not signing_secret:
            return False
        
        # Convert signing secret to bytes if needed
        if isinstance(signing_secret, str):
            signing_secret = signing_secret.encode('utf-8')
        
        # Prepare analysis document
        current_time = datetime.now()
        analysis_doc = {
            'gmail_id': email_data.get('id'),
            'sender': email_data.get('sender'),
            'subject': email_data.get('subject'),
            'date': email_data.get('date'),
            'risk_score': email_data.get('final_risk_score', 0),
            'risk_label': email_data.get('policy', {}).get('category', 'UNKNOWN'),
            'ai_risk_score': email_data.get('ai_analysis', {}).get('risk_score', 0),
            'heuristic_risk_score': email_data.get('heuristics', {}).get('risk_score', 0) * 10,
            'intents': email_data.get('ai_analysis', {}).get('intents', []),
            'indicators': email_data.get('heuristics', {}).get('indicators', []),
            'ai_summary': email_data.get('ai_analysis', {}).get('safe_summary', ''),
            'recommendations': email_data.get('ai_analysis', {}).get('recommendations', []),
            'processed_at': current_time.isoformat(),  # Convert to ISO string for JSON serialization
            'mock_mode': email_data.get('ai_analysis', {}).get('mock_mode', False)
        }
        
        # Sign the analysis
        from signing import sign
        signature = sign(analysis_doc, signing_secret)
        analysis_doc['signature'] = signature
        
        # Convert processed_at back to datetime for MongoDB
        analysis_doc['processed_at'] = current_time
        
        # Insert into MongoDB
        success = insert_analysis(
            analysis_doc,
            st.session_state.app_start_time,
            mongo_uri,
            signing_secret
        )
        
        if success:
            print(f"✅ Saved to MongoDB: {email_data.get('subject')[:50]}")
        else:
            print(f"⚠️ MongoDB save failed for: {email_data.get('subject')[:50]}")
        
        return success
        
    except Exception as e:
        # Log error but don't disrupt main flow
        print(f"❌ MongoDB save error: {str(e)}")
        import traceback
        traceback.print_exc()
        return False

def extract_sender_name(from_field):
    """
    Extract clean sender name from From field
    
    Args:
        from_field: Raw From header (e.g., "John Doe <john@example.com>")
        
    Returns:
        Clean sender name or email
    """
    match = re.match(r'^([^<]+)<(.+)>$', from_field)
    if match:
        name = match.group(1).strip().strip('"')
        return name if name else match.group(2)
    return from_field

def get_label_for_display(category: str) -> Dict:
    """
    Get display properties for a category
    
    Args:
        category: "SAFE", "REVIEW", or "HIGH_RISK"
        
    Returns:
        Dictionary with display properties
    """
    display_map = {
        "SAFE": {
            "text": "Safe",
            "badge_class": "badge-safe",
            "emoji": "✅",
            "color": "#1a7f37"
        },
        "REVIEW": {
            "text": "Review",
            "badge_class": "badge-review",
            "emoji": "⚠️",
            "color": "#9e6a03"
        },
        "HIGH_RISK": {
            "text": "High Risk",
            "badge_class": "badge-high",
            "emoji": "🚫",
            "color": "#da3633"
        }
    }
    
    return display_map.get(category, display_map["REVIEW"])


def generate_analysis_json(email_data: Dict) -> Dict:
    """
    Generate analysis JSON for M3 handoff
    
    Args:
        email_data: Complete email data with AI analysis
        
    Returns:
        Structured JSON for downstream processing
    """
    import json
    from datetime import datetime
    
    ai_analysis = email_data.get('ai_analysis', {})
    policy = email_data.get('policy', {})
    heuristics = email_data.get('heuristics', {})
    
    analysis_json = {
        "email_id": email_data.get('id'),
        "subject": email_data.get('subject'),
        "sender": email_data.get('sender'),
        "date": email_data.get('date'),
        "processed_at": ai_analysis.get('processed_at', datetime.utcnow().isoformat()),
        
        "risk_assessment": {
            "final_score": email_data.get('final_risk_score', 0),
            "ai_score": ai_analysis.get('risk_score', 0),
            "heuristic_score": heuristics.get('risk_score', 0) * 10,
            "category": policy.get('category', 'UNKNOWN'),
            "severity_level": policy.get('severity_level', 2)
        },
        
        "policy": {
            "category": policy.get('category', 'UNKNOWN'),
            "gmail_label": policy.get('label', ''),
            "action": policy.get('action', 'user_review'),
            "description": policy.get('description', '')
        },
        
        "ai_analysis": {
            "intents": ai_analysis.get('intents', []),
            "indicators": ai_analysis.get('indicators', []),
            "safe_summary": ai_analysis.get('safe_summary', ''),
            "recommendations": ai_analysis.get('recommendations', []),
            "mock_mode": ai_analysis.get('mock_mode', True)
        },
        
        "heuristic_analysis": {
            "risk_score": heuristics.get('risk_score', 0),
            "severity": heuristics.get('severity', 'unknown'),
            "urgency_found": heuristics.get('urgency_found', False),
            "credential_found": heuristics.get('credential_found', False),
            "indicators": heuristics.get('indicators', [])
        },
        
        "email_metadata": {
            "has_attachments": len(email_data.get('parsed', {}).get('attachments', [])) > 0,
            "attachment_count": len(email_data.get('parsed', {}).get('attachments', [])),
            "link_count": len(email_data.get('parsed', {}).get('all_links', [])),
            "body_length": len(email_data.get('parsed', {}).get('body_text', ''))
        }
    }
    
    return analysis_json


def get_severity_emoji(severity):
    """
    Get emoji for severity level
    
    Args:
        severity: 'safe', 'review', or 'high_risk' (legacy) OR policy dict
        
    Returns:
        Emoji string
    """
    # Handle new policy-based system
    if isinstance(severity, dict):
        return severity.get('severity_emoji', '⚠️')
    
    # Handle legacy string-based severity
    if severity == 'safe' or severity == 'SAFE':
        return "✅"
    elif severity == 'review' or severity == 'REVIEW':
        return "⚠️"
    else:
        return "🚫"

def render_email_list():
    """
    Render the left panel email list (inbox view)
    """
    st.markdown("### 📬 Inbox")
    
    if not st.session_state.emails:
        st.info("Click 'Fetch & Scan Emails' to load your inbox")
        return
    
    # Statistics - use policy categories
    total = len(st.session_state.emails)
    safe = sum(1 for e in st.session_state.emails if e.get('policy', {}).get('category') == 'SAFE')
    review = sum(1 for e in st.session_state.emails if e.get('policy', {}).get('category') == 'REVIEW')
    high_risk = sum(1 for e in st.session_state.emails if e.get('policy', {}).get('category') == 'HIGH_RISK')
    
    st.markdown(f"""
    <div class="stats-card">
        <strong style="color: #c9d1d9;">Total: {total}</strong> • 
        <span style="color: #3fb950;">Safe: {safe}</span> • 
        <span style="color: #d29922;">Review: {review}</span> • 
        <span style="color: #f85149;">Risk: {high_risk}</span>
    </div>
    """, unsafe_allow_html=True)
    
    # Last refresh time
    if st.session_state.last_refresh_time:
        time_ago = datetime.now() - st.session_state.last_refresh_time
        minutes_ago = int(time_ago.total_seconds() / 60)
        if minutes_ago < 1:
            st.caption("🔄 Updated just now")
        else:
            st.caption(f"🔄 Updated {minutes_ago}m ago")
    
    st.markdown("---")
    
    # Email list
    for idx, email in enumerate(st.session_state.emails):
        # Use policy if available, fallback to heuristics
        policy = email.get('policy', {})
        if policy:
            emoji = policy.get('severity_emoji', '⚠️')
        else:
            severity = email.get('heuristics', {}).get('severity', 'review')
            emoji = get_severity_emoji(severity)
        
        sender = extract_sender_name(email['sender'])
        subject = email['subject'][:55] + ('...' if len(email['subject']) > 55 else '')
        
        is_selected = st.session_state.selected_email_id == email['id']
        
        # Create clickable email card using columns to avoid green button
        col1, col2 = st.columns([0.05, 0.95])
        
        with col1:
            st.markdown(f"<div style='font-size: 20px; padding-top: 0.5rem;'>{emoji}</div>", unsafe_allow_html=True)
        
        with col2:
            if st.button(
                f"**{sender}**\n{subject}",
                key=f"email_{email['id']}",
                use_container_width=True,
                type="primary" if is_selected else "secondary"
            ):
                st.session_state.selected_email_id = email['id']
                st.rerun()

def render_email_detail():
    """
    Render the right panel email detail view
    """
    if not st.session_state.selected_email_id:
        st.info("← Select an email from the inbox to view details")
        return
    
    # Find selected email
    selected = None
    for email in st.session_state.emails:
        if email['id'] == st.session_state.selected_email_id:
            selected = email
            break
    
    if not selected:
        st.warning("Email not found")
        return
    
    # Get policy and AI data
    policy = selected.get('policy', {})
    ai_analysis = selected.get('ai_analysis', {})
    final_score = selected.get('final_risk_score', 0)
    
    # Severity badge - use policy if available
    if policy:
        severity = policy.get('category', 'REVIEW')
        emoji = policy.get('severity_emoji', '⚠️')
        severity_label = severity.replace('_', ' ').title()
    else:
        severity = selected['heuristics']['severity']
        emoji = get_severity_emoji(severity)
        severity_label = severity.replace('_', ' ').title()
    
    if severity == 'SAFE' or severity == 'safe':
        badge_class = 'badge-safe'
    elif severity == 'REVIEW' or severity == 'review':
        badge_class = 'badge-review'
    else:
        badge_class = 'badge-high'
    
    # Email header card
    st.markdown(f"""
    <div class="header-card">
        <h2 style="margin: 0; color: #ffffff;">{selected['subject']}</h2>
        <div style="margin-top: 1rem;">
            <span class="badge {badge_class}">{emoji} {severity_label}</span>
        </div>
    </div>
    """, unsafe_allow_html=True)
    
    # Email metadata
    col1, col2 = st.columns(2)
    with col1:
        st.markdown("**From**")
        st.code(selected['sender'], language=None)
    with col2:
        st.markdown("**Date**")
        st.code(format_date(selected['date']), language=None)
    
    # Attachments
    if selected['parsed']['attachments']:
        st.markdown("**Attachments**")
        st.code(', '.join(selected['parsed']['attachments']), language=None)
    
    st.markdown("---")
    
    # AI Analysis Section with Run Button
    # Show appropriate title based on mode
    if ai_analysis and ai_analysis.get('mock_mode'):
        st.markdown("### 🔍 Pattern-Based Analysis")
        st.caption("⚠️ Using rule-based detection (Mock Mode). Switch to Live mode in sidebar for real AI analysis.")
    else:
        st.markdown("### 🤖 AI Semantic Analysis")
        if ai_analysis:
            st.caption("✅ Analyzed with Google Gemini AI")
    
    # Button row
    col_btn1, col_btn2, col_btn3 = st.columns([1, 1, 2])
    
    # Run AI Analysis button (if not analyzed yet)
    if not ai_analysis:
        with col_btn1:
            if st.button("🔍 Run AI Analysis", key="run_ai_analysis", use_container_width=True):
                with st.spinner("🤖 Analyzing email with AI..."):
                    try:
                        # Run AI analysis
                        ai_result = analyze_email(selected['parsed'], selected['heuristics']['indicators'])
                        
                        # Check for API errors
                        if ai_result.get('error'):
                            st.error(f"❌ Gemini API Error: {ai_result['error']}")
                            if ai_result.get('fallback'):
                                st.info("ℹ️ Continuing with mock analysis results.")
                        elif not is_mock_mode() and ai_result.get('mock_mode'):
                            st.warning("⚠️ API call failed. Falling back to mock mode.")
                        
                        # Merge scores
                        heuristic_score_normalized = selected['heuristics']['risk_score'] * 10
                        new_final_score = merge_heuristic_and_ai_scores(
                            heuristic_score=heuristic_score_normalized,
                            ai_score=ai_result['risk_score'],
                            ai_weight=0.7
                        )
                        
                        # Map to policy
                        new_policy = map_score_to_label(new_final_score)
                        
                        # Update email data
                        selected['ai_analysis'] = ai_result
                        selected['policy'] = new_policy
                        selected['final_risk_score'] = new_final_score
                        
                        if not ai_result.get('error'):
                            st.success("✅ AI analysis complete!")
                        st.rerun()
                        
                    except Exception as e:
                        st.error(f"❌ Analysis failed: {str(e)}")
                        st.info("💡 Try switching to Mock mode in the sidebar or check your API key.")
                        
        st.info("Click the button above to run AI semantic analysis on this email.")
    else:
        # Re-analyze button (if already analyzed)
        with col_btn1:
            if st.button("🔄 Re-analyze", key="reanalyze_ai", use_container_width=True):
                with st.spinner("🤖 Re-analyzing email with AI..."):
                    try:
                        # Re-run AI analysis
                        ai_result = analyze_email(selected['parsed'], selected['heuristics']['indicators'])
                        
                        # Check for API errors
                        if ai_result.get('error'):
                            st.error(f"❌ Gemini API Error: {ai_result['error']}")
                            if ai_result.get('fallback'):
                                st.info("ℹ️ Continuing with mock analysis results.")
                        elif not is_mock_mode() and ai_result.get('mock_mode'):
                            st.warning("⚠️ API call failed. Falling back to mock mode.")
                        
                        # Merge scores
                        heuristic_score_normalized = selected['heuristics']['risk_score'] * 10
                        new_final_score = merge_heuristic_and_ai_scores(
                            heuristic_score=heuristic_score_normalized,
                            ai_score=ai_result['risk_score'],
                            ai_weight=0.7
                        )
                        
                        # Map to policy
                        new_policy = map_score_to_label(new_final_score)
                        
                        # Update in session state
                        for email in st.session_state.emails:
                            if email['id'] == selected['id']:
                                email['ai_analysis'] = ai_result
                                email['policy'] = new_policy
                                email['final_risk_score'] = new_final_score
                                break
                        
                        if not ai_result.get('error'):
                            st.success("✅ AI analysis updated!")
                        st.rerun()
                        
                    except Exception as e:
                        st.error(f"❌ Re-analysis failed: {str(e)}")
                        st.info("💡 Try switching to Mock mode in the sidebar or check your API key.")
    
    if ai_analysis:
        # Risk Score Gauge
        risk_score_val = ai_analysis.get('risk_score', 0)
        
        # Color based on risk level
        if risk_score_val < 30:
            gauge_color = "#1a7f37"
            risk_label = "LOW RISK"
        elif risk_score_val < 70:
            gauge_color = "#9e6a03"
            risk_label = "MEDIUM RISK"
        else:
            gauge_color = "#da3633"
            risk_label = "HIGH RISK"
        
        # Risk gauge visualization
        st.markdown(f"""
        <div style="background-color: #161b22; border: 1px solid #30363d; border-radius: 8px; padding: 1.5rem; margin-bottom: 1rem;">
            <div style="display: flex; justify-content: space-between; align-items: center; margin-bottom: 0.5rem;">
                <span style="color: #c9d1d9; font-size: 14px; font-weight: 600;">AI Risk Assessment</span>
                <span style="color: {gauge_color}; font-size: 18px; font-weight: 700;">{risk_score_val:.1f}/100</span>
            </div>
            <div style="background-color: #0d1117; border-radius: 4px; height: 12px; overflow: hidden;">
                <div style="background-color: {gauge_color}; height: 100%; width: {risk_score_val}%; transition: width 0.3s;"></div>
            </div>
            <div style="text-align: center; margin-top: 0.5rem;">
                <span style="color: {gauge_color}; font-size: 12px; font-weight: 600;">{risk_label}</span>
            </div>
        </div>
        """, unsafe_allow_html=True)
        
        # Score breakdown
        col1, col2, col3 = st.columns(3)
        with col1:
            st.metric("Final Score", f"{final_score:.1f}/100")
        with col2:
            st.metric("AI Score", f"{ai_analysis.get('risk_score', 0):.1f}/100")
        with col3:
            heuristic_score = selected['heuristics']['risk_score'] * 10
            st.metric("Heuristic Score", f"{heuristic_score:.1f}/100")
        
        st.markdown("")
        
        # Safe Summary (prominent display)
        if ai_analysis.get('safe_summary'):
            # Different label based on mode
            if ai_analysis.get('mock_mode'):
                st.markdown("**📝 Analysis Summary** (Pattern-Based)")
            else:
                st.markdown("**📝 AI Summary** (Gemini)")
            st.markdown(f"""
            <div style="background-color: #1c2128; border-left: 4px solid #58a6ff; padding: 1rem; border-radius: 4px; margin-bottom: 1rem;">
                <p style="color: #c9d1d9; margin: 0; font-size: 15px;">{ai_analysis['safe_summary']}</p>
            </div>
            """, unsafe_allow_html=True)
        
        # AI Insights
        if ai_analysis.get('intents'):
            st.markdown("**🎯 Detected Intents**")
            # Remove duplicates and display unique intents
            unique_intents = list(dict.fromkeys(ai_analysis['intents']))
            for intent in unique_intents:
                st.markdown(f'<div class="indicator-card">🎯 {intent.replace("_", " ").title()}</div>', 
                           unsafe_allow_html=True)
        
        if ai_analysis.get('indicators'):
            # Different label based on mode
            if ai_analysis.get('mock_mode'):
                st.markdown("**🚨 Detected Patterns**")
            else:
                st.markdown("**🚨 AI Indicators**")
            # Remove duplicates and display unique indicators
            unique_indicators = list(dict.fromkeys(ai_analysis['indicators']))
            for indicator in unique_indicators:
                st.markdown(f'<div class="indicator-card">• {indicator}</div>', 
                           unsafe_allow_html=True)
        
        # Analysis timestamp
        if ai_analysis.get('processed_at'):
            st.caption(f"� Analyzed: {ai_analysis['processed_at']}")
        
        st.markdown("---")
    
    # Threat Analysis (Heuristics)
    st.markdown("### 🔍 Heuristic Analysis")
    
    heuristics = selected['heuristics']
    risk_score = heuristics['risk_score']
    
    # Risk metrics
    col1, col2, col3 = st.columns(3)
    with col1:
        st.metric("Risk Score", f"{risk_score}/10")
    with col2:
        st.metric("Urgency", "Yes" if heuristics['urgency_found'] else "No")
    with col3:
        st.metric("Credentials", "Yes" if heuristics['credential_found'] else "No")
    
    st.markdown("")
    
    # Indicators - Remove duplicates
    if heuristics['indicators']:
        st.markdown("**Detected Indicators**")
        # Deduplicate indicators while preserving order
        unique_indicators = list(dict.fromkeys(heuristics['indicators']))
        for indicator in unique_indicators:
            st.markdown(f'<div class="indicator-card">{indicator}</div>', unsafe_allow_html=True)
    
    st.markdown("---")
    
    # Recommendations (prominent display)
    st.markdown("### 📋 Recommended Actions")
    
    recommendations = ai_analysis.get('recommendations', []) if ai_analysis else []
    if recommendations:
        # Deduplicate recommendations
        unique_recommendations = list(dict.fromkeys(recommendations))
        
        # Determine severity for styling
        if final_score >= 70:
            rec_color = "#da3633"
            rec_icon = "🚫"
            rec_title = "High Risk - Action Required"
        elif final_score >= 30:
            rec_color = "#9e6a03"
            rec_icon = "⚠️"
            rec_title = "Medium Risk - Review Needed"
        else:
            rec_color = "#1a7f37"
            rec_icon = "✅"
            rec_title = "Low Risk - Stay Vigilant"
        
        st.markdown(f"""
        <div style="background-color: #161b22; border: 2px solid {rec_color}; border-radius: 8px; padding: 1.5rem; margin-bottom: 1rem;">
            <div style="display: flex; align-items: center; margin-bottom: 1rem;">
                <span style="font-size: 24px; margin-right: 0.5rem;">{rec_icon}</span>
                <span style="color: #ffffff; font-size: 16px; font-weight: 600;">{rec_title}</span>
            </div>
        """, unsafe_allow_html=True)
        
        for idx, rec in enumerate(unique_recommendations, 1):
            st.markdown(f"**{idx}.** {rec}")
        
        st.markdown("</div>", unsafe_allow_html=True)
    else:
        st.info("Run AI analysis to get personalized recommendations")
    
    st.markdown("---")
    
    # Email body
    st.markdown("### 📄 Email Content")
    
    body_text = selected['parsed']['body_text']
    body_html = selected['parsed'].get('body_html', '')
    
    # View toggle if HTML is available
    if body_html and body_text:
        view_mode = st.radio(
            "View Mode",
            ["📝 Formatted Text", "🌐 HTML Preview", "📄 Raw Text"],
            horizontal=True,
            label_visibility="collapsed"
        )
    else:
        view_mode = "📄 Raw Text"
    
    if body_text or body_html:
        if view_mode == "🌐 HTML Preview" and body_html:
            # HTML preview in expandable container
            st.markdown("""
                <div style="
                    background-color: #ffffff;
                    padding: 20px;
                    border-radius: 8px;
                    border: 1px solid #ddd;
                    max-height: 500px;
                    overflow-y: auto;
                    color: #000000;
                    font-family: Arial, sans-serif;
                    font-size: 14px;
                    line-height: 1.6;
                ">
            """, unsafe_allow_html=True)
            
            # Sanitize and display HTML
            st.markdown(body_html, unsafe_allow_html=True)
            
            st.markdown("</div>", unsafe_allow_html=True)
            
        elif view_mode == "📝 Formatted Text" and body_text:
            # Formatted text with better readability
            formatted_text = body_text.strip()
            
            # Add markdown-style formatting
            st.markdown("""
                <div style="
                    background-color: #1e1e1e;
                    padding: 20px;
                    border-radius: 8px;
                    border: 1px solid #333;
                    max-height: 500px;
                    overflow-y: auto;
                    font-family: 'Segoe UI', Arial, sans-serif;
                    font-size: 14px;
                    line-height: 1.8;
                    color: #e0e0e0;
                    white-space: pre-wrap;
                    word-wrap: break-word;
                ">
            """ + formatted_text.replace('\n', '<br>') + """
                </div>
            """, unsafe_allow_html=True)
            
        else:
            # Raw text view
            preview = body_text[:3000] if body_text else "No text content"
            if len(body_text) > 3000:
                preview += "\n\n... (content truncated, showing first 3000 characters)"
            
            st.markdown("""
                <style>
                .email-content-box textarea {
                    font-family: 'Consolas', 'Courier New', monospace !important;
                    font-size: 13px !important;
                    line-height: 1.6 !important;
                    background-color: #1e1e1e !important;
                    color: #d4d4d4 !important;
                    border: 1px solid #333 !important;
                }
                </style>
            """, unsafe_allow_html=True)
            
            st.markdown('<div class="email-content-box">', unsafe_allow_html=True)
            st.text_area("Email Body", preview, height=400, disabled=True, label_visibility="collapsed")
            st.markdown('</div>', unsafe_allow_html=True)
    else:
        st.info("📭 No content available")
    
    # Links
    if selected['parsed']['all_links']:
        st.markdown("---")
        st.markdown("### 🔗 Links")
        with st.expander(f"Show {len(selected['parsed']['all_links'])} link(s)"):
            for idx, link in enumerate(selected['parsed']['all_links'], 1):
                st.code(link, language=None)
    
    # Export Analysis JSON (for M3)
    if ai_analysis:
        st.markdown("---")
        col1, col2 = st.columns([3, 1])
        with col1:
            st.markdown("**📤 Export Analysis Data**")
            st.caption("Generate JSON output for downstream processing (M3)")
        with col2:
            if st.button("📥 Export JSON", key="export_json"):
                import json
                analysis_json = generate_analysis_json(selected)
                
                # Sign the analysis if secrets are loaded
                if st.session_state.secrets_loaded and st.session_state.secrets:
                    if 'SIGNING_SECRET' in st.session_state.secrets:
                        try:
                            # Get signing secret (already a string, convert to bytes)
                            signing_secret = st.session_state.secrets['SIGNING_SECRET']
                            if isinstance(signing_secret, str):
                                signing_secret = signing_secret.encode('utf-8')
                            
                            # Sign the analysis record
                            analysis_json = sign_analysis(analysis_json, signing_secret)
                            st.success("✅ Analysis signed with digital signature")
                        except Exception as e:
                            st.warning(f"⚠️ Could not sign analysis: {str(e)}")
                    else:
                        st.info("ℹ️ Signing secret not available - exporting unsigned")
                else:
                    st.info("ℹ️ Secrets not loaded - exporting unsigned (load secrets in Security tab to enable signing)")
                
                json_str = json.dumps(analysis_json, indent=2)
                st.download_button(
                    label="Download JSON",
                    data=json_str,
                    file_name=f"analysis_{selected['id']}.json",
                    mime="application/json",
                    key="download_json"
                )

def render_security_tab():
    """
    Render the Security tab for secrets management and signature verification
    """
    st.markdown("## 🔐 Security Management")
    st.caption("Manage encrypted secrets and verify analysis signatures")
    st.markdown("---")
    
    # Secrets Management Section
    st.markdown("### 🔑 Secrets Management")
    
    # Display secrets status
    col1, col2 = st.columns([2, 1])
    
    with col1:
        if st.session_state.secrets_loaded and st.session_state.secrets:
            st.success("✅ **Secrets Loaded**")
            st.caption("Secrets are available in session state")
            
            # Show which secrets are loaded (without revealing values)
            with st.expander("📋 Loaded Secrets"):
                for key in st.session_state.secrets.keys():
                    if key == 'SIGNING_SECRET':
                        st.markdown(f"- 🔑 **{key}** (auto-generated, 256-bit)")
                    else:
                        st.markdown(f"- ✓ **{key}**")
        else:
            st.warning("⚠️ **Secrets Not Loaded**")
            st.caption("Load secrets to enable signing and verification")
    
    with col2:
        # Reload/Unload button
        if st.session_state.secrets_loaded:
            if st.button("🔄 Reload Secrets", use_container_width=True):
                st.session_state.secrets = None
                st.session_state.secrets_loaded = False
                st.rerun()
        else:
            st.info("💡 Load secrets below")
    
    st.markdown("---")
    
    # Load Secrets Section
    if not st.session_state.secrets_loaded:
        st.markdown("#### 🔓 Load Encrypted Secrets")
        st.caption("Enter your master passphrase to decrypt secrets.enc")
        
        # Check if secrets.enc exists
        import os
        secrets_file = "secrets.enc"
        
        if not os.path.exists(secrets_file):
            st.error(f"❌ **{secrets_file} not found**")
            st.info("📝 Run `python encrypt_secrets.py` to create encrypted secrets file")
            st.code("python encrypt_secrets.py", language="bash")
        else:
            st.success(f"✅ Found {secrets_file}")
            
            # Passphrase input
            passphrase = st.text_input(
                "Master Passphrase",
                type="password",
                key="load_passphrase",
                help="Enter the passphrase you used when creating secrets.enc"
            )
            
            col_load1, col_load2, col_load3 = st.columns([1, 1, 2])
            
            with col_load1:
                if st.button("🔓 Load Secrets", use_container_width=True, disabled=not passphrase):
                    try:
                        with st.spinner("🔓 Decrypting secrets..."):
                            secrets_data = load_encrypted(secrets_file, passphrase)
                            st.session_state.secrets = secrets_data
                            st.session_state.secrets_loaded = True
                            st.success("✅ Secrets loaded successfully!")
                            time.sleep(0.5)
                            st.rerun()
                    except ValueError as e:
                        st.error(f"❌ Decryption failed: {str(e)}")
                        st.info("💡 Check your passphrase and try again")
                    except Exception as e:
                        st.error(f"❌ Error loading secrets: {str(e)}")
            
            with col_load2:
                if st.button("ℹ️ Help", use_container_width=True):
                    st.info("""
                    **How to create secrets.enc:**
                    1. Run: `python encrypt_secrets.py`
                    2. Enter a strong passphrase
                    3. Provide your API keys
                    4. File will be saved as secrets.enc
                    """)
    
    st.markdown("---")
    
    # Signature Verification Section
    st.markdown("### ✍️ Signature Verification")
    st.caption("Verify the integrity and authenticity of analysis records")
    
    if not st.session_state.secrets_loaded:
        st.warning("⚠️ Load secrets first to enable signature verification")
    else:
        # Check if signing secret is available
        if 'SIGNING_SECRET' not in st.session_state.secrets:
            st.error("❌ Signing secret not found in loaded secrets")
        else:
            st.success("✅ Signing secret available")
            
            # Verification method selection
            verify_method = st.radio(
                "Verification Method",
                ["Paste JSON", "Upload File"],
                horizontal=True
            )
            
            analysis_json_str = None
            
            if verify_method == "Paste JSON":
                analysis_json_str = st.text_area(
                    "Paste Analysis JSON",
                    height=200,
                    placeholder='{"email_id": "...", "signature": "...", ...}',
                    help="Paste the complete analysis JSON including the signature field"
                )
            else:
                uploaded_file = st.file_uploader(
                    "Upload Analysis JSON",
                    type=['json'],
                    help="Upload a JSON file containing the signed analysis"
                )
                if uploaded_file:
                    analysis_json_str = uploaded_file.read().decode('utf-8')
            
            # Verify button
            if analysis_json_str:
                col_verify1, col_verify2, col_verify3 = st.columns([1, 1, 2])
                
                with col_verify1:
                    if st.button("🔍 Verify Signature", use_container_width=True):
                        try:
                            import json
                            analysis_record = json.loads(analysis_json_str)
                            
                            if 'signature' not in analysis_record:
                                st.error("❌ No signature field found in JSON")
                            else:
                                # Get signing secret (convert to bytes if string)
                                signing_secret = st.session_state.secrets['SIGNING_SECRET']
                                if isinstance(signing_secret, str):
                                    signing_secret = signing_secret.encode('utf-8')
                                
                                # Verify signature
                                is_valid = verify_analysis(analysis_record, signing_secret)
                                
                                if is_valid:
                                    st.success("✅ **Signature Valid**")
                                    st.balloons()
                                    st.markdown("""
                                    **Verification Successful**
                                    - Signature is authentic
                                    - Data has not been tampered with
                                    - Record integrity confirmed
                                    """)
                                    
                                    # Update MongoDB to mark as manually verified
                                    if 'email_id' in analysis_record or 'gmail_id' in analysis_record:
                                        email_id = analysis_record.get('email_id') or analysis_record.get('gmail_id')
                                        mongo_uri = st.session_state.secrets.get('MONGO_URI')
                                        
                                        if email_id and mongo_uri:
                                            try:
                                                updated = mark_signature_as_valid(email_id, mongo_uri)
                                                if updated:
                                                    st.success("✅ **Record Updated in Database**")
                                                    st.info("This email will now show as verified in the History tab")
                                                else:
                                                    st.info("ℹ️ Could not find this email in database (it may not be stored yet)")
                                            except Exception as e:
                                                st.warning(f"⚠️ Could not update database: {str(e)}")
                                    
                                    # Show record details
                                    with st.expander("📋 Record Details"):
                                        st.json(analysis_record)
                                else:
                                    st.error("❌ **Signature Invalid**")
                                    st.markdown("""
                                    **Verification Failed**
                                    - Signature does not match
                                    - Data may have been modified
                                    - Or signed with different secret
                                    """)
                        
                        except json.JSONDecodeError:
                            st.error("❌ Invalid JSON format")
                        except Exception as e:
                            st.error(f"❌ Verification error: {str(e)}")
                
                with col_verify2:
                    if st.button("🗑️ Clear", use_container_width=True):
                        st.rerun()
    
    st.markdown("---")
    
    # Security Information
    with st.expander("ℹ️ Security Features"):
        st.markdown("""
        ### 🔐 Encryption
        - **Algorithm**: AES-256-GCM
        - **Key Derivation**: scrypt (N=16384, r=8, p=1)
        - **Format**: salt(16) + nonce(12) + ciphertext+tag
        
        ### ✍️ Digital Signatures
        - **Algorithm**: HMAC-SHA256
        - **Output**: Base64-encoded signature
        - **Purpose**: Integrity and authenticity verification
        
        ### 🔑 Best Practices
        - Use strong passphrases (12+ characters)
        - Store passphrase in password manager
        - Never commit secrets.enc to version control
        - Backup secrets.enc securely
        - Rotate signing secrets periodically
        """)
    
    # Hybrid Mode Info
    st.markdown("---")
    st.info("""
    **💡 Hybrid Mode**: You can load secrets at runtime without restarting the app.
    This allows you to switch between different secret configurations on the fly.
    """)

def render_history_tab():
    """
    Render the History tab for viewing stored analyses from MongoDB (M4)
    """
    st.markdown("## 📚 Analysis History")
    st.caption("Securely stored email analyses with signature verification")
    st.markdown("---")
    
    # Check if MongoDB is enabled
    if not st.session_state.secrets_loaded or not st.session_state.secrets:
        st.warning("⚠️ **Secrets Not Loaded**")
        st.info("Load secrets in the Security tab to enable MongoDB history access")
        return
    
    # Check for MongoDB URI
    mongo_uri = st.session_state.secrets.get('MONGO_URI')
    signing_secret = st.session_state.secrets.get('SIGNING_SECRET')
    
    if not mongo_uri:
        st.error("❌ **MONGO_URI not found in secrets**")
        st.info("Add MONGO_URI to your secrets.enc file to enable MongoDB integration")
        return
    
    if not signing_secret:
        st.error("❌ **SIGNING_SECRET not found in secrets**")
        st.info("Add SIGNING_SECRET to your secrets.enc file to enable signature verification")
        return
    
    # Convert signing secret to bytes if needed
    if isinstance(signing_secret, str):
        signing_secret = signing_secret.encode('utf-8')
    
    # Enable MongoDB
    st.session_state.mongo_enabled = True
    
    # Filter controls
    col1, col2, col3 = st.columns([2, 2, 1])
    
    with col1:
        risk_filter = st.selectbox(
            "Filter by Risk Level",
            ["All", "HIGH_RISK", "REVIEW", "SAFE"],
            key="history_risk_filter"
        )
    
    with col2:
        st.write("")  # Spacing
    
    with col3:
        if st.button("🔄 Refresh", use_container_width=True):
            st.rerun()
    
    st.markdown("---")
    
    # Load analyses from MongoDB
    try:
        with st.spinner("📥 Loading analyses from MongoDB..."):
            # Build filter
            filter_by = None
            if risk_filter != "All":
                filter_by = {"risk_label": risk_filter}
            
            # Load analyses
            analyses = load_analyses(
                mongo_uri=mongo_uri,
                signing_secret=signing_secret,
                filter_by=filter_by,
                limit=100  # Limit to 100 most recent
            )
            
            # Count total
            total_count = count_analyses(mongo_uri, filter_by)
            
            if not analyses:
                st.info("📭 No analyses found in history")
                st.caption("Analyses will appear here after you scan emails with MongoDB enabled")
                return
            
            # Display summary
            valid_sigs = sum(1 for a in analyses if a.get('signature_valid', False))
            invalid_sigs = len(analyses) - valid_sigs
            
            col_s1, col_s2, col_s3, col_s4 = st.columns(4)
            
            with col_s1:
                st.metric("Total Analyses", total_count)
            with col_s2:
                st.metric("Shown", len(analyses))
            with col_s3:
                st.metric("✅ Valid Signatures", valid_sigs)
            with col_s4:
                if invalid_sigs > 0:
                    st.metric("⚠️ Invalid Signatures", invalid_sigs)
                else:
                    st.metric("Invalid Signatures", 0)
            
            st.markdown("---")
            
            # Display analyses in a table-like format
            for idx, analysis in enumerate(analyses):
                # Get fields
                gmail_id = analysis.get('gmail_id', 'Unknown')
                sender = analysis.get('sender', 'Unknown')
                subject = analysis.get('subject', 'No Subject')
                risk_label = analysis.get('risk_label', 'UNKNOWN')
                risk_score = analysis.get('risk_score', 0)
                processed_at = analysis.get('processed_at')
                signature_valid = analysis.get('signature_valid', False)
                manually_verified = analysis.get('signature_manually_verified', False)
                mock_mode = analysis.get('mock_mode', False)
                
                # Format timestamp
                if isinstance(processed_at, datetime):
                    time_str = processed_at.strftime("%Y-%m-%d %H:%M:%S")
                else:
                    time_str = str(processed_at)
                
                # Determine display color based on risk
                if risk_label == "HIGH_RISK":
                    risk_emoji = "🔴"
                    risk_color = "#d73a4a"
                elif risk_label == "REVIEW":
                    risk_emoji = "🟡"
                    risk_color = "#fb8500"
                else:
                    risk_emoji = "🟢"
                    risk_color = "#1a7f37"
                
                # Signature status
                if signature_valid:
                    if manually_verified:
                        sig_badge = "✅ Manually Verified"
                        sig_color = "#1a7f37"
                    else:
                        sig_badge = "✅ Verified"
                        sig_color = "#1a7f37"
                else:
                    sig_badge = "⚠️ Invalid"
                    sig_color = "#d73a4a"
                
                # Create expandable card
                with st.expander(
                    f"{risk_emoji} **{subject[:60]}{'...' if len(subject) > 60 else ''}** | From: {sender} | {time_str}",
                    expanded=False
                ):
                    # Two columns for layout
                    detail_col1, detail_col2 = st.columns([2, 1])
                    
                    with detail_col1:
                        st.markdown(f"**📧 Subject:** {subject}")
                        st.markdown(f"**👤 From:** {sender}")
                        st.markdown(f"**🆔 Gmail ID:** `{gmail_id[:20]}...`")
                        st.markdown(f"**📅 Processed:** {time_str}")
                        
                        if mock_mode:
                            st.caption("🤖 Analyzed in Mock Mode")
                    
                    with detail_col2:
                        st.markdown(f"**Risk Level:** <span style='color:{risk_color}'>{risk_emoji} {risk_label}</span>", unsafe_allow_html=True)
                        st.markdown(f"**Risk Score:** {risk_score:.1f}/100")
                        st.markdown(f"**Signature:** <span style='color:{sig_color}'>{sig_badge}</span>", unsafe_allow_html=True)
                    
                    # Show AI insights if available
                    if analysis.get('ai_summary'):
                        st.markdown("---")
                        st.markdown("**🤖 AI Summary:**")
                        st.info(analysis.get('ai_summary'))
                    
                    # Show recommendations
                    if analysis.get('recommendations'):
                        st.markdown("**💡 Recommendations:**")
                        for rec in analysis.get('recommendations', []):
                            st.markdown(f"- {rec}")
                    
                    # Show intents if available
                    if analysis.get('intents'):
                        st.markdown(f"**🎯 Detected Intents:** {', '.join(analysis.get('intents', []))}")
                    
                    # Show manual verification info
                    if manually_verified:
                        verified_at = analysis.get('signature_verified_at')
                        if verified_at:
                            if isinstance(verified_at, datetime):
                                verified_time = verified_at.strftime("%Y-%m-%d %H:%M:%S")
                            else:
                                verified_time = str(verified_at)
                            st.success(f"✅ **Manually verified on:** {verified_time}")
                    
                    # Warning for invalid signature
                    if not signature_valid:
                        st.warning("⚠️ **Warning:** This analysis has an invalid signature. Data may have been tampered with.")
                        st.info("💡 **Tip:** Export this email's JSON file and verify it in the Security tab to mark it as valid.")
                
            # Pagination info
            if total_count > len(analyses):
                st.caption(f"Showing {len(analyses)} of {total_count} total analyses (most recent)")
    
    except Exception as e:
        st.error(f"❌ Error loading history: {str(e)}")
        st.caption("Check your MongoDB connection and credentials")

# Main App Layout
def main():
    """
    Main application entry point
    Renders the Streamlit dashboard
    """
    # Header
    st.markdown("# 🛡️ PhishGuard")
    st.caption("AI-Powered Phishing Detection System")
    st.markdown("---")
    
    # Sidebar controls
    with st.sidebar:
        st.markdown("## ⚙️ Controls")
        
        # AI Mode Toggle
        st.markdown("### 🤖 AI Mode")
        
        # Initialize session state for mode if not exists
        if 'ai_mode' not in st.session_state:
            st.session_state.ai_mode = "Mock" if is_mock_mode() else "Live"
        
        current_mode = st.radio(
            "Select AI Mode",
            ["Mock", "Live"],
            index=0 if st.session_state.ai_mode == "Mock" else 1,
            horizontal=True,
            help="Mock: Uses simulated AI responses. Live: Uses Google Gemini API (requires API key)"
        )
        
        # Handle mode change
        if current_mode != st.session_state.ai_mode:
            st.session_state.ai_mode = current_mode
            set_mock_mode(current_mode == "Mock")
            st.success(f"✅ Switched to {current_mode} mode")
            st.rerun()
        
        # Show current status
        if is_mock_mode():
            st.info("🤖 **Mock Mode** - Using simulated AI")
        else:
            st.success("🚀 **Live Mode** - Using Gemini API")
            st.caption("If API fails, analysis will fall back to mock mode with error notification.")
        
        st.markdown("---")
        
        # Manual fetch
        max_results = st.slider("Emails to fetch", 5, 50, 30, 5)
        
        if st.button("🔄 Fetch & Scan Emails", use_container_width=True):
            if initialize_gmail_client():
                st.session_state.last_fetch_count = max_results
                fetch_and_scan_emails(max_results=max_results, is_auto_refresh=False)
                st.session_state.last_refresh_time = datetime.now()
        
        # Clear all button
        if st.session_state.emails:
            if st.button("🗑️ Clear All Emails", use_container_width=True):
                st.session_state.emails = []
                st.session_state.selected_email_id = None
                st.success("✅ All emails cleared")
                st.rerun()
        
        st.markdown("---")
        
        # Auto-refresh
        st.markdown("### 🔄 Auto Refresh")
        auto_refresh = st.toggle("Enable", value=st.session_state.auto_refresh_enabled)
        
        if auto_refresh != st.session_state.auto_refresh_enabled:
            st.session_state.auto_refresh_enabled = auto_refresh
        
        if st.session_state.auto_refresh_enabled:
            refresh_interval = st.slider("Interval (seconds)", 10, 300, st.session_state.refresh_interval, 10)
            st.session_state.refresh_interval = refresh_interval
            st.caption(f"Refreshing every {refresh_interval}s")
            
            # Auto-refresh logic
            if st.session_state.last_refresh_time is None or \
               (datetime.now() - st.session_state.last_refresh_time).total_seconds() >= refresh_interval:
                if st.session_state.gmail_client is not None:
                    fetch_and_scan_emails(max_results=st.session_state.get('last_fetch_count', 30), is_auto_refresh=True)
                    st.session_state.last_refresh_time = datetime.now()
                    time.sleep(0.5)
                    st.rerun()
        
        st.markdown("---")
        
        # Statistics
        if st.session_state.emails:
            st.markdown("### 📊 Statistics")
            
            total = len(st.session_state.emails)
            safe = sum(1 for e in st.session_state.emails if e.get('policy', {}).get('category') == 'SAFE')
            review = sum(1 for e in st.session_state.emails if e.get('policy', {}).get('category') == 'REVIEW')
            high_risk = sum(1 for e in st.session_state.emails if e.get('policy', {}).get('category') == 'HIGH_RISK')
            
            st.metric("Total", total)
            st.metric("Safe", safe)
            st.metric("Review", review)
            st.metric("High Risk", high_risk)
            
            if total > 0:
                threat_pct = ((review + high_risk) / total) * 100
                st.metric("Threat %", f"{threat_pct:.0f}%")
        
        st.markdown("---")
        
        # Detection info
        with st.expander("ℹ️ Detection Features"):
            st.markdown("""
            - Urgency tactics
            - Credential requests
            - Suspicious links
            - Risky attachments
            - Lookalike domains
            - IP-based URLs
            """)
    
    # Main content with tabs
    tab1, tab2, tab3 = st.tabs(["📧 Email Analysis", "� History", "�🔐 Security"])
    
    with tab1:
        # Email Analysis Tab
        col1, col2 = st.columns([1, 2])
        
        with col1:
            render_email_list()
        
        with col2:
            render_email_detail()
    
    with tab2:
        # History Tab (M4)
        render_history_tab()
    
    with tab3:
        # Security Tab
        render_security_tab()
    
    # Auto-refresh trigger
    if st.session_state.auto_refresh_enabled:
        time.sleep(1)
        st.rerun()

if __name__ == "__main__":
    main()