/* Sirvan: sign-in, two-factor authentication and sessions (Go only). Loaded on /login, /account and /admin/users
   and on every page without a session by layout(); see DESIGN.md "Sign-in & 2FA". */

/* the signed-out frame and the sign-in card (moved from style.css; layout() links auth.css on every page without a
   session, so error and SSO pages get it too) */
.auth { min-height: 100vh; display: grid; place-items: center; padding: var(--s5) var(--s4); }
.auth-box { width: 100%; max-width: 380px; }
.auth-box .brand { padding: 0 0 var(--s5); font-size: 17px; }
.auth-box .brand svg { width: 32px; height: 32px; }
.login { background: var(--sheet); border: 1px solid var(--border); border-radius: var(--r-sheet); padding: var(--s6) 28px; }
.narrow .login { padding: var(--s5); border-radius: var(--r-card); }
.login h1, .login h2 { font-size: 20px; line-height: 26px; margin: 0 0 4px; display: block; }
.login .hint { color: var(--muted); margin: 0 0 var(--s5); font-size: var(--fs-sm); }
.login form { display: flex; flex-direction: column; gap: var(--s4); }
.login label { display: flex; flex-direction: column; gap: 6px; font-size: var(--fs-sm); font-weight: 500; color: var(--text); }
.login input { width: 100%; height: 40px; font-size: var(--fs-md); }
.login button { width: 100%; height: 40px; margin-top: 4px; font-size: var(--fs-md); }
.login .banner { margin-bottom: var(--s4); }
/* SSO: Keycloak is the filled action; local account below a rule */
.login .btn { width: 100%; height: 40px; font-size: var(--fs-md); }
.login .local { margin: var(--s5) 0 0; padding-top: var(--s5); border-top: 1px solid var(--rule); }
.login .or { margin: 0 0 var(--s3); font-size: var(--fs-sm); font-weight: 500; color: var(--muted); }
.login details.local { border: 0; border-top: 1px solid var(--rule); border-radius: 0; background: none; padding-top: var(--s3); }
.login details.local > summary { padding: 0 var(--s1); min-height: 32px; color: var(--muted); font-size: var(--fs-sm); border-radius: var(--r-control); }
.login details.local[open] > summary { border-bottom: 0; margin-bottom: var(--s3); }
.auth-foot { color: var(--faint); font-size: var(--fs-xs); margin-top: var(--s4); padding-left: 2px;
  display: flex; align-items: center; justify-content: space-between; gap: var(--s2); }
@media (max-width: 640px) { .login { padding: var(--s5) var(--s4); } }

/* --- sign-in card ------------------------------------------------------------------------------------------ */
.login .hint { line-height: 18px; }
.login .hint .mono { color: var(--text); }
.login label.check { flex-direction: row; align-items: center; gap: 10px; font-weight: 400; color: var(--text-2); min-height: 40px; cursor: pointer; }
.login label.check input { width: 18px; height: 18px; flex: none; }
.login .sso-form { display: flex; flex-direction: column; gap: var(--s2); }
.login .sso-form button { order: -1; }
.login details.local { margin: var(--s5) 0 0; }
.login details.local > summary { font-weight: 500; color: var(--text-2); min-height: 40px; }
.login details.local[open] > summary { margin-bottom: var(--s2); }
.login details.local > .hint { margin: 0 0 var(--s3); }
.login .mfa-cancel { margin-top: var(--s4); align-items: center; }
.login .mfa-cancel button { width: auto; height: 40px; margin: 0; font-size: var(--fs-sm); }

/* --- the code field: one input, large monospace, numeric keypad ----------------------------------------- */
label.otp { display: flex; flex-direction: column; gap: 6px; font-size: var(--fs-sm); font-weight: 500; color: var(--text); }
input.otp { width: 100%; max-width: 280px; height: 52px; padding: 0 14px; font: 500 24px/1 var(--mono); letter-spacing: .18em;
  font-variant-numeric: tabular-nums; font-variant-ligatures: none; }
.login input.otp { max-width: none; height: 56px; font-size: 26px; }
input.otp.rc { height: 44px; font-size: 16px; letter-spacing: .04em; }
input.otp::placeholder { letter-spacing: .04em; }

/* --- "Lost your phone?" fold (sign-in and step-up) ------------------------------------------------------- */
details.recov { border: 0; background: none; margin: var(--s4) 0 0; }
details.recov > summary { padding: 0; min-height: 40px; color: var(--link); font-weight: 500; font-size: var(--fs-sm); }
details.recov[open] > summary { border-bottom: 0; }
details.recov > form { display: flex; flex-direction: column; gap: var(--s3); margin: var(--s2) 0 0; max-width: 440px; }
details.recov > form button { align-self: flex-start; }
.login details.recov > form button { align-self: stretch; }
details.recov > .hint { margin: var(--s3) 0 0; font-size: var(--fs-xs); line-height: 16px; color: var(--muted); max-width: 60ch; }

/* --- signed-in 2FA pages: gate (set up first / confirm it's you), manage, enrol, codes ------------------ */
.mfa { max-width: 760px; }
.mfa .lead { font-size: var(--fs-lg); line-height: 24px; color: var(--text); margin: 0 0 var(--s3); max-width: 62ch; }
.mfa.gate { max-width: 560px; }
.mfa .gate-act { display: flex; flex-wrap: wrap; gap: var(--s2); margin: var(--s5) 0 0; }
.mfa .gate-act .btn { margin: 0; }
.mfa .otp-form { margin: var(--s4) 0 0; max-width: 440px; }
.mfa .otp-form button { align-self: flex-start; }
.mfa .jform { margin-top: var(--s3); }
.mfa > p.muted.small, .mfa li > p.muted.small { margin: var(--s3) 0 0; }
.mfa h2 .badge, .acct h2 .badge { margin-left: var(--s2); vertical-align: middle; }
.acct .btn { margin-top: var(--s3); }
.mfa dl.kv { max-width: 480px; margin: 0 0 var(--s6); }

.mfa-acts { display: flex; flex-direction: column; gap: var(--s2); max-width: 640px; }
details.mfa-act { margin: 0; }
details.mfa-act > summary { display: grid; grid-template-columns: auto 1fr; gap: 0 12px; align-items: start; padding: var(--s3) var(--s4); }
details.mfa-act > summary::before { grid-row: 1; margin-top: 7px; }
details.mfa-act > summary b { grid-column: 2; font-weight: 500; }
details.mfa-act > summary span { grid-column: 2; font-weight: 400; font-size: var(--fs-sm); line-height: 18px; color: var(--muted); margin-top: 2px; }
details.mfa-act.off > summary b { color: var(--fail); }
details.mfa-act > form { padding: 0 var(--s4) var(--s4); }
div.mfa-act { padding: var(--s3) var(--s4); border: 1px solid var(--border); border-radius: var(--r-card); }

/* enrolment: two numbered steps, the QR beside its typed key */
ol.esteps { list-style: none; counter-reset: st; margin: 0; padding: 0; }
ol.esteps > li { counter-increment: st; position: relative; padding: 0 0 var(--s6) 40px; }
ol.esteps > li::before { content: counter(st); position: absolute; left: 0; top: 0; width: 26px; height: 26px; border-radius: 999px;
  display: grid; place-items: center; font-size: var(--fs-sm); font-weight: 600; color: var(--text); background: var(--raised);
  box-shadow: inset 0 0 0 1px var(--border); font-variant-numeric: tabular-nums; }
ol.esteps > li > h2 { margin: 2px 0 var(--s1); font-size: var(--fs-lg); line-height: 22px; }
.qrwrap { display: flex; gap: var(--s6); align-items: flex-start; margin-top: var(--s4); }
/* the QR is the one place with raw colours: scanners need dark modules on light, in both themes (DESIGN.md) */
.qrbox { flex: none; padding: 12px; background: #fff; border: 1px solid var(--border); border-radius: var(--r-card); }
svg.qr { display: block; width: 248px; height: 248px; }
.qrkey { min-width: 0; max-width: 360px; }
.qrkey > p { margin: 0 0 var(--s2); }
.mfa .key { font-size: 17px; line-height: 26px; letter-spacing: .06em; margin: 0 0 var(--s2); padding: var(--s2) var(--s3);
  background: var(--raised); border-radius: var(--r-control); color: var(--text); user-select: all; word-spacing: .2em; }
.uri-fold { margin: var(--s2) 0 0; }
.mfa .uri { word-break: break-all; font-size: var(--fs-xs); line-height: 16px; user-select: all; margin: 0 0 0 22px; }

/* recovery codes: a printable numbered grid, then the acknowledgement */
.codes-sheet { max-width: 640px; }
ol.codes { list-style: none; counter-reset: rc; display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 0 var(--s6);
  margin: var(--s4) 0; padding: var(--s3) var(--s5); background: var(--raised); border-radius: var(--r-card); user-select: all; }
ol.codes li { counter-increment: rc; display: flex; gap: var(--s3); align-items: baseline; padding: 6px 0; font-size: 16px; line-height: 24px;
  color: var(--text); letter-spacing: .02em; white-space: nowrap; }
ol.codes li::before { content: counter(rc); width: 2ch; flex: none; text-align: right; font: 400 var(--fs-xs)/24px var(--font);
  color: var(--muted); font-variant-numeric: tabular-nums; user-select: none; }
.ack { display: flex; flex-wrap: wrap; align-items: center; gap: var(--s3) var(--s4); }
.ack label.check { display: flex; align-items: center; gap: 10px; min-height: 40px; font-size: var(--fs-md); cursor: pointer; }
.ack label.check input { width: 18px; height: 18px; }
.ack .btn { margin: 0; }
.ack .wait { display: none; }
@supports selector(:has(*)) {
  .ack:not(:has(input:checked)) a.btn { display: none; }
  .ack:not(:has(input:checked)) .wait { display: inline-flex; align-items: center; }
}
.print-only { display: none; }

/* sessions and users */
.acct table.tbl-stack { margin: 0 0 var(--s3); }
table.users td.actions { white-space: normal; }
.uacts { display: flex; flex-wrap: wrap; justify-content: flex-end; gap: 4px; min-width: 300px; }
.uacts form + form { margin-left: 0; }
details.reset2fa { display: contents; }
details.reset2fa > summary { display: inline-flex; align-items: center; height: 28px; min-height: 0; padding: 0 10px; font-size: var(--fs-xs);
  color: var(--fail); border: 1px solid var(--control); border-radius: var(--r-control); background: var(--sheet); }
details.reset2fa > summary::before { display: none; }
details.reset2fa[open] > summary { border-bottom: 1px solid var(--control); border-radius: var(--r-control); background: var(--active); }
details.reset2fa > form { flex-basis: 100%; display: flex; gap: var(--s2); align-items: flex-end; justify-content: flex-end; flex-wrap: wrap;
  margin: var(--s2) 0 0; text-align: left; }
details.reset2fa label { display: flex; flex-direction: column; gap: 4px; font-size: var(--fs-xs); color: var(--muted); }
details.reset2fa input { min-width: 260px; }
details.reset2fa > p { flex-basis: 100%; margin: 4px 0 0; text-align: right; }

@media (max-width: 640px) {
  .qrwrap { flex-direction: column; gap: var(--s4); }
  svg.qr { width: 240px; height: 240px; }
  ol.esteps > li { padding-left: 36px; }
  ol.codes { grid-template-columns: 1fr; }
  input.otp { max-width: none; }
  .mfa .otp-form button, .mfa .gate-act .btn, .ack .btn, .ack .wait { width: 100%; justify-content: center; }
  .uacts { min-width: 0; justify-content: flex-start; }
  details.reset2fa input { min-width: 0; width: 100%; }
}

@media print {
  .side, .mbar, .crumb, .help-q, .banner, .ack, .codes-sheet > .section-note, .scanctl { display: none !important; }
  body, .content, .sheet { background: #fff; color: #000; padding: 0; margin: 0; border: 0; }
  .print-only { display: block; margin: 0 0 12px; }
  ol.codes { background: none; border: 1px solid #000; }
  ol.codes li, ol.codes li::before { color: #000; }
}
/* Account (moved from board.css): password or SSO first, same type as Jira and Matrix below */
.acct { max-width: 760px; }
.acct > h2 { margin-top: 0; }
.acct > .section-note { margin: 4px 0 var(--s4); }
.acct .jform { max-width: 440px; }
.acct .jform > button { align-self: flex-start; }