@extends('layouts.app')

@section('title', 'Security')

@section('content')
<div class="container">
    <div class="row justify-content-center">
        <div class="col-lg-7">
            <div class="card section-card">
                <div class="card-body p-4">
                    <h1 class="h3 mb-4">Account security</h1>
                    <p class="text-muted">Use an authenticator app for time-based one-time passwords. Recovery codes should be stored somewhere safe.</p>

                    @if($user->two_factor_confirmed_at)
                        <div class="alert alert-success">Two-factor authentication is enabled.</div>
                        <div class="mb-4">
                            <h2 class="h5">Recovery codes</h2>
                            <div class="row g-2">
                                @foreach($recoveryCodes as $code)
                                    <div class="col-md-6">
                                        <div class="border rounded-4 p-2 small font-monospace">{{ $code }}</div>
                                    </div>
                                @endforeach
                            </div>
                        </div>
                        <div class="d-flex flex-wrap gap-2">
                            <form method="post" action="{{ route('account.security.recovery-codes') }}">
                                @csrf
                                <button class="btn btn-outline-primary">Regenerate recovery codes</button>
                            </form>
                            <form method="post" action="{{ route('account.security.disable') }}">
                                @csrf
                                @method('DELETE')
                                <button class="btn btn-outline-danger">Disable MFA</button>
                            </form>
                        </div>
                    @else
                        @if(!$user->two_factor_secret)
                            <form method="post" action="{{ route('account.security.enable') }}">
                                @csrf
                                <button class="btn btn-primary">Start MFA setup</button>
                            </form>
                        @else
                            <p class="text-muted">Scan the QR code with your authenticator app, then confirm with a 6-digit code.</p>
                            <div class="text-center mb-3">{!! $qrSvg !!}</div>
                            <div class="alert alert-secondary small" style="word-break: break-all">{{ $otpauthUrl }}</div>

                            <form method="post" action="{{ route('account.security.confirm') }}" class="row g-3">
                                @csrf
                                <div class="col-md-6">
                                    <input name="code" class="form-control" placeholder="123456">
                                </div>
                                <div class="col-md-6">
                                    <button class="btn btn-primary w-100">Confirm MFA</button>
                                </div>
                            </form>
                        @endif
                    @endif
                </div>
            </div>
        </div>
    </div>
</div>
@endsection