{% if perms.core.killian_administration_view %}
<section class="module-panel" style="margin-top:22px;">
    <div class="module-panel-head">
        <div>
            <h2>Security</h2>
            <span>Global authentication and credential-reveal policy</span>
        </div>

        <div
            id="security-policy-warning"
            class="security-policy-warning"
            {% if system_settings.enforce_mfa or system_settings.require_mfa_for_credential_reveal %}hidden{% endif %}
        >
            2FA and Reveal Security Disabled (NOT RECOMMENDED)
        </div>
    </div>

    {% if perms.core.killian_security_manage %}
    <form method="post" style="padding:22px;">
        {% csrf_token %}
        <input type="hidden" name="action" value="save_security">

        <div class="toggle-row">
            <label
                class="toggle-switch-control"
                title="Toggle Enforce 2FA for all users"
            >
                <input
                    id="security-enforce-mfa"
                    type="checkbox"
                    name="enforce_mfa"
                    aria-label="Enforce 2FA for all users"
                    {% if system_settings.enforce_mfa %}checked{% endif %}
                >
                <span class="toggle-switch" aria-hidden="true"></span>
            </label>

            <span class="toggle-label">
                Enforce 2FA for all users
            </span>
        </div>

        <p class="muted" style="margin:10px 0 20px;">
            When disabled, users may still enable 2FA individually from the 2FA link
            in their account area. Accounts that already have 2FA enabled will continue
            to require it.
        </p>

        <div class="toggle-row">
            <label
                class="toggle-switch-control"
                title="Toggle Require 2FA when revealing credentials"
            >
                <input
                    id="security-reveal-mfa"
                    type="checkbox"
                    name="require_mfa_for_credential_reveal"
                    aria-label="Require 2FA when revealing credentials"
                    {% if system_settings.require_mfa_for_credential_reveal %}checked{% endif %}
                >
                <span class="toggle-switch" aria-hidden="true"></span>
            </label>

            <span class="toggle-label">
                Require 2FA when revealing credentials
            </span>
        </div>

        <p class="muted" style="margin:10px 0 20px;">
            When enabled, Killian requires a recent authenticator verification for every
            user before stored passwords or OTP values can be revealed. When global
            credential-reveal enforcement is disabled, Admin and Management accounts may
            control their own reveal-2FA preference. User-level and custom non-management
            roles cannot disable credential-reveal 2FA. Credential reveals are still
            written to the Audit Log.
        </p>

        <div class="security-window-setting">
            <label for="credential-reveal-mfa-window">
                Credential reveal 2FA validity
            </label>

            {% if can_adjust_credential_reveal_window %}
                <div class="security-window-input">
                    <input
                        id="credential-reveal-mfa-window"
                        type="number"
                        name="credential_reveal_mfa_window_hours"
                        min="1"
                        max="12"
                        step="1"
                        value="{{ system_settings.credential_reveal_mfa_window_hours }}"
                        required
                    >
                    <span>hours</span>
                </div>

                <p class="muted">
                    Administrator-only setting. Enter 1–12 hours. After this period,
                    another authenticator verification is required before protected
                    credentials or OTP values can be revealed or copied.
                </p>
            {% else %}
                <strong>
                    {{ system_settings.credential_reveal_mfa_window_hours }}
                    hour{{ system_settings.credential_reveal_mfa_window_hours|pluralize }}
                </strong>

                <p class="muted">
                    Only Administrators can change this setting.
                </p>
            {% endif %}
        </div>

        <button type="submit">Save Security Settings</button>
    </form>

    {% else %}

    <div style="padding:22px;">
        <strong>
            2FA enforcement:
            {% if system_settings.enforce_mfa %}Enabled{% else %}Disabled{% endif %}
        </strong>

        <div style="margin-top:8px;">
            <strong>
                Credential reveal 2FA:
                {% if system_settings.require_mfa_for_credential_reveal %}
                    Required
                {% else %}
                    Not globally required
                {% endif %}
            </strong>
        </div>

        <div style="margin-top:8px;">
            <strong>
                Credential reveal 2FA validity:
                {{ system_settings.credential_reveal_mfa_window_hours }}
                hour{{ system_settings.credential_reveal_mfa_window_hours|pluralize }}
            </strong>
        </div>

        <p class="muted" style="margin-top:10px;">
            Your role can view Administration but cannot change global security settings.
        </p>
    </div>

    {% endif %}
</section>


{% endif %}