{% extends "base.html" %}
{% block content %}
<section class="card">
  <div class="auth-symbol">{{ icon('shield') }}</div><span class="eyebrow">Secure your account</span>
  <h1>Set up your authenticator</h1>
  <p>All accounts require a password and an authenticator code before accessing the PKI. Add a new time-based account to an authenticator that supports SHA-256.</p>
  <dl class="setup-details">
    <dt>Account</dt><dd>{{ current_user['username'] }} — {{ settings.organization }}</dd>
    <dt>Setup key</dt><dd id="mfa-setup-key" class="mono">{{ secret }}</dd>
    <dt>Algorithm</dt><dd>SHA-256</dd>
    <dt>Digits / interval</dt><dd>6 digits / 30 seconds</dd>
  </dl>
  <p class="notice notice-warning">Store a protected backup of this setup key before continuing. There are no recovery codes or automated MFA resets in this version. A password reset does not remove the authenticator requirement.</p>
  <form method="post" action="{{ url_for('mfa.enroll') }}">
    <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
    <label>Current authenticator code <input name="code" inputmode="numeric" pattern="[0-9]{6}" minlength="6" maxlength="6" autocomplete="one-time-code" required autofocus></label>
    <button type="submit">Verify and activate authenticator</button>
  </form>
  <p class="muted">Enrollment expires after 10 minutes. The setup key is shown only until enrollment is completed.</p>
</section>
{% endblock %}