<?= $this->extend('layouts/enterprise') ?>

<?= $this->section('content') ?>

<div class="row justify-content-center">
    <div class="col-lg-6">
        <div class="stat-card mb-3">
            <div class="d-flex justify-content-between align-items-start mb-2">
                <h1 class="h5 mb-0">Transaction PIN (TPIN)</h1>
                <?php if (! empty($status['has_tpin'])): ?>
                    <span class="badge text-bg-success">Set</span>
                <?php else: ?>
                    <span class="badge text-bg-secondary">Not set</span>
                <?php endif; ?>
            </div>
            <p class="text-muted small mb-0">
                Your TPIN is a 4–6-digit code used to confirm sensitive actions when an administrator requires it for your account.
            </p>
            <?php if (! empty($status['required'])): ?>
                <div class="alert alert-warning py-2 small mt-3 mb-0">
                    An administrator has enabled TPIN confirmation for your account. Keep your TPIN set and up to date.
                </div>
            <?php endif; ?>
            <?php if (! empty($status['locked'])): ?>
                <div class="alert alert-danger py-2 small mt-3 mb-0">
                    TPIN is temporarily locked after failed attempts. Wait a few minutes, then try again.
                </div>
            <?php endif; ?>
            <?php if (! empty($status['set_at'])): ?>
                <div class="text-muted small mt-2">Last set: <?= esc($status['set_at']) ?></div>
            <?php endif; ?>
        </div>

        <?php if (session()->getFlashdata('errors')): ?>
            <div class="alert alert-danger py-2 small">
                <ul class="mb-0 ps-3">
                    <?php foreach ((array) session()->getFlashdata('errors') as $err): ?>
                        <li><?= esc(is_array($err) ? implode(', ', $err) : $err) ?></li>
                    <?php endforeach; ?>
                </ul>
            </div>
        <?php endif; ?>

        <?php if (empty($status['has_tpin'])): ?>
            <div class="stat-card">
                <h2 class="h6 mb-3">Create TPIN</h2>
                <form action="<?= base_url('profile/tpin/set') ?>" method="post" novalidate>
                    <?= csrf_field() ?>
                    <div class="mb-3">
                        <label for="tpin" class="form-label">New TPIN</label>
                        <input type="password" inputmode="numeric" pattern="\d{4,6}" maxlength="6" class="form-control" id="tpin" name="tpin" autocomplete="off" required>
                        <div class="form-text">Digits only, 4–6 characters. Avoid repeating the same digit.</div>
                    </div>
                    <div class="mb-3">
                        <label for="tpin_confirm" class="form-label">Confirm TPIN</label>
                        <input type="password" inputmode="numeric" pattern="\d{4,6}" maxlength="6" class="form-control" id="tpin_confirm" name="tpin_confirm" autocomplete="off" required>
                    </div>
                    <div class="mb-4">
                        <label for="current_password" class="form-label">Current Password</label>
                        <input type="password" class="form-control" id="current_password" name="current_password" required>
                    </div>
                    <div class="d-flex gap-2">
                        <button type="submit" class="btn btn-primary">Set TPIN</button>
                        <a href="<?= base_url('profile') ?>" class="btn btn-outline-secondary">Back</a>
                    </div>
                </form>
            </div>
        <?php else: ?>
            <div class="stat-card mb-3">
                <h2 class="h6 mb-3">Change TPIN</h2>
                <form action="<?= base_url('profile/tpin/change') ?>" method="post" novalidate>
                    <?= csrf_field() ?>
                    <div class="mb-3">
                        <label for="current_tpin" class="form-label">Current TPIN</label>
                        <input type="password" inputmode="numeric" pattern="\d{4,6}" maxlength="6" class="form-control" id="current_tpin" name="current_tpin" autocomplete="off" required>
                    </div>
                    <div class="mb-3">
                        <label for="tpin" class="form-label">New TPIN</label>
                        <input type="password" inputmode="numeric" pattern="\d{4,6}" maxlength="6" class="form-control" id="tpin" name="tpin" autocomplete="off" required>
                    </div>
                    <div class="mb-4">
                        <label for="tpin_confirm" class="form-label">Confirm New TPIN</label>
                        <input type="password" inputmode="numeric" pattern="\d{4,6}" maxlength="6" class="form-control" id="tpin_confirm" name="tpin_confirm" autocomplete="off" required>
                    </div>
                    <button type="submit" class="btn btn-primary">Update TPIN</button>
                </form>
            </div>

            <div class="stat-card">
                <h2 class="h6 mb-3">Remove TPIN</h2>
                <p class="text-muted small">Removing your TPIN may block actions that require confirmation until you set a new one.</p>
                <form action="<?= base_url('profile/tpin/clear') ?>" method="post" onsubmit="return confirm('Remove your TPIN?');">
                    <?= csrf_field() ?>
                    <div class="mb-3">
                        <label for="clear_current_tpin" class="form-label">Current TPIN</label>
                        <input type="password" inputmode="numeric" pattern="\d{4,6}" maxlength="6" class="form-control" id="clear_current_tpin" name="current_tpin" autocomplete="off" required>
                    </div>
                    <div class="d-flex gap-2">
                        <button type="submit" class="btn btn-outline-danger">Remove TPIN</button>
                        <a href="<?= base_url('profile') ?>" class="btn btn-outline-secondary">Back</a>
                    </div>
                </form>
            </div>
        <?php endif; ?>
    </div>
</div>

<?= $this->endSection() ?>
