{{-- Panel de Configuración de Doble Factor (2FA) y Dispositivos de Confianza (Estilo macOS / Glassmorphism) --}}
<div id="two-factor-security" class="rounded-2xl border border-slate-200/80 bg-white/90 backdrop-blur-xl shadow-lg p-6">
    <div class="flex flex-col md:flex-row md:items-center md:justify-between gap-4 border-b border-slate-200/70 pb-4">
        <div class="flex items-center gap-3">
            <div class="h-11 w-11 rounded-2xl bg-emerald-50 border border-emerald-200 flex items-center justify-center text-emerald-600 shadow-sm">
                <svg class="w-6 h-6" fill="none" stroke="currentColor" stroke-width="2" viewBox="0 0 24 24">
                    <path stroke-linecap="round" stroke-linejoin="round" d="M9 12.75 11.25 15 15 9.75m-3-7.036A11.959 11.959 0 0 1 3.598 6 11.99 11.99 0 0 0 3 9.749c0 5.592 3.824 10.29 9 11.623 5.176-1.332 9-6.03 9-11.622 0-1.31-.21-2.571-.598-3.751h-.152c-3.196 0-6.1-1.248-8.25-3.285Z" />
                </svg>
            </div>
            <div>
                <h3 class="text-base font-bold text-slate-900 tracking-tight">
                    Autenticación de Doble Factor (2FA — TOTP)
                </h3>
                <p class="text-xs text-slate-500">
                    Protección opcional con Google Authenticator y reconocimiento de equipos de confianza por 30 días.
                </p>
            </div>
        </div>

        @if(auth()->user()?->hasTwoFactorEnabled())
            <span class="inline-flex items-center gap-1.5 rounded-full bg-emerald-100 border border-emerald-200 px-3 py-1 text-xs font-semibold text-emerald-800">
                <span class="h-2 w-2 rounded-full bg-emerald-500"></span>
                2FA • Verificado
            </span>
        @else
            <span class="inline-flex items-center gap-1.5 rounded-full bg-amber-50 border border-amber-200 px-3 py-1 text-xs font-semibold text-amber-800">
                <span class="h-2 w-2 rounded-full bg-amber-500"></span>
                2FA • Sin activar
            </span>
        @endif
    </div>

    @if(!auth()->user()?->hasTwoFactorEnabled())
        <div class="mt-5 grid grid-cols-1 lg:grid-cols-12 gap-6 items-start">
            <div class="lg:col-span-5 flex flex-col items-center rounded-2xl border border-slate-200 bg-slate-50/70 p-5">
                @if(!empty($qrSvg))
                    <div class="bg-white p-3 rounded-2xl border border-slate-200 shadow-sm">
                        {!! $qrSvg !!}
                    </div>
                @endif
                @if(!empty($secret))
                    <div class="mt-4 w-full">
                        <span class="block text-xs font-semibold text-slate-500 uppercase tracking-wider mb-1">
                            Clave Manual Base32
                        </span>
                        <div class="font-mono text-xs font-bold text-slate-900 bg-white border border-slate-200 rounded-xl px-3 py-2 text-center select-all">
                            {{ $secret }}
                        </div>
                    </div>
                @endif
            </div>

            <div class="lg:col-span-7 space-y-4">
                @if(!empty($recoveryCodes))
                    <div>
                        <span class="block text-xs font-semibold text-slate-600 mb-2">
                            Códigos de Recuperación (Un solo uso)
                        </span>
                        <div class="grid grid-cols-2 gap-2 rounded-xl bg-slate-50 border border-slate-200 p-3">
                            @foreach($recoveryCodes as $recoveryCode)
                                <div class="font-mono text-xs font-bold text-slate-800 bg-white border border-slate-200 rounded-lg py-1.5 px-2 text-center">
                                    {{ $recoveryCode }}
                                </div>
                            @endforeach
                        </div>
                    </div>
                @endif

                <form method="POST" action="{{ route('users.two-factor.confirm', auth()->id()) }}" class="space-y-3">
                    @csrf
                    <label for="code" class="block text-xs font-semibold text-slate-700">
                        Código de 6 dígitos de Google Authenticator
                    </label>
                    <div class="flex gap-2">
                        <input
                            id="code"
                            name="code"
                            type="text"
                            inputmode="numeric"
                            maxlength="6"
                            required
                            placeholder="000000"
                            class="w-full rounded-xl border border-slate-300 bg-white px-4 py-2 text-center font-mono text-lg font-bold tracking-widest text-slate-900 focus:border-blue-500 focus:ring-2 focus:ring-blue-500/20"
                        />
                        <button
                            type="submit"
                            class="rounded-xl bg-blue-600 px-5 py-2 text-xs font-semibold text-white shadow-sm hover:bg-blue-700 transition"
                        >
                            Confirmar y Activar
                        </button>
                    </div>
                </form>
            </div>
        </div>
    @else
        <div class="mt-5 space-y-4">
            <div class="flex items-center justify-between">
                <h4 class="text-sm font-bold text-slate-900">Dispositivos de Confianza Autorizados</h4>
                <form method="POST" action="{{ route('users.trusted-devices.revoke', auth()->id()) }}">
                    @csrf
                    @method('DELETE')
                    <button
                        type="submit"
                        class="rounded-xl border border-rose-200 bg-rose-50 px-3 py-1.5 text-xs font-semibold text-rose-700 hover:bg-rose-100 transition"
                    >
                        Revocar confianza de todos los dispositivos
                    </button>
                </form>
            </div>

            <form method="POST" action="{{ route('users.two-factor.disable', auth()->id()) }}" class="pt-4 border-t border-slate-200 flex flex-col sm:flex-row gap-2">
                @csrf
                @method('DELETE')
                <input
                    type="password"
                    name="current_password"
                    placeholder="Contraseña actual o código TOTP para desactivar 2FA"
                    class="flex-1 rounded-xl border border-slate-300 px-3.5 py-2 text-xs text-slate-900"
                />
                <button
                    type="submit"
                    class="rounded-xl bg-rose-600 px-4 py-2 text-xs font-semibold text-white hover:bg-rose-700 transition"
                >
                    Desactivar 2FA
                </button>
            </form>
        </div>
    @endif
</div>