<?php defined('ABSPATH') || exit;
$tfa_opts = get_option('iv1wpt_2fa_settings', iv1wpt_2fa_defaults());
$current_user = wp_get_current_user();
$user_secret = get_user_meta($current_user->ID, 'admin_2fa_secret', true);
$last_verified = (int) get_user_meta($current_user->ID, 'admin_2fa_last_verified', true);
?>
<h2><span class="dashicons dashicons-shield"></span>&nbsp;<?php esc_html_e("Two-Factor Authentication (TOTP)", "iv1-wp-tools"); ?></h2>
<p class="description"><?php esc_html_e("TOTP-based 2FA for administrators. Requires an authenticator app (Google Authenticator, Authy, etc.).", "iv1-wp-tools"); ?></p>

<div id="iv1wpt-2fa-result" style="margin:15px 0;"></div>

<h3><?php esc_html_e("Global Settings", "iv1-wp-tools"); ?></h3>
<table class="iv1wpt-settings-table">
    <tr>
        <td style="width:50px; text-align:center;">
            <label class="iv1wpt-toggle"><input type="checkbox" id="iv1wpt-2fa-enabled" <?php checked(!empty($tfa_opts['enabled'])); ?>><span class="iv1wpt-toggle-slider"></span></label>
        </td>
        <td>
            <div class="iv1wpt-settings-label"><?php esc_html_e("Enable 2FA for administrators", "iv1-wp-tools"); ?></div>
            <div class="iv1wpt-settings-desc"><?php esc_html_e("All admins must verify via TOTP code.", "iv1-wp-tools"); ?></div>
        </td>
    </tr>
    <tr>
        <td></td>
        <td>
            <strong><?php esc_html_e("Verification validity:", "iv1-wp-tools"); ?></strong><br>
            <select id="iv1wpt-2fa-timeout" style="margin-top:4px;">
                <option value="3600" <?php selected($tfa_opts['timeout'], 3600); ?>><?php esc_html_e("1 hour", "iv1-wp-tools"); ?></option>
                <option value="21600" <?php selected($tfa_opts['timeout'], 21600); ?>><?php esc_html_e("6 hours", "iv1-wp-tools"); ?></option>
                <option value="43200" <?php selected($tfa_opts['timeout'], 43200); ?>><?php esc_html_e("12 hours", "iv1-wp-tools"); ?></option>
                <option value="86400" <?php selected($tfa_opts['timeout'], 86400); ?>><?php esc_html_e("24 hours", "iv1-wp-tools"); ?></option>
            </select>
        </td>
    </tr>
    <tr>
        <td></td>
        <td>
            <strong><?php esc_html_e("Exempt users (login names):", "iv1-wp-tools"); ?></strong><br>
            <textarea id="iv1wpt-2fa-exempt" rows="3" class="large-text code" style="max-width:400px;"><?php echo esc_textarea($tfa_opts['exempt_users']); ?></textarea>
            <p class="description"><?php esc_html_e("One login name per line.", "iv1-wp-tools"); ?> Diese Admins werden nicht nach 2FA gefragt.</p>
        </td>
    </tr>
</table>
<p class="submit" style="margin-top:8px;">
    <button type="button" id="iv1wpt-2fa-save" class="button button-primary"><?php esc_attr_e("Save 2FA settings", "iv1-wp-tools"); ?></button>
</p>

<h3 style="margin-top:30px; padding-top:15px; border-top:1px solid #ddd;"><?php esc_html_e("Your 2FA Status", "iv1-wp-tools"); ?></h3>
<table class="main-form-table">
    <tr>
        <th><?php esc_html_e("Status", "iv1-wp-tools"); ?></th>
        <td>
            <?php if ($user_secret): ?>
                <span style="color:#00a32a; font-weight:600;"><?php esc_html_e("Set up", "iv1-wp-tools"); ?></span>
            <?php else: ?>
                <span style="color:#999;"><?php esc_html_e("Not set up yet", "iv1-wp-tools"); ?></span>
                <p class="description">Der Secret wird beim nächsten Login generiert, wenn 2FA aktiviert ist.</p>
            <?php endif; ?>
        </td>
    </tr>
    <?php if ($last_verified > 0): ?>
    <tr><th><?php esc_html_e("Last verified", "iv1-wp-tools"); ?></th><td><?php echo wp_date('d.m.Y H:i', $last_verified); ?></td></tr>
    <?php endif; ?>
    <?php if ($user_secret): ?>
    <tr>
        <th><?php esc_html_e("QR Code", "iv1-wp-tools"); ?></th>
        <td>
            <button type="button" id="iv1wpt-2fa-show-qr" class="button button-small"><?php esc_html_e("Show QR code", "iv1-wp-tools"); ?></button>
            <div id="iv1wpt-2fa-qr" style="display:none; margin-top:10px;">
                <?php
                if (class_exists('PHPGangsta_GoogleAuthenticator')) {
                    $ga = new PHPGangsta_GoogleAuthenticator();
                    $qr_url = $ga->getQRCodeGoogleUrl(get_bloginfo('name'), $user_secret);
                    echo '<img src="' . esc_url($qr_url) . '" alt="QR" style="max-width:200px;border:1px solid #ddd;border-radius:8px;padding:8px;background:#fff;"><br>';
                }
                ?>
                <code style="font-size:13px;letter-spacing:1px;display:inline-block;margin-top:8px;padding:6px 12px;background:#f8f9fa;border-radius:4px;"><?php echo esc_html($user_secret); ?></code>
            </div>
        </td>
    </tr>
    <tr>
        <th><?php esc_html_e("Reset secret", "iv1-wp-tools"); ?></th>
        <td>
            <button type="button" id="iv1wpt-2fa-reset" class="button button-small" style="color:#b32d2e;"><?php esc_html_e("Reset secret", "iv1-wp-tools"); ?></button>
            <p class="description"><?php esc_html_e("A new QR code will be generated on next login.", "iv1-wp-tools"); ?></p>
        </td>
    </tr>
    <?php endif; ?>
</table>

<h3 style="margin-top:30px; padding-top:15px; border-top:1px solid #ddd;"><?php esc_html_e("All Administrators", "iv1-wp-tools"); ?></h3>
<table class="widefat striped" style="margin-top:10px;">
    <thead><tr><th><?php esc_html_e("User", "iv1-wp-tools"); ?></th><th><?php esc_html_e("Login", "iv1-wp-tools"); ?></th><th><?php esc_html_e("2FA Status", "iv1-wp-tools"); ?></th><th><?php esc_html_e("Last verified", "iv1-wp-tools"); ?></th><th>Aktion</th></tr></thead>
    <tbody>
    <?php
    $admins = get_users(['role' => 'administrator', 'orderby' => 'display_name']);
    foreach ($admins as $admin):
        $a_secret = get_user_meta($admin->ID, 'admin_2fa_secret', true);
        $a_last   = (int) get_user_meta($admin->ID, 'admin_2fa_last_verified', true);
    ?>
    <tr>
        <td><?php echo esc_html($admin->display_name); ?></td>
        <td><code><?php echo esc_html($admin->user_login); ?></code></td>
        <td><?php echo $a_secret ? '<span style="color:#00a32a;"><?php esc_html_e("Set up", "iv1-wp-tools"); ?></span>' : '<span style="color:#999;">—</span>'; ?></td>
        <td><?php echo $a_last > 0 ? wp_date('d.m.Y H:i', $a_last) : '—'; ?></td>
        <td><?php if ($a_secret): ?><button type="button" class="button button-small iv1wpt-2fa-reset-user" data-user-id="<?php echo esc_attr($admin->ID); ?>" style="color:#b32d2e;"><?php esc_html_e("Reset", "iv1-wp-tools"); ?></button><?php endif; ?></td>
    </tr>
    <?php endforeach; ?>
    </tbody>
</table>
