/* Login / MFA pages (application/_backend/modules/auth/auth/views/scripts/user/*.phtml).
   Lives in bloom (not bloom-console, which is being deprecated), served at
   /baseapp/css/auth.css - the /baseapp prefix is a symlink from
   bloom-console/httpdocs/baseapp into this repo's public/ dir (the same
   path recaptcha.min.js is already served through), since bare /css/* is
   served from a real, separate directory in bloom-console instead. */

:root {
    --auth-bg: #ffffff;
    --auth-card-bg: #ffffff;
    --auth-input-bg: #ffffff;
    --auth-border: #c9ced6;
    --auth-text: #1f2733;
    --auth-text-muted: #5b6472;
    /* Theme colours from layoutv3.css: icon rail black #12191d (its bg-slate-900)
       + accent orange #fdb813. */
    --auth-link: #b45309;
    --auth-primary: #fdb813;
    --auth-primary-dark: #e9a400;
    --auth-on-primary: #12191d;
    --auth-focus-ring: rgba(253, 184, 19, 0.35);
    --auth-topbar: #12191d;
    --auth-error-bg: #fdecea;
    --auth-error-text: #b3261e;
    --auth-radius: 4px;
}

/* Dark scheme follows the OS setting. */
@media (prefers-color-scheme: dark) {
    :root {
        --auth-bg: #1c2429;
        --auth-card-bg: #1c2429;
        --auth-input-bg: #1c2429;
        --auth-border: #46525a;
        --auth-text: #e6e7ea;
        --auth-text-muted: #b4b8c0;
        --auth-link: #fdb813;
        --auth-error-bg: #3a1d1b;
        --auth-error-text: #ffb4ab;
    }
}

* {
    box-sizing: border-box;
}

html, body {
    height: 100%;
}

body {
    margin: 0;
    display: flex;
    flex-direction: column;
    min-height: 100vh;
    background: var(--auth-bg);
    font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
    color: var(--auth-text);
}

/* Blue brand bar across the top. */
.authTopbar {
    flex: 0 0 auto;
    height: 56px;
    display: flex;
    align-items: center;
    padding: 0 20px;
    background: var(--auth-topbar);
}

.authBrand {
    display: inline-flex;
    align-items: center;
    gap: 8px;
    color: #fff;
    font-size: 18px;
    font-weight: 600;
    text-decoration: none;
}

.authBrand .mdi {
    font-size: 24px;
    color: var(--auth-primary);
}

/* Form panel on the left, illustration on the right (hidden on narrow screens). */
.authSplit {
    flex: 1 1 auto;
    display: flex;
    min-height: 0;
}

.authPanel {
    flex: 1 1 50%;
    display: flex;
    flex-direction: column;
    padding: 48px 16px 24px;
    background: var(--auth-card-bg);
}

.authArt {
    flex: 1 1 50%;
    display: flex;
    flex-direction: column;
    align-items: center;
    justify-content: center;
    padding: 48px 40px;
    color: #e6e7ea;
    /* Always dark (layoutv3 black), with a faint dot grid and a soft glow. */
    background:
        radial-gradient(rgba(255, 255, 255, 0.05) 1.2px, transparent 1.4px) 0 0 / 28px 28px,
        radial-gradient(circle at 50% 42%, #22303a 0%, #12191d 68%);
}

/* Feature cards (_login-slider.phtml): stacked in one grid cell so the panel
   keeps the tallest card's height while they cross-fade. */
.authSlides {
    display: grid;
    width: 100%;
    max-width: 440px;
    text-align: center;
}

.authSlide {
    grid-area: 1 / 1;
    opacity: 0;
    visibility: hidden;
    transition: opacity 0.6s ease, visibility 0.6s ease;
}

.authSlide.is-active {
    opacity: 1;
    visibility: visible;
}

.authSlide svg {
    display: block;
    width: 100%;
    max-width: 360px;
    height: auto;
    margin: 0 auto 28px;
}

.authSlide h2 {
    margin: 0 0 10px;
    font-size: 26px;
    font-weight: 700;
    color: #ffffff;
}

.authSlide h2 span {
    color: #fdb813;
}

.authSlide p {
    max-width: 360px;
    margin: 0 auto;
    font-size: 15px;
    line-height: 1.55;
    color: #a7b0b6;
}

.authSlide a {
    display: inline-flex;
    align-items: center;
    gap: 4px;
    margin-top: 16px;
    font-size: 14px;
    font-weight: 600;
    color: #fdb813;
    text-decoration: none;
}

.authSlide a:hover {
    text-decoration: underline;
}

.authDots {
    display: flex;
    gap: 8px;
    margin-top: 28px;
}

.authDots button {
    width: 8px;
    height: 8px;
    padding: 0;
    border: 0;
    border-radius: 4px;
    background: #46525a;
    cursor: pointer;
    transition: width 0.3s ease, background 0.3s ease;
}

.authDots button.is-active {
    width: 22px;
    background: #fdb813;
}

@media (max-width: 860px) {
    .authArt {
        display: none;
    }
}

.authCard {
    width: 100%;
    max-width: 520px;
    margin: auto auto;
}

/* Bottom-of-panel links (status, support). */
.authFooter {
    display: flex;
    flex-wrap: wrap;
    gap: 8px 32px;
    width: 100%;
    max-width: 520px;
    margin: 40px auto 0;
    font-size: 13px;
}

.authFooter a {
    color: var(--auth-text-muted);
    text-decoration: none;
}

.authFooter a:hover {
    color: var(--auth-text);
    text-decoration: underline;
}

.authIntro {
    color: var(--auth-text-muted);
    font-size: 14px;
    margin: 0 0 16px;
}

.mfa-sent-to {
    font-size: 13px;
    color: var(--auth-text-muted);
    margin: 0 0 16px;
}

.mfa-sent-to strong {
    color: var(--auth-text);
    font-weight: 600;
}

.error {
    display: flex;
    align-items: center;
    gap: 8px;
    background: var(--auth-error-bg);
    color: var(--auth-error-text);
    border-radius: 8px;
    padding: 10px 14px;
    margin-bottom: 16px;
    font-size: 14px;
}

/* Zend_Form output: <dl class="zend_form"><div class="form-element ..."><label/><input/></div>...</dl>.
   Deliberately scoped to .authForm, NOT .loginBox - the legacy, still-separate
   /css/login.css (served from bloom-console/httpdocs/css/login.css) already
   has its own .loginBox rules used by /login.php and friends; reusing that
   class name here would collide with and stack on top of those. */
.authForm dl.zend_form {
    margin: 0;
    padding: 0;
}

/* Real markup nests each field as <dt><label></dt><dd><input></dd> - reset
   the browser's default <dd> left indent (~40px) and <dt>/<dl> spacing so
   fields lay out edge-to-edge inside the card instead of shifted right. */
.authForm dt,
.authForm dd {
    margin: 0;
    padding: 0;
}

.authForm legend,
.authForm .heading,
.authForm .baseapp-form h2 {
    font-size: 30px;
    font-weight: 600;
    margin: 0 0 24px;
}

.authForm .form-element {
    margin-bottom: 16px;
}

.authForm label {
    display: block;
    font-size: 13px;
    font-weight: 600;
    color: var(--auth-text);
    margin-bottom: 8px;
}

.authForm input[type="text"],
.authForm input[type="password"],
.authForm input[type="email"] {
    width: 100%;
    padding: 11px 12px;
    font-size: 15px;
    border: 1px solid var(--auth-border);
    border-radius: var(--auth-radius);
    background: var(--auth-input-bg);
    color: var(--auth-text);
    transition: border-color 0.15s ease, box-shadow 0.15s ease;
}

.authForm input[type="text"]:focus,
.authForm input[type="password"]:focus,
.authForm input[type="email"]:focus {
    outline: none;
    border-color: var(--auth-primary);
    box-shadow: 0 0 0 3px var(--auth-focus-ring);
}

/* Show/hide password toggle icon - injected by TOOLBOX.togglePasswordField()
   as a sibling of the password <input> inside its <dd>. */
.authForm dd {
    position: relative;
}

.authForm input[type="password"] {
    padding-right: 38px;
}

.authForm .toggle-pwd-field-btn {
    position: absolute;
    top: 50%;
    right: 12px;
    transform: translateY(-50%);
    cursor: pointer;
    font-size: 18px;
    color: var(--auth-text-muted);
}

.authForm .toggle-pwd-field-btn:hover {
    color: var(--auth-text);
}

.authForm .form-element.checkbox-container,
.authForm input[type="checkbox"] {
    width: auto;
    display: inline-block;
    vertical-align: middle;
    margin-right: 6px;
}

.authForm ul.errors {
    list-style: none;
    margin: 6px 0 0;
    padding: 0;
    color: var(--auth-error-text);
    font-size: 13px;
}

.authForm input[type="submit"],
.authForm button[type="submit"],
.authForm .SubmitButton input {
    width: 100%;
    padding: 11px 16px;
    margin-top: 4px;
    font-size: 15px;
    font-weight: 600;
    color: var(--auth-on-primary);
    background: var(--auth-primary);
    border: none;
    border-radius: var(--auth-radius);
    cursor: pointer;
    transition: background 0.15s ease;
}

.authForm input[type="submit"]:hover,
.authForm button[type="submit"]:hover,
.authForm .SubmitButton input:hover {
    background: var(--auth-primary-dark);
}

.authForm input[type="submit"]:disabled {
    cursor: default;
    opacity: 0.85;
}

.authForm input[type="submit"].is-submitting {
    color: transparent;
}

.authForm .btn-spinner {
    position: absolute;
    top: 50%;
    left: 50%;
    transform: translate(-50%, -50%);
    font-size: 18px;
    line-height: 1;
    color: var(--auth-on-primary);
    pointer-events: none;
}

/* Zend renders an empty "&nbsp;" <dt> label for the submit button. */
.authForm .SubmitButton dt {
    display: none;
}

/* Login: "Forgot your password?" (moved in by login.phtml's JS) on the left,
   compact Log in button on the right. */
.authForm .authSubmitRow {
    display: flex;
    align-items: center;
    justify-content: space-between;
    gap: 16px;
}

.authForm .authSubmitRow a {
    color: var(--auth-link);
    font-size: 15px;
    text-decoration: none;
}

.authForm .authSubmitRow a:hover {
    text-decoration: underline;
}

.authForm .authSubmitRow input[type="submit"] {
    width: auto;
    margin-top: 0;
    padding: 11px 18px;
}

.authLinks {
    display: flex;
    flex-direction: column;
    align-items: flex-start;
    gap: 14px;
    margin-top: 28px;
    font-size: 15px;
    color: var(--auth-text-muted);
}

.authLinks a {
    color: var(--auth-link);
    text-decoration: none;
}

.authLinks a:hover {
    text-decoration: underline;
}

.authLinks a .mdi {
    font-size: 14px;
}

.authLinks a.is-disabled {
    color: var(--auth-text-muted);
    cursor: default;
    pointer-events: none;
}

.authLinks a.is-disabled:hover {
    text-decoration: none;
}

.authDivider {
    display: flex;
    align-items: center;
    gap: 12px;
    margin: 28px 0 0;
    color: var(--auth-text-muted);
    font-size: 13px;
}

.authDivider::before,
.authDivider::after {
    content: "";
    flex: 1;
    border-top: 1px solid var(--auth-border);
}

.sso {
    display: flex;
    flex-direction: column;
    gap: 8px;
    margin-top: 20px;
}

.sso a {
    display: flex;
    align-items: center;
    justify-content: center;
    gap: 8px;
    padding: 10px 14px;
    border: 1px solid var(--auth-border);
    border-radius: var(--auth-radius);
    color: var(--auth-text);
    text-decoration: none;
    font-size: 14px;
    font-weight: 500;
    transition: background 0.15s ease, border-color 0.15s ease;
}

.sso a:hover {
    background: var(--auth-bg);
    border-color: var(--auth-text-muted);
}

.sso a .mdi {
    font-size: 18px;
}

/* Ambiguous-email SSO account picker (Auth_SsoController::callbackAction()) -
   one button per linked account, each its own <form> posting the chosen
   userId to /auth/choose-account. */
.account-choices {
    list-style: none;
    margin: 0;
    padding: 0;
    display: flex;
    flex-direction: column;
    gap: 8px;
}

.account-choice {
    width: 100%;
    display: flex;
    align-items: center;
    justify-content: space-between;
    gap: 8px;
    padding: 10px 14px;
    border: 1px solid var(--auth-border);
    border-radius: var(--auth-radius);
    background: var(--auth-input-bg);
    color: var(--auth-text);
    font-size: 14px;
    cursor: pointer;
    transition: background 0.15s ease, border-color 0.15s ease;
}

.account-choice:hover {
    background: var(--auth-bg);
    border-color: var(--auth-primary);
}

.account-choice-name {
    font-weight: 600;
    text-align: left;
}

.account-choice-type {
    font-size: 12px;
    color: var(--auth-text-muted);
}