! $embedded])> {{-- The state belongs beside the title, not floating inside the card: it is a property of the account, not of whichever step is on screen. As a tab of the settings page the title steps down to an h2: the page already has its own, and two

elements is two page titles. The state badge stays either way — it is the first thing somebody opening this comes to find out. --}}

@if ($embedded)

{{ __('two_factor_setup.title') }}

@else

{{ __('two_factor_setup.title') }}

@endif

{{ __('two_factor_setup.sub') }}

{{ $twoFactorOn ? __('two_factor_setup.state_on') : __('two_factor_setup.state_off') }}

{{-- Every action below is re-checked server-side against a recent password confirmation — hiding a button stops nobody who can post to /livewire/update. --}} @if (! $passwordConfirmed) {{-- The gate. Being signed in is not enough to change how the account is protected: the realistic threat is an unlocked machine. --}}

{{ __('two_factor_setup.locked_title') }}

{{ __('two_factor_setup.confirm_first') }}

{{ __('two_factor_setup.confirm_button') }}

@elseif ($twoFactorOn)

{{ __('two_factor_setup.active_title') }}

{{ __('two_factor_setup.active_body') }}

{{ __('two_factor_setup.new_codes') }} {{ __('two_factor_setup.disable') }}

@elseif ($twoFactorPending) {{-- The step that had no way out. The secret exists but is unconfirmed, so "Abbrechen" genuinely clears it rather than leaving a dangling enrolment that nothing else on the console would ever show. --}}

{{ __('two_factor_setup.scan_title') }}

{{ __('two_factor_setup.step_two') }}

{!! $twoFactorQr !!}

1. 1. {{ __('two_factor_setup.scan_step_open') }}
2. 2. {{ __('two_factor_setup.scan_step_scan') }}
3. 3. {{ __('two_factor_setup.scan_step_code') }}

{{ __('two_factor_setup.activate') }} {{ __('two_factor_setup.cancel') }}

@else

{{ __('two_factor_setup.not_set_title') }}

{{ __('two_factor_setup.not_set_body') }}

{{ __('two_factor_setup.need_app') }}

{{ __('two_factor_setup.enable') }}

@endif @if ($recoveryCodes) {{-- Its own card, not a footnote under another one: these are the only way back in once the phone is gone, and they are shown exactly once. --}}

{{ __('two_factor_setup.codes_title') }}

{{ __('two_factor_setup.codes_hint') }}

@foreach ($recoveryCodes as $code)
• {{ $code }}
@endforeach

@endif