/*
 * Murikual.Modules.Identity — auth-specific style delta.
 *
 * Foundation: Murikual.Platform.UI base.css + app.css (linked before this file).
 * This file contains ONLY classes that are exclusive to the unauthenticated
 * auth-card layout (Setup, Login, Public realm pages) and that Platform.UI
 * does not ship.
 *
 * Do NOT redeclare tokens or component classes that already exist in Platform.UI.
 * (One deliberate exception below: the brand-accent default.)
 */

/* Brand-accent default. base.css ships the neutral platform default (#2563eb);
   Identity is Murikual's OWN OIDC provider, so its default accent is the brand
   ultramarine. A realm can still override --accent via its login design — that is
   emitted inline in _AuthLayout AFTER this file, so it wins. */
:root {
  --accent: #002fa7;
  --accent-hover: #0a3ec2;
  --accent-ring: rgba(0, 47, 167, 0.18);
  /* Brand the admin sidebar the same solid ultramarine as the rest of Murikual, so the
     white M mark sits on the brand colour (the login pages have no sidebar — harmless there). */
  --sidebar-bg: #002fa7;
}

/* ─── Auth shell (centered-card layout for Setup / Login / Public pages) ─── */

.auth-shell {
  min-height: 100vh;
  display: flex;
  /* Column so the optional language switcher stacks below the auth-card. */
  flex-direction: column;
  align-items: center;
  justify-content: center;
  padding: 1.5rem;
}

.auth-card {
  width: 100%;
  max-width: 26rem;
  background: var(--card-bg);
  border: 1px solid var(--border);
  border-radius: var(--radius);
  box-shadow: var(--shadow);
  padding: 2rem 2.25rem;
}

/* ─── Auth card header elements ────────────────────────────────────────────── */

.auth-brand {
  margin: 0 0 1.5rem;
  font-size: 0.75rem;
  font-weight: 600;
  letter-spacing: 0.08em;
  text-transform: uppercase;
  color: var(--text-secondary);
}

.auth-card h1 {
  margin: 0 0 0.375rem;
  font-size: 1.375rem;
  font-weight: 600;
  color: var(--text);
}

.auth-sub {
  margin: 0 0 1.5rem;
  color: var(--text-secondary);
  font-size: 0.875rem;
}

/* ─── Auth card form ────────────────────────────────────────────────────────── */

.auth-card form {
  display: flex;
  flex-direction: column;
  gap: 1rem;
}

/* When the auth-card form uses Platform.UI .form-group, its own margin-bottom
   already drives the rhythm — clear the flex gap to avoid double spacing. */
.auth-card form:has(> .form-group) {
  gap: 0;
}

.auth-card .form-group:last-of-type {
  margin-bottom: 0.5rem;
}

.auth-card label {
  display: flex;
  flex-direction: column;
  gap: 0.375rem;
  font-size: 0.8125rem;
  font-weight: 500;
  color: var(--text);
}

.auth-card input[type="email"],
.auth-card input[type="password"],
.auth-card input[type="text"] {
  appearance: none;
  width: 100%;
  padding: 0.5rem 0.75rem;
  border: 1px solid var(--border);
  border-radius: var(--radius-sm);
  background: var(--card-bg);
  font-size: 0.875rem;
  color: var(--text);
  transition: border-color 120ms ease, box-shadow 120ms ease;
}

.auth-card input:focus {
  outline: none;
  border-color: var(--accent);
  box-shadow: 0 0 0 3px var(--accent-ring);
}

/* Primary submit button. Excludes the test-user tile, which is also a
   button[type="submit"] but uses its own white-card styling below. */
.auth-card button[type="submit"]:not(.test-user-tile__btn) {
  appearance: none;
  margin-top: 0.5rem;
  padding: 0.625rem 0.75rem;
  background: var(--accent);
  color: #fff;
  border: none;
  border-radius: var(--radius-sm);
  font-size: 0.875rem;
  font-weight: 600;
  cursor: pointer;
  transition: background-color 120ms ease;
}

.auth-card button[type="submit"]:not(.test-user-tile__btn):hover { background: var(--accent-hover); }
.auth-card button[type="submit"]:not(.test-user-tile__btn):focus-visible {
  outline: none;
  box-shadow: 0 0 0 3px var(--accent-ring);
}

/* ─── Error banner ──────────────────────────────────────────────────────────── */

/*
 * .error — form error banner used inside auth-card pages.
 * Platform.UI ships .alert-error for admin pages; .error is the auth-card variant.
 * Uses semantic red tokens from Platform.UI base.css:
 *   --red-50  (#fef2f2) → background
 *   --red-200 (#fecaca) → border
 *   --red-700 (#b91c1c) → text
 */
.error {
  margin: 0 0 1rem;
  padding: 0.625rem 0.75rem;
  background: var(--red-50);
  color: var(--red-700);
  border: 1px solid var(--red-200);
  border-radius: var(--radius-sm);
  font-size: 0.8125rem;
}

/* ─── Footer hint ───────────────────────────────────────────────────────────── */

.auth-hint {
  margin: 1.5rem 0 0;
  font-size: 0.75rem;
  color: var(--text-secondary);
  text-align: center;
}

/* ─── Admin badges (delta over Platform.UI) ─────────────────────────────────── */

.badge-muted {
  color: #475569;
  background: #f1f5f9;
  border: 1px solid #e2e8f0;
}

/* ─── Identity sidebar brand (logo + wordmark) ──────────────────────────────── */

.sidebar-brand-link {
  display: flex;
  align-items: center;
  gap: 0.625rem;
  min-width: 0;
}

.sidebar-brand .sidebar-logo {
  width: 1.5rem;
  height: 1.5rem;
  flex-shrink: 0;
  display: block;
}

.sidebar-brand-link span {
  white-space: nowrap;
  overflow: hidden;
  text-overflow: ellipsis;
}

.mobile-header .mobile-brand {
  display: inline-flex;
  align-items: center;
  gap: 0.5rem;
}

.mobile-header .mobile-logo {
  width: 1.25rem;
  height: 1.25rem;
  display: inline-block;
  flex-shrink: 0;
}

/* ─── Identity sidebar logout button ────────────────────────────────────────── */

.logout-btn {
  width: 100%;
  background: none;
  border: none;
  cursor: pointer;
  font-family: inherit;
  font-size: inherit;
}

/* === Row actions + table polish === */
.row-actions { display: flex; flex-wrap: wrap; gap: .375rem; align-items: center; justify-content: flex-end; }
.row-actions .btn-mini, .row-actions a.btn-mini { padding: .25rem .5rem; font-size: .75rem; border-radius: .25rem; border: 1px solid #d1d5db; background: white; color: #374151; text-decoration: none; line-height: 1.2; cursor: pointer; display: inline-block; white-space: nowrap; }
.row-actions .btn-mini:hover { border-color: var(--accent); color: var(--accent); }
.row-actions .btn-danger.btn-mini { background: #fef2f2; color: #991b1b; border-color: #fecaca; }
.row-actions .btn-danger.btn-mini:hover { background: #dc2626; color: white; border-color: #b91c1c; }
.row-actions form { display: inline; margin: 0; }

/*
 * .empty-state — admin variant override.
 * Platform.UI ships .empty-state as plain centered text (text-align: center;
 * padding: 3rem 1rem) styling <h3>/<p>. Identity admin uses a dashed-border
 * gray card styling <h2> (matching admin page tone). Kept as an intentional
 * delta over base.css.
 */
.empty-state { background: #f9fafb; border: 1px dashed #d1d5db; border-radius: .5rem; padding: 2rem; text-align: center; color: #6b7280; }
.empty-state h2 { margin: 0 0 .5rem; color: #374151; font-size: 1rem; }
.empty-state .btn { margin-top: 1rem; }

.flash-success { background: #ecfdf5; border: 1px solid #a7f3d0; color: #065f46; padding: .75rem 1rem; border-radius: .375rem; margin-bottom: 1rem; }

/* === Danger zone === */
.danger-card { background: #fef2f2; border: 1px solid #fecaca; border-radius: .5rem; padding: 1.25rem; margin-bottom: 1rem; }
.danger-card h2 { color: #991b1b; margin: 0 0 .5rem; font-size: 1.125rem; }
/*
 * .btn-danger — filled red admin variant.
 * Platform.UI ships .btn-danger as a ghost/outline variant requiring .btn as
 * a foundation (card-bg background, red text). Identity admin uses .btn-danger
 * as a standalone class on bare <a>/<button> elements (12 Delete pages), so
 * we keep the self-contained filled-red rules. The .row-actions .btn-danger.btn-mini
 * deltas below layer on top of this. Kept as an intentional override.
 */
.btn-danger { background: #dc2626; color: white; border: 1px solid #b91c1c; padding: .5rem 1rem; border-radius: .25rem; cursor: pointer; display: inline-block; text-decoration: none; }
.btn-danger:hover { background: #b91c1c; }
.btn-danger[disabled] { opacity: .5; cursor: not-allowed; }
.impact-list { margin: .5rem 0; padding-left: 1.25rem; color: #991b1b; }
.actions-bar { display: flex; gap: .5rem; margin-top: 1rem; align-items: center; }
.actions-bar form { display: inline; margin: 0; }
.danger-zone { margin-top: 2rem; border-top: 1px solid #fecaca; padding-top: 1rem; }
.danger-zone h2 { color: #991b1b; }

/* ─── Manage tiles (Realm overview) ─────────────────────────────────────────── */

.manage-grid {
  display: grid;
  grid-template-columns: repeat(auto-fit, minmax(220px, 1fr));
  gap: 1rem;
  margin: 1.5rem 0;
}

.manage-tile {
  display: block;
  padding: 1rem 1.25rem;
  background: var(--card-bg);
  border: 1px solid var(--border);
  border-radius: var(--radius);
  text-decoration: none;
  color: var(--text);
  transition: border-color 0.15s ease, box-shadow 0.15s ease, transform 0.15s ease;
}

.manage-tile:hover {
  border-color: var(--accent);
  box-shadow: 0 1px 3px rgba(0, 47, 167, 0.08);
  text-decoration: none;
  color: var(--text);
}

.manage-tile-label {
  font-size: 0.75rem;
  font-weight: 500;
  text-transform: uppercase;
  letter-spacing: 0.05em;
  color: var(--text-secondary);
  margin: 0 0 0.25rem;
}

.manage-tile-hint {
  font-size: 0.9375rem;
  font-weight: 500;
  color: var(--text);
  margin: 0;
}

/* ─── Realm branding two-column layout ──────────────────────────────────────── */

.branding-grid {
  display: flex;
  gap: 2rem;
  flex-wrap: wrap;
}

.branding-grid-col {
  flex: 1;
  min-width: 280px;
}

.branding-preview-frame {
  border: 1px solid var(--border);
  border-radius: var(--radius-sm);
  width: 100%;
  height: 420px;
}

/* ─── Tab nav (used by _TabNav and _ClientTabNav partials) ──────────────────── */

.tabs {
  display: flex;
  gap: 0.25rem;
  border-bottom: 2px solid var(--gray-200);
  margin: 1rem 0;
  flex-wrap: wrap;
}

.tab {
  padding: 0.5rem 1rem;
  color: var(--text-secondary);
  text-decoration: none;
  border-bottom: 2px solid transparent;
  margin-bottom: -2px;
  transition: color 0.15s ease, border-color 0.15s ease;
}

.tab:hover {
  color: var(--accent);
  text-decoration: none;
}

.tab--active {
  color: var(--accent);
  border-bottom-color: var(--accent);
  font-weight: 600;
}

/* ─── Test-user binding row controls (Realm > Test users tab) ──────────────── */

/* Vertical stack of two tiny chevron buttons for reorder (up/down).
   Borderless, tight; lives in a single inline-flex container per row. */
.tu-reorder {
  display: inline-flex;
  flex-direction: column;
  gap: 1px;
  vertical-align: middle;
}
.tu-reorder form { display: inline; margin: 0; }
.tu-reorder button {
  appearance: none;
  background: none;
  border: 1px solid transparent;
  border-radius: .25rem;
  width: 1.5rem;
  height: 1.125rem;
  padding: 0;
  cursor: pointer;
  font-size: .75rem;
  line-height: 1;
  color: var(--text-secondary);
  display: inline-flex;
  align-items: center;
  justify-content: center;
}
.tu-reorder button:hover:not(:disabled) {
  background: var(--gray-100, #f3f4f6);
  color: var(--text);
  border-color: var(--border, #e5e7eb);
}
.tu-reorder button:disabled { opacity: .35; cursor: default; }

/* Inline-edit label cell: input flex-grows, Save button right-attached as one unit. */
.tu-label-form {
  display: inline-flex;
  align-items: stretch;
  gap: 0;
  max-width: 18rem;
  width: 100%;
}
.tu-label-form input[type="text"],
.tu-label-form input.form-control {
  flex: 1 1 auto;
  min-width: 0;
  padding: .375rem .5rem;
  font-size: .875rem;
  border: 1px solid var(--border, #e5e7eb);
  border-right: none;
  border-radius: .25rem 0 0 .25rem;
  background: #fff;
  color: var(--text);
  line-height: 1.3;
}
.tu-label-form input:focus {
  outline: none;
  border-color: var(--accent, #002fa7);
  box-shadow: 0 0 0 2px var(--accent-ring, rgba(0, 47, 167, .15));
  position: relative;
  z-index: 1;
}
.tu-label-form button {
  appearance: none;
  padding: .375rem .625rem;
  font-size: .75rem;
  font-weight: 500;
  background: var(--gray-100, #f3f4f6);
  border: 1px solid var(--border, #e5e7eb);
  border-radius: 0 .25rem .25rem 0;
  cursor: pointer;
  color: var(--text);
  line-height: 1.3;
  white-space: nowrap;
}
.tu-label-form button:hover {
  background: var(--accent, #002fa7);
  border-color: var(--accent, #002fa7);
  color: #fff;
}

/* ─── Warning alert (paired with Platform.UI .alert-error) ──────────────────── */

.alert-warning {
  margin: 0 0 1rem;
  padding: 0.625rem 0.75rem;
  background: var(--yellow-50);
  color: var(--yellow-700);
  border: 1px solid var(--yellow-100);
  border-radius: var(--radius-sm);
  font-size: 0.8125rem;
}

/* Info icon with a native-tooltip explanation (uses the title attribute). */
.info-icon {
  display: inline-flex;
  align-items: center;
  justify-content: center;
  width: 1rem;
  height: 1rem;
  border-radius: 50%;
  background: var(--gray-200, #e5e7eb);
  color: var(--gray-600, #4b5563);
  font-size: 0.6875rem;
  font-style: normal;
  font-weight: 600;
  cursor: help;
  user-select: none;
}

/* ─── Configuration grid (read-only label/value pairs) ──────────────────────── */
/* Replaces the older .detail-grid / .detail-row which used a fixed 160px column
   and heavy row borders. .config-grid is tighter and aligns labels by content
   width, which reads better for both short and long label sets. */

.config-grid {
  display: grid;
  grid-template-columns: max-content 1fr;
  gap: 0.5rem 1.5rem;
  padding: 1rem 1.25rem;
  align-items: baseline;
}

.config-label {
  font-size: 0.8125rem;
  font-weight: 500;
  color: var(--text-secondary);
  white-space: nowrap;
}

.config-value {
  font-size: 0.875rem;
  color: var(--text);
  min-width: 0;
  overflow-wrap: anywhere;
}

.config-value code {
  font-size: 0.8125rem;
}

/* ─── Checkbox list (multi-select rows, e.g. role assignment) ───────────────── */

.checkbox-list {
  list-style: none;
  margin: 0 0 1rem;
  padding: 0;
  border: 1px solid var(--border);
  border-radius: var(--radius-sm);
  overflow: hidden;
}

.checkbox-row {
  display: flex;
  align-items: center;
  gap: 0.625rem;
  padding: 0.625rem 0.875rem;
}

.checkbox-row + .checkbox-row {
  border-top: 1px solid var(--border);
}

.checkbox-row:hover {
  background: #f9fafb;
}

.checkbox-row input[type="checkbox"] {
  width: 1rem;
  height: 1rem;
  flex-shrink: 0;
  margin: 0;
}

.checkbox-row label {
  display: flex;
  align-items: baseline;
  gap: 0.625rem;
  margin: 0;
  cursor: pointer;
  min-width: 0;
}

.checkbox-row-hint {
  font-size: 0.8125rem;
  color: var(--text-secondary);
  overflow-wrap: anywhere;
}

/* ─── Public realm auth pages (Login/Register/Magic/Link/ForgotPassword/ResetPassword) ─── */

/* By default .auth-card is 26rem (narrow centered card). When the Login page
   renders the test-user panel beside the form, widen the card and switch to a
   2-column grid on desktop. On mobile/tablet, stack vertically. */
.auth-card:has(> .login-secondary) {
  max-width: 56rem;
  display: grid;
  gap: 1.5rem;
  grid-template-columns: minmax(0, 1fr);
}

@media (min-width: 768px) {
  .auth-card:has(> .login-secondary) {
    gap: 2rem;
    grid-template-columns: minmax(0, 1fr) 18rem;
    align-items: start;
  }
}

.login-primary { min-width: 0; }

/* Divider between the sign-in form and the test-user panel: a horizontal rule
   above the panel when stacked (mobile), a vertical rule beside it when the
   layout switches to two columns (desktop). The grid gap supplies the breathing
   room; the border + padding place a clean line inside the gutter. */
.login-secondary {
  border-top: 1px solid var(--border);
  padding-top: 1.5rem;
}
@media (min-width: 768px) {
  .login-secondary {
    border-top: none;
    padding-top: 0;
    border-left: 1px solid var(--border);
    padding-left: 2rem;
  }
}

/* Realm logo at the top of the auth card. */
.auth-logo {
  margin: 0 0 1rem;
  display: flex;
  justify-content: center;
}
.auth-logo img { max-height: 56px; max-width: 100%; }

/* External IdP buttons (OIDC/OAuth2/SAML "Sign in with X"). */
.external-providers {
  display: flex;
  flex-direction: column;
  gap: 0.5rem;
  margin: 0 0 1rem;
}

/* Full-width button variant — used inside narrow auth card. */
.btn-block {
  display: block;
  width: 100%;
  text-align: center;
}

/* "or" divider between external providers and the email form. */
.auth-divider {
  display: flex;
  align-items: center;
  gap: 0.75rem;
  margin: 1rem 0;
  color: var(--text-secondary);
  font-size: 0.75rem;
  text-transform: uppercase;
  letter-spacing: 0.08em;
}
.auth-divider::before,
.auth-divider::after {
  content: "";
  flex: 1 1 auto;
  height: 1px;
  background: var(--border);
}

/* Secondary actions under the form (Forgot password, Sign up). */
.auth-secondary-actions {
  margin: 1rem 0 0;
  text-align: center;
  font-size: 0.8125rem;
  color: var(--text-secondary);
}
.auth-secondary-actions a {
  color: var(--accent);
  text-decoration: none;
}
.auth-secondary-actions a:hover { text-decoration: underline; }
.auth-secondary-divider { margin: 0 0.5rem; }

/* Neutral info banner (paired with .alert-error / .alert-warning). */
.alert-info {
  margin: 0 0 1rem;
  padding: 0.625rem 0.75rem;
  background: var(--blue-50, #eff6ff);
  color: var(--blue-700, #1d4ed8);
  border: 1px solid var(--blue-100, #dbeafe);
  border-radius: var(--radius-sm);
  font-size: 0.8125rem;
}

/* Consent screen scope list. */
.consent-scopes {
  margin: 0 0 1.5rem;
  padding: 0.75rem 1rem 0.75rem 2.25rem;
  background: var(--gray-50, #f9fafb);
  border: 1px solid var(--border);
  border-radius: var(--radius-sm);
  font-size: 0.875rem;
}
.consent-scopes li { margin: 0.125rem 0; }

/* Side-by-side button row (Allow/Deny on consent screen). */
.form-actions--split {
  display: flex;
  gap: 0.75rem;
}
.form-actions--split > .btn { flex: 1 1 0; }

/* ─── Test-user panel (test-mode login side panel) ──────────────────────────── */

.test-user-panel {
  background: var(--yellow-50);
  border: 1px solid var(--yellow-100);
  border-radius: var(--radius-sm);
  padding: 1rem;
}
.test-user-panel h2 {
  margin: 0 0 0.5rem;
  font-size: 0.9375rem;
  /* Amber dark enough for AA-readable contrast on the tint background. */
  color: var(--yellow-700);
}
.test-user-panel__hint {
  margin: 0 0 0.75rem;
  font-size: 0.75rem;
  color: var(--yellow-700);
}
.test-user-panel__list {
  list-style: none;
  padding: 0;
  margin: 0;
  display: flex;
  flex-direction: column;
  gap: 0.5rem;
}
.test-user-tile form { margin: 0; }
.test-user-tile__btn {
  appearance: none;
  width: 100%;
  text-align: left;
  background: var(--card-bg);
  border: 1px solid var(--border);
  border-radius: var(--radius-sm);
  padding: 0.625rem 0.75rem;
  cursor: pointer;
  display: flex;
  flex-direction: column;
  gap: 0.125rem;
  font-family: inherit;
  font-size: 0.8125rem;
  color: var(--text);
  transition: border-color 120ms ease;
}
.test-user-tile__btn:hover { border-color: var(--yellow-700); }
.test-user-tile__btn:focus-visible {
  outline: none;
  border-color: var(--yellow-700);
  box-shadow: 0 0 0 3px var(--accent-ring);
}
.test-user-tile__label { font-weight: 600; }
.test-user-tile__sub,
.test-user-tile__email { font-size: 0.75rem; color: var(--text-secondary); }
.test-user-tile--disabled .test-user-tile__btn { opacity: 0.5; cursor: not-allowed; }

/* Field-level error list (used under password field on Register etc). */
.field-error-list {
  margin: 0.25rem 0 0;
  padding-left: 1.25rem;
  color: var(--red-700);
  font-size: 0.8125rem;
}

/* "info" banner used inside auth-card pages (e.g. invite flow notice). */
.info-banner {
  margin: 0 0 1rem;
  padding: 0.625rem 0.75rem;
  background: var(--blue-50, #eff6ff);
  color: var(--blue-700, #1d4ed8);
  border: 1px solid var(--blue-100, #dbeafe);
  border-radius: var(--radius-sm);
  font-size: 0.8125rem;
}

/* Realm footer links (imprint, privacy, …) rendered below the auth-card. */
.auth-footer {
  margin-top: var(--space-4);
  display: flex;
  gap: var(--space-3);
  justify-content: center;
  flex-wrap: wrap;
}
.auth-footer-link {
  color: var(--text-secondary);
  font-size: 0.8125rem;
  text-decoration: none;
}
.auth-footer-link:hover { color: var(--accent); text-decoration: underline; }

/* Language switcher rendered below the auth-card when a realm enables >1 language. */
.auth-lang-switcher {
  margin-top: var(--space-4);
  display: flex;
  gap: var(--space-3);
  justify-content: center;
  flex-wrap: wrap;
}
.auth-lang-link {
  color: var(--text-secondary);
  font-size: 0.8125rem;
  text-decoration: none;
}
.auth-lang-link:hover { color: var(--accent); text-decoration: underline; }
.auth-lang-link--active { color: var(--text-primary); font-weight: 600; }