{% extends 'administration/base.html.twig' %}

{% block title %}{{ 'admin.two_factor.settings'|trans }}{% endblock %}

{% block body %}
<div class="container mt-4">
    <div class="row justify-content-center">
        <div class="col-lg-8">
            <div class="admin-card p-4">
                <h1 class="h4 mb-3">{{ 'admin.two_factor.settings'|trans }}</h1>
                <p class="text-muted">{{ 'admin.two_factor.intro'|trans }}</p>

                {% for label, messages in app.flashes %}
                    {% for message in messages %}
                        <div class="alert alert-{{ label == 'error' ? 'danger' : (label == 'info' ? 'info' : 'success') }}">{{ message }}</div>
                    {% endfor %}
                {% endfor %}

                {% if not user.hasAdminRole() %}
                    <div class="alert alert-warning">{{ 'admin.two_factor.admin_only'|trans }}</div>
                {% else %}
                    <h2 class="h5 mt-4 mb-3">{{ 'admin.two_factor.section_totp'|trans }}</h2>
                    {% if user.isTotpAuthenticationEnabled() %}
                        <div class="alert alert-success">
                            <i class="bi bi-shield-check me-2"></i>{{ 'admin.two_factor.active'|trans }}
                        </div>
                        <form method="post" action="{{ path('admin_two_factor_disable') }}" onsubmit="return confirm({{ 'admin.two_factor.confirm_disable'|trans|json_encode|e('html_attr') }});">
                            <input type="hidden" name="_csrf_token" value="{{ csrf_token('two_factor_disable') }}">
                            <button type="submit" class="btn btn-outline-danger">{{ 'admin.two_factor.disable'|trans }}</button>
                        </form>
                    {% elseif user.isTotpSetupPending() %}
                        <p class="fw-semibold">{{ 'admin.two_factor.step_confirm'|trans }}</p>
                        {% if qrDataUri %}
                            <div class="text-center mb-3">
                                <img src="{{ qrDataUri }}" alt="QR" class="img-fluid border rounded" style="max-width: 260px;" />
                            </div>
                        {% endif %}
                        <form method="post" action="{{ path('admin_two_factor_confirm') }}" class="row g-2 align-items-end mb-3">
                            <input type="hidden" name="_csrf_token" value="{{ csrf_token('two_factor_confirm') }}">
                            <div class="col-md-4">
                                <label class="form-label" for="code">{{ 'admin.two_factor.code_label'|trans }}</label>
                                <input type="text" name="code" id="code" class="form-control" inputmode="numeric" pattern="[0-9]*" autocomplete="one-time-code" required maxlength="10" placeholder="123456" />
                            </div>
                            <div class="col-md-8">
                                <button type="submit" class="btn btn-primary">{{ 'admin.two_factor.confirm'|trans }}</button>
                            </div>
                        </form>
                        <form method="post" action="{{ path('admin_two_factor_cancel_setup') }}">
                            <input type="hidden" name="_csrf_token" value="{{ csrf_token('two_factor_cancel') }}">
                            <button type="submit" class="btn btn-link text-muted px-0">{{ 'admin.two_factor.cancel_setup'|trans }}</button>
                        </form>
                    {% else %}
                        <p>{{ 'admin.two_factor.inactive'|trans }}</p>
                        <form method="post" action="{{ path('admin_two_factor_start') }}">
                            <input type="hidden" name="_csrf_token" value="{{ csrf_token('two_factor_start') }}">
                            <button type="submit" class="btn btn-primary">{{ 'admin.two_factor.enable'|trans }}</button>
                        </form>
                    {% endif %}

                    <hr class="my-4">

                    <h2 class="h5 mb-3">{{ 'admin.two_factor.section_passkeys'|trans }}</h2>
                    <p class="text-muted small">{{ 'admin.two_factor.passkeys_intro'|trans }}</p>
                    <a href="{{ path('admin_two_factor_passkey_register') }}" class="btn btn-outline-primary mb-3">{{ 'admin.two_factor.passkey_add'|trans }}</a>

                    {% set passkeys = user.webauthnKeyEntities %}
                    {% if passkeys is not empty %}
                        <ul class="list-group list-group-flush border rounded">
                            {% for key in passkeys %}
                                <li class="list-group-item d-flex justify-content-between align-items-center flex-wrap gap-2">
                                    <div>
                                        <span class="fw-medium">{% if key.label %}{{ key.label }}{% else %}{{ 'admin.two_factor.passkey_unnamed'|trans }}{% endif %}</span>
                                        <span class="text-muted small ms-2">{{ key.createdAt|date('Y-m-d H:i') }}</span>
                                    </div>
                                    <form method="post" action="{{ path('admin_two_factor_passkey_delete', { id: key.id }) }}" class="mb-0" onsubmit="return confirm({{ 'admin.two_factor.passkey_confirm_remove'|trans|json_encode|e('html_attr') }});">
                                        <input type="hidden" name="_csrf_token" value="{{ csrf_token('passkey_delete_' ~ key.id) }}">
                                        <button type="submit" class="btn btn-sm btn-outline-danger">{{ 'admin.two_factor.passkey_remove'|trans }}</button>
                                    </form>
                                </li>
                            {% endfor %}
                        </ul>
                    {% else %}
                        <p class="text-muted mb-0">{{ 'admin.two_factor.passkeys_none'|trans }}</p>
                    {% endif %}

                    {% if user.isTotpAuthenticationEnabled() and user.isWebAuthnAuthenticatorEnabled() %}
                    <hr class="my-4">
                    <h2 class="h5 mb-3">{{ 'admin.two_factor.section_preferred'|trans }}</h2>
                    <p class="text-muted small mb-3">{{ 'admin.two_factor.preferred_intro'|trans }}</p>
                    <form method="post" action="{{ path('admin_two_factor_set_preferred') }}">
                        <input type="hidden" name="_csrf_token" value="{{ csrf_token('two_factor_preferred') }}">
                        <div class="d-flex flex-wrap gap-2 align-items-center">
                            <select name="preferred_provider" class="form-select" style="max-width: 320px;">
                                <option value="totp"{{ user.preferredTwoFactorProvider == 'totp' ? ' selected' : '' }}>{{ 'admin.two_factor.provider_totp'|trans }}</option>
                                <option value="webauthn_two_factor_provider"{{ user.preferredTwoFactorProvider == 'webauthn_two_factor_provider' ? ' selected' : '' }}>{{ 'admin.two_factor.provider_passkey'|trans }}</option>
                            </select>
                            <button type="submit" class="btn btn-outline-primary btn-sm">{{ 'admin.two_factor.preferred_save'|trans }}</button>
                        </div>
                    </form>
                    {% endif %}

                    <hr class="my-4">

                    <h2 class="h5 mb-3">{{ 'admin.two_factor.section_recovery'|trans }}</h2>
                    {% if user.hasAnySecondFactorEnabled %}
                        {% if user.recoveryCodesCompletedAt %}
                            <p class="text-muted small mb-2">{{ 'admin.two_factor.recovery_status_ok'|trans({'%count%': user.recoveryCodes|length}) }}</p>
                            <a href="{{ path('admin_recovery_codes_wizard') }}" class="btn btn-outline-secondary">{{ 'admin.two_factor.recovery_manage'|trans }}</a>
                        {% elseif user.isRecoveryRegenerationRequired %}
                            <div class="alert alert-warning mb-2">{{ 'admin.two_factor.recovery_pending_regen'|trans }}</div>
                            <a href="{{ path('admin_recovery_codes_wizard') }}" class="btn btn-primary">{{ 'admin.two_factor.recovery_open_wizard'|trans }}</a>
                        {% else %}
                            <div class="alert alert-warning mb-2">{{ 'admin.two_factor.recovery_setup_required'|trans }}</div>
                            <a href="{{ path('admin_recovery_codes_wizard') }}" class="btn btn-primary">{{ 'admin.two_factor.recovery_open_wizard'|trans }}</a>
                        {% endif %}
                    {% else %}
                        <p class="text-muted small mb-0">{{ 'admin.two_factor.recovery_need_method'|trans }}</p>
                    {% endif %}
                {% endif %}
            </div>
        </div>
    </div>
</div>
{% endblock %}