{% extends "panel/base.html" %}
{% block title %}Security — JQC Control{% endblock %}
{% block page_title %}Security{% endblock %}
{% block content %}
<div class="row">
  <div class="col-lg-7">
    <div class="card shadow-sm">
      <div class="card-header bg-light d-flex justify-content-between align-items-center">
        <h6 class="mb-0 fw-semibold"><i class="bi bi-shield-lock me-1"></i>Two-Factor Authentication</h6>
        {% if mfa_enabled %}
        <span class="badge bg-success">Enabled</span>
        {% else %}
        <span class="badge bg-secondary">Disabled</span>
        {% endif %}
      </div>
      <div class="card-body">
        {% if mfa_enabled %}
        <p class="text-muted small mb-2">
          Your superadmin account requires a 6-digit code at every sign-in.
          Recovery codes remaining: <strong>{{ recovery_remaining }}</strong>.
        </p>
        <form method="POST" action="{{ url_for('auth.mfa_disable') }}"
              onsubmit="return confirm('Disable two-factor on the control panel? This lowers security for ALL tenants.');">
          <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
          <label class="form-label small">Enter a current code or your password to disable:</label>
          <div class="input-group">
            <input type="text" name="code" class="form-control" placeholder="6-digit code"
                   inputmode="numeric" autocomplete="off">
            <input type="password" name="password" class="form-control" placeholder="…or password"
                   autocomplete="off">
            <button type="submit" class="btn btn-outline-danger">Disable 2FA</button>
          </div>
        </form>
        {% else %}
        <p class="text-muted small mb-3">
          Two-factor is strongly recommended — the control panel manages every
          tenant. After your password you'll confirm a one-time code from an
          authenticator app.
        </p>
        <a href="{{ url_for('auth.mfa_setup') }}" class="btn btn-primary">
          <i class="bi bi-shield-plus me-1"></i>Enable Two-Factor
        </a>
        {% endif %}
      </div>
    </div>
  </div>
</div>
{% endblock %}