{% extends "_shell.html" %}
{% block title %}{{ _("Two-factor sign-in") }} — ser2netweb{% endblock %}
{% block main %}
<section class="panel panel-narrow">
  <div class="panel-head"><h2>{{ _("Two-factor sign-in") }}</h2><a class="btn sm" href="{{ base }}/settings">{{ _("← Settings") }}</a></div>
  {% if ok %}<div class="banner ok" role="status" tabindex="-1" data-feedback>{{ ok }}</div>{% endif %}
  {% if error %}<div class="banner error" role="alert" tabindex="-1" data-feedback>{{ error }}</div>{% endif %}
  {% if refusal %}
  <p>{{ refusal }}</p>
  {% elif enabled %}
  <p><span class="tag">{{ _("enabled") }}</span> {{ _('Signing in as <span class="mono">%(user)s</span> takes your password and a code from your authenticator app.', user=me.username) }}</p>
  <h3 class="mt-sm">{{ _("Turn it off") }}</h3>
  <form method="post" action="{{ base }}/settings/totp/disable" class="authform">
    <input type="hidden" name="_csrf" value="{{ request.state.csrf_token }}">
    <label>{{ _("Current password") }} <input type="password" name="password" autocomplete="current-password" required></label>
    <label>{{ _("Code") }} <input type="text" name="code" inputmode="numeric" autocomplete="one-time-code" pattern="[0-9 ]{6,7}" maxlength="7" autocapitalize="none" autocorrect="off" spellcheck="false" required></label>
    <button class="btn" type="submit">{{ _("Turn off two-factor sign-in") }}</button>
  </form>
  {% else %}
  <p class="muted mb-sm">{{ _("With two-factor sign-in, signing in also takes a 6-digit code from an authenticator app on your phone or computer (any app for time-based codes, TOTP: Google or Microsoft Authenticator, Aegis, FreeOTP, KeePassXC …), so a password alone is not enough. The codes follow the clock: keep the time of this server right (NTP).") }}</p>
  <ol>
    <li>{{ _("In the app, add an account with this key (time-based):") }}
      <div class="mono token-box">{{ secret_grouped }}</div>
      <p class="muted">{{ _("Or give the app this link (some take it pasted; any QR code maker turns it into a code to scan):") }}</p>
      <div class="mono token-box">{{ uri }}</div>
    </li>
    <li>{{ _("Enter the code the app shows, and your password:") }}</li>
  </ol>
  <form method="post" action="{{ base }}/settings/totp/enable" class="authform">
    <input type="hidden" name="_csrf" value="{{ request.state.csrf_token }}">
    <input type="hidden" name="enrol" value="{{ enrol }}">
    <label>{{ _("Code") }} <input type="text" name="code" inputmode="numeric" autocomplete="one-time-code" pattern="[0-9 ]{6,7}" maxlength="7" autocapitalize="none" autocorrect="off" spellcheck="false" required></label>
    <label>{{ _("Current password") }} <input type="password" name="password" autocomplete="current-password" required></label>
    <button class="btn primary" type="submit">{{ _("Turn on two-factor sign-in") }}</button>
  </form>
  {% endif %}
  {% if not refusal %}
  <p class="muted mt-sm">{{ _('Lost the app or the device? An admin can turn two-factor sign-in off for you in Settings → Users. On the server, <span class="mono">ser2netweb --set-password NAME</span> sets a new password and turns it off — also for the only admin.') }}</p>
  {% endif %}
</section>
{% endblock %}