Add roadmap management feature with database schema and user management

- Implemented roadmap.php for displaying and managing roadmap items with filters for quarter and status.
- Created schema.sql to define the database structure for users, invites, daily plans, tasks, brainstorm sessions, brainstorm cards, roadmap items, and integrations.
- Developed users.php for admin panel to manage team members and invitations, including functionality to create and revoke invites.
This commit is contained in:
2026-09-08 12:47:11 +02:00
commit 9da056b480
25 changed files with 3737 additions and 0 deletions
+185
View File
@@ -0,0 +1,185 @@
<?php
/**
* Fociz Uitnodiging Accepteren & Account Registratie met 2FA
*/
require_once __DIR__ . '/../includes/auth.php';
start_secure_session();
$token = trim($_GET['token'] ?? ($_POST['token'] ?? ''));
$invite = validate_invite($token);
if (!$invite) {
die("
<!DOCTYPE html>
<html lang='nl' class='dark'>
<head><script src='https://cdn.tailwindcss.com'></script></head>
<body class='bg-[#090d16] text-white min-h-screen flex items-center justify-center p-4'>
<div class='max-w-md bg-slate-900 border border-slate-800 rounded-2xl p-8 text-center'>
<h2 class='text-xl font-bold text-red-400 mb-2'>Ongeldige Uitnodiging</h2>
<p class='text-sm text-slate-400 mb-6'>Deze uitnodigingslink is ongeldig, verlopen of al eerder gebruikt.</p>
<a href='/auth/login.php' class='px-4 py-2 bg-emerald-500 text-slate-950 font-bold rounded-xl text-xs'>Naar Inloggen</a>
</div>
</body>
</html>
");
}
$error = null;
if (empty($_SESSION['invite_totp_secret'])) {
$_SESSION['invite_totp_secret'] = TOTP::generateSecret(16);
}
$secret = $_SESSION['invite_totp_secret'];
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
$name = trim($_POST['name'] ?? '');
$password = $_POST['password'] ?? '';
$confirmPassword = $_POST['confirm_password'] ?? '';
$totpCode = trim($_POST['totp_code'] ?? '');
if (empty($name) || empty($password) || empty($totpCode)) {
$error = "Alle velden (inclusief 2FA verificatiecode) zijn verplicht.";
} elseif (strlen($password) < 8) {
$error = "Het wachtwoord moet minimaal 8 tekens lang zijn.";
} elseif ($password !== $confirmPassword) {
$error = "Wachtwoorden komen niet overeen.";
} elseif (!TOTP::verifyCode($secret, $totpCode)) {
$error = "Ongeldige 2FA verificatiecode. Controleer de tijd op uw smartphone.";
} else {
try {
$db = get_db_connection();
$passwordHash = password_hash($password, PASSWORD_DEFAULT);
$backupCodes = TOTP::generateBackupCodes(8);
$db->beginTransaction();
// 1. Maak gebruiker aan
$stmt = $db->prepare("
INSERT INTO users (name, email, password_hash, role, two_factor_secret, two_factor_enabled, backup_codes)
VALUES (?, ?, ?, ?, ?, 1, ?)
");
$stmt->execute([
$name,
$invite['email'],
$passwordHash,
$invite['role'],
$secret,
json_encode($backupCodes)
]);
$newUserId = (int)$db->lastInsertId();
// 2. Markeer invite als gebruikt
$stmtInvite = $db->prepare("UPDATE invites SET used_at = NOW() WHERE id = ?");
$stmtInvite->execute([$invite['id']]);
$db->commit();
// Start sessie
$_SESSION['user_id'] = $newUserId;
$_SESSION['user_name'] = $name;
$_SESSION['user_email'] = $invite['email'];
$_SESSION['user_role'] = $invite['role'];
$_SESSION['is_2fa_verified'] = true;
unset($_SESSION['invite_totp_secret']);
header('Location: /planner.php');
exit;
} catch (Exception $e) {
if ($db->inTransaction()) $db->rollBack();
$error = "Fout bij registreren: " . $e->getMessage();
}
}
}
$otpAuthUrl = TOTP::getOtpAuthUrl($invite['email'], $secret, 'Fociz');
$qrCodeUrl = TOTP::getQrCodeUrl($otpAuthUrl, 180);
$pageTitle = "Fociz — Uitnodiging Accepteren";
?>
<!DOCTYPE html>
<html lang="nl" class="dark">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title><?= htmlspecialchars($pageTitle) ?></title>
<script src="https://cdn.tailwindcss.com"></script>
<script src="https://unpkg.com/lucide@latest"></script>
<style>body { background-color: #090d16; color: #f1f5f9; }</style>
</head>
<body class="min-h-screen flex items-center justify-center p-4 bg-gradient-to-br from-[#090d16] via-[#0f172a] to-[#090d16]">
<div class="w-full max-w-lg bg-slate-900/90 border border-slate-800 rounded-2xl shadow-2xl backdrop-blur-xl p-8">
<div class="text-center mb-8">
<div class="inline-flex items-center justify-center w-14 h-14 rounded-2xl bg-emerald-500/10 border border-emerald-500/30 text-emerald-400 mb-3 shadow-lg shadow-emerald-500/10">
<i data-lucide="shield-check" class="w-8 h-8"></i>
</div>
<h1 class="text-2xl font-bold text-white">Welkom bij Fociz</h1>
<p class="text-slate-400 text-sm mt-1">
Uitgenodigd door <strong class="text-slate-200"><?= htmlspecialchars($invite['inviter_name']) ?></strong> voor <span class="text-emerald-400 font-mono text-xs bg-emerald-500/10 px-2 py-0.5 rounded"><?= htmlspecialchars($invite['email']) ?></span>
</p>
</div>
<?php if ($error): ?>
<div class="mb-6 p-4 rounded-xl bg-red-500/10 border border-red-500/30 flex items-start space-x-3 text-red-400 text-sm">
<i data-lucide="alert-triangle" class="w-5 h-5 flex-shrink-0 mt-0.5"></i>
<span><?= htmlspecialchars($error) ?></span>
</div>
<?php endif; ?>
<form method="POST" action="/auth/invite.php" class="space-y-4">
<input type="hidden" name="token" value="<?= htmlspecialchars($token) ?>">
<div>
<label class="block text-xs font-medium text-slate-300 mb-1">Uw naam</label>
<input type="text" name="name" required placeholder="Bijv. Sarah de Vries" value="<?= htmlspecialchars($_POST['name'] ?? '') ?>" class="w-full bg-slate-800/80 border border-slate-700 rounded-xl px-4 py-2.5 text-white placeholder-slate-500 focus:outline-none focus:ring-2 focus:ring-emerald-500/50 text-sm transition">
</div>
<div class="grid grid-cols-1 sm:grid-cols-2 gap-3">
<div>
<label class="block text-xs font-medium text-slate-300 mb-1">Wachtwoord (min. 8 tekens)</label>
<input type="password" name="password" required placeholder="••••••••" class="w-full bg-slate-800/80 border border-slate-700 rounded-xl px-4 py-2.5 text-white placeholder-slate-500 focus:outline-none focus:ring-2 focus:ring-emerald-500/50 text-sm transition">
</div>
<div>
<label class="block text-xs font-medium text-slate-300 mb-1">Bevestig wachtwoord</label>
<input type="password" name="confirm_password" required placeholder="••••••••" class="w-full bg-slate-800/80 border border-slate-700 rounded-xl px-4 py-2.5 text-white placeholder-slate-500 focus:outline-none focus:ring-2 focus:ring-emerald-500/50 text-sm transition">
</div>
</div>
<!-- 2FA Verplichting -->
<div class="mt-6 pt-6 border-t border-slate-800 text-center space-y-4">
<h3 class="text-sm font-bold text-white uppercase tracking-wider text-emerald-400">
Verplichte Tweestapsverificatie (2FA)
</h3>
<p class="text-xs text-slate-400">
Scan deze QR-code in uw authenticator app (Google Authenticator, Microsoft Authenticator of 1Password):
</p>
<div class="inline-block p-3 bg-white rounded-2xl shadow-xl">
<img src="<?= htmlspecialchars($qrCodeUrl) ?>" alt="2FA QR Code" class="w-40 h-40 mx-auto">
</div>
<div class="bg-slate-800/60 border border-slate-700/80 rounded-xl p-2.5 text-xs text-slate-400 max-w-sm mx-auto font-mono">
Sleutel: <strong class="text-slate-200"><?= htmlspecialchars($secret) ?></strong>
</div>
<div>
<label class="block text-xs font-medium text-slate-300 mb-1.5">
Voer de 6-cijferige code uit uw app in:
</label>
<input type="text" name="totp_code" required maxlength="6" placeholder="123456" class="w-48 mx-auto block text-center tracking-[0.5em] font-mono text-xl bg-slate-800 border border-slate-700 rounded-xl py-2 text-white focus:outline-none focus:ring-2 focus:ring-emerald-500/50 transition">
</div>
</div>
<button type="submit" class="w-full mt-6 bg-emerald-500 hover:bg-emerald-600 text-slate-950 font-bold py-3 px-4 rounded-xl transition shadow-lg shadow-emerald-500/20 flex items-center justify-center space-x-2">
<span>Account Activeren & Inloggen</span>
<i data-lucide="check-circle-2" class="w-4 h-4"></i>
</button>
</form>
</div>
<script>
if (typeof lucide !== 'undefined') lucide.createIcons();
</script>
</body>
</html>
+212
View File
@@ -0,0 +1,212 @@
<?php
/**
* Fociz Veilige Login met Tweestapsverificatie (2FA)
*/
require_once __DIR__ . '/../includes/auth.php';
start_secure_session();
// Als er nog geen admin is, direct naar setup
if (!has_admin_user()) {
header('Location: /auth/setup.php');
exit;
}
// Als al volledig ingelogd en 2FA geverifieerd, ga naar planner
if (!empty($_SESSION['user_id']) && !empty($_SESSION['is_2fa_verified'])) {
header('Location: /planner.php');
exit;
}
$error = null;
$step = isset($_SESSION['pending_2fa_user_id']) ? 2 : 1;
// Terug naar stap 1
if (isset($_GET['action']) && $_GET['action'] === 'restart') {
unset($_SESSION['pending_2fa_user_id'], $_SESSION['pending_2fa_user_email']);
header('Location: /auth/login.php');
exit;
}
// POST Verwerking
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
$db = get_db_connection();
// STAP 1: Wachtwoord verificatie
if ($step === 1) {
$email = strtolower(trim($_POST['email'] ?? ''));
$password = $_POST['password'] ?? '';
if (empty($email) || empty($password)) {
$error = "Vul e-mailadres en wachtwoord in.";
} else {
$stmt = $db->prepare("SELECT id, name, email, password_hash, two_factor_secret, two_factor_enabled FROM users WHERE email = ?");
$stmt->execute([$email]);
$user = $stmt->fetch();
if ($user && password_verify($password, $user['password_hash'])) {
// Succesvol stap 1: zet tijdelijke pending sessie voor 2FA
$_SESSION['pending_2fa_user_id'] = $user['id'];
$_SESSION['pending_2fa_user_email'] = $user['email'];
$_SESSION['pending_2fa_user_name'] = $user['name'];
$step = 2;
} else {
$error = "Onjuist e-mailadres of wachtwoord.";
}
}
}
// STAP 2: 2FA TOTP Code verificatie
elseif ($step === 2) {
$userId = $_SESSION['pending_2fa_user_id'] ?? null;
$totpCode = trim(str_replace(' ', '', $_POST['totp_code'] ?? ''));
if (!$userId || empty($totpCode)) {
$error = "Vul de 6-cijferige 2FA verificatiecode in.";
} else {
$stmt = $db->prepare("SELECT id, name, email, role, two_factor_secret, backup_codes FROM users WHERE id = ?");
$stmt->execute([$userId]);
$user = $stmt->fetch();
$isValid = false;
// 1. Controleer TOTP code
if (!empty($user['two_factor_secret']) && TOTP::verifyCode($user['two_factor_secret'], $totpCode)) {
$isValid = true;
}
// 2. Controleer optioneel backup codes
if (!$isValid && !empty($user['backup_codes'])) {
$backupCodes = json_decode($user['backup_codes'], true) ?: [];
$codeUpper = strtoupper($totpCode);
$key = array_search($codeUpper, $backupCodes);
if ($key !== false) {
$isValid = true;
// Verbruik de backup code
unset($backupCodes[$key]);
$stmtUpdate = $db->prepare("UPDATE users SET backup_codes = ? WHERE id = ?");
$stmtUpdate->execute([json_encode(array_values($backupCodes)), $userId]);
}
}
if ($isValid) {
// Volledige login succesvol
$_SESSION['user_id'] = $user['id'];
$_SESSION['user_name'] = $user['name'];
$_SESSION['user_email'] = $user['email'];
$_SESSION['user_role'] = $user['role'];
$_SESSION['is_2fa_verified'] = true;
unset($_SESSION['pending_2fa_user_id'], $_SESSION['pending_2fa_user_email'], $_SESSION['pending_2fa_user_name']);
header('Location: /planner.php');
exit;
} else {
$error = "Onjuiste 2FA code. Controleer uw authenticator app en probeer opnieuw.";
}
}
}
}
$pageTitle = "Fociz — Inloggen";
?>
<!DOCTYPE html>
<html lang="nl" class="dark">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title><?= htmlspecialchars($pageTitle) ?></title>
<script src="https://cdn.tailwindcss.com"></script>
<script src="https://unpkg.com/lucide@latest"></script>
<style>body { background-color: #090d16; color: #f1f5f9; }</style>
</head>
<body class="min-h-screen flex items-center justify-center p-4 bg-gradient-to-br from-[#090d16] via-[#0f172a] to-[#090d16]">
<div class="w-full max-w-md bg-slate-900/90 border border-slate-800 rounded-2xl shadow-2xl backdrop-blur-xl p-8">
<!-- Header -->
<div class="text-center mb-8">
<div class="inline-flex items-center justify-center w-14 h-14 rounded-2xl bg-emerald-500/10 border border-emerald-500/30 text-emerald-400 mb-3 shadow-lg shadow-emerald-500/10">
<i data-lucide="shield-check" class="w-8 h-8"></i>
</div>
<h1 class="text-3xl font-extrabold tracking-tight text-white">Fociz</h1>
<p class="text-slate-400 text-sm mt-1">
Veilig inloggen met tweestapsverificatie (2FA)
</p>
</div>
<?php if ($error): ?>
<div class="mb-6 p-4 rounded-xl bg-red-500/10 border border-red-500/30 flex items-start space-x-3 text-red-400 text-sm">
<i data-lucide="alert-triangle" class="w-5 h-5 flex-shrink-0 mt-0.5"></i>
<span><?= htmlspecialchars($error) ?></span>
</div>
<?php endif; ?>
<?php if ($step === 1): ?>
<!-- STAP 1: E-mail & Wachtwoord -->
<form method="POST" action="/auth/login.php" class="space-y-4">
<div>
<label class="block text-xs font-medium text-slate-300 mb-1">E-mailadres</label>
<div class="relative">
<input type="email" name="email" required autofocus placeholder="uw.naam@bedrijf.nl" value="<?= htmlspecialchars($_POST['email'] ?? '') ?>" class="w-full bg-slate-800/80 border border-slate-700 rounded-xl px-4 py-2.5 text-white placeholder-slate-500 focus:outline-none focus:ring-2 focus:ring-emerald-500/50 text-sm transition">
</div>
</div>
<div>
<label class="block text-xs font-medium text-slate-300 mb-1">Wachtwoord</label>
<div class="relative">
<input type="password" name="password" required placeholder="••••••••" class="w-full bg-slate-800/80 border border-slate-700 rounded-xl px-4 py-2.5 text-white placeholder-slate-500 focus:outline-none focus:ring-2 focus:ring-emerald-500/50 text-sm transition">
</div>
</div>
<button type="submit" class="w-full mt-4 bg-emerald-500 hover:bg-emerald-600 text-slate-950 font-bold py-3 px-4 rounded-xl transition shadow-lg shadow-emerald-500/20 flex items-center justify-center space-x-2">
<span>Verder naar 2FA</span>
<i data-lucide="arrow-right" class="w-4 h-4"></i>
</button>
</form>
<?php else: ?>
<!-- STAP 2: 2FA TOTP Code -->
<form method="POST" action="/auth/login.php" class="space-y-5">
<div class="text-center">
<div class="inline-flex items-center justify-center w-12 h-12 rounded-xl bg-emerald-500/10 text-emerald-400 mb-2">
<i data-lucide="key" class="w-6 h-6"></i>
</div>
<p className="text-sm text-slate-300 font-medium">
Voer uw 6-cijferige verificatiecode in
</p>
<p class="text-xs text-slate-400 mt-1">
Gekoppeld aan <strong class="text-slate-200"><?= htmlspecialchars($_SESSION['pending_2fa_user_email'] ?? '') ?></strong>
</p>
</div>
<div>
<input type="text" name="totp_code" required autofocus maxlength="9" placeholder="000 000" class="w-full text-center tracking-[0.4em] font-mono text-2xl bg-slate-800/80 border border-slate-700 rounded-xl py-3 text-white placeholder-slate-600 focus:outline-none focus:ring-2 focus:ring-emerald-500/50 transition">
<span class="text-[11px] text-slate-500 text-center block mt-1">
Tip: U kunt ook een 8-cijferige herstelcode invoeren.
</span>
</div>
<div class="flex space-x-3">
<a href="/auth/login.php?action=restart" class="w-1/3 text-center bg-slate-800 hover:bg-slate-700 text-slate-300 font-medium py-2.5 px-3 rounded-xl transition text-sm flex items-center justify-center">
Terug
</a>
<button type="submit" class="w-2/3 bg-emerald-500 hover:bg-emerald-600 text-slate-950 font-bold py-2.5 px-4 rounded-xl transition shadow-lg shadow-emerald-500/20 flex items-center justify-center space-x-2">
<span>Inloggen</span>
<i data-lucide="check-circle-2" class="w-4 h-4"></i>
</button>
</div>
</form>
<?php endif; ?>
<div class="mt-8 pt-6 border-t border-slate-800/80 text-center text-xs text-slate-500">
Toegang tot Fociz is strikt op uitnodiging. Vraag uw beheerder om een uitnodigingslink.
</div>
</div>
<script>
if (typeof lucide !== 'undefined') lucide.createIcons();
</script>
</body>
</html>
+29
View File
@@ -0,0 +1,29 @@
<?php
/**
* Fociz Uitloggen
*/
require_once __DIR__ . '/../includes/auth.php';
start_secure_session();
// Vernietig alle sessie variabelen
$_SESSION = [];
if (ini_get("session.use_cookies")) {
$params = session_get_cookie_params();
setcookie(
session_name(),
'',
time() - 42000,
$params["path"],
$params["domain"],
$params["secure"],
$params["httponly"]
);
}
session_destroy();
header('Location: /auth/login.php');
exit;
+209
View File
@@ -0,0 +1,209 @@
<?php
/**
* Fociz First-Run Admin Initialisatie Wizard
*/
require_once __DIR__ . '/../includes/auth.php';
start_secure_session();
// Als er al een beheerder bestaat, sluit deze pagina direct af
if (has_admin_user()) {
header('Location: /auth/login.php');
exit;
}
$error = null;
$success = false;
$backupCodes = [];
// Haal of genereer een tijdelijke sessie-sleutel voor de 2FA configuratie
if (empty($_SESSION['setup_totp_secret'])) {
$_SESSION['setup_totp_secret'] = TOTP::generateSecret(16);
}
$secret = $_SESSION['setup_totp_secret'];
// Formulierverwerking
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
$name = trim($_POST['name'] ?? '');
$email = strtolower(trim($_POST['email'] ?? ''));
$password = $_POST['password'] ?? '';
$confirmPassword = $_POST['confirm_password'] ?? '';
$totpCode = trim($_POST['totp_code'] ?? '');
if (empty($name) || empty($email) || empty($password) || empty($totpCode)) {
$error = "Alle velden (inclusief de 2FA verificatiecode) zijn verplicht.";
} elseif (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
$error = "Voer een geldig e-mailadres in.";
} elseif (strlen($password) < 8) {
$error = "Het wachtwoord moet minimaal 8 tekens bevatten.";
} elseif ($password !== $confirmPassword) {
$error = "De ingevoerde wachtwoorden komen niet overeen.";
} elseif (!TOTP::verifyCode($secret, $totpCode)) {
$error = "Ongeldige 2FA verificatiecode. Zorg dat de tijd op uw telefoon gelijk loopt en probeer opnieuw.";
} else {
// Alles klopt: maak de allereerste Admin gebruiker aan in MariaDB!
try {
$db = get_db_connection();
$passwordHash = password_hash($password, PASSWORD_DEFAULT);
$backupCodes = TOTP::generateBackupCodes(8);
$stmt = $db->prepare("
INSERT INTO users (name, email, password_hash, role, two_factor_secret, two_factor_enabled, backup_codes)
VALUES (?, ?, ?, 'ADMIN', ?, 1, ?)
");
$stmt->execute([
$name,
$email,
$passwordHash,
$secret,
json_encode($backupCodes)
]);
$adminId = (int)$db->lastInsertId();
// Automatische sessie starten
$_SESSION['user_id'] = $adminId;
$_SESSION['user_name'] = $name;
$_SESSION['user_email'] = $email;
$_SESSION['user_role'] = 'ADMIN';
$_SESSION['is_2fa_verified'] = true;
unset($_SESSION['setup_totp_secret']);
$success = true;
} catch (Exception $e) {
$error = "Fout bij aanmaken beheerder in MariaDB: " . $e->getMessage();
}
}
}
$otpAuthUrl = TOTP::getOtpAuthUrl(!empty($email) ? $email : 'admin@fociz.local', $secret, 'Fociz');
$qrCodeUrl = TOTP::getQrCodeUrl($otpAuthUrl, 200);
$pageTitle = "Fociz — Eerste Initialisatie";
?>
<!DOCTYPE html>
<html lang="nl" class="dark">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title><?= htmlspecialchars($pageTitle) ?></title>
<script src="https://cdn.tailwindcss.com"></script>
<script src="https://unpkg.com/lucide@latest"></script>
<style>body { background-color: #090d16; color: #f1f5f9; }</style>
</head>
<body class="min-h-screen flex items-center justify-center p-4 bg-gradient-to-br from-[#090d16] via-[#0f172a] to-[#090d16]">
<div class="w-full max-w-xl bg-slate-900/90 border border-slate-800 rounded-2xl shadow-2xl backdrop-blur-xl p-8">
<!-- Header -->
<div class="text-center mb-8">
<div class="inline-flex items-center justify-center w-14 h-14 rounded-2xl bg-emerald-500/10 border border-emerald-500/30 text-emerald-400 mb-3 shadow-lg shadow-emerald-500/10">
<i data-lucide="shield-check" class="w-8 h-8"></i>
</div>
<h1 class="text-3xl font-bold tracking-tight text-white">Fociz Initialisatie</h1>
<p class="text-slate-400 text-sm mt-1">
Eenmalige configuratie van het hoofdbeheerdersaccount met verplichte 2FA
</p>
</div>
<?php if ($error): ?>
<div class="mb-6 p-4 rounded-xl bg-red-500/10 border border-red-500/30 flex items-start space-x-3 text-red-400 text-sm">
<i data-lucide="alert-triangle" class="w-5 h-5 flex-shrink-0 mt-0.5"></i>
<span><?= htmlspecialchars($error) ?></span>
</div>
<?php endif; ?>
<?php if ($success): ?>
<!-- Stap 3: Voltooid met backup codes -->
<div class="text-center space-y-6">
<div class="w-16 h-16 bg-emerald-500/20 text-emerald-400 rounded-full flex items-center justify-center mx-auto border border-emerald-500/40">
<i data-lucide="check-circle-2" class="w-10 h-10"></i>
</div>
<div>
<h2 class="text-2xl font-bold text-white mb-1">Beheerder Geïnstalleerd!</h2>
<p class="text-slate-400 text-sm">
Uw account is aangemaakt en direct beveiligd met 2FA. Bewaar deze eenmalige herstelcodes veilig:
</p>
</div>
<div class="bg-slate-950/90 border border-slate-800 rounded-xl p-4 text-left">
<div class="text-xs font-semibold text-slate-400 mb-2">HERSTELCODES (NOODGEBRUIK):</div>
<div class="grid grid-cols-2 gap-2 font-mono text-xs text-slate-300">
<?php foreach ($backupCodes as $code): ?>
<span class="bg-slate-900 px-2.5 py-1.5 rounded border border-slate-800 text-center"><?= htmlspecialchars($code) ?></span>
<?php endforeach; ?>
</div>
</div>
<a href="/planner.php" class="inline-flex items-center justify-center w-full bg-emerald-500 hover:bg-emerald-600 text-slate-950 font-bold py-3 px-4 rounded-xl transition shadow-lg shadow-emerald-500/20 space-x-2">
<span>Start met Fociz Dagplanning</span>
<i data-lucide="arrow-right" class="w-4 h-4"></i>
</a>
</div>
<?php else: ?>
<form method="POST" action="/auth/setup.php" class="space-y-5">
<!-- Account Info -->
<div class="space-y-4">
<div>
<label class="block text-xs font-medium text-slate-300 mb-1">Volledige naam</label>
<input type="text" name="name" required placeholder="Bijv. Niek Rabelink" value="<?= htmlspecialchars($_POST['name'] ?? '') ?>" class="w-full bg-slate-800/80 border border-slate-700 rounded-xl px-4 py-2.5 text-white placeholder-slate-500 focus:outline-none focus:ring-2 focus:ring-emerald-500/50 text-sm transition">
</div>
<div>
<label class="block text-xs font-medium text-slate-300 mb-1">Beheerder E-mailadres</label>
<input type="email" name="email" required placeholder="admin@bedrijf.nl" value="<?= htmlspecialchars($_POST['email'] ?? '') ?>" class="w-full bg-slate-800/80 border border-slate-700 rounded-xl px-4 py-2.5 text-white placeholder-slate-500 focus:outline-none focus:ring-2 focus:ring-emerald-500/50 text-sm transition">
</div>
<div class="grid grid-cols-1 sm:grid-cols-2 gap-3">
<div>
<label class="block text-xs font-medium text-slate-300 mb-1">Wachtwoord (min. 8 tekens)</label>
<input type="password" name="password" required placeholder="••••••••" class="w-full bg-slate-800/80 border border-slate-700 rounded-xl px-4 py-2.5 text-white placeholder-slate-500 focus:outline-none focus:ring-2 focus:ring-emerald-500/50 text-sm transition">
</div>
<div>
<label class="block text-xs font-medium text-slate-300 mb-1">Bevestig wachtwoord</label>
<input type="password" name="confirm_password" required placeholder="••••••••" class="w-full bg-slate-800/80 border border-slate-700 rounded-xl px-4 py-2.5 text-white placeholder-slate-500 focus:outline-none focus:ring-2 focus:ring-emerald-500/50 text-sm transition">
</div>
</div>
</div>
<!-- 2FA QR Code & Koppeling -->
<div class="mt-6 pt-6 border-t border-slate-800 text-center space-y-4">
<h3 class="text-sm font-bold text-white uppercase tracking-wider flex items-center justify-center space-x-1.5 text-emerald-400">
<i data-lucide="key" class="w-4 h-4"></i>
<span>Tweestapsverificatie (2FA) Koppelen</span>
</h3>
<p class="text-xs text-slate-400 max-w-md mx-auto">
Scan onderstaande QR-code met uw authenticator app (Google Authenticator, Microsoft Authenticator of 1Password):
</p>
<div class="inline-block p-3 bg-white rounded-2xl shadow-xl">
<img src="<?= htmlspecialchars($qrCodeUrl) ?>" alt="2FA QR Code" class="w-44 h-44 mx-auto">
</div>
<div class="bg-slate-800/60 border border-slate-700/80 rounded-xl p-2.5 text-xs text-slate-400 max-w-sm mx-auto font-mono flex items-center justify-between">
<span>Sleutel: <strong class="text-slate-200"><?= htmlspecialchars($secret) ?></strong></span>
</div>
<div>
<label class="block text-xs font-medium text-slate-300 mb-1.5">
Voer de 6-cijferige verificatiecode uit uw app in:
</label>
<input type="text" name="totp_code" required maxlength="6" placeholder="123456" class="w-48 mx-auto block text-center tracking-[0.5em] font-mono text-xl bg-slate-800 border border-slate-700 rounded-xl py-2 text-white focus:outline-none focus:ring-2 focus:ring-emerald-500/50 transition">
</div>
</div>
<button type="submit" class="w-full mt-6 bg-emerald-500 hover:bg-emerald-600 text-slate-950 font-bold py-3 px-4 rounded-xl transition shadow-lg shadow-emerald-500/20 flex items-center justify-center space-x-2">
<span>Account & 2FA Bevestigen</span>
<i data-lucide="check-circle-2" class="w-4 h-4"></i>
</button>
</form>
<?php endif; ?>
</div>
<script>
if (typeof lucide !== 'undefined') lucide.createIcons();
</script>
</body>
</html>