[%# This Source Code Form is subject to the terms of the Mozilla Public
  # License, v. 2.0. If a copy of the MPL was not distributed with this
  # file, You can obtain one at http://mozilla.org/MPL/2.0/.
  #
  # This Source Code Form is "Incompatible With Secondary Licenses", as
  # defined by the Mozilla Public License, v. 2.0.
  #%]

[% SET MFA_HOWTO = "https://wiki.mozilla.org/BMO/UserGuide/Two-Factor_Authentication" %]
[% tab_footer = BLOCK %]
  <form action="token.cgi" method="post" id="forgot-form">
    <input type="hidden" name="loginname" value="[% user.login FILTER html %]">
    <input type="hidden" name="a" value="reqpw">
    <input type="hidden" name="token" value="[% issue_hash_token(['reqpw']) FILTER html %]">
  </form>
[% END %]

[% IF NOT Bugzilla.feature('mfa') %]
  <input type="hidden" name="mfa_action" id="mfa-action" value="">
  <p>
    Two-factor Authentication is not available.
  </p>
  [% RETURN %]
[% END %]
[% IF user.cryptpassword == '*' %]
  <input type="hidden" name="mfa_action" id="mfa-action" value="" data-nopassword="true">
  [% IF Bugzilla.request_cache.mfa_warning %]
    <p>
      Your account requires Two-Factor authentication to be configured before you can use [% terms.Bugzilla %]
    </p>
  [% END %]
  <p>
    Before you can enable two-factor authentication you must set a password on your account.
    To do this on your account please click on "Reset Password";
    this will email you instructions to start the password reset process.
  </p>
  <p>
    As part of this transition you will no longer be able to use GitHub to log in to [% terms.Bugzilla %].
  </p>
  [% RETURN %]
[% END %]

<div id="mfa-container">
  [% IF mfa_recovery_token %]
    <input type="hidden" name="mfa_action" id="mfa-action" value="">

    <p>
      Here are your recovery codes.
    </p>

    [% INCLUDE recovery_blurb %]
    <iframe id="mfa-recovery-frame" tabindex="-1"
            src="userprefs.cgi?tab=mfa&frame=recovery&t=[% mfa_recovery_token FILTER uri %]">
    </iframe>

  [% ELSIF user.mfa %]
    <p>
      Two-factor authentication is currently <b>enabled</b> using
      <b>[% SWITCH user.mfa %]
        [% CASE "TOTP" %]TOTP
        [% CASE "Duo" %]Duo Security
      [% END %]</b>.
    </p>
    <input type="hidden" name="mfa_action" id="mfa-action" value="disable">

    <div class="mfa-buttons">
      <div>
        <button type="button" id="mfa-disable">Disable Two-factor Authentication</button>
        [% INCLUDE "mfa/protected.html.tmpl" %]
      </div>
      <div>
        <button type="button" id="mfa-recovery">Generate Printable Recovery Codes</button>
        [% INCLUDE "mfa/protected.html.tmpl" %]
      </div>
    </div>

    <p class="mfa-api-blurb">
      [% IF user.settings.api_key_only.value == 'on' %]
        Enabling two-factor authentication has also required systems that
        interface with [% terms.Bugzilla %]'s API to use <a href="userprefs.cgi?tab=apikey">API keys</a>
        for authentication.<br>
        <br>
        While not recommended, this limitation can be lifted by changing the
        <a href="userprefs.cgi?tab=settings#api_key_only">Require API key authentication for API requests</a>
        preference.
      [% ELSE %]
        Systems that interface with [% terms.Bugzilla %]'s API are not required to use API keys.<br>
        Change the
        <a href="userprefs.cgi?tab=settings#api_key_only">Require API key authentication for API requests</a>
        preference to enforce API key usage.
      [% END %]
    </p>

    [% IF user.mfa && user.in_group("mozilla-employee-confidential") %]
      <p class="mfa-disable-blurb">
        You will need to disable your two-factor authentication in order to change to a different method.
        There will be a small amount of time when your account will not be as secure, so you may use the
        <a href="userprefs.cgi?tab=sessions">sessions</a> page to log out all other sessions other
        than the current one after setting up the new method.
      </p>
    [% END %]

    <div id="mfa-recovery-container" style="display:none">
      <p>
        Your current password and verification code is required to generate
        recovery codes.
      </p>
      <ul>
        <li><b>Generating recovery codes obsoletes previously generated ones</b></li>
      </ul>
      [% INCLUDE recovery_blurb %]
    </div>

    <div id="mfa-disable-container" style="display:none">
      <p>
        Your current password and verification code is required to disable
        two-factor authentication.
      </p>
    </div>

    <div id="mfa-auth-container" style="display:none">
      <p>
        <label for="mfa-password">Current Password:</label>
        <input type="password" name="password" id="mfa-password" required>
      </p>

      [%# disable/recovery - totp %]
      [% IF user.mfa == "TOTP" %]

        <label for="code">Code:</label>
        <input type="text" name="code" id="code"
               placeholder="123456" maxlength="9" pattern="\d{6,9}" size="10"
               autocomplete="off" required>

      [%# disable/recovery - duo %]
      [% ELSIF user.mfa == "Duo" %]

        <p>
          <img src="images/duo.png" id="duo-logo" width="32" height="32">
          Verification with Duo Security will be performed before your account is updated.
        </p>

      [% END %]
    </div>

  [% ELSE %]
    [% IF Bugzilla.request_cache.mfa_warning %]
      <p class="mfa-warning-msg">
        You <b>must</b> enable two-factor authentication
        [% UNLESS Bugzilla.request_cache.mfa_grace_period_expired %]
          before <i>[% Bugzilla.user.mfa_required_date FILTER time %]</i>.
          After that date, you will be restricted to this page until 2FA is configured.
        [% ELSE %]
          before continuing to use [% terms.Bugzilla %].
        [% END %]
      </p>
      <p>
        <b>Need help setting up 2FA?</b>
        You may want to <a href="[% MFA_HOWTO FILTER html %]">read these comprehensive instructions</a>.
      </p>
    [% ELSE %]
      <p>
        Two-factor authentication is currently <b>disabled</b>.
      </p>
    [% END %]
    <input type="hidden" name="mfa_action" id="mfa-action" value="enable">
    <input type="hidden" name="mfa" id="mfa">

    <div id="mfa-select" class="mfa-buttons">
      <p>
        Select the two-factor system you want to use:
      </p>

      <button type="button" id="mfa-select-totp">Time-based One-Time Password (TOTP)</button><br>
      <blockquote>
        Requires a smartphone and a TOTP app (such as
        <a href="https://support.google.com/accounts/answer/1066447" target="_blank" rel="noopener noreferrer">Google Authenticator</a>
        or <a href="https://freeotp.github.io/" target="_blank" rel="noopener noreferrer">Red Hat FreeOTP</a>),
      </blockquote>

      [% IF Param("duo_host") && user.in_group("mozilla-employee-confidential") %]
        <button type="button" id="mfa-select-duo">Duo Security</button><br>
        <blockquote>
          Requires a <a href="https://mana.mozilla.org/wiki/display/SD/DuoSecurity" target="_blank" rel="noopener noreferrer">Duo Security</a>
          account (recommended for Mozilla employees).
        </blockquote>
      [% END %]
    </div>

    <div id="mfa-enable-shared" style="display:none">
      <p>
        Your current password is required to enable two-factor authentication.
      </p>
      <p>
        <label for="mfa-password">Current Password:</label>
        <input type="password" name="password" id="mfa-password" required>
      </p>
    </div>

    [%# enable - TOTP %]
    <div id="mfa-enable-totp" style="display:none">

      <div id="mfa-totp-throbber">
        Generating new QR code.. <img src="../../images/throbber.gif" width="16" height="11">
      </div>

      <div id="mfa-totp-issued" style="display:none">
        <iframe id="mfa-enable-totp-frame" src="userprefs.cgi?tab=mfa&frame=totp" tabindex="-1"></iframe>
        <div id="mfa-totp-blurb">
          Scan this QR code with your <a href="#" id="mfa-totp-apps">TOTP App</a>,
          then enter the six digit code the app generates.<br>
          <br>
          <label id="mfa-totp-enable-code">Code:</label>
          <input type="text" name="code" id="mfa-totp-enable-code"
                  placeholder="123456" maxlength="6" pattern="\d{6}" size="10"
                  autocomplete="off">
        </div>
      </div>

      <p>
        If you have problems enrolling, this may be due to an inaccurate time on your device.<br>
        Please check that the time on your device is accurate by visiting <b>http://time.is/</b>.
      </p>

      <div id="mfa-totp-apps-popup" class="mfa-totp-popup" style="display:none">
        Example TOTP Applications:<br>
        <ul>
          <li>Android and iOS:
            <a href="https://support.google.com/accounts/answer/1066447" target="_blank" rel="noopener noreferrer">Google Authenticator</a>,
            <a href="https://freeotp.github.io/" target="_blank" rel="noopener noreferrer">Red Hat FreeOTP</a>
          </li>
          <li>Firefox OS:
            <a href="https://marketplace.firefox.com/app/firekey/" target="_blank" rel="noopener noreferrer">Firekey</a>
          </li>
          <li>Windows Phone:
            <a href="http://www.windowsphone.com/en-us/store/app/authenticator/021dd79f-0598-e011-986b-78e7d1fa76f8"
                target="_blank rel="noopener noreferrer"">Authenticator</a>
          </li>
        </ul>
        <a href="https://en.wikipedia.org/wiki/Time-based_One-time_Password_Algorithm#Client_implementations" target="_blank" rel="noopener noreferrer">
          Other clients
        </a>
        <button type="button" class="mfa-totp-popup-close">Close</button>
      </div>

    </div>

    [% IF Param("duo_host") && user.in_group("mozilla-employee-confidential") %]
      [%# enable - duo %]
      <div id="mfa-enable-duo" style="display:none">

        <p>
          <label title="This is generally your Mozilla LDAP Username" id="mfa-duo-user-label" for="mfa-duo-user">Duo Username:</label>
          <input type="text" name="username" id="mfa-duo-user">
        </p>

        <p>
          <img src="images/duo.png" id="duo-logo" width="32" height="32">
          Verification with Duo Security will be performed before your account is updated.<br>

          You must be <a href="https://mana.mozilla.org/wiki/display/SD/DuoSecurity" target="_blank" rel="noopener noreferrer">
          enrolled with Duo Security via login.mozilla.com</a> before you can use Duo 2FA.
        </p>

      </div>
    [% END %]

  [% END %]

  <div id="mfa-confirm" style="display:none">
    <p>
      Two-factor authentication settings will not be updated until you
      <b>Submit Changes</b>.
    </p>

    <p class="mfa-api-blurb" style="display:none">
      Enabling two-factor authentication will also require systems that
      interface with [% terms.Bugzilla %]'s API to use <a href="userprefs.cgi?tab=apikey">API keys</a>
      for authentication.  While not recommended, this limitation can be lifted by changing the
      <a href="userprefs.cgi?tab=settings#api_key_only">Require API key authentication for API requests</a>
      preference after 2FA is enabled.
    </p>
  </div>

</div>

[% BLOCK recovery_blurb %]
  <ul>
    <li>These codes can be used in case you lose your second factor</li>
    <li>Please store them safely in a locked cabinet at home</li>
    <li>If in doubt, generate and print new recovery codes</li>
    <li><b>Do not store these codes electronically</b></li>
  </ul>
[% END %]