@php
    $methodsByProvider = collect($authMethods)->keyBy('provider');
    $hasTotp = $methodsByProvider->has('totp') && $methodsByProvider->get('totp')?->verified_at;
    $hasEmail = ($user->two_factor ?? false) || ($methodsByProvider->has('email') && $methodsByProvider->get('email')?->verified_at);
    $channelProviders = ['sms', 'whatsapp', 'telegram'];
    $profileMfaVerification = session('profile_mfa_verification');
@endphp

<div id="mfa" class="card mb-2">
    <div class="card-header border-bottom">
        <h4 class="card-title mb-25">Multi-factor authentication</h4>
        <p class="card-text mb-0 text-muted">Add a second factor to protect your account from unauthorized access.</p>
    </div>
    <div class="card-body mt-1">
        {{-- Authenticator (TOTP) --}}
        <div class="mb-2 pb-2 border-bottom">
            <div class="d-flex flex-wrap justify-content-between align-items-start gap-1 mb-1">
                <div>
                    <h5 class="mb-25">Authenticator app</h5>
                    <p class="mb-0 text-muted">Use Google Authenticator, Authy, or a compatible TOTP app.</p>
                </div>
                @if($hasTotp)
                    <span class="badge badge-light-success">Enabled</span>
                @elseif(!empty($mfaSettings['authenticator']))
                    <span class="badge badge-light-secondary">Available</span>
                @else
                    <span class="badge badge-light-secondary">Disabled by org</span>
                @endif
            </div>

            @if($hasTotp)
                <form action="{{ route('user.account.security.methods.disable', ['provider' => 'totp']) }}" method="post" class="d-inline">
                    @csrf
                    <button type="submit" class="btn btn-outline-danger btn-sm"
                            data-security-confirm="Disable authenticator app?">
                        Disable
                    </button>
                </form>
            @elseif(!empty($mfaSettings['authenticator']))
                @if($pendingTotpSecret)
                    <div class="row">
                        <div class="col-md-5 mb-1">
                            <p class="mb-50">Scan this QR code with your authenticator app:</p>
                            <canvas data-totp-qr="{{ $pendingTotpQrUrl }}"
                                    aria-label="Authenticator setup QR code"></canvas>
                            <p class="mb-50 mt-1">Alternatively, enter this setup key manually:</p>
                            <code class="user-select-all">{{ $pendingTotpSecret }}</code>
                            <details class="mt-1">
                                <summary class="small text-muted">Advanced setup URI</summary>
                                <code class="small text-break user-select-all">{{ $pendingTotpQrUrl }}</code>
                            </details>
                        </div>
                        <div class="col-md-7">
                            <form action="{{ route('user.account.security.totp.confirm') }}" method="post">
                                @csrf
                                <div class="mb-1">
                                    <label class="form-label required" for="totp_code">Confirmation code</label>
                                    <input type="text" name="code" id="totp_code" maxlength="6"
                                           class="form-control"
                                           placeholder="123456" autocomplete="one-time-code" inputmode="numeric">
                                </div>
                                <button type="submit" class="btn btn-primary btn-sm">Confirm & enable</button>
                            </form>
                        </div>
                    </div>
                @else
                    <form action="{{ route('user.account.security.totp.enable') }}" method="post">
                        @csrf
                        <button type="submit" class="btn btn-primary btn-sm">
                            <i data-feather="smartphone" class="me-25"></i> Set up authenticator
                        </button>
                    </form>
                @endif
            @endif
        </div>

        {{-- Email OTP --}}
        <div class="mb-2 pb-2 border-bottom">
            <div class="d-flex flex-wrap justify-content-between align-items-start gap-1 mb-1">
                <div>
                    <h5 class="mb-25">Email OTP</h5>
                    <p class="mb-0 text-muted">Receive one-time codes at {{ $user->email }}.</p>
                </div>
                @if($hasEmail)
                    <span class="badge badge-light-success">Enabled</span>
                @elseif(!empty($mfaSettings['email']))
                    <span class="badge badge-light-secondary">Available</span>
                @else
                    <span class="badge badge-light-secondary">Disabled by org</span>
                @endif
            </div>

            @if($hasEmail)
                <form action="{{ route('user.account.security.methods.disable', ['provider' => 'email']) }}" method="post" class="d-inline">
                    @csrf
                    <button type="submit" class="btn btn-outline-danger btn-sm"
                            data-security-confirm="Disable email OTP?">
                        Disable
                    </button>
                </form>
            @elseif(!empty($mfaSettings['email']))
                <form action="{{ route('user.account.security.email_otp.enable') }}" method="post">
                    @csrf
                    <button type="submit" class="btn btn-primary btn-sm">
                        <i data-feather="mail" class="me-25"></i> Enable email OTP
                    </button>
                </form>
            @endif
        </div>

        {{-- Channel linker --}}
        <div>
            @if(is_array($profileMfaVerification))
                <div class="alert alert-info">
                    <div class="alert-body">
                        <h5>Verify {{ ucfirst($profileMfaVerification['provider']) }} OTP</h5>
                        <p>Enter the code sent to {{ $profileMfaVerification['identifier'] }}.</p>
                        <form action="{{ route('user.account.security.channels.confirm') }}" method="post" class="row g-1 align-items-end">
                            @csrf
                            <input type="hidden" name="provider" value="{{ $profileMfaVerification['provider'] }}">
                            <div class="col-md-8">
                                <label class="form-label" for="profile_channel_code">Verification code</label>
                                <input type="text" name="code" id="profile_channel_code" class="form-control"
                                       autocomplete="one-time-code" required>
                            </div>
                            <div class="col-md-4">
                                <button type="submit" class="btn btn-primary w-100">Verify</button>
                            </div>
                        </form>
                    </div>
                </div>
            @endif

            <h5 class="mb-1">Link OTP channel</h5>
            <p class="text-muted mb-1">Connect SMS, WhatsApp, or Telegram if your organization allows them.</p>

            @php
                $linkedChannels = collect($authMethods)->whereIn('provider', $channelProviders);
            @endphp

            @if($linkedChannels->isNotEmpty())
                <div class="table-responsive mb-1">
                    <table class="table table-sm">
                        <thead>
                        <tr>
                            <th>Provider</th>
                            <th>Identifier</th>
                            <th>Status</th>
                            <th></th>
                        </tr>
                        </thead>
                        <tbody>
                        @foreach($linkedChannels as $method)
                            <tr>
                                <td class="text-capitalize">{{ $method->provider }}</td>
                                <td>{{ $method->identifier }}</td>
                                <td>
                                    @if($method->verified_at)
                                        <span class="badge badge-light-success">Verified</span>
                                    @else
                                        <span class="badge badge-light-warning">Unverified</span>
                                    @endif
                                </td>
                                <td class="text-end">
                                    <form action="{{ route('user.account.security.methods.disable', ['provider' => $method->provider]) }}"
                                          method="post" class="d-inline">
                                        @csrf
                                        <button type="submit" class="btn btn-sm btn-outline-danger"
                                                data-security-confirm="Remove this channel?">Remove</button>
                                    </form>
                                </td>
                            </tr>
                        @endforeach
                        </tbody>
                    </table>
                </div>
            @endif

            @php
                $anyChannelEnabled = !empty($mfaSettings['sms']) || !empty($mfaSettings['whatsapp']) || !empty($mfaSettings['telegram']);
            @endphp

            @if($anyChannelEnabled)
                <form action="{{ route('user.account.security.channels.link') }}" method="post" class="row g-1 align-items-end">
                    @csrf
                    <div class="col-md-3">
                        <label class="form-label" for="channel_provider">Provider</label>
                        <select name="provider" id="channel_provider" class="form-select">
                            @if(!empty($mfaSettings['sms']))
                                <option value="sms">SMS</option>
                            @endif
                            @if(!empty($mfaSettings['whatsapp']))
                                <option value="whatsapp">WhatsApp</option>
                            @endif
                            @if(!empty($mfaSettings['telegram']))
                                <option value="telegram">Telegram</option>
                            @endif
                        </select>
                    </div>
                    <div class="col-md-5">
                        <label class="form-label" for="channel_identifier">Phone / chat ID</label>
                        <input type="text" name="identifier" id="channel_identifier" class="form-control"
                               placeholder="+15551234567 or chat id" required>
                    </div>
                    <div class="col-md-4">
                        <button type="submit" class="btn btn-outline-primary">
                            <i data-feather="link" class="me-25"></i> Link channel
                        </button>
                    </div>
                </form>
            @else
                <p class="text-muted mb-0 small">No OTP channels are enabled by your organization.</p>
            @endif
        </div>
    </div>
</div>

@if($pendingTotpSecret)
    @push('scripts')
        <script src="{{ asset(mix('js/mfa.js')) }}"></script>
    @endpush
@endif