feat: activity log tab + rotate secret UI + HTTPS warning + security section

includes/Core/AdminMenu.php

@@ -10,87 +10,62 @@ class AdminMenu {
         add_action('admin_menu',            [$this, 'register']);
         add_action('admin_enqueue_scripts', [$this, 'enqueueAssets']);
         add_action('admin_init',            [$this, 'registerSettings']);
+        add_action('admin_post_asktam_mcp_rotate_secret', [$this, 'handleRotateSecret']);
     }
 
     public function registerSettings(): void {
-        register_setting(
+        register_setting('asktam_mcp_settings_group', 'asktam_mcp_settings', [
-            'asktam_mcp_settings_group',
+            'sanitize_callback' => [$this, 'sanitizeSettings'],
-            'asktam_mcp_settings',
+        ]);
-            ['sanitize_callback' => [$this, 'sanitizeSettings']]
-        );
     }
 
     public function sanitizeSettings(mixed $input): array {
-        $clean = [];
+        return [
-        $clean['rate_limit']    = max(1, min(300, (int) ($input['rate_limit'] ?? 60)));
+            'rate_limit'    => max(1, min(300, (int) ($input['rate_limit'] ?? 60))),
-        $clean['log_requests']  = !empty($input['log_requests']);
+            'log_requests'  => !empty($input['log_requests']),
-        $clean['allow_raw_sql'] = !empty($input['allow_raw_sql']);
+            'allow_raw_sql' => !empty($input['allow_raw_sql']),
-        $clean['wc_enabled']    = !empty($input['wc_enabled']);
+            'wc_enabled'    => !empty($input['wc_enabled']),
-        return $clean;
+            'require_https' => !empty($input['require_https']),
+        ];
     }
 
     public function register(): void {
         add_menu_page('AskTam MCP', 'AskTam MCP', 'manage_options', 'asktam-mcp', [$this, 'renderDashboard'], 'dashicons-rest-api', 80);
         add_submenu_page('asktam-mcp', 'API Keys',     'API Keys',     'manage_options', 'asktam-mcp',          [$this, 'renderDashboard']);
+        add_submenu_page('asktam-mcp', 'Activity Log', 'Activity Log', 'manage_options', 'asktam-mcp-log',      [$this, 'renderLog']);
         add_submenu_page('asktam-mcp', 'Settings',     'Settings',     'manage_options', 'asktam-mcp-settings', [$this, 'renderSettings']);
     }
 
     public function enqueueAssets(string $hook): void {
-        if (!in_array($hook, ['toplevel_page_asktam-mcp', 'asktam-mcp_page_asktam-mcp-settings'], true)) {
+        if (!str_contains($hook, 'asktam-mcp')) return;
-            return;
-        }
         add_action('admin_head', [$this, 'inlineStyles']);
     }
 
-    public function inlineStyles(): void {
+    public function inlineStyles(): void { ?>
-        ?>
         <style>
-        .mcp-wrap { max-width: 960px; }
+        .mcp-wrap{max-width:960px}.mcp-endpoint-bar{background:#f0f6fc;border:1px solid #c0d8f0;border-radius:6px;padding:14px 18px;display:flex;align-items:center;gap:12px;flex-wrap:wrap;margin-bottom:24px}.mcp-endpoint-bar code{background:#fff;border:1px solid #ddd;padding:4px 10px;border-radius:4px;font-size:13px;flex:1;min-width:200px}.mcp-cards{display:grid;grid-template-columns:1fr 1fr;gap:20px;margin-bottom:32px}.mcp-card{background:#fff;border:1px solid #ddd;border-radius:8px;padding:20px}.mcp-card h3{margin:0 0 6px;display:flex;align-items:center;gap:8px;font-size:15px}.mcp-card p{color:#555;font-size:13px;margin:0 0 14px}.mcp-card pre{background:#1e1e2e;color:#cdd6f4;border-radius:6px;padding:12px 14px;font-size:12px;overflow-x:auto;line-height:1.6;position:relative;margin:0 0 12px}.mcp-card pre .kp{color:#f9e2af}.mcp-card pre .ku{color:#89dceb}.copy-btn{background:none;border:1px solid #ccc;border-radius:4px;padding:2px 8px;font-size:11px;cursor:pointer;position:absolute;top:8px;right:8px;color:#aaa}.copy-btn:hover{background:#333;color:#fff}.mcp-key-table{width:100%;border-collapse:collapse;font-size:13px}.mcp-key-table th{text-align:left;padding:8px 12px;background:#f6f7f7;border-bottom:2px solid #ddd}.mcp-key-table td{padding:9px 12px;border-bottom:1px solid #eee;vertical-align:middle}.mcp-badge{display:inline-block;padding:2px 8px;border-radius:10px;font-size:11px;font-weight:600}.mcp-ok{background:#d1fae5;color:#065f46}.mcp-no{background:#fee2e2;color:#991b1b}.mcp-scope{display:inline-block;background:#ede9fe;color:#5b21b6;border-radius:3px;padding:1px 6px;font-size:11px;margin:1px}.mcp-generate-form{background:#fff;border:1px solid #ddd;border-radius:8px;padding:20px 24px;margin-bottom:28px}.mcp-form-row{display:flex;gap:12px;align-items:flex-end;flex-wrap:wrap;margin-bottom:14px}.mcp-form-row label{font-size:13px;font-weight:600;display:block;margin-bottom:4px}.mcp-form-row input[type=text]{border:1px solid #ddd;border-radius:4px;padding:7px 10px;font-size:13px;min-width:200px}.mcp-scope-checks{display:flex;gap:12px;flex-wrap:wrap;align-items:center}.mcp-scope-checks label{font-weight:normal;display:flex;align-items:center;gap:5px;font-size:13px;cursor:pointer}.mcp-warn{background:#fff8ed;border:1px solid #f0b429;border-radius:6px;padding:12px 16px;margin-bottom:20px;font-size:13px}.mcp-danger{background:#fff0f0;border:1px solid #f5c6cb;border-radius:6px;padding:16px 20px;margin-bottom:20px}.mcp-log-table{width:100%;border-collapse:collapse;font-size:12px}.mcp-log-table th{background:#f6f7f7;padding:7px 10px;text-align:left;border-bottom:2px solid #ddd}.mcp-log-table td{padding:6px 10px;border-bottom:1px solid #eee}.mcp-dot-ok{color:#22c55e;font-weight:700}.mcp-dot-fail{color:#ef4444;font-weight:700}
-        .mcp-endpoint-bar { background:#f0f6fc; border:1px solid #c0d8f0; border-radius:6px; padding:14px 18px; display:flex; align-items:center; gap:12px; flex-wrap:wrap; margin-bottom:24px; }
-        .mcp-endpoint-bar code { background:#fff; border:1px solid #ddd; padding:4px 10px; border-radius:4px; font-size:13px; flex:1; min-width:200px; }
-        .mcp-cards { display:grid; grid-template-columns:1fr 1fr; gap:20px; margin-bottom:32px; }
-        .mcp-card { background:#fff; border:1px solid #ddd; border-radius:8px; padding:20px; }
-        .mcp-card h3 { margin:0 0 6px; display:flex; align-items:center; gap:8px; font-size:15px; }
-        .mcp-card p { color:#555; font-size:13px; margin:0 0 14px; }
-        .mcp-card pre { background:#1e1e2e; color:#cdd6f4; border-radius:6px; padding:12px 14px; font-size:12px; overflow-x:auto; line-height:1.6; position:relative; margin:0 0 12px; }
-        .mcp-card pre .key-placeholder { color:#f9e2af; }
-        .mcp-card pre .key-url { color:#89dceb; }
-        .copy-btn { background:none; border:1px solid #ccc; border-radius:4px; padding:2px 8px; font-size:11px; cursor:pointer; position:absolute; top:8px; right:8px; color:#aaa; }
-        .copy-btn:hover { background:#333; color:#fff; }
-        .mcp-key-table { width:100%; border-collapse:collapse; font-size:13px; }
-        .mcp-key-table th { text-align:left; padding:8px 12px; background:#f6f7f7; border-bottom:2px solid #ddd; }
-        .mcp-key-table td { padding:9px 12px; border-bottom:1px solid #eee; vertical-align:middle; }
-        .mcp-key-table tr:hover td { background:#fafafa; }
-        .mcp-badge { display:inline-block; padding:2px 8px; border-radius:10px; font-size:11px; font-weight:600; }
-        .mcp-badge-active { background:#d1fae5; color:#065f46; }
-        .mcp-badge-inactive { background:#fee2e2; color:#991b1b; }
-        .mcp-scope { display:inline-block; background:#ede9fe; color:#5b21b6; border-radius:3px; padding:1px 6px; font-size:11px; margin:1px; }
-        .mcp-generate-form { background:#fff; border:1px solid #ddd; border-radius:8px; padding:20px 24px; margin-bottom:28px; }
-        .mcp-generate-form h3 { margin:0 0 16px; font-size:15px; }
-        .mcp-form-row { display:flex; gap:12px; align-items:flex-end; flex-wrap:wrap; margin-bottom:14px; }
-        .mcp-form-row label { font-size:13px; font-weight:600; display:block; margin-bottom:4px; }
-        .mcp-form-row input[type=text] { border:1px solid #ddd; border-radius:4px; padding:7px 10px; font-size:13px; min-width:200px; }
-        .mcp-scope-checks { display:flex; gap:12px; flex-wrap:wrap; align-items:center; }
-        .mcp-scope-checks label { font-weight:normal; display:flex; align-items:center; gap:5px; font-size:13px; cursor:pointer; }
-        @media(max-width:700px){ .mcp-cards{grid-template-columns:1fr;} .mcp-form-row{flex-direction:column;} }
         </style>
-        <?php
+    <?php }
-    }
 
+    // -------------------------------------------------------------------------
+    // Dashboard — API Keys
+    // -------------------------------------------------------------------------
     public function renderDashboard(): void {
         global $wpdb;
-        $table  = $wpdb->prefix . 'asktam_mcp_keys';
+        $keys   = $wpdb->get_results("SELECT * FROM {$wpdb->prefix}asktam_mcp_keys ORDER BY created_at DESC");
-        $keys   = $wpdb->get_results("SELECT * FROM {$table} ORDER BY created_at DESC");
         $sseUrl = rest_url('asktam-mcp/v1/sse');
-        $msgUrl = rest_url('asktam-mcp/v1/message');
+        $isHttps = is_ssl();
         ?>
         <div class="wrap mcp-wrap">
             <h1 style="display:flex;align-items:center;gap:10px;">
                 <span class="dashicons dashicons-rest-api" style="font-size:26px;width:26px;height:26px;color:#2271b1;"></span>
-                AskTam MCP
+                AskTam MCP <span style="font-size:12px;font-weight:400;color:#999;background:#f0f0f0;padding:2px 8px;border-radius:10px;">v<?php echo esc_html(ASKTAM_MCP_VERSION); ?></span>
-                <span style="font-size:12px;font-weight:400;color:#999;background:#f0f0f0;padding:2px 8px;border-radius:10px;">v<?php echo esc_html(ASKTAM_MCP_VERSION); ?></span>
             </h1>
 
+            <?php if (!$isHttps): ?>
+            <div class="mcp-warn">⚠️ <strong>HTTPS not detected.</strong> The MCP endpoint is accessible over HTTP — tokens can be intercepted in transit. Enable SSL before using this plugin in production. <a href="<?php echo esc_url(admin_url('admin.php?page=asktam-mcp-settings')); ?>">Disable this warning →</a></div>
+            <?php endif; ?>
+
             <div class="mcp-endpoint-bar">
                 <strong>SSE Endpoint:</strong>
                 <code id="mcp-sse-url"><?php echo esc_html($sseUrl); ?></code>
@@ -98,17 +73,14 @@ class AdminMenu {
                 <a href="<?php echo esc_url(rest_url('asktam-mcp/v1/info')); ?>" target="_blank" class="button button-small">Info →</a>
             </div>
 
-            <!-- Generate key form -->
+            <!-- Generate key -->
             <div class="mcp-generate-form">
                 <h3>Generate API Key</h3>
                 <form method="post" action="<?php echo esc_url(admin_url('admin-post.php')); ?>">
                     <?php wp_nonce_field('asktam_mcp_create_key', '_wpnonce_mcp'); ?>
                     <input type="hidden" name="action" value="asktam_mcp_create_key">
                     <div class="mcp-form-row">
-                        <div>
+                        <div><label for="mcp-key-name">Label</label><input type="text" id="mcp-key-name" name="key_name" placeholder="e.g. Claude Desktop" required></div>
-                            <label for="mcp-key-name">Label</label>
-                            <input type="text" id="mcp-key-name" name="key_name" placeholder="e.g. Claude Desktop, GPT Action" required>
-                        </div>
                         <div>
                             <label>Scopes</label>
                             <div class="mcp-scope-checks">
@@ -120,147 +92,170 @@ class AdminMenu {
                         </div>
                         <div><?php submit_button('Generate', 'primary', 'submit', false, ['style' => 'height:34px;margin:0;']); ?></div>
                     </div>
-                    <p style="margin:0;color:#888;font-size:12px;"><strong>Read</strong> = list/get &nbsp;·&nbsp; <strong>Write</strong> = create/update/delete content &nbsp;·&nbsp; <strong>Admin</strong> = plugins/themes/users/options (supersedes all) &nbsp;·&nbsp; <strong>WooCommerce</strong> = product/order mutations</p>
+                    <p style="margin:0;color:#888;font-size:12px;"><strong>Read</strong> = list/get &nbsp;·&nbsp; <strong>Write</strong> = create/update/delete content &nbsp;·&nbsp; <strong>Admin</strong> = full access (supersedes all) &nbsp;·&nbsp; <strong>WooCommerce</strong> = product/order mutations</p>
                 </form>
             </div>
 
             <!-- Integration cards -->
             <div class="mcp-cards">
-
-                <!-- Claude -->
                 <div class="mcp-card">
-                    <h3>
+                    <h3><svg width="20" height="20" viewBox="0 0 24 24" fill="none"><circle cx="12" cy="12" r="12" fill="#D97757"/><path d="M7.5 16.5L12 7.5L16.5 16.5" stroke="white" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round"/><path d="M9 13.5H15" stroke="white" stroke-width="1.8" stroke-linecap="round"/></svg> Claude (claude.ai / Claude Desktop)</h3>
-                        <svg width="20" height="20" viewBox="0 0 24 24" fill="none"><circle cx="12" cy="12" r="12" fill="#D97757"/><path d="M7.5 16.5L12 7.5L16.5 16.5" stroke="white" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round"/><path d="M9 13.5H15" stroke="white" stroke-width="1.8" stroke-linecap="round"/></svg>
+                    <p>Add as custom connector. URL + your API key as OAuth Client ID and secret.</p>
-                        Claude (claude.ai / Claude Desktop)
-                    </h3>
-                    <p>Add as a remote MCP server. In the connector dialog, paste the SSE URL and your API key into the <strong>token field</strong> (leave OAuth Client ID blank).</p>
-
                     <strong style="font-size:12px;color:#555;display:block;margin-bottom:4px;">claude.ai → Settings → Connectors → Add custom connector</strong>
                     <pre style="font-size:12px;background:#f6f7f7;color:#333;border:1px solid #ddd;padding:10px 12px;border-radius:5px;margin-bottom:12px;">URL:              <span style="color:#2271b1;"><?php echo esc_html($sseUrl); ?></span>
-Token:  <span style="color:#b45309;">YOUR_API_KEY  ← paste here</span>
+OAuth Client ID:  <span style="color:#b45309;">YOUR_API_KEY</span>
-OAuth Client ID: (leave blank)</pre>
+Client Secret:    <span style="color:#b45309;">YOUR_API_KEY</span> (same)</pre>
-
                     <strong style="font-size:12px;color:#555;display:block;margin-bottom:4px;">Claude Desktop → claude_desktop_config.json</strong>
-                    <pre id="claude-desktop-config" style="position:relative;">{
+                    <pre id="claude-desktop" style="position:relative;">{
   "mcpServers": {
     "wordpress": {
-      "url": "<span class="key-url"><?php echo esc_html($sseUrl); ?></span>",
+      "url": "<span class="ku"><?php echo esc_html($sseUrl); ?></span>",
-      "headers": {
+      "headers": { "Authorization": "Bearer <span class="kp">YOUR_API_KEY</span>" }
-        "Authorization": "Bearer <span class="key-placeholder">YOUR_API_KEY</span>"
-      }
     }
   }
 }
-<button class="copy-btn" onclick="copyCode('claude-desktop-config',this)">Copy</button></pre>
+<button class="copy-btn" onclick="copyPre('claude-desktop',this)">Copy</button></pre>
                 </div>
-
-                <!-- OpenAI -->
                 <div class="mcp-card">
-                    <h3>
+                    <h3><svg width="20" height="20" viewBox="0 0 24 24" fill="none"><circle cx="12" cy="12" r="12" fill="#10a37f"/><path d="M12 6.5C9 6.5 7 8.8 7 11.5C7 13.2 7.9 14.7 9.2 15.6L8.5 17.5H15.5L14.8 15.6C16.1 14.7 17 13.2 17 11.5C17 8.8 15 6.5 12 6.5Z" stroke="white" stroke-width="1.5" stroke-linejoin="round"/><line x1="10" y1="12" x2="14" y2="12" stroke="white" stroke-width="1.5" stroke-linecap="round"/></svg> OpenAI (GPT Actions)</h3>
-                        <svg width="20" height="20" viewBox="0 0 24 24" fill="none"><circle cx="12" cy="12" r="12" fill="#10a37f"/><path d="M12 6.5C9 6.5 7 8.8 7 11.5C7 13.2 7.9 14.7 9.2 15.6L8.5 17.5H15.5L14.8 15.6C16.1 14.7 17 13.2 17 11.5C17 8.8 15 6.5 12 6.5Z" stroke="white" stroke-width="1.5" stroke-linejoin="round"/><line x1="10" y1="12" x2="14" y2="12" stroke="white" stroke-width="1.5" stroke-linecap="round"/></svg>
+                    <p>Import OpenAPI schema. Auth via API Key in <code>X-MCP-API-Key</code> header.</p>
-                        OpenAI (GPT Actions / Assistants)
-                    </h3>
-                    <p>Import the OpenAPI schema into a Custom GPT Action. Auth via API Key in the <code>X-MCP-API-Key</code> header.</p>
-
                     <strong style="font-size:12px;color:#555;display:block;margin-bottom:4px;">GPT Builder → Actions → Import from URL</strong>
-                    <pre id="openai-schema-url" style="position:relative;"><span class="key-url"><?php echo esc_html(rest_url('asktam-mcp/v1/openapi.json')); ?></span>
+                    <pre id="openai-url" style="position:relative;"><span class="ku"><?php echo esc_html(rest_url('asktam-mcp/v1/openapi.json')); ?></span>
-<button class="copy-btn" onclick="copyCode('openai-schema-url',this)">Copy</button></pre>
+<button class="copy-btn" onclick="copyPre('openai-url',this)">Copy</button></pre>
-
+                    <strong style="font-size:12px;color:#555;display:block;margin-bottom:4px;">Authentication → API Key → Header name: <code>X-MCP-API-Key</code></strong>
-                    <strong style="font-size:12px;color:#555;display:block;margin-bottom:4px;">Authentication → API Key → Header name</strong>
-                    <pre>{
-  "type": "apiKey",
-  "in": "header",
-  "name": "<span class="key-placeholder">X-MCP-API-Key</span>"
-}</pre>
                 </div>
-
             </div>
 
             <!-- Keys table -->
             <h2 style="margin-bottom:12px;">API Keys</h2>
             <?php if ($keys): ?>
             <table class="mcp-key-table">
-                <thead>
+                <thead><tr><th>Label</th><th>Key (masked)</th><th>Scopes</th><th>Created</th><th>Last Used</th><th>Status</th><th></th></tr></thead>
-                    <tr><th>Label</th><th>Key (masked)</th><th>Scopes</th><th>Created</th><th>Last Used</th><th>Status</th><th></th></tr>
-                </thead>
                 <tbody>
-                <?php foreach ($keys as $key): ?>
+                <?php foreach ($keys as $k): ?>
                 <tr>
-                        <td><strong><?php echo esc_html($key->name); ?></strong></td>
+                    <td><strong><?php echo esc_html($k->name); ?></strong></td>
                     <td>
-                            <code style="font-size:12px;background:#f6f7f7;padding:2px 8px;border-radius:3px;"><?php echo esc_html(substr($key->api_key, 0, 8) . '•••••••••••••' . substr($key->api_key, -4)); ?></code>
+                        <code style="font-size:12px;background:#f6f7f7;padding:2px 8px;border-radius:3px;"><?php echo esc_html(substr($k->api_key,0,8).'•••••••••••••'.substr($k->api_key,-4)); ?></code>
-                            <button onclick="navigator.clipboard.writeText('<?php echo esc_js($key->api_key); ?>');this.textContent='✓ Copied';setTimeout(()=>this.textContent='Copy',2000)" class="button button-small" style="margin-left:6px;">Copy</button>
+                        <button onclick="navigator.clipboard.writeText('<?php echo esc_js($k->api_key); ?>');this.textContent='✓';setTimeout(()=>this.textContent='Copy',2000)" class="button button-small" style="margin-left:6px;">Copy</button>
                     </td>
-                        <td><?php foreach (array_map('trim', explode(',', $key->scopes)) as $s): ?><span class="mcp-scope"><?php echo esc_html($s); ?></span><?php endforeach; ?></td>
+                    <td><?php foreach (array_map('trim',explode(',',$k->scopes)) as $s): ?><span class="mcp-scope"><?php echo esc_html($s); ?></span><?php endforeach; ?></td>
-                        <td style="color:#666;font-size:12px;"><?php echo esc_html(date('Y-m-d', strtotime($key->created_at))); ?></td>
+                    <td style="color:#666;font-size:12px;"><?php echo esc_html(date('Y-m-d',strtotime($k->created_at))); ?></td>
-                        <td style="color:#666;font-size:12px;"><?php echo $key->last_used ? esc_html(date('Y-m-d H:i', strtotime($key->last_used))) : '—'; ?></td>
+                    <td style="color:#666;font-size:12px;"><?php echo $k->last_used ? esc_html(date('Y-m-d H:i',strtotime($k->last_used))) : '—'; ?></td>
-                        <td><span class="mcp-badge <?php echo $key->is_active ? 'mcp-badge-active' : 'mcp-badge-inactive'; ?>"><?php echo $key->is_active ? 'Active' : 'Inactive'; ?></span></td>
+                    <td><span class="mcp-badge <?php echo $k->is_active ? 'mcp-ok' : 'mcp-no'; ?>"><?php echo $k->is_active ? 'Active' : 'Inactive'; ?></span></td>
                     <td>
                         <form method="post" action="<?php echo esc_url(admin_url('admin-post.php')); ?>" style="display:inline;">
-                                <?php wp_nonce_field('asktam_mcp_revoke_' . $key->id, '_wpnonce_mcp'); ?>
+                            <?php wp_nonce_field('asktam_mcp_revoke_'.$k->id,'_wpnonce_mcp'); ?>
                             <input type="hidden" name="action" value="asktam_mcp_revoke_key">
-                                <input type="hidden" name="key_id" value="<?php echo (int) $key->id; ?>">
+                            <input type="hidden" name="key_id" value="<?php echo (int)$k->id; ?>">
-                                <button type="submit" class="button button-small" onclick="return confirm('Revoke key for <?php echo esc_js($key->name); ?>?')" <?php echo !$key->is_active ? 'disabled' : ''; ?>>Revoke</button>
+                            <button type="submit" class="button button-small" onclick="return confirm('Revoke key for <?php echo esc_js($k->name); ?>?')" <?php echo !$k->is_active?'disabled':''; ?>>Revoke</button>
                         </form>
                     </td>
                 </tr>
                 <?php endforeach; ?>
                 </tbody>
             </table>
-            <?php else: ?>
+            <?php else: ?><p style="color:#888;">No keys yet. Generate one above.</p><?php endif; ?>
-                <p style="color:#888;">No keys yet. Generate one above.</p>
-            <?php endif; ?>
-        </div>
 
+            <!-- Danger zone: rotate secret -->
+            <h2 style="margin-top:32px;margin-bottom:12px;">Security</h2>
+            <div class="mcp-danger">
+                <strong>⚠ Rotate JWT Secret</strong>
+                <p style="margin:8px 0;font-size:13px;color:#555;">Immediately invalidates <strong>all active JWT tokens</strong> across all connected AI clients. They will need to re-authenticate. Use if you suspect a token leak.</p>
+                <form method="post" action="<?php echo esc_url(admin_url('admin-post.php')); ?>" onsubmit="return confirm('This will disconnect all active AI clients immediately. Confirm?')">
+                    <?php wp_nonce_field('asktam_mcp_rotate_secret','_wpnonce_rotate'); ?>
+                    <input type="hidden" name="action" value="asktam_mcp_rotate_secret">
+                    <button type="submit" class="button" style="background:#dc3545;color:#fff;border-color:#dc3545;">Rotate JWT Secret Now</button>
+                </form>
+            </div>
+        </div>
         <script>
-        function copyCode(id, btn) {
+        function copyPre(id,btn){const el=document.getElementById(id);const text=el.innerText.replace(/Copy$/,'').trim();navigator.clipboard.writeText(text);btn.textContent='✓ Copied';setTimeout(()=>btn.textContent='Copy',2000);}
-            const el = document.getElementById(id);
-            const text = el.innerText.replace(/\bCopy\b.*$/, '').trim();
-            navigator.clipboard.writeText(text);
-            btn.textContent = '✓ Copied';
-            setTimeout(() => btn.textContent = 'Copy', 2000);
-        }
         </script>
         <?php
     }
 
+    // -------------------------------------------------------------------------
+    // Activity Log
+    // -------------------------------------------------------------------------
+    public function renderLog(): void {
+        global $wpdb;
+        $page    = max(1, (int) ($_GET['paged'] ?? 1));
+        $perPage = 50;
+        $offset  = ($page - 1) * $perPage;
+        $total   = (int) $wpdb->get_var("SELECT COUNT(*) FROM {$wpdb->prefix}asktam_mcp_log");
+        $logs    = $wpdb->get_results($wpdb->prepare(
+            "SELECT l.*, k.name as key_name
+             FROM {$wpdb->prefix}asktam_mcp_log l
+             LEFT JOIN {$wpdb->prefix}asktam_mcp_keys k ON l.key_id = k.id
+             ORDER BY l.created_at DESC LIMIT %d OFFSET %d",
+            $perPage, $offset
+        ));
+        $pages = ceil($total / $perPage);
+        ?>
+        <div class="wrap mcp-wrap">
+            <h1>AskTam MCP — Activity Log</h1>
+            <p style="color:#888;margin-bottom:16px;"><?php echo number_format($total); ?> total entries · 90-day retention</p>
+
+            <?php if ($logs): ?>
+            <table class="mcp-log-table">
+                <thead><tr><th>Time</th><th>Key</th><th>Tool</th><th>IP</th><th>Duration</th><th>Status</th></tr></thead>
+                <tbody>
+                <?php foreach ($logs as $l): ?>
+                <tr>
+                    <td style="color:#666;"><?php echo esc_html(date('Y-m-d H:i:s', strtotime($l->created_at))); ?></td>
+                    <td><?php echo esc_html($l->key_name ?? "key #{$l->key_id}"); ?></td>
+                    <td><code><?php echo esc_html($l->tool); ?></code></td>
+                    <td style="color:#888;font-size:11px;"><?php echo esc_html($l->ip); ?></td>
+                    <td style="color:#888;"><?php echo (int)$l->duration_ms; ?>ms</td>
+                    <td><?php echo $l->status ? '<span class="mcp-dot-ok">✓</span>' : '<span class="mcp-dot-fail">✗</span>'; ?></td>
+                </tr>
+                <?php endforeach; ?>
+                </tbody>
+            </table>
+            <?php if ($pages > 1): ?>
+            <div style="margin-top:16px;">
+                <?php for ($i = 1; $i <= $pages; $i++): ?>
+                    <a href="<?php echo esc_url(add_query_arg('paged', $i)); ?>" class="button button-small" <?php echo $i === $page ? 'style="font-weight:700;"' : ''; ?>><?php echo $i; ?></a>
+                <?php endfor; ?>
+            </div>
+            <?php endif; ?>
+            <?php else: ?><p style="color:#888;">No activity logged yet.</p><?php endif; ?>
+        </div>
+        <?php
+    }
+
+    // -------------------------------------------------------------------------
+    // Settings
+    // -------------------------------------------------------------------------
     public function renderSettings(): void {
-        $settings = get_option('asktam_mcp_settings', []);
+        $s = get_option('asktam_mcp_settings', []);
         ?>
         <div class="wrap mcp-wrap">
             <h1>AskTam MCP — Settings</h1>
             <form method="post" action="options.php">
-                <?php
+                <?php settings_fields('asktam_mcp_settings_group'); do_settings_sections('asktam_mcp_settings_group'); ?>
-                settings_fields('asktam_mcp_settings_group');
-                do_settings_sections('asktam_mcp_settings_group');
-                ?>
                 <table class="form-table" style="max-width:600px;">
-                    <tr>
+                    <tr><th>Rate Limit (req/min per key)</th><td><input type="number" name="asktam_mcp_settings[rate_limit]" value="<?php echo (int)($s['rate_limit']??60); ?>" min="1" max="300" class="small-text"></td></tr>
-                        <th>Rate Limit (req/min per key)</th>
+                    <tr><th>Require HTTPS</th><td><input type="checkbox" name="asktam_mcp_settings[require_https]" value="1" <?php checked($s['require_https']??true); ?>><p class="description">Block all MCP requests over HTTP.</p></td></tr>
-                        <td><input type="number" name="asktam_mcp_settings[rate_limit]" value="<?php echo (int) ($settings['rate_limit'] ?? 60); ?>" min="1" max="300" class="small-text"></td>
+                    <tr><th>Log Requests</th><td><input type="checkbox" name="asktam_mcp_settings[log_requests]" value="1" <?php checked($s['log_requests']??true); ?>></td></tr>
-                    </tr>
+                    <tr><th>Allow Raw SQL <span style="font-weight:400;color:#888;">(admin scope)</span></th><td><input type="checkbox" name="asktam_mcp_settings[allow_raw_sql]" value="1" <?php checked($s['allow_raw_sql']??false); ?>><p class="description">Allows admin-scoped keys to run SELECT queries.</p></td></tr>
-                    <tr>
+                    <tr><th>WooCommerce Tools</th><td><input type="checkbox" name="asktam_mcp_settings[wc_enabled]" value="1" <?php checked($s['wc_enabled']??class_exists('WooCommerce')); ?> <?php echo !class_exists('WooCommerce')?'disabled':''; ?>><p class="description"><?php echo class_exists('WooCommerce')?'WooCommerce detected ✓':'WooCommerce not active'; ?></p></td></tr>
-                        <th>Log Requests</th>
-                        <td><input type="checkbox" name="asktam_mcp_settings[log_requests]" value="1" <?php checked($settings['log_requests'] ?? true); ?>></td>
-                    </tr>
-                    <tr>
-                        <th>Allow Raw SQL <span style="font-weight:400;color:#888;">(admin scope only)</span></th>
-                        <td>
-                            <input type="checkbox" name="asktam_mcp_settings[allow_raw_sql]" value="1" <?php checked($settings['allow_raw_sql'] ?? false); ?>>
-                            <p class="description">Allows admin-scoped keys to execute SELECT queries directly.</p>
-                        </td>
-                    </tr>
-                    <tr>
-                        <th>WooCommerce Tools</th>
-                        <td>
-                            <input type="checkbox" name="asktam_mcp_settings[wc_enabled]" value="1" <?php checked($settings['wc_enabled'] ?? class_exists('WooCommerce')); ?> <?php echo !class_exists('WooCommerce') ? 'disabled' : ''; ?>>
-                            <p class="description"><?php echo class_exists('WooCommerce') ? 'WooCommerce detected ✓' : 'WooCommerce not active'; ?></p>
-                        </td>
-                    </tr>
                 </table>
                 <?php submit_button(); ?>
             </form>
         </div>
         <?php
     }
+
+    // -------------------------------------------------------------------------
+    // Rotate secret action
+    // -------------------------------------------------------------------------
+    public function handleRotateSecret(): void {
+        if (!current_user_can('manage_options')) wp_die('Unauthorized');
+        check_admin_referer('asktam_mcp_rotate_secret', '_wpnonce_rotate');
+        TokenManager::rotateSecret();
+        wp_redirect(add_query_arg(['mcp_notice' => 'rotated'], admin_url('admin.php?page=asktam-mcp')));
+        exit;
+    }
 }