<?php
$bp = Auth::basePath();
$user = Auth::user();
$hasTotp = AuthFactors::hasTotp((int) ($user['id'] ?? 0));
$issuer = (string) cfg('app_name', 'Android Cast');
$account = (string) ($user['username'] ?? '');
$otpUri = $totpSecret ? AuthTotp::provisioningUri($totpSecret, $account, $issuer) : '';
$qrUrl = $otpUri !== '' ? AuthTotp::qrImageUrl($otpUri) : '';
?>
<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <title>Account security — <?= h(cfg('app_name')) ?></title>
  <script>
    (function () {
      var l = localStorage.getItem('crash_console_lang');
      if (l === 'en' || l === 'ru') document.documentElement.setAttribute('lang', l);
    })();
  </script>
  <link rel="stylesheet" href="<?= h($bp) ?>/assets/css/app.css">
  <script src="<?= h($bp) ?>/assets/js/i18n.js" defer></script>
</head>
<body class="login-page" data-base-path="<?= h($bp) ?>">
  <div class="login-card" style="max-width:28rem">
    <h1 data-i18n="security.title">Account security</h1>
    <p class="muted"><?= h($account) ?></p>
    <?php if (!empty($securityError)): ?>
      <div class="alert"><?= h($securityError) ?></div>
    <?php endif; ?>
    <?php if (!empty($securitySuccess)): ?>
      <div class="alert alert--ok"><?= h($securitySuccess) ?></div>
    <?php endif; ?>

    <?php if ($hasTotp): ?>
      <p data-i18n="security.totp_enabled">Authenticator app is enrolled.</p>
      <form method="post" action="<?= h($bp) ?>/account-security" onsubmit="return confirm('Remove authenticator?');">
        <input type="hidden" name="action" value="remove_totp">
        <button type="submit" class="btn btn--secondary" data-i18n="security.remove_totp">Remove authenticator</button>
      </form>
    <?php elseif ($totpSecret): ?>
      <p data-i18n="security.scan_qr">Scan this QR code with your authenticator app, then enter a code to confirm.</p>
      <?php if ($qrUrl): ?>
        <p style="text-align:center"><img src="<?= h($qrUrl) ?>" width="200" height="200" alt="TOTP QR" loading="lazy"></p>
      <?php endif; ?>
      <details class="hint">
        <summary data-i18n="security.manual_secret">Can’t scan?</summary>
        <code style="word-break:break-all"><?= h($totpSecret) ?></code>
      </details>
      <form method="post" action="<?= h($bp) ?>/account-security">
        <input type="hidden" name="action" value="confirm_totp">
        <label><span data-i18n="twofa.code">Authentication code</span>
          <input name="code" inputmode="numeric" pattern="[0-9]{6}" maxlength="6" required></label>
        <button type="submit" data-i18n="security.confirm_totp">Confirm enrollment</button>
      </form>
    <?php else: ?>
      <p data-i18n="security.totp_intro">Protect your account with a 6-digit authenticator app (recommended for alpha).</p>
      <form method="post" action="<?= h($bp) ?>/account-security">
        <input type="hidden" name="action" value="start_totp">
        <button type="submit" data-i18n="security.start_totp">Set up authenticator</button>
      </form>
    <?php endif; ?>

    <p class="hint" style="margin-top:1.5rem"><a href="<?= h($bp) ?>/" data-i18n="security.back_console">Back to console</a></p>
  </div>
  <?php platform_render_footer(); ?>
</body>
</html>
