<?php
/**
 * Unified Two-Factor Authentication Shortcode Partial
 *
 * Handles both app-based (TOTP) and email-based 2FA methods.
 *
 * This template is loaded via Guard_Dog_View_Loader::load_partial() which uses
 * extract() to inject variables from the calling context.
 *
 * @package GuardDog
 * @since 1.6.0
 *
 * @var array                     $atts           Shortcode attributes passed to [guard_dog_2fa].
 * @var string                    $passkeys_markup Shared passkey-management markup for frontend display.
 * @var string                    $sessions_markup Shared active-session markup for frontend display.
 * @var Guard_Dog_Two_Factor_Auth $guard_dog_this The Two Factor Auth instance (passed as 'this' and renamed).
 */

if (!defined('ABSPATH')) exit; // Exit if accessed directly

// phpcs:disable WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound
// These are local variables in a template file, not global variables
// The Plugin Checker incorrectly flags local template variables as globals
// These variables are scoped to this template file and do not pollute the global namespace

// Parse attributes
$atts = shortcode_atts([
    'style' => 'default', // default, minimal, compact
    'show_2fa' => true,
], $atts, 'guard_dog_2fa');

$passkeys_markup = isset( $passkeys_markup ) ? (string) $passkeys_markup : '';
$sessions_markup = isset( $sessions_markup ) ? (string) $sessions_markup : '';
$show_2fa = ! empty( $atts['show_2fa'] );

$user_id = get_current_user_id();
$is_app_2fa_enabled = $guard_dog_this->is_2fa_enabled_for_user($user_id);

// Check if email 2FA is available
$email_2fa_enabled = get_option('guard_dog_email_2fa_enabled', false);
$email_provider_configured = false;
$is_email_2fa_enabled_for_user = false;

if ( $email_2fa_enabled && function_exists( 'Guard_Dog' ) && isset( Guard_Dog()->features['email_two_factor_auth'] ) ) {
    $email_2fa_instance = Guard_Dog()->features['email_two_factor_auth'];
    $email_provider_configured = $email_2fa_instance->is_email_provider_configured();
    $is_email_2fa_enabled_for_user = $email_2fa_instance->is_email_2fa_enabled_for_user( $user_id );
}

// Determine which 2FA methods are available
$app_2fa_available = true; // App-based 2FA is always available
$email_2fa_available = $email_2fa_enabled && $email_provider_configured;
$any_2fa_enabled = $is_app_2fa_enabled || $is_email_2fa_enabled_for_user;
$instance_id = wp_unique_id( 'guard-dog-2fa-shortcode-' );
$ids = array(
    'regenerate_recovery_codes' => $instance_id . '-regenerate-recovery-codes',
    'recovery_codes_display'    => $instance_id . '-recovery-codes-display',
    'copy_recovery_codes'       => $instance_id . '-copy-recovery-codes',
    'codes_container'           => $instance_id . '-codes-container',
    'disable_app_2fa'           => $instance_id . '-disable-app-2fa',
    'disable_email_2fa'         => $instance_id . '-disable-email-2fa',
    'enable_app_2fa'            => $instance_id . '-enable-app-2fa',
    'enable_email_2fa'          => $instance_id . '-enable-email-2fa',
    'setup_section'             => $instance_id . '-setup-section',
    'qr_code'                   => $instance_id . '-qr-code',
    'secret_key'                => $instance_id . '-secret-key',
    'copy_secret_key'           => $instance_id . '-copy-secret-key',
    'verify_code'               => $instance_id . '-verify-code',
    'verify_app_2fa'            => $instance_id . '-verify-app-2fa',
    'setup_feedback'            => $instance_id . '-setup-feedback',
    'email_setup_section'       => $instance_id . '-email-setup-section',
    'email_verify_code'         => $instance_id . '-email-verify-code',
    'verify_email_2fa'          => $instance_id . '-verify-email-2fa',
    'resend_email_2fa_code'     => $instance_id . '-resend-email-2fa-code',
    'messages'                  => $instance_id . '-messages',
);
// phpcs:enable WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound
?>

<div
    id="<?php echo esc_attr( $instance_id ); ?>"
    class="guard-dog-2fa-shortcode-container"
    data-guard-dog-2fa-container="1"
    data-style="<?php echo esc_attr($atts['style']); ?>"
>
    <?php if ( $show_2fa ) : ?>
    
    <!-- Main 2FA Status Section -->
    <div class="guard-dog-2fa-status-section">
        <h3 class="guard-dog-2fa-heading">
            <?php esc_html_e('Two-Factor Authentication', 'guard-dog'); ?>
        </h3>
        <div class="guard-dog-2fa-status <?php echo esc_attr($any_2fa_enabled ? 'guard-dog-2fa-enabled' : 'guard-dog-2fa-disabled'); ?>">
            <?php if ( $any_2fa_enabled ) : ?>
                <p><?php esc_html_e( 'Two-factor authentication is enabled for your account.', 'guard-dog' ); ?></p>
                <?php if ( $is_app_2fa_enabled ) : ?>
                    <p><strong><?php esc_html_e( 'App-based 2FA:', 'guard-dog' ); ?></strong> <?php esc_html_e( 'Active', 'guard-dog' ); ?></p>
                <?php endif; ?>
                <?php if ( $is_email_2fa_enabled_for_user ) : ?>
                    <p><strong><?php esc_html_e( 'Email-based 2FA:', 'guard-dog' ); ?></strong> <?php esc_html_e( 'Active', 'guard-dog' ); ?></p>
                <?php endif; ?>
            <?php else : ?>
                <p><?php esc_html_e( 'Two-factor authentication is not enabled for your account.', 'guard-dog' ); ?></p>
            <?php endif; ?>
        </div>
    </div>

    <?php if ( $any_2fa_enabled ) : ?>
        <!-- 2FA Management Section (when enabled) -->
        
        <?php if ( $is_app_2fa_enabled ) : ?>
            <!-- App-based 2FA Management -->
            <div class="guard-dog-2fa-app-section">
                <h4><?php esc_html_e('App-Based Two-Factor Authentication', 'guard-dog'); ?></h4>
                <p class="guard-dog-2fa-description">
                    <?php esc_html_e('Manage your authenticator app-based two-factor authentication.', 'guard-dog'); ?>
                </p>
                
                <!-- Recovery Codes Section -->
                <div class="guard-dog-2fa-recovery-section">
                    <h5><?php esc_html_e('Recovery Codes', 'guard-dog'); ?></h5>
                    <p class="guard-dog-2fa-description">
                        <?php esc_html_e('Recovery codes allow you to access your account if you lose your authenticator device.', 'guard-dog'); ?>
                    </p>
                    <div class="guard-dog-2fa-buttons">
                        <button
                            type="button"
                            class="guard-dog-2fa-btn guard-dog-2fa-btn-secondary"
                            id="<?php echo esc_attr( $ids['regenerate_recovery_codes'] ); ?>"
                            data-user-id="<?php echo esc_attr($user_id); ?>"
                            data-guard-dog-regenerate-recovery-codes
                        >
                            <?php esc_html_e('Regenerate Recovery Codes', 'guard-dog'); ?>
                        </button>
                    </div>

                    <div
                        id="<?php echo esc_attr( $ids['recovery_codes_display'] ); ?>"
                        class="guard-dog-2fa-recovery-codes"
                        data-guard-dog-recovery-codes-display
                    >
                        <div class="guard-dog-2fa-recovery-header">
                            <h6><?php esc_html_e('Your Recovery Codes', 'guard-dog'); ?></h6>
                            <button
                                type="button"
                                class="guard-dog-2fa-copy-btn"
                                id="<?php echo esc_attr( $ids['copy_recovery_codes'] ); ?>"
                                data-guard-dog-copy-recovery-codes
                            >
                                <?php esc_html_e('Copy All', 'guard-dog'); ?>
                            </button>
                        </div>
                        <div
                            class="guard-dog-2fa-codes-grid"
                            id="<?php echo esc_attr( $ids['codes_container'] ); ?>"
                            data-guard-dog-codes-container
                        >
                            <!-- Recovery codes will be populated here -->
                        </div>
                        <p class="guard-dog-2fa-warning">
                            <strong><?php esc_html_e('Important:', 'guard-dog'); ?></strong>
                            <?php esc_html_e('Save these codes in a secure location. Each code can only be used once.', 'guard-dog'); ?>
                        </p>
                    </div>
                </div>

                <!-- Disable App 2FA Section -->
                <div class="guard-dog-2fa-disable-app-section">
                    <h5><?php esc_html_e('Disable App-Based 2FA', 'guard-dog'); ?></h5>
                    <p class="guard-dog-2fa-description">
                        <?php esc_html_e('Disabling app-based 2FA will make your account less secure.', 'guard-dog'); ?>
                    </p>
                    <button
                        type="button"
                        class="guard-dog-2fa-btn guard-dog-2fa-btn-danger"
                        id="<?php echo esc_attr( $ids['disable_app_2fa'] ); ?>"
                        data-user-id="<?php echo esc_attr($user_id); ?>"
                        data-guard-dog-disable-app-2fa
                    >
                        <?php esc_html_e('Disable App 2FA', 'guard-dog'); ?>
                    </button>
                </div>
            </div>
        <?php endif; ?>

        <?php if ( $is_email_2fa_enabled_for_user ) : ?>
            <!-- Email-based 2FA Management -->
            <div class="guard-dog-2fa-email-section">
                <h4><?php esc_html_e('Email-Based Two-Factor Authentication', 'guard-dog'); ?></h4>
                <p class="guard-dog-2fa-description">
                    <?php esc_html_e('Manage your email-based two-factor authentication.', 'guard-dog'); ?>
                </p>

                <!-- Disable Email 2FA Section -->
                <div class="guard-dog-2fa-disable-email-section">
                    <h5><?php esc_html_e('Disable Email 2FA', 'guard-dog'); ?></h5>
                    <p class="guard-dog-2fa-description">
                        <?php esc_html_e('Disabling email 2FA will make your account less secure.', 'guard-dog'); ?>
                    </p>
                    <button
                        type="button"
                        class="guard-dog-2fa-btn guard-dog-2fa-btn-danger"
                        id="<?php echo esc_attr( $ids['disable_email_2fa'] ); ?>"
                        data-user-id="<?php echo esc_attr($user_id); ?>"
                        data-guard-dog-disable-email-2fa
                    >
                        <?php esc_html_e('Disable Email 2FA', 'guard-dog'); ?>
                    </button>
                </div>
            </div>
        <?php endif; ?>

    <?php endif; ?>
    
    <!-- 2FA Setup Section (for enabling additional methods) -->
    
    <!-- App-based 2FA Setup (show if not enabled) -->
    <?php if ( ! $is_app_2fa_enabled ): ?>
        <div class="guard-dog-2fa-app-setup-section">
            <h4><?php esc_html_e('App-Based Two-Factor Authentication', 'guard-dog'); ?></h4>
            <p class="guard-dog-2fa-description">
                <?php esc_html_e('Enhance your account security by enabling two-factor authentication with an authenticator app.', 'guard-dog'); ?>
            </p>
            <button
                type="button"
                class="guard-dog-2fa-btn guard-dog-2fa-btn-primary"
                id="<?php echo esc_attr( $ids['enable_app_2fa'] ); ?>"
                data-user-id="<?php echo esc_attr( $user_id ); ?>"
                data-guard-dog-enable-app-2fa
            >
                <?php esc_html_e('Enable App 2FA', 'guard-dog'); ?>
            </button>
        </div>
    <?php endif; ?>

    <!-- Email-based 2FA Setup (show if not enabled and available) -->
    <?php if ( $email_2fa_available && ! $is_email_2fa_enabled_for_user ): ?>
        <div class="guard-dog-2fa-email-setup-section">
            <h4><?php esc_html_e('Email-Based Two-Factor Authentication', 'guard-dog'); ?></h4>
            <p class="guard-dog-2fa-description">
                <?php esc_html_e('Enable email-based two-factor authentication for enhanced security.', 'guard-dog'); ?>
            </p>
            <button
                type="button"
                class="guard-dog-2fa-btn guard-dog-2fa-btn-primary"
                id="<?php echo esc_attr( $ids['enable_email_2fa'] ); ?>"
                data-user-id="<?php echo esc_attr( $user_id ); ?>"
                data-guard-dog-enable-email-2fa
            >
                <span class="guard-dog-2fa-btn-icon">📧</span>
                <?php esc_html_e('Enable Email 2FA', 'guard-dog'); ?>
            </button>
        </div>
    <?php endif; ?>

        <!-- 2FA Setup Section (hidden by default) -->
        <div
            id="<?php echo esc_attr( $ids['setup_section'] ); ?>"
            class="guard-dog-2fa-setup-section"
            data-guard-dog-2fa-setup-section
        >
            <h4><?php esc_html_e('Set Up Two-Factor Authentication', 'guard-dog'); ?></h4>
            <ol class="guard-dog-2fa-instructions">
                <li><?php esc_html_e('Install an authenticator app (like Google Authenticator, Authy, or Microsoft Authenticator)', 'guard-dog'); ?></li>
                <li><?php esc_html_e('Scan the QR code below or manually enter the secret key', 'guard-dog'); ?></li>
                <li><?php esc_html_e('Enter the 6-digit code from your app to verify setup', 'guard-dog'); ?></li>
            </ol>

            <div class="guard-dog-2fa-setup-content">
                <div class="guard-dog-2fa-qr-section">
                    <div
                        id="<?php echo esc_attr( $ids['qr_code'] ); ?>"
                        class="guard-dog-2fa-qr-code"
                        data-guard-dog-2fa-qr-code
                    >
                        <!-- QR code will be populated here -->
                    </div>
                    <div class="guard-dog-2fa-secret">
                        <label><?php esc_html_e('Manual Secret Key:', 'guard-dog'); ?></label>
                        <code
                            id="<?php echo esc_attr( $ids['secret_key'] ); ?>"
                            class="guard-dog-2fa-secret-key"
                            data-guard-dog-2fa-secret-key
                        ></code>
                        <button
                            type="button"
                            class="guard-dog-2fa-copy-btn"
                            id="<?php echo esc_attr( $ids['copy_secret_key'] ); ?>"
                            data-guard-dog-copy-secret-key
                        >
                            <?php esc_html_e('Copy', 'guard-dog'); ?>
                        </button>
                    </div>
                </div>

                <div class="guard-dog-2fa-verify-section">
                    <label for="<?php echo esc_attr( $ids['verify_code'] ); ?>"><?php esc_html_e('Verification Code:', 'guard-dog'); ?></label>
                    <div class="guard-dog-2fa-verify-input">
                        <input
                            type="text"
                            id="<?php echo esc_attr( $ids['verify_code'] ); ?>"
                            name="guard_dog_2fa_verify_code"
                            maxlength="6"
                            placeholder="000000"
                            autocomplete="off"
                            data-guard-dog-2fa-verify-code
                        />
                        <button
                            type="button"
                            class="guard-dog-2fa-btn guard-dog-2fa-btn-primary"
                            id="<?php echo esc_attr( $ids['verify_app_2fa'] ); ?>"
                            data-guard-dog-verify-app-2fa
                        >
                            <?php esc_html_e('Verify & Enable', 'guard-dog'); ?>
                        </button>
                    </div>
                </div>
            </div>

            <div
                id="<?php echo esc_attr( $ids['setup_feedback'] ); ?>"
                class="guard-dog-2fa-feedback"
                data-guard-dog-2fa-setup-feedback
            >
                <!-- Feedback messages will appear here -->
            </div>
        </div>

        <!-- Email 2FA Setup Section (hidden by default) -->
        <div
            id="<?php echo esc_attr( $ids['email_setup_section'] ); ?>"
            class="guard-dog-email-2fa-setup-section"
            data-guard-dog-email-2fa-setup-section
        >
            <h4><?php esc_html_e('Complete Email 2FA Setup', 'guard-dog'); ?></h4>
            <p class="guard-dog-2fa-description">
                <?php esc_html_e('A verification code has been sent to your email address. Enter the 6-digit code below to complete setup.', 'guard-dog'); ?>
            </p>
            
            <div class="guard-dog-email-2fa-verification-form">
                <div class="guard-dog-email-2fa-form-group">
                    <label for="<?php echo esc_attr( $ids['email_verify_code'] ); ?>"><?php esc_html_e('Verification Code:', 'guard-dog'); ?></label>
                    <input
                        type="text"
                        id="<?php echo esc_attr( $ids['email_verify_code'] ); ?>"
                        name="guard-dog-email-2fa-verify-code"
                        size="6"
                        maxlength="6"
                        autocomplete="off"
                        placeholder="000000"
                        data-guard-dog-email-2fa-verify-code
                    />
                    <p class="guard-dog-email-2fa-help-text">
                        <?php esc_html_e('Enter the 6-digit code sent to your email address.', 'guard-dog'); ?>
                    </p>
                </div>
                
                <div class="guard-dog-2fa-buttons">
                    <button
                        type="button"
                        class="guard-dog-2fa-btn guard-dog-2fa-btn-primary"
                        id="<?php echo esc_attr( $ids['verify_email_2fa'] ); ?>"
                        data-guard-dog-verify-email-2fa
                    >
                        <?php esc_html_e('Verify & Enable', 'guard-dog'); ?>
                    </button>
                    <button
                        type="button"
                        class="guard-dog-2fa-btn guard-dog-2fa-btn-secondary"
                        id="<?php echo esc_attr( $ids['resend_email_2fa_code'] ); ?>"
                        data-guard-dog-resend-email-2fa-code
                    >
                        <?php esc_html_e('Resend Code', 'guard-dog'); ?>
                    </button>
                </div>
            </div>
        </div>
    <?php endif; ?>

        <?php if ( ! empty( $passkeys_markup ) ) : ?>
            <?php // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Trusted plugin partial markup. ?>
            <?php echo $passkeys_markup; ?>
        <?php endif; ?>

        <?php if ( ! empty( $sessions_markup ) ) : ?>
            <?php // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Trusted plugin partial markup. ?>
            <?php echo $sessions_markup; ?>
        <?php endif; ?>

    <?php if ( $show_2fa ) : ?>
        <!-- 2FA Information Section -->
        <div class="guard-dog-2fa-info">
            <h4><?php esc_html_e('How Two-Factor Authentication Works', 'guard-dog'); ?></h4>
            
            <div class="guard-dog-2fa-method-info">
                <h5><?php esc_html_e('App-Based 2FA (TOTP)', 'guard-dog'); ?></h5>
                <ol>
                    <li><?php esc_html_e('Install an authenticator app on your mobile device', 'guard-dog'); ?></li>
                    <li><?php esc_html_e('Scan the QR code or enter the secret key manually', 'guard-dog'); ?></li>
                    <li><?php esc_html_e('Enter the 6-digit code from your app when logging in', 'guard-dog'); ?></li>
                    <li><?php esc_html_e('Codes change every 30 seconds for security', 'guard-dog'); ?></li>
                </ol>
            </div>

            <?php if ( $email_2fa_available ) : ?>
            <div class="guard-dog-2fa-method-info">
                <h5><?php esc_html_e( 'Email-Based 2FA', 'guard-dog' ); ?></h5>
                <ol>
                    <li><?php esc_html_e( 'When you log in, you\'ll be prompted to enter a verification code', 'guard-dog' ); ?></li>
                    <li><?php esc_html_e( 'A 6-digit code will be sent to your email address', 'guard-dog' ); ?></li>
                    <li><?php esc_html_e( 'Enter the code to complete the login process', 'guard-dog' ); ?></li>
                    <li><?php esc_html_e( 'The code expires after 10 minutes for security', 'guard-dog' ); ?></li>
                </ol>
            </div>
            <?php endif; ?>
            
            <div class="guard-dog-2fa-notice guard-dog-2fa-info">
                <p><strong><?php esc_html_e('Note:', 'guard-dog'); ?></strong> 
                <?php esc_html_e('You can use both app-based and email-based 2FA simultaneously for enhanced security. Each method provides an additional layer of protection.', 'guard-dog'); ?></p>
            </div>
        </div>

    <!-- Messages Container -->
    <div
        id="<?php echo esc_attr( $ids['messages'] ); ?>"
        class="guard-dog-2fa-messages"
        data-guard-dog-2fa-messages
    >
        <!-- Success/error messages will appear here -->
    </div>
    <?php endif; ?>
</div> 
