<?php
/**
 * Plugin Name: WP Business Forum
 * Plugin URI:  https://git.viper.ipv64.net/M_Viper/WP-Business-Forum
 * Description: Professionelles Forum mit eigenem Login, Rollen, Signaturen, Hierarchie und Moderations-Tools.
 * Version:     1.0.5
 * Author:      M_Viper
 * Author URI:  https://m-viper.de
 * Text Domain: wp-business-forum
 * Requires PHP: 7.0
 */

if ( ! defined( 'ABSPATH' ) ) exit;

define( 'WBF_PATH',    plugin_dir_path( __FILE__ ) );
define( 'WBF_URL',     plugin_dir_url( __FILE__ ) );
define( 'WBF_VERSION', '1.0.5' );

require_once WBF_PATH . 'includes/class-forum-db.php';
require_once WBF_PATH . 'includes/class-forum-roles.php';
require_once WBF_PATH . 'includes/class-forum-levels.php';
require_once WBF_PATH . 'includes/class-forum-bbcode.php';
require_once WBF_PATH . 'includes/class-forum-auth.php';
require_once WBF_PATH . 'includes/class-forum-shortcodes.php';
require_once WBF_PATH . 'includes/class-forum-ajax.php';
require_once WBF_PATH . 'includes/class-forum-export.php';
require_once WBF_PATH . 'includes/class-forum-mc-bridge.php';
require_once WBF_PATH . 'includes/class-forum-totp.php';
require_once WBF_PATH . 'includes/forum-statusapi.php';
require_once WBF_PATH . 'admin/forum-admin.php';
require_once WBF_PATH . 'admin/forum-settings.php';
require_once WBF_PATH . 'admin/forum-setup.php';

// ── Aktivierung ────────────────────────────────────────────────────────────────
register_activation_hook( __FILE__, function() {
    WBF_DB::install();
    // Transient für einmalige Weiterleitung zum Setup-Wizard setzen
    set_transient( 'wbf_activation_redirect', true, 30 );
});

// ── Export / Import Hooks ─────────────────────────────────────────────────────
add_action( 'plugins_loaded', function() {
    WBF_Export::hooks();
}, 5 );

// ── DB-Schema sicherstellen (läuft bei jedem Seitenaufruf, sehr günstig) ─────
// Stellt sicher dass neue Spalten auch auf bestehenden Installs vorhanden sind,
// ohne dass das Plugin erneut deaktiviert/aktiviert werden muss.
add_action( 'plugins_loaded', function() {
    $db_ver = (int) get_option( 'wbf_db_version', 0 );
    if ( $db_ver < 2 ) {
        global $wpdb;
        // profile_public: Sicherheits-kritisch — muss immer existieren
        $cols = $wpdb->get_col( "DESCRIBE {$wpdb->prefix}forum_users" );
        if ( ! in_array( 'profile_public', $cols ) ) {
            $wpdb->query( "ALTER TABLE {$wpdb->prefix}forum_users ADD COLUMN profile_public TINYINT(1) NOT NULL DEFAULT 1" );
            // Alle bestehenden User explizit auf öffentlich setzen
            $wpdb->query( "UPDATE {$wpdb->prefix}forum_users SET profile_public = 1 WHERE profile_public IS NULL" );
        }
        update_option( 'wbf_db_version', 2 );
    }
}, 10 );

// ── Session frühzeitig starten (PHP 8.3 Fix) ────────────────────────────────
// session_start() MUSS vor jedem HTML-Output laufen.
// plugins_loaded (Prio 1) ist der früheste sichere Zeitpunkt in WordPress.
// Der 'init'-Hook (in class-forum-auth.php) läuft als Fallback weiterhin,
// aber dieser frühe Aufruf verhindert den PHP 8.3 E_WARNING "headers already sent".
add_action( 'plugins_loaded', function() {
    WBF_Auth::init();
}, 1 );

// ── Superadmin-Sync ───────────────────────────────────────────────────────────
add_action( 'wp_login', function() { WBF_Roles::sync_superadmin(); } );
add_action( 'init',     function() { WBF_Roles::sync_superadmin(); } );

// ── Body-Klasse ───────────────────────────────────────────────────────────────
add_filter( 'body_class', function( $classes ) {
    global $post;
    if ( $post && has_shortcode( $post->post_content, 'business_forum' ) ) {
        $classes[] = 'wbf-forum-page';
    }
    return $classes;
});

// ── Cron: Abgelaufene Sperren aufheben ────────────────────────────────────────
add_action( 'wbf_check_expired_bans', function() {
    WBF_DB::check_expired_bans();
} );

if ( ! wp_next_scheduled( 'wbf_check_expired_bans' ) ) {
    wp_schedule_event( time(), 'hourly', 'wbf_check_expired_bans' );
}

register_deactivation_hook( __FILE__, function() {
    wp_clear_scheduled_hook( 'wbf_check_expired_bans' );
    wp_clear_scheduled_hook( 'wbf_check_for_updates' );
} );


// ── Forum-URL Hilfsfunktion ───────────────────────────────────────────────────
function wbf_get_forum_url() {
    // 1. Gespeicherte Seite aus dem Setup-Wizard
    $page_id = get_option('wbf_forum_page_id');
    if ( $page_id ) {
        $url = get_permalink( $page_id );
        if ( $url ) return $url;
    }
    // 2. Fallback: Seite mit [business_forum] Shortcode suchen (direkt im post_content)
    global $wpdb;
    $page_id = $wpdb->get_var( $wpdb->prepare(
        "SELECT ID FROM {$wpdb->posts} WHERE post_type = 'page' AND post_status = 'publish' AND post_content LIKE %s LIMIT 1",
        '%[business_forum]%'
    ) );
    if ( $page_id ) return get_permalink( $page_id );
    // 3. Letzter Fallback: aktuelle Seite
    return home_url('/');
}

// ── Assets ────────────────────────────────────────────────────────────────────
add_action( 'wp_enqueue_scripts', function() {
    wp_enqueue_style(  'wbf-style',  WBF_URL . 'assets/css/forum-style.css',  [], WBF_VERSION );
    wp_enqueue_script( 'wbf-script', WBF_URL . 'assets/js/forum-script.js', ['jquery'], WBF_VERSION, true );
    // 2FA: QR-Code-Bibliothek (nur laden wenn User eingeloggt oder auf Loginseite)
    wp_enqueue_script( 'qrcodejs', 'https://cdnjs.cloudflare.com/ajax/libs/qrcodejs/1.0.0/qrcode.min.js', [], '1.0.0', true );
    wp_add_inline_script( 'wbf-script', wbf_get_2fa_inline_js(), 'after' );
   
    $wbf_user = WBF_Auth::get_current_user();
    if ( $wbf_user ) {
        WBF_DB::touch_last_active( $wbf_user->id );
    }
    wp_localize_script( 'wbf-script', 'WBF', [
        'ajax_url'             => admin_url('admin-ajax.php'),
        'nonce'                => wp_create_nonce('wbf_nonce'),
        'logged_in'            => WBF_Auth::is_forum_logged_in() ? 'yes' : 'no',
        'auto_logout_minutes'  => (int)( wbf_get_settings()['auto_logout_minutes'] ?? 30 ),
        'my_id'                => $wbf_user ? (int)$wbf_user->id : 0,
        'unread_dm'            => $wbf_user ? WBF_DB::count_unread_messages($wbf_user->id) : 0,
        'forum_url'            => wbf_get_forum_url(),
        'reactions'            => WBF_DB::get_allowed_reactions(),
    ]);
});


// ══════════════════════════════════════════════════════════════════════════════
// ── Update-Checker ────────────────────────────────────────────────────────────
// Prüft täglich gegen die Gitea-Releases-API ob eine neue Version verfügbar ist.
// Releases-URL: https://git.viper.ipv64.net/M_Viper/WP-Business-Forum/releases
// ══════════════════════════════════════════════════════════════════════════════

define( 'WBF_UPDATE_API',      'https://git.viper.ipv64.net/api/v1/repos/M_Viper/WP-Business-Forum/releases?limit=1&page=1' );
define( 'WBF_RELEASES_PAGE',   'https://git.viper.ipv64.net/M_Viper/WP-Business-Forum/releases' );
define( 'WBF_UPDATE_TRANSIENT','wbf_update_check' );

/**
 * Holt die neueste Release-Info von Gitea (gecacht per Transient, 12h).
 * Gibt null zurück wenn kein Update verfügbar oder API nicht erreichbar.
 *
 * @return array|null  ['version'=>string, 'url'=>string, 'name'=>string, 'published'=>string, 'body'=>string]
 */
function wbf_get_latest_release() {
    $cached = get_transient( WBF_UPDATE_TRANSIENT );
    if ( $cached !== false ) {
        return $cached ?: null;  // false = noch nie gecacht, '' = kein Update
    }

    $response = wp_remote_get( WBF_UPDATE_API, [
        'timeout'    => 8,
        'user-agent' => 'WP-Business-Forum/' . WBF_VERSION . '; ' . get_bloginfo('url'),
        'sslverify'  => true,
    ] );

    if ( is_wp_error($response) || wp_remote_retrieve_response_code($response) !== 200 ) {
        // Bei Fehler 1h warten bevor erneut versucht
        set_transient( WBF_UPDATE_TRANSIENT, '', HOUR_IN_SECONDS );
        return null;
    }

    $body     = wp_remote_retrieve_body( $response );
    $releases = json_decode( $body, true );

    if ( empty($releases) || ! is_array($releases) || empty($releases[0]) ) {
        set_transient( WBF_UPDATE_TRANSIENT, '', 12 * HOUR_IN_SECONDS );
        return null;
    }

    $latest  = $releases[0];
    $version = ltrim( $latest['tag_name'] ?? '', 'v' );   // "v1.2.0" → "1.2.0"

    $info = [
        'version'   => $version,
        'url'       => $latest['html_url'] ?? WBF_RELEASES_PAGE,
        'name'      => $latest['name'] ?? $latest['tag_name'] ?? $version,
        'published' => $latest['published_at'] ?? '',
        'body'      => wp_strip_all_tags( $latest['body'] ?? '' ),
    ];

    // 12 Stunden cachen
    set_transient( WBF_UPDATE_TRANSIENT, $info, 12 * HOUR_IN_SECONDS );
    return $info;
}

/**
 * Prüft ob ein Update verfügbar ist.
 * Gibt die Release-Info zurück wenn Gitea-Version > installierte Version.
 */
function wbf_update_available() {
    $latest = wbf_get_latest_release();
    if ( ! $latest || empty($latest['version']) ) return null;
    if ( version_compare( $latest['version'], WBF_VERSION, '>' ) ) {
        return $latest;
    }
    return null;
}

// ── Cron: täglich Update prüfen (Cache warm halten) ──────────────────────────
add_action( 'wbf_check_for_updates', function() {
    delete_transient( WBF_UPDATE_TRANSIENT );
    wbf_get_latest_release();
} );

if ( ! wp_next_scheduled( 'wbf_check_for_updates' ) ) {
    wp_schedule_event( time(), 'twicedaily', 'wbf_check_for_updates' );
}

// ── Admin-Notice wenn Update verfügbar ───────────────────────────────────────
add_action( 'admin_notices', function() {
    if ( ! current_user_can('manage_options') ) return;

    $update = wbf_update_available();
    if ( ! $update ) return;

    // Notice ausblenden wenn der User sie weggeklickt hat (per GET-Parameter)
    if ( isset($_GET['wbf_dismiss_update']) && check_admin_referer('wbf_dismiss_update') ) {
        set_transient( 'wbf_update_dismissed_' . WBF_VERSION, $update['version'], 7 * DAY_IN_SECONDS );
        wp_safe_redirect( remove_query_arg(['wbf_dismiss_update','_wpnonce']) );
        exit;
    }

    $dismissed = get_transient( 'wbf_update_dismissed_' . WBF_VERSION );
    if ( $dismissed === $update['version'] ) return;

    $dismiss_url = wp_nonce_url(
        add_query_arg('wbf_dismiss_update', '1'),
        'wbf_dismiss_update'
    );
    $changelog_url = esc_url( $update['url'] );
    $new_ver       = esc_html( $update['version'] );
    $cur_ver       = esc_html( WBF_VERSION );

    echo "
    <div class=\"notice notice-warning is-dismissible\" style=\"border-left-color:#f59e0b;padding:12px 15px\">
        <div style=\"display:flex;align-items:center;gap:14px;flex-wrap:wrap\">
            <span style=\"font-size:1.6rem\">🔔</span>
            <div>
                <strong style=\"font-size:.95rem\">WP Business Forum — Update verfügbar!</strong>
                <p style=\"margin:.3rem 0 0;color:#374151\">
                    Version <strong>{$new_ver}</strong> ist verfügbar. Du verwendest <strong>{$cur_ver}</strong>.
                </p>
            </div>
            <div style=\"display:flex;gap:8px;margin-left:auto\">
                <a href=\"{$changelog_url}\" target=\"_blank\" rel=\"noopener\"
                   class=\"button button-primary\" style=\"background:#f59e0b;border-color:#d97706\">
                    📋 Changelog & Download
                </a>
                <a href=\"" . esc_url($dismiss_url) . "\" class=\"button\">Später erinnern</a>
            </div>
        </div>
    </div>";
} );

// ── Update-Badge im WP-Admin-Menü ─────────────────────────────────────────────
add_action( 'admin_menu', function() {
    $update = wbf_update_available();
    if ( ! $update ) return;
    global $menu;
    if ( ! is_array($menu) ) return;
    foreach ( $menu as &$item ) {
        if ( isset($item[2]) && $item[2] === 'wbf-admin' ) {
            $item[0] .= ' <span class="update-plugins"><span class="plugin-count">1</span></span>';
            break;
        }
    }
}, 999 );

// ── Manuellen Cache-Reset erlauben (für die Admin-UI) ─────────────────────────
add_action( 'admin_init', function() {
    if ( ! isset($_GET['wbf_refresh_update']) ) return;
    if ( ! current_user_can('manage_options') ) return;
    if ( ! check_admin_referer('wbf_refresh_update') ) return;
    delete_transient( WBF_UPDATE_TRANSIENT );
    wp_safe_redirect( remove_query_arg(['wbf_refresh_update','_wpnonce']) );
    exit;
} );

// ══════════════════════════════════════════════════════════════════════════════
// ── 2FA Inline-JavaScript ─────────────────────────────────────────────────────
// Liefert das JS für: Login-2FA-Step, Profil-Setup-Wizard, Deaktivierung
// ══════════════════════════════════════════════════════════════════════════════

function wbf_get_2fa_inline_js() {
    return <<<'JS'
(function ($) {
    'use strict';

    /* ══════════════════════════════════════════════════════════════
       2FA — Login-Flow
       Wenn der Server 2fa_required:true zurückgibt, zeigt das
       Login-Formular eine Code-Eingabe anstatt die Fehlermeldung.
       ══════════════════════════════════════════════════════════════ */

    // Original-Login-Handler überschreiben um 2FA abzufangen
    $(document).off('click', '.wbf-login-submit-btn');
    $(document).on('click', '.wbf-login-submit-btn', function () {
        var $btn = $(this).prop('disabled', true).html('<i class="fas fa-spinner fa-spin"></i>');
        var $box = $(this).closest('.wbf-auth-box');

        // 2FA-Panel verstecken falls sichtbar
        $box.find('.wbf-2fa-login-step').remove();

        $.post(WBF.ajax_url, {
            action:      'wbf_login',
            nonce:       WBF.nonce,
            username:    $box.find('.wbf-field-username').val(),
            password:    $box.find('.wbf-field-password').val(),
            remember_me: $box.find('.wbf-field-remember').is(':checked') ? '1' : ''
        }, function (res) {
            if (res && res.success) {
                location.reload();
            } else if (res && res.data && res.data['2fa_required']) {
                // 2FA erforderlich — Code-Eingabe einblenden
                $btn.prop('disabled', false).html('<i class="fas fa-sign-in-alt"></i> Einloggen');
                wbfShow2faLoginStep($box);
            } else {
                var msg = (res && res.data && res.data.message) ? res.data.message : 'Fehler';
                $box.find('.wbf-login-msg').text(msg).css('color', '#f05252').show();
                setTimeout(function () { $box.find('.wbf-login-msg').fadeOut(); }, 4000);
                $btn.prop('disabled', false).html('<i class="fas fa-sign-in-alt"></i> Einloggen');
            }
        }, 'json').fail(function (xhr) {
            $box.find('.wbf-login-msg').text('Verbindungsfehler (' + xhr.status + ')').css('color', '#f05252').show();
            $btn.prop('disabled', false).html('<i class="fas fa-sign-in-alt"></i> Einloggen');
        });
    });

    function wbfShow2faLoginStep($box) {
        // Altes Modal entfernen falls vorhanden
        $('#wbf2faLoginModal').remove();

        var modal =
            '<div id="wbf2faLoginModal" class="wbf-2fa-modal-overlay">' +
            '<div class="wbf-2fa-modal-box">' +
            '<div class="wbf-2fa-modal-header">' +
            '<span class="wbf-2fa-modal-icon">🛡️</span>' +
            '<div>' +
            '<strong class="wbf-2fa-modal-title">Zwei-Faktor-Authentifizierung</strong>' +
            '<p class="wbf-2fa-modal-sub">Gib den Code aus deiner Authenticator-App ein.</p>' +
            '</div>' +
            '</div>' +
            '<input type="text" class="wbf-2fa-code-input" placeholder="1 2 3  4 5 6"' +
            ' maxlength="7" inputmode="numeric" autocomplete="one-time-code">' +
            '<div class="wbf-2fa-modal-actions">' +
            '<button class="wbf-btn wbf-btn--primary wbf-2fa-submit-btn">' +
            '<i class="fas fa-check"></i> Bestätigen' +
            '</button>' +
            '<button class="wbf-btn wbf-2fa-cancel-btn">' +
            '<i class="fas fa-xmark"></i> Abbrechen' +
            '</button>' +
            '</div>' +
            '<span class="wbf-2fa-msg"></span>' +
            '</div>' +
            '</div>';

        $('body').append(modal);
        // Kurze Verzögerung für CSS-Transition
        setTimeout(function () {
            $('#wbf2faLoginModal').addClass('wbf-2fa-modal--visible');
            $('#wbf2faLoginModal .wbf-2fa-code-input').focus();
        }, 20);
    }

    // 2FA-Code absenden
    $(document).on('click', '.wbf-2fa-submit-btn', function () {
        var $step = $(this).closest('.wbf-2fa-modal-box');
        var $btn  = $(this).prop('disabled', true).html('<i class="fas fa-spinner fa-spin"></i>');
        var code  = $step.find('.wbf-2fa-code-input').val().replace(/\s+/g, '');

        if (code.length !== 6) {
            $step.find('.wbf-2fa-msg').text('Bitte 6-stelligen Code eingeben.').css('color', '#f05252').show();
            $btn.prop('disabled', false).html('<i class="fas fa-check"></i> Code bestätigen');
            return;
        }

        $.post(WBF.ajax_url, {
            action: 'wbf_2fa_verify_login',
            code:   code
        }, function (res) {
            if (res && res.success) {
                location.reload();
            } else {
                var msg = (res && res.data && res.data.message) ? res.data.message : 'Ungültiger Code.';
                $step.find('.wbf-2fa-msg').text(msg).css('color', '#f05252').show();
                $step.find('.wbf-2fa-code-input').val('').focus();
                $btn.prop('disabled', false).html('<i class="fas fa-check"></i> Code bestätigen');
            }
        }, 'json').fail(function (xhr) {
            $step.find('.wbf-2fa-msg').text('Verbindungsfehler.').css('color', '#f05252').show();
            $btn.prop('disabled', false).html('<i class="fas fa-check"></i> Code bestätigen');
        });
    });

    // Enter-Taste im Code-Feld
    $(document).on('keydown', '.wbf-2fa-code-input', function (e) {
        if (e.key === 'Enter') $(this).closest('.wbf-2fa-login-step').find('.wbf-2fa-submit-btn').click();
    });

    // Abbrechen: 2FA-Modal schließen
    $(document).on('click', '.wbf-2fa-cancel-btn', function () {
        var $modal = $('#wbf2faLoginModal');
        $modal.removeClass('wbf-2fa-modal--visible');
        setTimeout(function () { $modal.remove(); }, 250);
    });

    // Klick außerhalb des Modals schließt es
    $(document).on('click', '#wbf2faLoginModal', function (e) {
        if ($(e.target).is('#wbf2faLoginModal')) {
            var $modal = $(this);
            $modal.removeClass('wbf-2fa-modal--visible');
            setTimeout(function () { $modal.remove(); }, 250);
        }
    });

    /* ══════════════════════════════════════════════════════════════
       2FA — Profil-Setup-Wizard
       ══════════════════════════════════════════════════════════════ */

    // Schritt 1 starten: Secret + QR generieren
    $(document).on('click', '#wbf2faStartBtn', function () {
        var $btn = $(this).prop('disabled', true).html('<i class="fas fa-spinner fa-spin"></i> Lädt…');

        $.post(WBF.ajax_url, {
            action: 'wbf_2fa_setup_begin',
            nonce:  WBF.nonce
        }, function (res) {
            if (!res || !res.success) {
                $btn.prop('disabled', false).html('<i class="fas fa-shield-halved"></i> 2FA einrichten');
                alert((res && res.data && res.data.message) ? res.data.message : 'Fehler');
                return;
            }
            var secret = res.data.secret;
            var uri    = res.data.uri;

            // QR-Code rendern (qrcodejs)
            $('#wbf2faQr').empty();
            if (typeof QRCode !== 'undefined') {
                // QR-Code in isolierten Wrapper einbetten (kein Flex-Kontext)
                var qrEl = document.getElementById('wbf2faQr');
                qrEl.innerHTML = '';

                new QRCode(qrEl, {
                    text:   uri,
                    width:  200,
                    height: 200,
                    correctLevel: QRCode.CorrectLevel.M
                });

                // Kein JS-Eingriff nötig — CSS übernimmt Größe + img-Verstecken
            } else {
                // Fallback: Link anzeigen
                $('#wbf2faQr').html(
                    '<a href="' + uri + '" style="font-size:.75rem;word-break:break-all">otpauth Link</a>'
                );
            }
            // Secret für manuelle Eingabe formatiert anzeigen (Leerzeichen alle 4 Zeichen)
            var fmt = secret.replace(/=/g, '').replace(/(.{4})/g, '$1 ').trim();
            $('#wbf2faSecret').text(fmt);

            // Panels tauschen
            $('#wbf2faInactive').hide();
            $('#wbf2faStep1').fadeIn(200);
        }, 'json').fail(function () {
            $btn.prop('disabled', false).html('<i class="fas fa-shield-halved"></i> 2FA einrichten');
            alert('Verbindungsfehler. Bitte Seite neu laden.');
        });
    });

    // Weiter zu Schritt 2
    $(document).on('click', '#wbf2faToStep2', function () {
        $('#wbf2faStep1').hide();
        $('#wbf2faStep2').fadeIn(200);
        $('#wbf2faVerifyCode').focus();
    });

    // Zurück zu Schritt 1
    $(document).on('click', '#wbf2faBackBtn', function () {
        $('#wbf2faStep2').hide();
        $('#wbf2faStep1').fadeIn(200);
    });

    // Schritt 2: Code bestätigen und 2FA aktivieren
    $(document).on('click', '#wbf2faVerifyBtn', function () {
        var $btn  = $(this).prop('disabled', true).html('<i class="fas fa-spinner fa-spin"></i>');
        var $msg  = $('#wbf2faVerifyMsg');
        var code  = $('#wbf2faVerifyCode').val().replace(/\s+/g, '');

        if (code.length !== 6) {
            $msg.text('Bitte 6-stelligen Code eingeben.').css('color', '#f05252').show();
            $btn.prop('disabled', false).html('<i class="fas fa-check"></i> Bestätigen & aktivieren');
            return;
        }

        $.post(WBF.ajax_url, {
            action: 'wbf_2fa_setup_verify',
            nonce:  WBF.nonce,
            code:   code
        }, function (res) {
            if (res && res.success) {
                $('#wbf2faStep2').hide();
                $('#wbf2faStep3').fadeIn(300);
                // Badge im Header aktualisieren
                $('#wbf2faCard .wbf-2fa-badge')
                    .removeClass('wbf-2fa-badge--off')
                    .addClass('wbf-2fa-badge--on')
                    .html('<i class="fas fa-check-circle"></i> Aktiv');
                // Nach 2 Sek. Seite neu laden damit der Header-Status stimmt
                setTimeout(function () { location.reload(); }, 2500);
            } else {
                var msg = (res && res.data && res.data.message) ? res.data.message : 'Ungültiger Code.';
                $msg.text(msg).css('color', '#f05252').show();
                $('#wbf2faVerifyCode').val('').focus();
                $btn.prop('disabled', false).html('<i class="fas fa-check"></i> Bestätigen & aktivieren');
            }
        }, 'json').fail(function () {
            $msg.text('Verbindungsfehler.').css('color', '#f05252').show();
            $btn.prop('disabled', false).html('<i class="fas fa-check"></i> Bestätigen & aktivieren');
        });
    });

    // Enter-Taste im Verifikationsfeld
    $(document).on('keydown', '#wbf2faVerifyCode', function (e) {
        if (e.key === 'Enter') $('#wbf2faVerifyBtn').click();
    });

    /* ══════════════════════════════════════════════════════════════
       2FA — Deaktivierung (Profil)
       ══════════════════════════════════════════════════════════════ */

    $(document).on('click', '#wbf2faDisableBtn', function () {
        var $btn  = $(this).prop('disabled', true).html('<i class="fas fa-spinner fa-spin"></i>');
        var $msg  = $('#wbf2faDisableMsg');
        var pw    = $('#wbf2faDisablePw').val();
        var code  = $('#wbf2faDisableCode').val().replace(/\s+/g, '');

        if (!pw) {
            $msg.text('Bitte Passwort eingeben.').css('color', '#f05252').show();
            $btn.prop('disabled', false)
                .html('<i class="fas fa-shield-xmark"></i> 2FA deaktivieren');
            return;
        }
        if (code.length !== 6) {
            $msg.text('Bitte 6-stelligen Code eingeben.').css('color', '#f05252').show();
            $btn.prop('disabled', false)
                .html('<i class="fas fa-shield-xmark"></i> 2FA deaktivieren');
            return;
        }

        $.post(WBF.ajax_url, {
            action:   'wbf_2fa_disable',
            nonce:    WBF.nonce,
            password: pw,
            code:     code
        }, function (res) {
            if (res && res.success) {
                $msg.text('✔ ' + (res.data.message || '2FA deaktiviert.')).css('color', '#56cf7e').show();
                setTimeout(function () { location.reload(); }, 1500);
            } else {
                var msg = (res && res.data && res.data.message) ? res.data.message : 'Fehler.';
                $msg.text(msg).css('color', '#f05252').show();
                $('#wbf2faDisableCode').val('').focus();
                $btn.prop('disabled', false)
                    .html('<i class="fas fa-shield-xmark"></i> 2FA deaktivieren');
            }
        }, 'json').fail(function () {
            $msg.text('Verbindungsfehler.').css('color', '#f05252').show();
            $btn.prop('disabled', false)
                .html('<i class="fas fa-shield-xmark"></i> 2FA deaktivieren');
        });
    });

}(jQuery));
JS;
}