/*
 * Readocracy — sessionVersion 2 auth screens (sign in, code, MFA, enrolment,
 * recovery, recovery codes, step-up, sign out everywhere).
 * Loaded by templates/auth/shell.tpl for the plain Readocracy app.
 *
 * Self-contained on purpose. design.tpl loads style.css only when the visitor
 * is not Preauth, so it is present on the Guest steps (sign in, code, MFA,
 * enrolment, recovery) and absent on the signed-in ones (step-up, recovery
 * codes, sign out everywhere). Nothing here may depend on it, or those three
 * screens would render differently from the other five.
 *
 * Visual language follows the existing /login page: photo canvas, white card,
 * uppercase letterspaced labels, green CTA, green accent bar along the bottom.
 */

:root {
	--auth-green: #02db73;
	--auth-green-bright: #11ff82;
	--auth-green-deep: #01b95f;
	--auth-ink: #111111;
	--auth-ink-soft: #5f5f5f;
	--auth-ink-mute: #9e9c9c;
	--auth-line: #d8d8d8;
	--auth-field-bg: #e5e5e5;
	--auth-error: #c0392b;
	--auth-radius: 5px;
}

/* nav.css paints the body near-black and design.tpl still renders the site nav
   on these screens ($ttai is unset this early, so even TTAI gets the
   Readocracy one). The auth flow is a bare focused screen: drop the chrome. */
nav.main-nav,
nav.main-nav.ttai-navbar,
nav.main-nav-rwrdrc {
	display: none !important;
}

body.readocracy {
	background: #ffffff;
	padding: 0;
}

.auth-rc {
	position: relative;
	box-sizing: border-box;
	width: 100%;
	min-height: 100vh;
	padding: 16px 0 40px;
	/* Solid first so a missing/slow photo never leaves text on bare black. */
	background-color: #10201a;
	background-image: url("/img/onboard/onboard-bg-v1.jpg");
	background-repeat: no-repeat;
	background-position: center center;
	background-size: cover;
	font-family: proxima-nova, -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;
	-webkit-font-smoothing: antialiased;
}

/* The accent bar the login page carries along the bottom. */
.auth-rc::after {
	content: '';
	position: absolute;
	left: 0;
	bottom: 0;
	width: 100%;
	height: 12px;
	opacity: 0.8;
	background-color: var(--auth-green-bright);
}

.auth-rc .auth-logo {
	display: inline-block;
	margin: 16px 0 0 28px;
}

.auth-rc .auth-logo img {
	display: block;
	width: 40px;
	height: 35.4px;
}

.auth-rc .auth-wrap {
	margin: 60px 0 90px 10%;
	max-width: 420px;
}

.auth-rc .auth-card {
	box-sizing: border-box;
	background: #ffffff;
	border-radius: var(--auth-radius);
	padding: 40px 45px 45px;
	color: var(--auth-ink);
}

/* ---- Copy ---- */

.auth-rc .auth-title {
	margin: 0 0 16px;
	font-size: 24px;
	font-weight: 700;
	line-height: 1.25;
	color: var(--auth-ink);
}

.auth-rc .auth-lead {
	margin: 0 0 20px;
	font-size: 14px;
	line-height: 1.55;
	color: var(--auth-ink-soft);
}

.auth-rc .auth-lead strong {
	color: var(--auth-ink);
}

.auth-rc .auth-context {
	margin: 0 0 20px;
	padding: 12px 14px;
	border-left: 3px solid var(--auth-green);
	background: #f4fbf7;
	font-size: 14px;
	line-height: 1.5;
	color: var(--auth-ink);
}

/* Enrolment with no encryption key configured — a dead end, so it reads as one. */
.auth-rc .auth-notice {
	margin: 0 0 20px;
	padding: 12px 14px;
	border-radius: var(--auth-radius);
	background: #fdeceb;
	color: var(--auth-error);
	font-size: 14px;
	font-weight: 700;
	line-height: 1.5;
}

/* ---- Form ---- */

.auth-rc .auth-form {
	margin: 0;
	padding: 0;
}

.auth-rc .auth-field {
	margin-bottom: 18px;
}

.auth-rc .auth-field:last-child {
	margin-bottom: 0;
}

.auth-rc .auth-label {
	display: block;
	margin-bottom: 10px;
	font-size: 14px;
	font-weight: 700;
	letter-spacing: 3.5px;
	text-transform: uppercase;
	color: var(--auth-ink-mute);
}

.auth-rc .auth-input {
	box-sizing: border-box;
	width: 100%;
	padding: 10px 12px;
	border: 1px solid #979797;
	border-radius: 3px;
	background-color: var(--auth-field-bg);
	color: var(--auth-ink);
	font-family: inherit;
	font-size: 14px;
	font-weight: 700;
	transition: border-color 0.2s ease, background-color 0.2s ease;
}

.auth-rc .auth-input::placeholder {
	color: #b5b5b5;
	letter-spacing: normal;
}

.auth-rc .auth-input:focus {
	outline: none;
	border-color: var(--auth-green);
	background-color: #ffffff;
}

/* Six-digit codes — wide tracking so the digits are countable at a glance. */
.auth-rc .auth-code {
	font-size: 22px;
	letter-spacing: 8px;
	text-align: center;
	font-variant-numeric: tabular-nums;
}

/* Recovery codes are alphanumeric and get read off a page — monospace so 0/O
   and 1/l are distinguishable. */
.auth-rc .auth-mono {
	font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
	font-size: 16px;
	letter-spacing: 2px;
	text-align: center;
}

/* No error class reaches the input itself, so key off the message that
   follows it — an unsupported :has() simply leaves the border unchanged. */
.auth-rc .auth-input:has(+ .auth-error) {
	border-color: var(--auth-error);
}

.auth-rc .auth-error {
	display: block;
	margin-top: 6px;
	font-size: 13px;
	font-weight: 700;
	color: var(--auth-error);
}

.auth-rc .auth-check {
	display: flex;
	align-items: flex-start;
	gap: 10px;
	font-size: 13px;
	font-weight: 700;
	line-height: 1.45;
	color: var(--auth-ink-soft);
	cursor: pointer;
}

.auth-rc .auth-check input {
	flex: 0 0 auto;
	margin: 2px 0 0;
	accent-color: var(--auth-green);
}

.auth-rc .auth-submit {
	box-sizing: border-box;
	width: 100%;
	padding: 16px 20px;
	border: none;
	border-radius: var(--auth-radius);
	background: var(--auth-green);
	color: #ffffff;
	font-family: inherit;
	font-size: 20px;
	font-weight: 900;
	text-align: center;
	cursor: pointer;
	-webkit-appearance: none;
	transition: background-color 0.2s ease;
}

.auth-rc .auth-submit:hover {
	background: var(--auth-green-deep);
}

.auth-rc .auth-submit:focus-visible {
	outline: 3px solid rgba(2, 219, 115, 0.45);
	outline-offset: 2px;
}

/* Revoking every session is destructive and unrecoverable — it does not get
   the same green as "Sign in". */
.auth-rc .auth-submit-danger {
	background: var(--auth-error);
}

.auth-rc .auth-submit-danger:hover {
	background: #a3301f;
}

.auth-rc .auth-submit-danger:focus-visible {
	outline-color: rgba(192, 57, 43, 0.45);
}

/* ---- Secondary links ---- */

.auth-rc .auth-fine {
	display: flex;
	flex-direction: column;
	gap: 10px;
	align-items: flex-start;
	margin-top: 26px;
}

.auth-rc .auth-fine a,
.auth-rc .auth-fine a:link,
.auth-rc .auth-fine a:visited {
	padding-bottom: 2px;
	border-bottom: 2px solid #b7b7b7;
	color: #8f8f8f;
	font-size: 14px;
	font-weight: 700;
	text-decoration: none;
}

.auth-rc .auth-fine a:hover {
	border-color: var(--auth-green);
	color: var(--auth-ink);
}

/* ---- Enrolment: QR + manual key ---- */

/* config::renderQR() returns false in MWE core and Readocracy does not override
   it yet, so $qr is empty and this block does not render — the manual key below
   is the live path. Sized for whatever it returns (inline svg or a data-uri
   img), on white so a dark-module QR stays scannable in any theme. */
.auth-rc .auth-qr {
	display: flex;
	justify-content: center;
	margin: 0 0 20px;
	padding: 14px;
	border: 1px solid var(--auth-line);
	border-radius: var(--auth-radius);
	background: #ffffff;
}

.auth-rc .auth-qr img,
.auth-rc .auth-qr svg,
.auth-rc .auth-qr canvas {
	display: block;
	width: 180px;
	height: 180px;
	image-rendering: pixelated;
}

.auth-rc .auth-key {
	margin: 0 0 22px;
	padding: 14px 16px;
	border: 1px solid var(--auth-line);
	border-radius: var(--auth-radius);
	background: #fafafa;
}

.auth-rc .auth-key p {
	margin: 0 0 8px;
	font-size: 13px;
	line-height: 1.5;
	color: var(--auth-ink-soft);
}

.auth-rc .auth-key p:last-child {
	margin-bottom: 0;
}

.auth-rc .auth-key code {
	display: block;
	/* The shared secret is typed into another app by hand — let it wrap and be
	   selected rather than clipped. */
	word-break: break-all;
	font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
	font-size: 15px;
	font-weight: 700;
	letter-spacing: 1px;
	color: var(--auth-ink);
	-webkit-user-select: all;
	user-select: all;
}

.auth-rc .auth-key-account {
	font-size: 12px;
	color: var(--auth-ink-mute);
}

/* ---- Recovery codes ---- */

.auth-rc .auth-codes {
	display: grid;
	grid-template-columns: repeat(2, minmax(0, 1fr));
	gap: 8px;
	margin: 0 0 24px;
	padding: 14px;
	list-style: none;
	border: 1px solid var(--auth-line);
	border-radius: var(--auth-radius);
	background: #fafafa;
}

.auth-rc .auth-codes code {
	display: block;
	font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
	font-size: 15px;
	font-weight: 700;
	letter-spacing: 1px;
	color: var(--auth-ink);
	-webkit-user-select: all;
	user-select: all;
}

/* ---- Narrow ---- */

@media screen and (max-width: 875px) {
	.auth-rc .auth-wrap {
		margin: 32px auto 60px;
		padding: 0 16px;
		max-width: 100%;
	}

	.auth-rc .auth-logo {
		margin-left: 16px;
	}

	.auth-rc .auth-card {
		padding: 28px 22px 32px;
	}

	.auth-rc .auth-title {
		font-size: 21px;
	}

	.auth-rc .auth-codes {
		grid-template-columns: 1fr;
	}
}