{% extends 'core/base.html' %}

{% block content %}

<div class="mfa-settings-stack">

{% if not mfa_enrolled %}

<div class="auth-card wide">
    <h1>Set Up Two-Factor Authentication</h1>

    <p>
        Scan the QR code below with your authenticator application, then
        enter the generated 6-digit code to complete enrollment.
    </p>

    <img
        class="qr"
        src="data:image/png;base64,{{ qr_data }}"
        alt="Authenticator enrollment QR code"
    >

    <p>
        <strong>Manual key:</strong>
        <code>{{ secret }}</code>
    </p>

    <p class="muted">
        This enrollment code is shown only while setting up two-factor
        authentication. After enrollment is complete, Killian will no longer
        display the QR code or manual authenticator key.
    </p>

    <form method="post">
        {% csrf_token %}
        <input
            type="hidden"
            name="action"
            value="enable_mfa"
        >

        <label>Enter the 6-digit code to activate 2FA</label>

        <input
            name="code"
            inputmode="numeric"
            autocomplete="one-time-code"
            required
            autofocus
        >

        <button type="submit">
            Enable 2FA
        </button>
    </form>
</div>

{% else %}

<div class="auth-card wide">
    <h1>Two-Factor Authentication</h1>

    <div class="info-notice">
        <strong>2FA Enabled</strong>
        <span>
            Authenticator-based two-factor authentication is configured
            for this account.
        </span>
    </div>

    <p class="muted" style="margin-top:14px;">
        For security, your authenticator QR code and manual enrollment key
        are not displayed after enrollment.
    </p>
</div>


<div class="auth-card wide">
    <h2 style="margin-top:0;">
        Credential Reveal Security
    </h2>

    <p>
        When credential reveal 2FA is required, one successful
        authenticator verification remains valid for
        <strong>
            {{ system_settings.credential_reveal_mfa_window_hours }}
            hour{{ system_settings.credential_reveal_mfa_window_hours|pluralize }}
        </strong>
        in your current signed-in session.
    </p>

    {% if system_settings.require_mfa_for_credential_reveal %}

        <div class="info-notice">
            <strong>Globally enforced</strong>
            <span>
                Killian currently requires credential reveal 2FA for all
                users. Your personal preference cannot override the global
                policy.
            </span>
        </div>

        <p class="muted" style="margin-top:14px;">
            Current effective policy:
            <strong>2FA required</strong>
        </p>

    {% elif can_manage_reveal_mfa_preference %}

        <form method="post">
            {% csrf_token %}

            <input
                type="hidden"
                name="action"
                value="save_reveal_mfa_preference"
            >

            <label class="toggle-row">
                <input
                    id="reveal-mfa-preference-toggle"
                    type="checkbox"
                    name="require_mfa_for_credential_reveal"
                    data-disable-confirm="Warning: Disabling credential reveal 2FA allows stored passwords and OTP values to be revealed without re-entering your authenticator code. Credential Reveal permission, Restricted Access permission, and audit logging still apply. Disable this protection?"
                    {% if user.security.require_mfa_for_credential_reveal %}checked{% endif %}
                >

                <span
                    class="toggle-switch"
                    aria-hidden="true"
                ></span>

                <span class="toggle-label">
                    Require 2FA when I reveal credentials
                </span>
            </label>

            <p class="muted" style="margin:12px 0 0;">
                Enabled by default. When disabled, this affects only your
                account while global credential reveal enforcement is off.
                Every credential reveal remains recorded in the Audit Log.
            </p>
        </form>

    {% else %}

        <div class="info-notice">
            <strong>2FA required for credential reveals</strong>
            <span>
                User-level and custom non-management roles cannot disable
                credential-reveal 2FA.
            </span>
        </div>

    {% endif %}
</div>

{% endif %}

</div>

{% endblock %}

{% block scripts %}<script src="/static/js/mfa-setup.js"></script>{% endblock %}