{% extends "base.html" %}
{% block content %}
<section class="card">
  <div class="auth-symbol">{{ icon('lock') }}</div><span class="eyebrow">Second verification step</span>
  <h1>Verify your authenticator</h1>
  <p>Your account credentials were accepted. Enter the current 6-digit code for {{ current_user['username'] }} to access the PKI.</p>
  <form method="post" action="{{ url_for('mfa.challenge') }}">
    <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
    <label>Authenticator code <input name="code" inputmode="numeric" pattern="[0-9]{6}" minlength="6" maxlength="6" autocomplete="one-time-code" required autofocus></label>
    <button type="submit">Verify code and sign in</button>
  </form>
  <p class="muted">Each code can be used once. If you have just signed in elsewhere, wait for the next code. Keep your authenticator clock synchronized.</p>
  <p class="notice">A lost authenticator requires your protected enrollment backup. This version has no automated MFA reset or recovery codes.</p>
</section>
{% endblock %}