setup_2fa.php

<?php
/* ── 1. Session + Auth (HTML output yok — header() çağrısı güvenli) ─ */
require_once __DIR__ . '/includes/session.php';
require_once __DIR__ . '/includes/require_admin.php';   // db, fingerprint, permissions
require_once __DIR__ . '/includes/totp.php';
require_once __DIR__ . '/includes/qr.php';
require_once __DIR__ . '/includes/audit.php';

$userId = (int)$_SESSION['user_id'];

$stmt = $pdo->prepare("SELECT username, totp_secret FROM users WHERE user_id = ? AND deleted_at IS NULL");
$stmt->execute([$userId]);
$user = $stmt->fetch(PDO::FETCH_ASSOC);

if (!$user) {
    $_SESSION['flash_error'] = t('err_user_nf');
    header("Location: dashboard.php"); exit;
}

$alreadyEnabled = !empty($user['totp_secret']);
$step           = $_GET['step'] ?? ($alreadyEnabled ? 'enabled' : 'setup');
$error          = '';
$disableError   = '';

/* ── 2. QR secret hazırla ────────────────────────────────────────── */
if ($step === 'setup' && !$alreadyEnabled) {
    if (empty($_SESSION['totp_setup_secret'])) {
        $_SESSION['totp_setup_secret'] = totp_generate_secret();
    }
    $secret = $_SESSION['totp_setup_secret'];
    $qrSvg  = qr_svg(totp_uri($secret, $user['username'], APP_NAME), 7, 4, '2FA QR');
}

/* ── 3. POST: Kodu doğrula + kaydet ─────────────────────────────── */
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['verify_code'])) {

    if (!hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'] ?? '')) {
        $_SESSION['flash_error'] = t('err_csrf');
        header("Location: setup_2fa.php"); exit;
    }

    $code   = preg_replace('/\D/', '', $_POST['totp_code'] ?? '');
    $secret = $_SESSION['totp_setup_secret'] ?? '';

    if (empty($secret)) {
        $_SESSION['flash_error'] = t('2fa_sess_exp');
        header("Location: setup_2fa.php"); exit;
    }

    if (!totp_verify($secret, $code)) {
        /* Sayfayı yeniden göster — hata mesajıyla */
        $step  = 'setup';
        $qrSvg = qr_svg(totp_uri($secret, $user['username'], APP_NAME), 7, 4, '2FA QR');
        $error = t('2fa_verify_err');
    } else {
        $pdo->prepare("UPDATE users SET totp_secret = ? WHERE user_id = ?")
            ->execute([$secret, $userId]);
        unset($_SESSION['totp_setup_secret']);
        logAction($pdo, 'USER_2FA_ENABLE', 'user', $userId);
        $_SESSION['flash_success'] = t('2fa_on_ok');
        header("Location: setup_2fa.php?step=enabled"); exit;
    }
}

/* ── 4. POST: 2FA Kapat ───────────────────────────────────────────── */
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['disable_2fa'])) {

    if (!hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'] ?? '')) {
        $_SESSION['flash_error'] = t('err_csrf');
        header("Location: setup_2fa.php"); exit;
    }

    $code          = preg_replace('/\D/', '', $_POST['totp_code'] ?? '');
    $currentSecret = $user['totp_secret'];

    if (!totp_verify($currentSecret, $code)) {
        $disableError   = t('2fa_off_err');
        $step           = 'enabled';
        $alreadyEnabled = true;
    } else {
        $pdo->prepare("UPDATE users SET totp_secret = NULL WHERE user_id = ?")
            ->execute([$userId]);
        logAction($pdo, 'USER_2FA_DISABLE', 'user', $userId);
        $_SESSION['flash_success'] = t('2fa_off_ok');
        header("Location: setup_2fa.php"); exit;
    }
}

/* ── 5. HTML output — buradan sonra header() çağrısı yapılmaz ─────── */
$title = t('2fa_title');
require __DIR__ . '/layout/header.php';
?>

<div class="page-header">
  <div>
    <h1 class="page-title"><?= t('2fa_title') ?></h1>
    <p class="page-subtitle"><?= t('2fa_sub') ?></p>
  </div>
</div>

<div class="row justify-content-center">
  <div class="col-lg-6">

    <?php if ($step === 'enabled' || ($alreadyEnabled && $step !== 'setup')): ?>
    <!-- ZATEN AKTİF -->
    <div class="card">
      <div class="card-body" style="text-align:center; padding:40px 24px;">
        <div style="width:64px;height:64px;background:var(--success-bg);border-radius:50%;display:flex;align-items:center;justify-content:center;font-size:28px;color:var(--success-text);margin:0 auto 20px;">
          <i class="bi bi-shield-check"></i>
        </div>
        <h3 style="font-size:18px; font-weight:700; margin:0 0 8px;"><?= t('2fa_on_title') ?></h3>
        <p style="color:var(--text-muted); margin:0 0 28px; font-size:14px;">
          <?= nl2br(htmlspecialchars(t('2fa_on_desc'))) ?>
        </p>

        <?php if (!empty($disableError)): ?>
        <div class="alert alert-danger mb-4">
          <i class="bi bi-exclamation-circle-fill"></i>
          <span><?= htmlspecialchars($disableError) ?></span>
        </div>
        <?php endif; ?>

        <details style="text-align:left; margin-bottom:20px;">
          <summary style="cursor:pointer; font-size:14px; color:var(--danger); font-weight:500; padding:8px 0;">
            <i class="bi bi-shield-x"></i> <?= t('2fa_off_lbl') ?>
          </summary>
          <div style="margin-top:12px; padding:16px; background:var(--bg); border-radius:8px; border:1px solid var(--border);">
            <p style="font-size:13px; color:var(--text-muted); margin:0 0 12px;"><?= t('2fa_off_desc') ?></p>
            <form method="post">
              <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($_SESSION['csrf_token']) ?>">
              <div class="form-group" style="margin-bottom:12px;">
                <input type="text" name="totp_code" class="form-control log-action"
                       placeholder="000000" maxlength="6"
                       autocomplete="one-time-code" inputmode="numeric"
                       style="text-align:center; letter-spacing:.2em; font-size:18px;">
              </div>
              <button type="submit" name="disable_2fa" class="btn btn-danger w-100">
                <?= t('2fa_off_btn') ?>
              </button>
            </form>
          </div>
        </details>
      </div>
    </div>

    <?php else: ?>
    <!-- KURULUM AŞAMASI -->
    <div class="card">
      <div class="card-hd"><span class="card-title"><?= t('2fa_step1') ?></span></div>
      <div class="card-body">

        <?php if (!empty($error)): ?>
        <div class="alert alert-danger mb-4">
          <i class="bi bi-exclamation-circle-fill"></i>
          <span><?= htmlspecialchars($error) ?></span>
        </div>
        <?php endif; ?>

        <p style="font-size:14px; color:var(--text-secondary); margin-bottom:20px;">
          <?= t('2fa_step1_d') ?>
        </p>

        <!--
          QR yerelde üretilir (includes/qr.php). Secret hiçbir zaman
          harici bir servise, tarayıcı geçmişine veya referrer'a düşmez.
        -->
        <div class="qr-frame">
          <?= $qrSvg ?? '' ?>
        </div>

        <div style="margin-bottom:20px; padding:12px 16px; background:var(--bg); border-radius:8px; border:1px solid var(--border);">
          <div style="font-size:11px; color:var(--text-muted); margin-bottom:6px;"><?= t('2fa_manual_key') ?></div>
          <div class="log-action" style="font-family:'JetBrains Mono',monospace; font-size:14px; font-weight:600; letter-spacing:.15em; word-break:break-all; color:var(--primary);">
            <?= htmlspecialchars($secret ?? '') ?>
          </div>
        </div>
      </div>
    </div>

    <div class="card mt-4">
      <div class="card-hd"><span class="card-title"><?= t('2fa_step2') ?></span></div>
      <div class="card-body">
        <p style="font-size:14px; color:var(--text-secondary); margin-bottom:20px;">
          <?= t('2fa_step2_d') ?>
        </p>
        <form method="post">
          <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($_SESSION['csrf_token']) ?>">
          <div class="form-group">
            <input type="text" name="totp_code" class="form-control log-action"
                   placeholder="000000" maxlength="6"
                   autocomplete="one-time-code" inputmode="numeric"
                   style="text-align:center; font-size:28px; letter-spacing:.3em; padding:16px;" required>
          </div>
          <button type="submit" name="verify_code" class="btn btn-primary w-100 mt-2">
            <i class="bi bi-shield-check"></i> <?= t('2fa_verify_btn') ?>
          </button>
        </form>
      </div>
    </div>

    <?php endif; ?>

  </div>
</div>

<?php include __DIR__ . "/layout/footer.php"; ?>