from PDAPI import *

TOTP_CONFIG = {
    "digits": 6,
    "interval": 30,
}


__metadata__ = {
    "methods": ["POST"],
    "blueprint": "GERP",
    "permission": 1.0,
    "attributes": [],
    "limit": "5 per minute",
    "form": [
        {"Name": "token", "Type": "str", "MaxLen": 6}
    ]
}

def HandleRequest(_CleanedData):
    current_user = UGM.GetELTUser()
    if not current_user:
        return {"code": 401, "msg": "未登录"}, 401

    Token = _CleanedData["form"].get("token", "").strip()
    if not Token or len(Token) != 6:
        return {"code": 1, "msg": "请输入6位验证码"}, 200

    existing = GERPUser2FA.query.filter(GERPUser2FA.UserUUID == current_user.UserUUID).first()
    if not existing or existing.IsEnabled != 1:
        return {"code": 1, "msg": "2FA未启用"}, 200

    Totp = pyotp.TOTP(existing.SecretKey, digits=TOTP_CONFIG["digits"], interval=TOTP_CONFIG["interval"])
    if Totp.verify(Token, valid_window=1):
        existing.IsEnabled = 0
        existing.Verified = 0
        try:
            db.session.commit()
            return {"code": 0, "msg": "2FA已禁用"}, 200
        except:
            db.session.rollback()
            return {"code": 1, "msg": "SQL 提交失败"}, 200

    return {"code": 1, "msg": "验证码错误，请重试"}, 200