{% extends "base.html" %}

{% block title %}Set Up Two-Factor Authentication - Counterscarp Engine{% endblock %}

{% block content %}
<style>
    .auth-container {
        max-width: 500px;
        margin: 3rem auto;
        padding: 0 1rem;
    }
    .auth-card {
        background: #16213e;
        border: 1px solid #2a2a4e;
        border-radius: 16px;
        padding: 2rem;
    }
    .auth-card h1 {
        font-size: 1.5rem;
        color: #fff;
        margin-bottom: 0.4rem;
    }
    .auth-subtitle {
        color: #a0a0b0;
        font-size: 0.95rem;
        margin-bottom: 1.75rem;
    }
    .auth-error {
        background: rgba(220, 53, 69, 0.1);
        border: 1px solid rgba(220, 53, 69, 0.3);
        color: #dc3545;
        padding: 0.75rem 1rem;
        border-radius: 8px;
        font-size: 0.9rem;
        margin-bottom: 1.25rem;
    }
    .totp-section {
        margin-bottom: 1.5rem;
    }
    .totp-section h2 {
        font-size: 1rem;
        color: #c0c0d0;
        margin-bottom: 0.5rem;
        font-weight: 600;
    }
    .totp-uri-box, .totp-secret-box {
        background: #0f1629;
        border: 1px solid #2a2a4e;
        border-radius: 8px;
        padding: 0.75rem 1rem;
        color: #e0e0e0;
        font-family: 'Courier New', monospace;
        font-size: 0.85rem;
        word-break: break-all;
        user-select: all;
    }
    .totp-secret-box {
        font-size: 1.1rem;
        letter-spacing: 2px;
        text-align: center;
        color: #667eea;
        font-weight: 600;
    }
    .totp-hint {
        color: #888;
        font-size: 0.82rem;
        margin-top: 0.4rem;
    }
    #qrcode-canvas {
        display: block;
        margin: 0.75rem auto;
        background: #fff;
        padding: 12px;
        border-radius: 8px;
    }
    .auth-field {
        margin-bottom: 1.25rem;
    }
    .auth-field label {
        display: block;
        color: #a0a0a0;
        font-size: 0.875rem;
        font-weight: 500;
        margin-bottom: 0.4rem;
    }
    .auth-input {
        width: 100%;
        padding: 0.75rem 1rem;
        background: #0f1629;
        border: 1px solid #2a2a4e;
        border-radius: 8px;
        color: #e0e0e0;
        font-size: 1.25rem;
        font-family: 'Courier New', monospace;
        letter-spacing: 6px;
        text-align: center;
        transition: border-color 0.2s;
        box-sizing: border-box;
    }
    .auth-input:focus {
        outline: none;
        border-color: #667eea;
    }
    .btn-auth-submit {
        width: 100%;
        padding: 0.8rem 1.5rem;
        background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
        color: white;
        border: none;
        border-radius: 8px;
        font-size: 1rem;
        font-weight: 600;
        cursor: pointer;
        transition: opacity 0.2s, transform 0.2s;
        margin-top: 0.25rem;
    }
    .btn-auth-submit:hover {
        opacity: 0.9;
        transform: translateY(-1px);
    }
    .auth-divider {
        display: flex;
        align-items: center;
        gap: 0.75rem;
        margin: 1.25rem 0;
        color: #555;
        font-size: 0.875rem;
    }
    .auth-divider::before,
    .auth-divider::after {
        content: '';
        flex: 1;
        height: 1px;
        background: #2a2a4e;
    }
    @media (max-width: 480px) {
        .auth-container { margin: 1.5rem auto; }
        .auth-card { padding: 1.5rem; }
    }
</style>

<div class="auth-container">
    <div class="auth-card">
        {% if setup_complete %}
        <h1>Two-Factor Authentication Enabled</h1>
        <p class="auth-subtitle" style="color:#4ade80;">2FA has been successfully enabled for your account.</p>

        <div class="totp-section">
            <h2 style="color:#fbbf24;">&#9888; Save Your Recovery Codes</h2>
            <p class="totp-hint" style="color:#e0e0e0; margin-bottom:0.75rem;">
                These 10 one-time recovery codes can be used to access your account if you lose your authenticator.
                <strong style="color:#dc3545;">They will NOT be shown again.</strong>
            </p>
            <div class="recovery-codes-box" id="recovery-codes-box" style="background:#0f1629; border:1px solid #2a2a4e; border-radius:8px; padding:1rem; font-family:'Courier New',monospace; font-size:1rem; color:#667eea; line-height:2; text-align:center; user-select:all;">
                {% for code in recovery_codes %}{{ code }}{% if not loop.last %}<br>{% endif %}{% endfor %}
            </div>
            <button type="button" onclick="copyRecoveryCodes()" style="width:100%; margin-top:0.75rem; padding:0.6rem 1rem; background:#2a2a4e; color:#e0e0e0; border:1px solid #444; border-radius:8px; font-size:0.9rem; cursor:pointer;" id="copy-codes-btn">Copy codes</button>
        </div>

        <a href="/settings?msg=2FA+enabled+successfully" class="btn-auth-submit" style="display:block; text-align:center; text-decoration:none; margin-top:1rem;">Continue to Settings</a>

        <script>
        function copyRecoveryCodes() {
            var codes = [{% for code in recovery_codes %}"{{ code }}"{% if not loop.last %},{% endif %}{% endfor %}];
            var text = codes.join("\n");
            navigator.clipboard.writeText(text).then(function() {
                document.getElementById('copy-codes-btn').textContent = 'Copied!';
                setTimeout(function(){ document.getElementById('copy-codes-btn').textContent = 'Copy codes'; }, 2000);
            });
        }
        </script>
        {% else %}
        <h1>Set Up Two-Factor Authentication</h1>
        <p class="auth-subtitle">Scan the QR code with your authenticator app (Google Authenticator, Authy, 1Password, etc.)</p>

        {% if error %}
        <div class="auth-error">{{ error }}</div>
        {% endif %}

        <div class="totp-section">
            <h2>1. Scan QR Code</h2>
            <canvas id="qrcode-canvas"></canvas>
            <p class="totp-hint">Can't scan? Copy the URI below into your authenticator app.</p>
            <div class="totp-uri-box">{{ provisioning_uri }}</div>
        </div>

        <div class="auth-divider">or enter manually</div>

        <div class="totp-section">
            <h2>2. Manual Entry Key</h2>
            <div class="totp-secret-box">{{ totp_secret }}</div>
            <p class="totp-hint">Type: TOTP &bull; Algorithm: SHA1 &bull; Digits: 6 &bull; Period: 30s</p>
        </div>

        <div class="auth-divider">verify</div>

        <form method="POST" action="/auth/totp/setup">
            <input type="hidden" name="_csrf_token" value="{{ csrf_token }}">
            <div class="auth-field">
                <label for="code">Enter the 6-digit code from your app</label>
                <input type="text"
                       id="code"
                       name="code"
                       class="auth-input"
                       placeholder="000000"
                       maxlength="6"
                       pattern="[0-9]{6}"
                       inputmode="numeric"
                       autocomplete="one-time-code"
                       required
                       autofocus>
            </div>
            <button type="submit" class="btn-auth-submit">Verify &amp; Enable 2FA</button>
        </form>
        {% endif %}
    </div>
</div>

{% if not setup_complete %}
<script src="https://cdn.jsdelivr.net/npm/qrious@4.0.2/dist/qrious.min.js"></script>
<script>
(function() {
    try {
        var qr = new QRious({
            element: document.getElementById('qrcode-canvas'),
            value: {{ provisioning_uri | tojson }},
            size: 200,
            level: 'M'
        });
    } catch(e) {
        // QR library failed to load — user can still use manual entry
        var canvas = document.getElementById('qrcode-canvas');
        if (canvas) canvas.style.display = 'none';
    }
})();
</script>
{% endif %}
{% endblock %}