{{--
    Carte « Sécurité du compte » — réutilisée pour les commerçants et les managers.

    Paramètres :
    - $partner                    : App\Models\Partner
    - $subject                    : App\Models\User (commerçant ou manager)
    - $subjectKey                 : 'user' | 'manager' (clé route + clé include modales)
    - $abilityPrefix              : 'partner_users' | 'partner_managers'
    - $modalsPartial              : nom de la vue contenant les modales déjà câblées
    - $activeTrustedDevicesCount  : int
    - $activeSessionsCount        : int|null  (null si SESSION_DRIVER != database)
    - $sessionDriver              : string
    - $wrapInCard                 : bool (default true) — rendre le wrapper card+header.
                                    À passer false quand la carte est intégrée dans un tab-pane.
--}}

@php
    $twoFactorStatus = $subject->twoFactorStatusFor($partner);
    $hasSecret = ! is_null($subject->two_factor_confirmed_at);
    $isLocked = $subject->password_locked_at !== null;
    $sessionsAvailable = $activeSessionsCount !== null;
    $failedAttempts = (int) ($subject->password_failed_attempts ?? 0);
    $twoFactorLockout = $subject->twoFactorLockout;
    $twoFactorLocked = $twoFactorLockout?->locked_until?->isFuture() ?? false;
    $twoFactorFailedAttempts = (int) ($twoFactorLockout?->failed_attempts_24h ?? 0);
    $wrapInCard = $wrapInCard ?? true;
@endphp

@if($wrapInCard)
<div class="card mb-3">
    <h5 class="card-header d-flex align-items-center">
        <i class="fas fa-shield-halved me-2" aria-hidden="true"></i>
        {{ __('security.section.title') }}
    </h5>
    <div class="card-body">
@endif

        {{-- 1. ÉTAT DE LA DOUBLE AUTHENTIFICATION --}}
        <section aria-labelledby="two-factor-status-title">
            <h6 id="two-factor-status-title" class="text-uppercase text-muted small mb-2">
                <i class="fas fa-key me-1" aria-hidden="true"></i>
                {{ __('security.section.two_factor') }}
            </h6>

            <div class="d-flex flex-wrap align-items-center gap-2 mb-2">
                <span class="badge {{ $twoFactorStatus->badgeClass() }}">{{ $twoFactorStatus->label() }}</span>
                @if($help = $twoFactorStatus->helperText())
                    <span class="text-muted small">{{ $help }}</span>
                @endif
            </div>

            <dl class="row mb-0 small text-muted">
                @if($subject->two_factor_confirmed_at)
                    <dt class="col-sm-5 fw-normal">{{ __('security.two_factor.configured_at') }}</dt>
                    <dd class="col-sm-7">{{ $subject->two_factor_confirmed_at->format('d/m/Y à H:i') }}</dd>
                @endif
                @if($subject->two_factor_reset_at)
                    <dt class="col-sm-5 fw-normal">{{ __('security.two_factor.last_reset') }}</dt>
                    <dd class="col-sm-7">
                        {{ $subject->two_factor_reset_at->format('d/m/Y à H:i') }}
                        ({{ $subject->two_factor_reset_at->diffForHumans() }})
                    </dd>
                @endif
                @if(! $subject->two_factor_confirmed_at && ! $subject->two_factor_reset_at)
                    <dt class="col-sm-5 fw-normal">{{ __('security.two_factor.configuration') }}</dt>
                    <dd class="col-sm-7"><em>{{ __('security.two_factor.never_configured') }}</em></dd>
                @endif
            </dl>
        </section>

        <hr class="my-3">

        {{-- 2. APPAREILS & SESSIONS --}}
        <section aria-labelledby="devices-sessions-title">
            <h6 id="devices-sessions-title" class="text-uppercase text-muted small mb-3">
                <i class="fas fa-laptop me-1" aria-hidden="true"></i>
                {{ __('security.section.devices_sessions') }}
            </h6>

            @can($abilityPrefix . '.revoke_trusted_devices', $subject)
                <div class="d-flex justify-content-between align-items-center mb-2 gap-2">
                    <span>
                        <i class="fas fa-mobile-screen text-muted me-2" aria-hidden="true"></i>
                        {{ trans_choice('security.devices.active', $activeTrustedDevicesCount, ['count' => $activeTrustedDevicesCount]) }}
                    </span>
                    @if($activeTrustedDevicesCount > 0)
                        <button type="button"
                                class="btn btn-sm btn-outline-secondary flex-shrink-0"
                                data-bs-toggle="modal"
                                data-bs-target="#revokeTrustedDevicesModal"
                                aria-haspopup="dialog">
                            <i class="fas fa-laptop-slash me-1" aria-hidden="true"></i>
                            {{ __('security.devices.revoke_button') }}
                        </button>
                    @else
                        <span class="text-muted small flex-shrink-0">{{ __('security.devices.nothing_to_revoke') }}</span>
                    @endif
                </div>
            @endcan

            @can($abilityPrefix . '.revoke_sessions', $subject)
                <div class="d-flex justify-content-between align-items-center gap-2">
                    <span>
                        <i class="fas fa-circle-user text-muted me-2" aria-hidden="true"></i>
                        @if($sessionsAvailable)
                            {{ trans_choice('security.sessions.active', $activeSessionsCount, ['count' => $activeSessionsCount]) }}
                        @else
                            {{ __('security.sessions.unavailable') }}
                        @endif
                    </span>
                    @if($sessionsAvailable && $activeSessionsCount > 0)
                        <button type="button"
                                class="btn btn-sm btn-warning flex-shrink-0"
                                data-bs-toggle="modal"
                                data-bs-target="#revokeSessionsModal"
                                aria-haspopup="dialog">
                            <i class="fas fa-right-from-bracket me-1" aria-hidden="true"></i>
                            {{ __('security.sessions.revoke_button') }}
                        </button>
                    @elseif(! $sessionsAvailable)
                        <span class="text-muted small flex-shrink-0">
                            {{ __('security.sessions.driver_warning', ['driver' => $sessionDriver]) }}
                        </span>
                    @else
                        <span class="text-muted small flex-shrink-0">{{ __('security.sessions.nothing_to_revoke') }}</span>
                    @endif
                </div>
            @endcan
        </section>

        @can($abilityPrefix . '.unlock_account', $subject)
            <hr class="my-3">

            {{-- 3. VERROUILLAGE DU COMPTE --}}
            <section aria-labelledby="account-lock-title">
                <h6 id="account-lock-title" class="text-uppercase text-muted small mb-3">
                    <i class="fas {{ $isLocked ? 'fa-lock text-danger' : 'fa-lock-open text-muted' }} me-1" aria-hidden="true"></i>
                    {{ __('security.section.account_lock') }}
                </h6>

                @if($isLocked)
                    <div class="d-flex justify-content-between align-items-center gap-2">
                        <span>
                            <span class="badge bg-danger me-2">
                                {{ __('security.account.locked_at', ['date' => $subject->password_locked_at->format('d/m/Y H:i')]) }}
                            </span>
                            <span class="text-muted small">
                                {{ trans_choice('security.account.failed_attempts', $failedAttempts, ['count' => $failedAttempts]) }}
                            </span>
                        </span>
                        <button type="button"
                                class="btn btn-sm btn-warning flex-shrink-0"
                                data-bs-toggle="modal"
                                data-bs-target="#unlockAccountModal"
                                aria-haspopup="dialog">
                            <i class="fas fa-lock-open me-1" aria-hidden="true"></i>
                            {{ __('security.button.unlock_account') }}
                        </button>
                    </div>
                @else
                    <p class="text-muted small mb-0">
                        <i class="fas fa-circle-check text-success me-1" aria-hidden="true"></i>
                        {{ __('security.account.healthy') }}
                        @if($failedAttempts > 0)
                            <span class="ms-1">({{ trans_choice('security.account.failed_attempts', $failedAttempts, ['count' => $failedAttempts]) }})</span>
                        @endif
                    </p>
                @endif
            </section>
        @endcan

        @can($abilityPrefix . '.unlock_2fa', $subject)
            <hr class="my-3">

            {{-- 3b. VERROUILLAGE 2FA --}}
            <section aria-labelledby="two-factor-lockout-title">
                <h6 id="two-factor-lockout-title" class="text-uppercase text-muted small mb-3">
                    <i class="fas {{ $twoFactorLocked ? 'fa-user-lock text-warning' : 'fa-user-shield text-muted' }} me-1" aria-hidden="true"></i>
                    {{ __('security.section.two_factor_lockout') }}
                </h6>

                @if($twoFactorLocked)
                    <div class="d-flex justify-content-between align-items-center gap-2">
                        <span>
                            <span class="badge bg-warning text-dark me-2">
                                {{ __('security.two_factor_lockout.locked_until', ['date' => $twoFactorLockout->locked_until->format('d/m/Y H:i')]) }}
                            </span>
                            <span class="text-muted small">
                                {{ trans_choice('security.two_factor_lockout.failed_attempts', $twoFactorFailedAttempts, ['count' => $twoFactorFailedAttempts]) }}
                            </span>
                        </span>
                        <button type="button"
                                class="btn btn-sm btn-warning flex-shrink-0"
                                data-bs-toggle="modal"
                                data-bs-target="#unlockTwoFactorLockoutModal"
                                aria-haspopup="dialog">
                            <i class="fas fa-unlock-keyhole me-1" aria-hidden="true"></i>
                            {{ __('security.button.unlock_2fa_lockout') }}
                        </button>
                    </div>
                @else
                    <p class="text-muted small mb-0">
                        <i class="fas fa-circle-check text-success me-1" aria-hidden="true"></i>
                        {{ __('security.two_factor_lockout.healthy') }}
                        @if($twoFactorFailedAttempts > 0)
                            <span class="ms-1">({{ trans_choice('security.two_factor_lockout.failed_attempts', $twoFactorFailedAttempts, ['count' => $twoFactorFailedAttempts]) }})</span>
                        @endif
                    </p>
                @endif
            </section>
        @endcan

        @can($abilityPrefix . '.reset_2fa', $subject)
            @if($hasSecret)
                <hr class="my-3">

                {{-- 4. ZONE À RISQUE — RESET 2FA --}}
                <section aria-labelledby="danger-zone-title">
                    <h6 id="danger-zone-title" class="text-uppercase text-danger small mb-2">
                        <i class="fas fa-triangle-exclamation me-1" aria-hidden="true"></i>
                        {{ __('security.section.danger_zone') }}
                    </h6>
                    <div class="d-flex justify-content-between align-items-center gap-3">
                        <p class="text-muted small mb-0">
                            {{ __('security.section.reset_2fa_help') }}
                        </p>
                        <button type="button"
                                class="btn btn-sm btn-danger flex-shrink-0"
                                data-bs-toggle="modal"
                                data-bs-target="#resetTwoFactorModal"
                                aria-haspopup="dialog">
                            <i class="fas fa-rotate me-1" aria-hidden="true"></i>
                            {{ __('security.section.reset_2fa_button') }}
                        </button>
                    </div>
                </section>
            @endif
        @endcan

@if($wrapInCard)
    </div>
</div>
@endif

@include($modalsPartial, ['partner' => $partner, $subjectKey => $subject])