{{define "title"}}Authenticator - {{.Site}}{{end}}
{{define "main"}}
<h2>Authenticator</h2>

{{with .Data.Codes}}
<h3>Recovery codes</h3>
<p>Each of these works once, in place of a code. They are not shown again.</p>
<pre>{{range .}}{{.}}
{{end}}</pre>
{{end}}

{{if .Data.Enrolled}}
<p>
This account has an authenticator, and {{.Data.Left}} recovery codes left.
</p>

<h3>New recovery codes</h3>
<p>Making new ones stops the old ones working.</p>
<form method="post" action="/settings/totp/codes">
<input type="hidden" name="csrf" value="{{.CSRF}}">
{{if .Data.Local}}
<p>
<label for="codes-current">Current password</label>
<input id="codes-current" name="current" type="password" autocomplete="current-password" required>
</p>
{{else}}
<p>
<label for="codes-code">Code from the authenticator</label>
<input id="codes-code" name="code" inputmode="numeric" autocomplete="one-time-code" required>
</p>
{{end}}
<p><button type="submit">Make new recovery codes</button></p>
</form>

<h3>Remove</h3>
{{if .Data.Required}}
<p>
This account holds the global admin flag, so it must keep an authenticator.
Another admin has to take the flag away first.
</p>
{{else}}
<p>Removing it signs out every session for this account.</p>
<form method="post" action="/settings/totp/remove">
<input type="hidden" name="csrf" value="{{.CSRF}}">
{{if .Data.Local}}
<p>
<label for="current">Current password</label>
<input id="current" name="current" type="password" autocomplete="current-password" required>
</p>
{{else}}
<p>
<label for="remove-code">Code from the authenticator</label>
<input id="remove-code" name="code" inputmode="numeric" autocomplete="one-time-code" required>
</p>
{{end}}
<p><button type="submit">Remove the authenticator</button></p>
</form>
{{end}}

{{else}}
<p>
Type this secret into an authenticator, or give it the URI. There is no QR
code: it would be useless in a terminal browser.
</p>
<pre>{{.Data.Secret}}

{{.Data.URI}}</pre>
<p>
Then prove it took, which is what enrols it. Enrolling signs out every other
session.
{{if .Data.Local}}
It takes the password as well: a stolen cookie must not be able to put a second
factor on this account and lock its owner out.
{{else}}
This account signs in through an external provider and has no password here, so
enrolling rests on this session alone. The address on file is told, and an admin
can clear an authenticator you did not enrol.
{{end}}
</p>
<form method="post" action="/settings/totp">
<input type="hidden" name="csrf" value="{{.CSRF}}">
<input type="hidden" name="secret" value="{{.Data.Secret}}">
<p>
<label for="code">Code from the authenticator</label>
<input id="code" name="code" inputmode="numeric" autocomplete="one-time-code" required>
</p>
{{if .Data.Local}}
<p>
<label for="enrol-current">Current password</label>
<input id="enrol-current" name="current" type="password" autocomplete="current-password" required>
</p>
{{end}}
<p><button type="submit">Enroll</button></p>
</form>
{{end}}
{{end}}