<?php

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

class AIEO_Two_Factor {

	
	const ACTION = 'aieo_2fa';

	
	const META_NONCE = 'aieo_2fa_login_nonce';

	
	const NONCE_TTL = 900;

	
	private static $opened = array();

	
	public static function register() {
		add_action( 'set_logged_in_cookie', array( __CLASS__, 'note_opened_session' ), 10, 6 );
		add_action( 'wp_login', array( __CLASS__, 'intercept' ), 10, 2 );
		add_action( 'login_form_' . self::ACTION, array( __CLASS__, 'handle_second_step' ) );

		
		add_action( 'show_user_profile', array( __CLASS__, 'profile_section' ) );
		add_action( 'edit_user_profile', array( __CLASS__, 'profile_section' ) );

		add_action( 'wp_ajax_aieo_2fa_begin', array( __CLASS__, 'ajax_begin' ) );
		add_action( 'wp_ajax_aieo_2fa_confirm', array( __CLASS__, 'ajax_confirm' ) );
		add_action( 'wp_ajax_aieo_2fa_disable', array( __CLASS__, 'ajax_disable' ) );
		add_action( 'wp_ajax_aieo_2fa_recovery', array( __CLASS__, 'ajax_new_recovery_codes' ) );

		
		add_action( 'admin_notices', array( __CLASS__, 'enrolment_notice' ) );
		
		
		add_action( 'admin_notices', array( __CLASS__, 'handoff_notice' ) );
	}

	

	
	public static function is_required( $user ) {
		if ( ! AIEO_Login_Security::feature_active( '2fa' ) ) {
			return false;
		}
		return AIEO_Login_Security::user_is_protected( $user );
	}

	
	public static function should_challenge( $user ) {
		if ( ! AIEO_Login_Security::feature_active( '2fa' ) ) {
			return false;
		}
		if ( AIEO_TOTP::is_active( $user->ID ) ) {
			return true;
		}
		return self::is_required( $user ) && self::grace_expired( $user );
	}

	
	public static function grace_anchor( $user ) {
		$user = is_numeric( $user ) ? get_userdata( (int) $user ) : $user;
		if ( ! $user instanceof WP_User ) {
			return 0;
		}

		$override = (int) get_user_meta( $user->ID, AIEO_TOTP::META_GRACE_FROM, true );
		if ( $override > 0 ) {
			return $override;
		}

		$conf  = AIEO_Login_Security::feature( '2fa' );
		$since = isset( $conf['enabled_at'] ) ? (int) $conf['enabled_at'] : 0;
		if ( $since <= 0 ) {
			return 0;
		}

		
		
		$made = strtotime( (string) $user->user_registered . ' UTC' );
		$made = ( false === $made || $made <= 0 ) ? 0 : $made;

		return max( $since, $made );
	}

	
	public static function grace_expired( $user ) {
		$conf = AIEO_Login_Security::feature( '2fa' );
		$days = max( 0, (int) $conf['grace_days'] );
		
		if ( 0 === $days ) {
			return true;
		}

		$anchor = self::grace_anchor( $user );
		if ( $anchor <= 0 ) {
			return false;
		}
		return ( time() - $anchor ) > ( $days * DAY_IN_SECONDS );
	}

	
	public static function grace_days_left( $user ) {
		$conf = AIEO_Login_Security::feature( '2fa' );
		$days = max( 0, (int) $conf['grace_days'] );
		if ( 0 === $days ) {
			return 0;
		}

		$anchor = self::grace_anchor( $user );
		if ( $anchor <= 0 ) {
			
			
			return $days;
		}

		$left = ( $anchor + ( $days * DAY_IN_SECONDS ) ) - time();
		return max( 0, (int) ceil( $left / DAY_IN_SECONDS ) );
	}

	

	
	public static function intercept( $user_login, $user = null ) {
		if ( ! $user instanceof WP_User ) {
			$user = get_user_by( 'login', $user_login );
		}
		if ( ! $user instanceof WP_User ) {
			return;
		}
		if ( ! self::should_challenge( $user ) ) {
			return;
		}
		if ( self::device_is_trusted( $user->ID ) ) {
			return;
		}

		
		wp_clear_auth_cookie();
		self::end_opened_sessions( $user->ID );

		$nonce = self::issue_login_nonce( $user->ID );

		
		$redirect = isset( $_REQUEST['redirect_to'] ) ? esc_url_raw( wp_unslash( $_REQUEST['redirect_to'] ) ) : admin_url();
		
		$remember = ! empty( $_REQUEST['rememberme'] );

		self::render_second_step( $user, $nonce, $redirect, $remember, '', false );
		exit;
	}

	
	public static function note_opened_session( $cookie, $expire, $expiration, $user_id, $scheme = 'logged_in', $token = '' ) {
		if ( '' !== (string) $token ) {
			self::$opened[ (int) $user_id ][] = (string) $token;
		}
	}

	
	private static function end_opened_sessions( $user_id ) {
		$user_id = (int) $user_id;
		if ( empty( self::$opened[ $user_id ] ) ) {
			return;
		}
		$sessions = WP_Session_Tokens::get_instance( $user_id );
		foreach ( self::$opened[ $user_id ] as $token ) {
			$sessions->destroy( $token );
		}
		unset( self::$opened[ $user_id ] );
	}

	
	public static function handle_second_step() {
		if ( 'POST' !== strtoupper( isset( $_SERVER['REQUEST_METHOD'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REQUEST_METHOD'] ) ) : '' ) ) {
			wp_safe_redirect( wp_login_url() );
			exit;
		}

		
		$user_id = isset( $_POST['aieo_user'] ) ? (int) $_POST['aieo_user'] : 0;
		
		$ticket = isset( $_POST['aieo_nonce'] ) ? sanitize_text_field( wp_unslash( $_POST['aieo_nonce'] ) ) : '';

		$user = $user_id ? get_userdata( $user_id ) : null;
		if ( ! $user instanceof WP_User || ! self::consume_login_nonce( $user_id, $ticket ) ) {
			
			
			wp_safe_redirect( wp_login_url() );
			exit;
		}

		
		$redirect = isset( $_POST['redirect_to'] ) ? esc_url_raw( wp_unslash( $_POST['redirect_to'] ) ) : admin_url();
		
		$remember = ! empty( $_POST['rememberme'] );
		
		$code = isset( $_POST['aieo_code'] ) ? sanitize_text_field( wp_unslash( $_POST['aieo_code'] ) ) : '';
		
		$pending_secret = isset( $_POST['aieo_enrolling'] ) ? '1' === sanitize_text_field( wp_unslash( $_POST['aieo_enrolling'] ) ) : false;
		$trust          = self::trust_requested();

		$ok    = false;
		$error = '';

		if ( $pending_secret ) {
			
			
			$result = AIEO_TOTP::confirm_enrolment( $user->ID, $code );
			$ok     = ! empty( $result['ok'] );
			$error  = $ok ? '' : (string) $result['message'];
			if ( $ok ) {
				self::notify_account( $user, 'enrolled' );
				
				
				set_transient( 'aieo_2fa_codes_' . $user->ID, $result['codes'], 10 * MINUTE_IN_SECONDS );
			}
		} else {
			$ok = AIEO_TOTP::verify( $user->ID, $code );
			if ( ! $ok && AIEO_TOTP::verify_recovery_code( $user->ID, $code ) ) {
				$ok = true;
				self::notify_account( $user, 'recovery_used' );
			}
			if ( ! $ok ) {
				$error = __( 'That code is not right. Codes change every 30 seconds — wait for the next one and try again.', 'ai-eshop-optimizer' );
				
				
				
				do_action( 'wp_login_failed', $user->user_login, new WP_Error( 'aieo_2fa_bad_code', $error ) );
			}
		}

		if ( ! $ok ) {
			$nonce = self::issue_login_nonce( $user->ID );
			
			
			self::render_second_step( $user, $nonce, $redirect, $remember, $error, $trust );
			exit;
		}

		if ( $trust ) {
			self::remember_device( $user->ID );
		}

		wp_set_auth_cookie( $user->ID, $remember );
		do_action( 'aieo_2fa_passed', $user );

		$redirect = wp_validate_redirect( $redirect, admin_url() );
		wp_safe_redirect( $redirect );
		exit;
	}

	

	
	private static function issue_login_nonce( $user_id ) {
		$plain = bin2hex( random_bytes( 32 ) );
		update_user_meta(
			$user_id,
			self::META_NONCE,
			array(
				'hash'    => wp_hash( $plain ),
				'expires' => time() + self::NONCE_TTL,
			)
		);
		return $plain;
	}

	
	private static function consume_login_nonce( $user_id, $plain ) {
		$stored = get_user_meta( $user_id, self::META_NONCE, true );
		delete_user_meta( $user_id, self::META_NONCE );

		if ( ! is_array( $stored ) || empty( $stored['hash'] ) || empty( $stored['expires'] ) ) {
			return false;
		}
		if ( time() > (int) $stored['expires'] ) {
			return false;
		}
		return hash_equals( (string) $stored['hash'], wp_hash( (string) $plain ) );
	}

	

	

	
	public static function remember_days() {
		$conf = AIEO_Login_Security::feature( '2fa' );
		return max( 0, (int) ( isset( $conf['remember_days'] ) ? $conf['remember_days'] : 0 ) );
	}

	
	private static function trust_requested() {
		
		return self::remember_days() > 0 && isset( $_POST['aieo_trust'] ) && '1' === sanitize_text_field( wp_unslash( $_POST['aieo_trust'] ) );
	}

	
	private static function trust_cookie() {
		return 'aieo_2fa_trust_' . COOKIEHASH;
	}

	
	private static function device_is_trusted( $user_id ) {
		if ( 0 === self::remember_days() ) {
			return false;
		}

		$name = self::trust_cookie();
		
		$raw = isset( $_COOKIE[ $name ] ) ? sanitize_text_field( wp_unslash( $_COOKIE[ $name ] ) ) : '';
		if ( '' === $raw ) {
			return false;
		}

		$tokens = get_user_meta( $user_id, 'aieo_2fa_trusted', true );
		if ( ! is_array( $tokens ) ) {
			return false;
		}

		$hash = wp_hash( $raw );
		foreach ( $tokens as $t ) {
			if ( self::token_counts( $t ) && hash_equals( (string) $t['hash'], $hash ) ) {
				return true;
			}
		}
		return false;
	}

	
	private static function token_counts( $t ) {
		return is_array( $t ) && isset( $t['hash'], $t['expires'] ) && ! empty( $t['ticked'] ) && time() < (int) $t['expires'];
	}

	
	private static function remember_device( $user_id ) {
		$days = self::remember_days();
		if ( 0 === $days ) {
			return;
		}

		$plain   = bin2hex( random_bytes( 32 ) );
		$expires = time() + ( $days * DAY_IN_SECONDS );

		$tokens = get_user_meta( $user_id, 'aieo_2fa_trusted', true );
		$tokens = is_array( $tokens ) ? $tokens : array();
		
		
		
		$tokens   = array_values( array_filter( $tokens, array( __CLASS__, 'token_counts' ) ) );
		$tokens[] = array(
			'hash'    => wp_hash( $plain ),
			'expires' => $expires,
			'ticked'  => 1,
		);
		update_user_meta( $user_id, 'aieo_2fa_trusted', $tokens );

		setcookie(
			self::trust_cookie(),
			$plain,
			array(
				'expires'  => $expires,
				'path'     => COOKIEPATH ? COOKIEPATH : '/',
				'domain'   => COOKIE_DOMAIN,
				'secure'   => is_ssl(),
				'httponly' => true,
				'samesite' => 'Lax',
			)
		);
	}

	

	
	private static function render_second_step( $user, $nonce, $redirect, $remember, $error, $trust ) {
		$enrolling = ! AIEO_TOTP::is_active( $user->ID );
		$secret    = '';
		$uri       = '';

		if ( $enrolling ) {
			$start  = AIEO_TOTP::begin_enrolment( $user->ID );
			$secret = $start['secret'];
			$uri    = $start['uri'];
		}

		$title = $enrolling
			? __( 'Set up your authenticator', 'ai-eshop-optimizer' )
			: __( 'One more step', 'ai-eshop-optimizer' );

		
		
		
		
		
		
		
		
		
		
		
		
		$chrome = function_exists( 'login_header' ) && function_exists( 'login_footer' );

		if ( $chrome ) {
			login_header( $title, $error ? '<div id="login_error">' . wp_kses_post( $error ) . '</div>' : '' );
		} else {
			self::minimal_header( $title, $error );
		}

		echo '<form name="aieo2fa" id="loginform" method="post" action="' . esc_url( self::step_url() ) . '">';

		if ( $enrolling ) {
			echo '<p style="margin-bottom:14px;">' . esc_html__( 'This account manages the shop, so it needs a code from your phone as well as a password.', 'ai-eshop-optimizer' ) . '</p>';
			echo '<p style="margin-bottom:14px;">' . esc_html__( 'Open your authenticator app — Google Authenticator, Microsoft Authenticator, 1Password, Authy — and scan this:', 'ai-eshop-optimizer' ) . '</p>';

			$svg = AIEO_QR::svg( $uri, array( 'size' => 200, 'alt' => __( 'Scan with your authenticator app', 'ai-eshop-optimizer' ) ) );
			if ( '' !== $svg ) {
				echo '<div style="text-align:center;margin:0 0 14px;">' . $svg . '</div>'; 
			}

			echo '<p style="margin-bottom:6px;font-size:12px;color:#50575e;">' . esc_html__( 'No camera? Type this key in instead:', 'ai-eshop-optimizer' ) . '</p>';
			echo '<p style="margin-bottom:14px;font-family:monospace;font-size:14px;letter-spacing:1px;word-break:break-all;">' . esc_html( AIEO_TOTP::format_secret( $secret ) ) . '</p>';
			echo '<input type="hidden" name="aieo_enrolling" value="1">';
			echo '<label for="aieo_code">' . esc_html__( 'Now type the six-digit code it shows', 'ai-eshop-optimizer' ) . '</label>';
		} else {
			echo '<label for="aieo_code">' . esc_html__( 'Six-digit code from your authenticator app', 'ai-eshop-optimizer' ) . '</label>';
		}

		
		
		
		echo '<input type="text" name="aieo_code" id="aieo_code" class="input" value="" size="20"'
			. ' autocomplete="one-time-code" inputmode="numeric" pattern="[0-9 ]*" autofocus'
			. ' aria-describedby="aieo-2fa-hint" style="letter-spacing:4px;font-size:20px;">';

		if ( ! $enrolling ) {
			echo '<p id="aieo-2fa-hint" style="font-size:12px;color:#50575e;margin:8px 0 14px;">'
				. esc_html__( 'Lost your phone? Type one of the recovery codes you saved instead.', 'ai-eshop-optimizer' )
				. '</p>';
		}

		echo self::trust_box( $trust ); 

		echo '<input type="hidden" name="aieo_user" value="' . esc_attr( (string) $user->ID ) . '">';
		echo '<input type="hidden" name="aieo_nonce" value="' . esc_attr( $nonce ) . '">';
		echo '<input type="hidden" name="redirect_to" value="' . esc_attr( $redirect ) . '">';
		if ( $remember ) {
			echo '<input type="hidden" name="rememberme" value="1">';
		}

		echo '<p class="submit" style="margin-top:16px;">';
		echo '<button type="submit" class="button button-primary button-large" style="width:100%;">'
			. esc_html( $enrolling ? __( 'Confirm and sign in', 'ai-eshop-optimizer' ) : __( 'Sign in', 'ai-eshop-optimizer' ) )
			. '</button>';
		echo '</p>';
		echo '</form>';

		if ( $chrome ) {
			login_footer( 'aieo_code' );
		} else {
			self::minimal_footer();
		}
	}

	
	public static function trust_box( $trust ) {
		$days = self::remember_days();
		if ( 0 === $days ) {
			return '';
		}
		return '<p class="aieo-2fa-trust" style="margin:14px 0 0;">'
			. '<label for="aieo_trust"><input type="checkbox" name="aieo_trust" id="aieo_trust" value="1" aria-describedby="aieo-2fa-trust-hint"' . checked( (bool) $trust, true, false ) . '> '
			. esc_html(
				sprintf(
					
					_n( 'Trust this browser for %d day', 'Trust this browser for %d days', $days, 'ai-eshop-optimizer' ),
					$days
				)
			)
			. '</label></p>'
			. '<p id="aieo-2fa-trust-hint" style="font-size:12px;color:#50575e;margin:4px 0 0;">'
			. esc_html__( 'No code will be asked for on this browser until then. Leave it unticked on a shared or public computer.', 'ai-eshop-optimizer' )
			. '</p>';
	}

	
	private static function minimal_header( $title, $error ) {
		nocache_headers();
		header( 'Content-Type: text/html; charset=utf-8' );

		echo '<!doctype html><html ' . get_language_attributes() . '><head><meta charset="utf-8">'; 
		echo '<meta name="viewport" content="width=device-width,initial-scale=1">';
		echo '<meta name="robots" content="noindex,nofollow">';
		echo '<title>' . esc_html( $title ) . '</title>';
		echo '<style>'
			. 'body{font:16px/1.5 -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,sans-serif;background:#f0f0f1;color:#3c434a;margin:0;padding:40px 16px}'
			. '.box{max-width:360px;margin:0 auto;background:#fff;padding:26px 24px;border:1px solid #c3c4c7;border-radius:4px}'
			. 'h1{font-size:20px;margin:0 0 16px}'
			. 'label{display:block;margin:0 0 6px;font-size:14px}'
			. 'input.input{width:100%;padding:8px;border:1px solid #8c8f94;border-radius:3px;box-sizing:border-box}'
			. '.aieo-2fa-trust label{display:flex;align-items:center;gap:8px;min-height:24px;margin:0}'
			. '.aieo-2fa-trust input{width:18px;height:18px;margin:0;flex:none}'
			. '.button{display:inline-block;padding:10px 16px;border:0;border-radius:3px;background:#2271b1;color:#fff;font-size:15px;cursor:pointer}'
			. '#login_error{background:#fcf0f1;border-left:4px solid #d63638;padding:10px 12px;margin:0 0 14px;font-size:14px}'
			. '</style></head><body><div class="box">';
		echo '<h1>' . esc_html( $title ) . '</h1>';
		if ( $error ) {
			echo '<div id="login_error">' . wp_kses_post( $error ) . '</div>';
		}
	}

	
	private static function minimal_footer() {
		echo '</div></body></html>';
	}

	
	private static function step_url() {
		return add_query_arg( 'action', self::ACTION, wp_login_url() );
	}

	
	private static function action_attr( $action_id, $destructive = false ) {
		if ( class_exists( 'AIEO_DMM_UI' ) && is_callable( array( 'AIEO_DMM_UI', 'action_attr' ) ) ) {
			return AIEO_DMM_UI::action_attr( 'login_security', $action_id, $destructive );
		}
		return 'data-aieo-action="' . esc_attr( 'login_security.' . $action_id ) . '"'
			. ( $destructive ? ' data-aieo-action-destructive="1"' : '' );
	}

	

	
	public static function profile_section( $user ) {
		if ( ! AIEO_Login_Security::feature( '2fa' )['enabled'] && ! AIEO_TOTP::is_active( $user->ID ) ) {
			return;
		}

		$is_self  = ( get_current_user_id() === (int) $user->ID );
		$active   = AIEO_TOTP::is_active( $user->ID );
		$required = self::is_required( $user );
		$left     = AIEO_TOTP::recovery_codes_left( $user->ID );

		echo '<h2 id="aieo-2fa">' . esc_html__( 'Two-factor authentication', 'ai-eshop-optimizer' ) . '</h2>';
		echo '<table class="form-table" role="presentation"><tr>';
		echo '<th>' . esc_html__( 'Status', 'ai-eshop-optimizer' ) . '</th><td>';

		if ( $active ) {
			echo '<p style="margin:0 0 8px;"><strong style="color:#15803d;">' . esc_html__( 'On.', 'ai-eshop-optimizer' ) . '</strong> '
				. esc_html(
					sprintf(
						
						_n( '%d recovery code left.', '%d recovery codes left.', $left, 'ai-eshop-optimizer' ),
						$left
					)
				) . '</p>';
			if ( $left <= 2 ) {
				echo '<p style="margin:0 0 8px;color:#b32d2e;">' . esc_html__( 'Running low — issue a new set before you are locked out of your own shop.', 'ai-eshop-optimizer' ) . '</p>';
			}
		} elseif ( $required ) {
			$days = self::grace_days_left( $user );
			echo '<p style="margin:0 0 8px;"><strong id="aieo-2fa-status" style="color:#b32d2e;">' . esc_html__( 'Off, and required for this account.', 'ai-eshop-optimizer' ) . '</strong> ';
			echo esc_html(
				$days > 0
					? sprintf(
						
						_n( 'You have %d day left to set it up before it is asked for at sign-in.', 'You have %d days left to set it up before it is asked for at sign-in.', $days, 'ai-eshop-optimizer' ),
						$days
					)
					: __( 'It will be asked for at your next sign-in.', 'ai-eshop-optimizer' )
			);
			echo '</p>';
		} else {
			echo '<p style="margin:0 0 8px;"><span id="aieo-2fa-status">' . esc_html__( 'Off.', 'ai-eshop-optimizer' ) . '</span></p>';
		}

		if ( ! $is_self ) {
			
			if ( $active && current_user_can( 'edit_user', $user->ID ) ) {
				echo '<p><button type="button" class="button" id="aieo-2fa-disable" data-user="' . esc_attr( (string) $user->ID ) . '" '
					. self::action_attr( 'disable_2fa', true ) . '>' 
					. esc_html__( 'Switch off for this user', 'ai-eshop-optimizer' ) . '</button>';
				echo ' <span class="description">' . esc_html__( 'Use when somebody has lost their phone and their recovery codes. They will be asked to set it up again.', 'ai-eshop-optimizer' ) . '</span></p>';
			}
			echo '</td></tr></table>';
			self::print_profile_js( $user->ID );
			return;
		}

		echo '<div id="aieo-2fa-panel"></div>';
		echo '<p>';
		if ( ! $active ) {
			echo '<button type="button" class="button button-primary" id="aieo-2fa-begin" '
				. self::action_attr( 'begin_2fa' ) . '>' 
				. esc_html__( 'Set up two-factor authentication', 'ai-eshop-optimizer' ) . '</button>';
		} else {
			echo '<button type="button" class="button" id="aieo-2fa-recovery" '
				. self::action_attr( 'new_recovery_codes', true ) . '>' 
				. esc_html__( 'Issue new recovery codes', 'ai-eshop-optimizer' ) . '</button> ';
			if ( ! $required ) {
				echo '<button type="button" class="button" id="aieo-2fa-disable" data-user="' . esc_attr( (string) $user->ID ) . '" '
					. self::action_attr( 'disable_2fa', true ) . '>' 
					. esc_html__( 'Switch off', 'ai-eshop-optimizer' ) . '</button>';
			}
		}
		echo '</p>';
		echo '</td></tr></table>';

		self::print_profile_js( $user->ID );
	}

	
	private static function print_profile_js( $user_id ) {
		$nonce = wp_create_nonce( 'aieo_2fa_profile' );
		?>
		<script>
		(function(){
			var AJAX  = <?php echo wp_json_encode( admin_url( 'admin-ajax.php' ) ); ?>;
			var NONCE = <?php echo wp_json_encode( $nonce ); ?>;
			var USER  = <?php echo (int) $user_id; ?>;
			var panel = document.getElementById('aieo-2fa-panel');

			function post(action, extra) {
				var fd = new FormData();
				fd.set('action', action);
				fd.set('nonce', NONCE);
				fd.set('user_id', USER);
				Object.keys(extra || {}).forEach(function(k){ fd.set(k, extra[k]); });
				return fetch(AJAX, {method:'POST', credentials:'same-origin', body: fd}).then(function(r){ return r.json(); });
			}

			var begin = document.getElementById('aieo-2fa-begin');
			if (begin) begin.addEventListener('click', function(){
				begin.disabled = true;
				post('aieo_2fa_begin').then(function(res){
					if (!res || !res.success) {
						// Only put the button back when there is nothing to confirm.
						begin.disabled = false;
						window.alert(<?php echo wp_json_encode( __( 'Could not start setup.', 'ai-eshop-optimizer' ) ); ?>);
						return;
					}
					// HIDE the start button for as long as a code is waiting to be
					// confirmed. It used to stay live directly beneath the Confirm
					// box, and pressing it again called begin_enrolment(), which
					// mints a FRESH secret and silently kills the QR the person has
					// just scanned. They then type a code from a dead secret, are
					// told it does not match, and reasonably conclude the feature is
					// broken. Reported from the field 2026-08-29.
					begin.style.display = 'none';
					panel.innerHTML = res.data.html;
					var confirm = document.getElementById('aieo-2fa-confirm');
					confirm.addEventListener('click', function(){
						var code = document.getElementById('aieo-2fa-code').value;
						post('aieo_2fa_confirm', {code: code}).then(function(r2){
							var msg = document.getElementById('aieo-2fa-msg');
							if (r2 && r2.success) {
								panel.innerHTML = r2.data.html;
								// Enrolled. The status line above still reads "Off"
								// because it was rendered before any of this, and the
								// recovery codes are on screen exactly once, so we
								// must not reload the page to refresh it.
								var st = document.getElementById('aieo-2fa-status');
								if (st) {
									st.textContent = <?php echo wp_json_encode( __( 'On. Save the recovery codes below before you leave this page.', 'ai-eshop-optimizer' ) ); ?>;
									st.style.color = '#15803d';
								}
							} else {
								msg.textContent = (r2 && r2.data && r2.data.message) || '';
								msg.style.color = '#b32d2e';
							}
						});
					});
				});
			});

			var off = document.getElementById('aieo-2fa-disable');
			if (off) off.addEventListener('click', function(){
				if (!window.confirm(<?php echo wp_json_encode( __( 'Switch off two-factor authentication for this account? It will be protected by its password alone.', 'ai-eshop-optimizer' ) ); ?>)) return;
				post('aieo_2fa_disable', {target: off.getAttribute('data-user')}).then(function(){ location.reload(); });
			});

			var re = document.getElementById('aieo-2fa-recovery');
			if (re) re.addEventListener('click', function(){
				if (!window.confirm(<?php echo wp_json_encode( __( 'Issue a new set of recovery codes? Any codes you already saved stop working.', 'ai-eshop-optimizer' ) ); ?>)) return;
				post('aieo_2fa_recovery').then(function(res){
					if (res && res.success) { panel.innerHTML = res.data.html; }
				});
			});
		})();
		</script>
		<?php
	}

	

	
	private static function verify( $target = 0 ) {
		check_ajax_referer( 'aieo_2fa_profile', 'nonce' );
		$target = $target ? (int) $target : get_current_user_id();
		if ( ! $target || ! current_user_can( 'edit_user', $target ) ) {
			wp_send_json_error( array( 'message' => 'permission_denied' ), 403 );
		}
		return $target;
	}

	
	public static function ajax_begin() {
		$user_id = self::verify();

		
		if ( $user_id !== get_current_user_id() ) {
			wp_send_json_error( array( 'message' => 'self_only' ), 403 );
		}

		$start = AIEO_TOTP::begin_enrolment( $user_id );
		$svg   = AIEO_QR::svg( $start['uri'], array( 'size' => 190, 'alt' => __( 'Scan with your authenticator app', 'ai-eshop-optimizer' ) ) );

		$html  = '<div class="aieo-dmm-card" style="max-width:520px;margin:12px 0;">';
		$html .= '<p>' . esc_html__( 'Scan this with your authenticator app, then type the code it shows to prove it worked.', 'ai-eshop-optimizer' ) . '</p>';
		$html .= '<div style="margin:10px 0;">' . $svg . '</div>';
		$html .= '<p style="font-size:12px;color:#50575e;margin:0 0 4px;">' . esc_html__( 'No camera? Type this key in instead:', 'ai-eshop-optimizer' ) . '</p>';
		$html .= '<p style="font-family:monospace;letter-spacing:1px;word-break:break-all;">' . esc_html( AIEO_TOTP::format_secret( $start['secret'] ) ) . '</p>';
		$html .= '<p><input type="text" id="aieo-2fa-code" class="regular-text" inputmode="numeric" autocomplete="one-time-code" placeholder="' . esc_attr__( '123456', 'ai-eshop-optimizer' ) . '" style="width:140px;letter-spacing:3px;"> ';
		$html .= '<button type="button" class="button button-primary" id="aieo-2fa-confirm">' . esc_html__( 'Confirm', 'ai-eshop-optimizer' ) . '</button></p>';
		$html .= '<p id="aieo-2fa-msg" style="margin:0;font-size:13px;"></p>';
		$html .= '</div>';

		wp_send_json_success( array( 'html' => $html ) );
	}

	
	public static function ajax_confirm() {
		$user_id = self::verify();
		if ( $user_id !== get_current_user_id() ) {
			wp_send_json_error( array( 'message' => 'self_only' ), 403 );
		}

		$code   = isset( $_POST['code'] ) ? sanitize_text_field( wp_unslash( $_POST['code'] ) ) : '';
		$result = AIEO_TOTP::confirm_enrolment( $user_id, $code );

		if ( empty( $result['ok'] ) ) {
			wp_send_json_error( array( 'message' => $result['message'] ) );
		}

		self::notify_account( get_userdata( $user_id ), 'enrolled' );
		wp_send_json_success( array( 'html' => self::recovery_codes_html( $result['codes'] ) ) );
	}

	
	public static function ajax_disable() {
		$target  = isset( $_POST['target'] ) ? (int) $_POST['target'] : 0;
		$user_id = self::verify( $target );

		AIEO_TOTP::disable( $user_id );
		
		
		
		
		update_user_meta( $user_id, AIEO_TOTP::META_GRACE_FROM, (string) time() );

		self::notify_account( get_userdata( $user_id ), 'disabled' );
		wp_send_json_success();
	}

	
	public static function ajax_new_recovery_codes() {
		$user_id = self::verify();
		if ( $user_id !== get_current_user_id() ) {
			wp_send_json_error( array( 'message' => 'self_only' ), 403 );
		}
		if ( ! AIEO_TOTP::is_active( $user_id ) ) {
			wp_send_json_error( array( 'message' => 'not_enrolled' ), 400 );
		}

		$codes = AIEO_TOTP::issue_recovery_codes( $user_id );
		self::notify_account( get_userdata( $user_id ), 'recovery_reissued' );
		wp_send_json_success( array( 'html' => self::recovery_codes_html( $codes ) ) );
	}

	
	private static function recovery_codes_html( array $codes ) {
		$html  = '<div class="aieo-dmm-card" style="max-width:520px;margin:12px 0;border-left:4px solid #dba617;">';
		$html .= '<h3 style="margin-top:0;">' . esc_html__( 'Save these recovery codes now', 'ai-eshop-optimizer' ) . '</h3>';
		$html .= '<p>' . esc_html__( 'Each one signs you in once if your phone is lost or wiped. This is the only time they are shown — print them, or put them in your password manager. They cannot be shown again, only replaced.', 'ai-eshop-optimizer' ) . '</p>';
		$html .= '<p style="font-family:monospace;font-size:15px;line-height:2;letter-spacing:1px;">';
		foreach ( $codes as $c ) {
			$html .= esc_html( $c ) . '<br>';
		}
		$html .= '</p></div>';
		return $html;
	}

	

	
	public static function enrolment_notice() {
		if ( ! AIEO_Login_Security::feature_active( '2fa' ) ) {
			return;
		}
		$user = wp_get_current_user();
		if ( ! $user || ! self::is_required( $user ) || AIEO_TOTP::is_active( $user->ID ) ) {
			return;
		}

		$days = self::grace_days_left( $user );
		$url  = admin_url( 'profile.php#aieo-2fa' );

		echo '<div class="notice notice-warning"><p><strong>'
			. esc_html__( 'Your account still has no second factor.', 'ai-eshop-optimizer' )
			. '</strong> '
			. esc_html(
				$days > 0
					? sprintf(
						
						_n( 'This account manages the shop, so a code from your phone will be required in %d day.', 'This account manages the shop, so a code from your phone will be required in %d days.', $days, 'ai-eshop-optimizer' ),
						$days
					)
					: __( 'This account manages the shop, so a code from your phone will be required at your next sign-in.', 'ai-eshop-optimizer' )
			)
			. ' <a href="' . esc_url( $url ) . '">' . esc_html__( 'Set it up now', 'ai-eshop-optimizer' ) . '</a></p></div>';
	}

	
	public static function handoff_notice() {
		$key   = 'aieo_2fa_codes_' . get_current_user_id();
		$codes = get_transient( $key );
		if ( ! is_array( $codes ) || empty( $codes ) ) {
			return;
		}
		delete_transient( $key );

		echo '<div class="notice notice-warning"><p><strong>'
			. esc_html__( 'Save these recovery codes now — this is the only time they are shown.', 'ai-eshop-optimizer' )
			. '</strong></p><p>'
			. esc_html__( 'Each one signs you in once if your phone is lost or wiped. Print them, or put them in your password manager. They cannot be shown again, only replaced from your profile.', 'ai-eshop-optimizer' )
			. '</p><p style="font-family:monospace;font-size:15px;line-height:2;letter-spacing:1px;">';
		foreach ( $codes as $c ) {
			echo esc_html( (string) $c ) . '<br>';
		}
		echo '</p></div>';
	}

	
	private static function notify_account( $user, $event ) {
		if ( ! $user instanceof WP_User || ! is_email( $user->user_email ) ) {
			return;
		}

		$site = wp_specialchars_decode( get_bloginfo( 'name' ), ENT_QUOTES );

		$lines = array(
			'enrolled'          => __( 'Two-factor authentication was switched ON for your account.', 'ai-eshop-optimizer' ),
			'disabled'          => __( 'Two-factor authentication was switched OFF for your account.', 'ai-eshop-optimizer' ),
			'recovery_used'     => __( 'One of your recovery codes was used to sign in.', 'ai-eshop-optimizer' ),
			'recovery_reissued' => __( 'A new set of recovery codes was issued for your account. Any you had saved no longer work.', 'ai-eshop-optimizer' ),
		);
		if ( ! isset( $lines[ $event ] ) ) {
			return;
		}

		$body = $lines[ $event ] . "\n\n"
			. sprintf(
				
				__( 'Account: %1$s on %2$s', 'ai-eshop-optimizer' ),
				$user->user_login,
				$site
			) . "\n"
			. sprintf(
				
				__( 'When: %s', 'ai-eshop-optimizer' ),
				wp_date( 'j F Y, H:i' )
			) . "\n\n"
			. __( 'If this was you, nothing needs doing. If it was not, change your password immediately and tell whoever runs the shop.', 'ai-eshop-optimizer' );

		wp_mail(
			$user->user_email,
			sprintf(
				
				__( '[%s] Your sign-in security changed', 'ai-eshop-optimizer' ),
				$site
			),
			$body
		);
	}
}