/* openmun-auth — the pages auth serves (login shell and admin dashboard).
 *
 * Every colour is a token on :root; no rule below names a colour literal
 * (tests/test_shell.py holds that). Two groups:
 *
 * - Theme tokens: the default host theme (docs/BRANDING.md §4). A host theme
 *   overrides exactly these on the shell pages.
 * - Core tokens: status colours and the admin chrome. Never themed, so a theme
 *   cannot make an error look like success (BRANDING.md §6).
 */
*, *::before, *::after { box-sizing: border-box; }

:root {
    /* Theme tokens (default host theme) */
    --brand: #2563eb;
    --brand-strong: #1d4ed8;
    --on-brand: #ffffff;
    --background: #f8fafc;
    --surface: #ffffff;
    --text: #1e293b;
    --text-muted: #64748b;
    --border: #e2e8f0;
    --font-body: -apple-system, BlinkMacSystemFont, 'Segoe UI', system-ui, sans-serif;

    /* Core tokens (never themed) */
    --font-mono: 'SFMono-Regular', Consolas, 'Liberation Mono', monospace;
    --on-core: #fff;
    --neutral: #64748b;
    --neutral-strong: #475569;
    --success: #16a34a;
    --success-strong: #15803d;
    --success-bg: #dcfce7;
    --success-fg: #166534;
    --success-line: #bbf7d0;
    --danger: #dc2626;
    --danger-strong: #b91c1c;
    --danger-bg: #fee2e2;
    --danger-fg: #991b1b;
    --danger-line: #fecaca;
    --caution-bg: #fef3c7;
    --caution-fg: #92400e;
    --caution-line: #fde68a;
    --info-bg: #dbeafe;
    --info-fg: #1e40af;
    --muted-bg: #f1f5f9;
    --muted-fg: #475569;
    --row-hover: #f8fafc;
    --shadow: rgba(0, 0, 0, 0.1);
    --camera-bg: #000;
    --header-bg: #1e293b;
    --header-text: #f1f5f9;
    --header-link: #94a3b8;
    --header-link-hover: #fff;
    --header-link-hover-bg: rgba(255, 255, 255, 0.1);
}

body {
    margin: 0;
    font-family: var(--font-body);
    font-size: 14px;
    line-height: 1.5;
    color: var(--text);
    background: var(--background);
}

a { color: var(--brand); }
/* Form controls take the page's typeface (browsers give them their own). */
button, input, select, textarea { font-family: inherit; }

/* Header */
header {
    background: var(--header-bg);
    color: var(--header-text);
    padding: 0 1rem;
}
.header-inner {
    max-width: 1200px;
    margin: 0 auto;
    display: flex;
    align-items: center;
    gap: 1.5rem;
    height: 56px;
}
.header-title {
    font-size: 1rem;
    font-weight: 600;
    margin: 0;
    white-space: nowrap;
}
header nav {
    display: flex;
    gap: 0.25rem;
}
header nav a {
    color: var(--header-link);
    text-decoration: none;
    font-size: 0.875rem;
    padding: 0.25rem 0.5rem;
    border-radius: 4px;
}
header nav a:hover {
    color: var(--header-link-hover);
    background: var(--header-link-hover-bg);
}
.header-user {
    margin-left: auto;
    font-size: 0.875rem;
    color: var(--header-link);
}

/* Main content */
main {
    max-width: 1200px;
    margin: 0 auto;
    padding: 1.5rem 1rem;
}

/* Section headings */
h2 {
    font-size: 1.25rem;
    font-weight: 600;
    margin: 2rem 0 1rem;
    padding-bottom: 0.5rem;
    border-bottom: 2px solid var(--border);
}
h2:first-child { margin-top: 0; }

/* Forms */
.form-row {
    display: flex;
    flex-wrap: wrap;
    gap: 0.75rem;
    align-items: end;
    margin-bottom: 1rem;
    padding: 1rem;
    background: var(--surface);
    border: 1px solid var(--border);
    border-radius: 6px;
}
.form-group {
    display: flex;
    flex-direction: column;
    gap: 0.25rem;
}
.form-group label {
    font-size: 0.75rem;
    font-weight: 600;
    color: var(--text-muted);
    text-transform: uppercase;
    letter-spacing: 0.5px;
}

input[type="text"],
input[type="email"],
input[type="password"],
input[type="number"],
input[type="url"],
select {
    padding: 0.5rem 0.75rem;
    border: 1px solid var(--border);
    border-radius: 4px;
    font-size: 0.875rem;
    background: var(--surface);
    color: var(--text);
}
input:focus, select:focus {
    outline: 2px solid var(--brand);
    outline-offset: -1px;
    border-color: var(--brand);
}
input.narrow { width: 120px; }
input.wide { width: 280px; }

/* Buttons */
.btn {
    display: inline-flex;
    align-items: center;
    padding: 0.5rem 1rem;
    font-size: 0.875rem;
    font-weight: 500;
    border: none;
    border-radius: 4px;
    cursor: pointer;
    text-decoration: none;
    color: var(--on-brand);
    background: var(--brand);
    white-space: nowrap;
}
.btn:hover { background: var(--brand-strong); }
.btn-sm { padding: 0.25rem 0.5rem; font-size: 0.75rem; }
.btn-secondary { color: var(--on-core); background: var(--neutral); }
.btn-secondary:hover { background: var(--neutral-strong); }
.btn-danger { color: var(--on-core); background: var(--danger); }
.btn-danger:hover { background: var(--danger-strong); }
.btn-success { color: var(--on-core); background: var(--success); }
.btn-success:hover { background: var(--success-strong); }

/* Tables */
table {
    width: 100%;
    border-collapse: collapse;
    background: var(--surface);
    border: 1px solid var(--border);
    border-radius: 6px;
    overflow: hidden;
    font-size: 0.875rem;
    margin-bottom: 1rem;
}
th {
    text-align: left;
    padding: 0.75rem;
    background: var(--muted-bg);
    font-weight: 600;
    font-size: 0.75rem;
    color: var(--text-muted);
    text-transform: uppercase;
    letter-spacing: 0.5px;
    border-bottom: 2px solid var(--border);
}
td {
    padding: 0.5rem 0.75rem;
    border-bottom: 1px solid var(--border);
    vertical-align: middle;
}
tr:last-child td { border-bottom: none; }
tr:hover td { background: var(--row-hover); }
tr.inactive td { opacity: 0.5; }

/* Badges */
.badge {
    display: inline-block;
    padding: 0.125rem 0.5rem;
    font-size: 0.75rem;
    font-weight: 500;
    border-radius: 9999px;
    white-space: nowrap;
}
.badge-green { background: var(--success-bg); color: var(--success-fg); }
.badge-red { background: var(--danger-bg); color: var(--danger-fg); }
.badge-blue { background: var(--info-bg); color: var(--info-fg); }
.badge-gray { background: var(--muted-bg); color: var(--muted-fg); }
.badge-yellow { background: var(--caution-bg); color: var(--caution-fg); }

/* Alerts */
.alert {
    padding: 0.75rem 1rem;
    border-radius: 6px;
    margin-bottom: 1rem;
    font-size: 0.875rem;
}
.alert-success { background: var(--success-bg); color: var(--success-fg); border: 1px solid var(--success-line); }
.alert-error { background: var(--danger-bg); color: var(--danger-fg); border: 1px solid var(--danger-line); }

/* Login page */
.login-wrapper {
    min-height: 100vh;
    display: flex;
    align-items: center;
    justify-content: center;
    background: var(--background);
}
.login-card {
    background: var(--surface);
    border: 1px solid var(--border);
    border-radius: 8px;
    padding: 2rem;
    width: 100%;
    max-width: 400px;
    box-shadow: 0 1px 3px var(--shadow);
}
.shell-host {
    text-align: center;
}
.host-logo {
    display: block;
    max-width: 100%;
    max-height: 56px;
    margin: 0 auto 0.75rem;
}
.shell-footer {
    margin-top: 1.5rem;
    padding-top: 1rem;
    border-top: 1px solid var(--border);
    text-align: center;
    font-size: 0.75rem;
    color: var(--text-muted);
}
.shell-footer nav {
    display: flex;
    justify-content: center;
    gap: 1rem;
    margin-bottom: 0.25rem;
}
.shell-footer p { margin: 0; }
.login-card h1 {
    font-size: 1.25rem;
    margin: 0 0 0.5rem;
    text-align: center;
}
.login-card .subtitle {
    text-align: center;
    color: var(--text-muted);
    font-size: 0.875rem;
    margin: 0 0 1.5rem;
}
.login-card .form-group { margin-bottom: 1rem; }
.login-card input[type="text"],
.login-card input[type="email"],
.login-card input[type="password"] { width: 100%; }
.login-card .btn {
    width: 100%;
    justify-content: center;
    padding: 0.75rem;
    margin-top: 0.5rem;
}
/* The organisation choice after an identify-first login: one full-width
   button per organisation, stacked. */
.choice-list { display: flex; flex-direction: column; }
/* The organisation step for a user name, folded under the address form. */
.login-card details { margin-top: 1rem; }
.login-card details summary { cursor: pointer; }
.login-card details form { margin-top: 0.75rem; }
/* Signup honeypot: off-screen, never shown to a person (no inline style, so a
   strict style-src policy holds). */
.honeypot {
    position: absolute;
    left: -10000px;
    top: auto;
    width: 1px;
    height: 1px;
    overflow: hidden;
}
.login-sep {
    margin: 1.5rem 0;
    border: none;
    border-top: 1px solid var(--border);
}

/* Login tab chooser (radio-driven, no JS needed) */
.tab-radio { position: absolute; opacity: 0; pointer-events: none; }
.tab-bar {
    display: flex;
    gap: 0.25rem;
    margin: 0 0 1.25rem;
    border-bottom: 1px solid var(--border);
}
.tab-label {
    flex: 1;
    text-align: center;
    padding: 0.5rem 0.5rem;
    font-size: 0.8125rem;
    font-weight: 500;
    color: var(--text-muted);
    cursor: pointer;
    border-bottom: 2px solid transparent;
    margin-bottom: -1px;
    user-select: none;
}
.tab-label:hover { color: var(--text); }
/* Keyboard focus on the (visually hidden) radio highlights its label. */
.tab-radio:focus-visible + .tab-bar .tab-label,
.tab-radio:focus-visible ~ .tab-bar .tab-label { outline: none; }
.tab-panel { display: none; }
#tab-password:checked ~ .tab-bar label[for="tab-password"],
#tab-scan:checked ~ .tab-bar label[for="tab-scan"],
#tab-code:checked ~ .tab-bar label[for="tab-code"] {
    color: var(--brand);
    border-bottom-color: var(--brand);
}
#tab-password:checked ~ .tab-panels .panel-password,
#tab-scan:checked ~ .tab-panels .panel-scan,
#tab-code:checked ~ .tab-panels .panel-code { display: block; }
.login-card .tab-panel input[type="text"],
.login-card .tab-panel input[type="password"] { width: 100%; }

/* QR scanner */
#scanner-container {
    width: 100%;
    border-radius: 6px;
    overflow: hidden;
    margin-bottom: 0.75rem;
}
#scanner-container:not(.open) { display: none; }
#scanner-container.open {
    display: block;
    background: var(--camera-bg);
    border: 1px solid var(--border);
}
.scanner-status {
    margin: 0.5rem 0 0;
    font-size: 0.8125rem;
    color: var(--text-muted);
    text-align: center;
}
.scanner-warning {
    margin: 0.75rem 0 0;
    padding: 0.75rem;
    font-size: 0.8125rem;
    background: var(--caution-bg);
    color: var(--caution-fg);
    border: 1px solid var(--caution-line);
    border-radius: 6px;
}
.panel-scan .btn { width: 100%; justify-content: center; }

/* Monospace */
.mono { font-family: var(--font-mono); }
.code-display {
    font-family: var(--font-mono);
    font-size: 1.5rem;
    font-weight: bold;
    letter-spacing: 2px;
    color: var(--text);
}

/* Checkbox groups */
.checkbox-group {
    display: flex;
    flex-wrap: wrap;
    gap: 0.5rem;
}
.checkbox-group label {
    display: flex;
    align-items: center;
    gap: 0.25rem;
    font-size: 0.8125rem;
    cursor: pointer;
    text-transform: none;
    font-weight: normal;
    letter-spacing: normal;
    color: var(--text);
}

/* Admin forms laid out by their row (no inline style: CSP style-src 'self') */
.form-contents { display: contents; }
.form-row-block { display: block; }
.inline-form { display: flex; gap: 0.3rem; }

/* A secret shown once (token code, set-password link) */
.secret-panel { padding: 1.5rem; }
.secret-panel .code-display { margin: 1rem 0; }
.secret-panel-wide { padding: 2rem; }
.secret-panel-wide .code-display { margin: 1.5rem 0; }
.detail-line { padding: 0.5rem; }

/* Actions cell */
.actions {
    display: flex;
    gap: 0.25rem;
    flex-wrap: wrap;
}

/* Audit log warning rows */
.warning-row td { background: var(--caution-bg); }

/* Utility */
.text-muted { color: var(--text-muted); }
.text-sm { font-size: 0.75rem; }
.text-center { text-align: center; }
.break-all { word-break: break-all; }
.mt-2 { margin-top: 1rem; }
.mb-2 { margin-bottom: 1rem; }

/* Second factors (openmun_auth.routers.factor) */
.qr-display { display: flex; justify-content: center; margin: 1rem 0; }
.qr-display svg {
  /* ~5 px per module at version 8 (57 modules with the quiet zone); never wider than
     the card. The SVG carries its own white background and quiet zone. */
  display: block; width: min(18rem, 100%); height: auto; aspect-ratio: 1;
  shape-rendering: crispEdges;
}
.factor-list { list-style: none; padding: 0; }
.factor-list li { display: flex; flex-wrap: wrap; align-items: center; gap: 0.5rem; padding: 0.5rem 0; border-bottom: 1px solid var(--border); }
.factor-list form { margin-left: auto; }
.recovery-codes { columns: 2; column-gap: 2rem; margin: 1rem 0; }
.recovery-codes li { padding: 0.15rem 0; }