@extends('layouts.auth')

@section('content')
@php
/**
 * E-mail activation code. Same anatomy as auth/reset.php.
 *
 * Posts to /login, which is where the account is waiting: this is not a page somebody
 * navigates to but a state the sign-in door is in, so leaving it is a matter of finishing
 * or abandoning the sign-in rather than following a link away.
 *
 * @var string $verifyEmail  the address the code was sent to
 */
$verifyEmail = $verifyEmail ?? '';
@endphp
<h1 class="qm-auth-title">{{ t_raw('auth.verify_title') }}</h1>
@php // Raw address into t(): t() substitutes the parameter and then escapes the whole
      // sentence, so pre-escaping it here got it escaped twice — an o'neil@… address
      // rendered as "o&#039;neil@…" in the subtitle.
@endphp
<p class="qm-auth-sub">{{ t_raw('auth.verify_sub', [':email' => $verifyEmail]) }}</p>

<form method="post" action="{{ route('login') }}" class="qm-auth-form" data-validate novalidate>
    @csrf
    <div class="mb-3">
        <label for="code" class="form-label">{{ t_raw('auth.verify_code_label') }}</label>
        <input type="text" id="code" name="code" class="form-control" inputmode="numeric" pattern="\d{6}"
               maxlength="6" autocomplete="one-time-code" data-label="{{ t_raw('auth.verify_code_label') }}"
               required autofocus placeholder="{{ t_raw('auth.two_factor_code_placeholder') }}">
    </div>
    <button type="submit" class="qm-btn w-100">{{ t_raw('auth.verify_btn') }}</button>
</form>

<form method="post" action="{{ route('login') }}" class="qm-auth-form">
    @csrf
    <input type="hidden" name="intent" value="resend">
    <button type="submit" class="qm-btn qm-btn-outline w-100">{{ t_raw('auth.verify_resend_btn') }}</button>
</form>

<form method="post" action="{{ route('login') }}">
    @csrf
    <p class="qm-auth-foot"><button type="submit" name="cancel" value="1" class="qm-auth-link">{{ t_raw('auth.back_to_sign_in') }}</button></p>
</form>
@endsection