@extends('layouts.platform')

@section('title', 'Account Security')
@section('header', 'Account Security')

@section('content')
    <div class="max-w-3xl space-y-6">

        @if (session('success'))
            <div class="rounded-lg bg-green-50 border border-green-200 px-4 py-3 text-sm text-green-800">
                {{ session('success') }}
            </div>
        @endif

        @if (!empty($freshRecoveryCodes))
            <div class="rounded-xl bg-amber-50 border border-amber-200 p-6">
                <h2 class="text-base font-semibold text-amber-900 flex items-center gap-2">
                    Save your recovery codes
                </h2>
                <p class="mt-1 text-sm text-amber-800">
                    Each code works exactly once. Store them somewhere safe — if you lose your
                    authenticator app, these are the only way back into your account.
                </p>
                <div class="mt-4 grid grid-cols-1 sm:grid-cols-2 gap-2">
                    @foreach ($freshRecoveryCodes as $code)
                        <code class="rounded-md bg-white border border-amber-300 px-3 py-2 text-sm text-amber-900 font-mono text-center">{{ $code }}</code>
                    @endforeach
                </div>
            </div>
        @endif

        {{-- 2FA Status --}}
        <div class="rounded-xl bg-white shadow-sm ring-1 ring-gray-900/5 p-6">
            <div class="flex items-start justify-between">
                <div>
                    <h2 class="text-base font-semibold text-gray-900">Two-Factor Authentication</h2>
                    <p class="mt-1 text-sm text-gray-500">
                        Add an extra layer of protection to your Super Admin account using an
                        authenticator app (Google Authenticator, Authy, etc.).
                    </p>
                </div>
                @if ($enabled)
                    <span class="inline-flex shrink-0 items-center rounded-full bg-green-100 px-3 py-1 text-xs font-semibold text-green-800">Enabled</span>
                @else
                    <span class="inline-flex shrink-0 items-center rounded-full bg-gray-100 px-3 py-1 text-xs font-semibold text-gray-600">Disabled</span>
                @endif
            </div>

            @if (!$enabled)
                <div class="mt-6 space-y-5">
                    <p class="text-sm text-gray-600">
                        Scan the QR code below with your authenticator app, or enter the secret
                        manually, then confirm with a code to enable.
                    </p>

                    @php
                        $issuer = config('app.name', 'Pishon');
                        $otpauth = app(\App\Services\Auth\TwoFactorService::class)->otpAuthUrl($user, $secret, $issuer);
                        $qr = \SimpleSoftwareIO\QrCode\Facades\QrCode::size(200)->margin(1)
                            ->color(31, 41, 55)->backgroundColor(255, 255, 255)
                            ->generate($otpauth);
                    @endphp

                    <div class="inline-block rounded-xl bg-white border border-gray-200 p-4">
                        {!! $qr !!}
                    </div>

                    <div>
                        <label class="block text-xs font-medium uppercase tracking-wide text-gray-500">Manual secret</label>
                        <code class="mt-1 inline-block rounded-md bg-gray-100 px-3 py-2 text-sm font-mono text-gray-800 break-all">{{ $secret }}</code>
                    </div>

                    <form method="POST" action="{{ route('platform.security.two-factor.enable') }}" class="space-y-4">
                        @csrf
                        <input type="hidden" name="secret" value="{{ $secret }}">
                        <div>
                            <label for="code" class="block text-sm font-medium text-gray-700">Verification code *</label>
                            <input type="text" id="code" name="code" required inputmode="numeric" autocomplete="one-time-code"
                                   class="mt-1 block w-full max-w-xs rounded-lg border border-gray-300 px-3 py-2.5 text-sm shadow-sm focus:border-primary-500 focus:outline-none focus:ring-1 focus:ring-primary-500">
                            @error('code') <p class="mt-1 text-sm text-red-600">{{ $message }}</p> @enderror
                        </div>
                        <button type="submit" class="rounded-lg bg-primary-600 px-5 py-2.5 text-sm font-semibold text-white shadow-sm hover:bg-primary-700 transition-colors">
                            Enable Two-Factor Authentication
                        </button>
                    </form>
                </div>
            @else
                <div class="mt-6 space-y-5">
                    <div class="rounded-lg bg-gray-50 border border-gray-200 px-4 py-3 text-sm text-gray-700">
                        Two-factor authentication is active on this account. You will be asked for a
                        code on every sign-in.
                    </div>

                    <div class="pt-2">
                        <h3 class="text-sm font-semibold text-gray-900">Recovery codes</h3>
                        <p class="mt-1 text-sm text-gray-500">
                            Invalidating and issuing a fresh batch of one-time recovery codes.
                        </p>
                        <form method="POST" action="{{ route('platform.security.two-factor.recovery-codes') }}" class="mt-3 flex items-end gap-3">
                            @csrf
                            <div>
                                <label for="current_password" class="block text-sm font-medium text-gray-700">Current password *</label>
                                <input type="password" id="current_password" name="current_password" required autocomplete="current-password"
                                       class="mt-1 block w-full rounded-lg border border-gray-300 px-3 py-2.5 text-sm shadow-sm focus:border-primary-500 focus:outline-none focus:ring-1 focus:ring-primary-500">
                                @error('current_password') <p class="mt-1 text-sm text-red-600">{{ $message }}</p> @enderror
                            </div>
                            <button type="submit" class="rounded-lg bg-gray-800 px-5 py-2.5 text-sm font-semibold text-white shadow-sm hover:bg-gray-900 transition-colors">
                                Generate New Codes
                            </button>
                        </form>
                    </div>

                    <div class="pt-2">
                        <h3 class="text-sm font-semibold text-red-600">Disable two-factor authentication</h3>
                        <p class="mt-1 text-sm text-gray-500">
                            Removing 2FA weakens this account's security. Confirm with your current password.
                        </p>
                        <form method="POST" action="{{ route('platform.security.two-factor.disable') }}" class="mt-3 flex items-end gap-3">
                            @csrf
                            <div>
                                <label for="disable_password" class="block text-sm font-medium text-gray-700">Current password *</label>
                                <input type="password" id="disable_password" name="current_password" required autocomplete="current-password"
                                       class="mt-1 block w-full rounded-lg border border-gray-300 px-3 py-2.5 text-sm shadow-sm focus:border-primary-500 focus:outline-none focus:ring-1 focus:ring-primary-500">
                            </div>
                            <button type="submit" class="rounded-lg bg-red-600 px-5 py-2.5 text-sm font-semibold text-white shadow-sm hover:bg-red-700 transition-colors">
                                Disable
                            </button>
                        </form>
                    </div>
                </div>
            @endif
        </div>

    </div>
@endsection