/* ==================================================== next-pim login theme
 *
 * The stylesheet for every page Keycloak shows a person: sign-in, the password
 * prompts, OTP, the error and info pages. There is one card on a soft page, and
 * it is built out of the same four decisions the app's panels are: --bg on
 * --bg-soft, a --line edge, --r-lg, --shadow-md.
 *
 * tokens.css is not a copy — it is `src/ui/tokens.css`, the app's own token
 * file, bind-mounted into this directory by `pnpm kc:up`. A second copy would
 * be a second source of truth, and the day someone turned --brand-h the login
 * page is the one surface that would quietly keep the old blue.
 *
 * Theme: the app's theme is a cookie on the app's origin, and Keycloak is a
 * different origin — it cannot read it, and there is no honest way to. So this
 * page follows the OS, which is what the app's own default (`auto`) does too.
 * Everything themed is a light-dark() token, so that costs nothing here.
 *
 * The class names come from theme.properties, which maps Keycloak's kc*
 * properties onto them. Base's templates carry no other classes, so this file
 * plus that mapping is the whole design.
 */

@import 'tokens.css';

* {
  box-sizing: border-box;
}

html.login {
  -webkit-text-size-adjust: 100%;
}

body.login {
  margin: 0;
  min-height: 100vh;
  display: flex;
  align-items: center;
  justify-content: center;
  padding: var(--s-6) var(--s-4);
  color: var(--fg);
  background: var(--bg-soft);
  font: var(--t-base) / 1.5 var(--font-ui);
}

a {
  color: var(--accent);
  text-decoration: none;
}
a:hover {
  text-decoration: underline;
}

/* Same focus contract as the app, for the same reasons, from the same tokens —
   see the focus block in tokens.css, which this page shares. This page had the
   app's OLD split: a hard accent outline for everything, a halo for the fields.
   The login screen is the first page of the app, so it is the app; it cannot
   indicate focus a different way than the page it hands you to.

   No `border-radius` here (it squared off every pill it touched while focused),
   and the outline is kept-but-transparent so forced-colors still has one. */
:focus-visible {
  outline: 2px solid transparent;
  outline-offset: 2px;
  box-shadow: var(--focus-ring);
}

/* -------------------------------------------------------------- the column */

.login-page {
  width: 100%;
  max-width: 26rem;
  display: flex;
  flex-direction: column;
  gap: var(--s-5);
}

/* ------------------------------------------------------------------- brand */

/* The app's header brand, minus the header: the accent dot and the wordmark.
   The text is the realm's displayName, so it is Keycloak's to say, not this
   file's — a CSS ::content wordmark would be a logo a screen reader cannot
   read and a translator cannot reach. */
.login-brand {
  display: flex;
  justify-content: center;
}
.login-brand .brand {
  display: flex;
  align-items: center;
  gap: var(--s-2);
  font-weight: 700;
  font-size: var(--t-lg);
  color: var(--fg);
}
.login-brand .brand::before {
  content: '';
  width: 0.6rem;
  height: 0.6rem;
  border-radius: var(--r-full);
  background: var(--accent);
  flex: none;
}
/* An unset displayNameHtml would leave a bare dot floating over the card. */
.login-brand .brand:empty {
  display: none;
}

/* -------------------------------------------------------------------- card */

.card {
  background: var(--bg);
  border: 1px solid var(--line);
  border-radius: var(--r-lg);
  box-shadow: var(--shadow-md);
  padding: var(--s-6);
}

.card-head {
  display: flex;
  flex-direction: column;
  gap: var(--s-2);
  margin-bottom: var(--s-5);
}
#kc-page-title {
  margin: 0;
  font-size: var(--t-xl);
  font-weight: 700;
  line-height: 1.25;
}

/* The username Keycloak is re-prompting for ("not you?"), on the second step of
   a flow. A fact about the attempt, so: muted, small, and out of the title. */
#kc-username {
  display: flex;
  align-items: center;
  gap: var(--s-2);
  font-size: var(--t-sm);
  color: var(--muted);
}
#kc-username label {
  margin: 0;
  font-weight: 600;
  color: var(--fg);
}
#kc-username a {
  font-size: var(--t-sm);
}
.kc-login-tooltip {
  display: flex;
  align-items: center;
}
.kc-tooltip-text {
  display: none;
}

/* ------------------------------------------------------ locale switch */

/* Same control as the app's .langs, rebuilt on Keycloak's markup: a button and
   a menu rather than a row of links, because the set can be long. */
.langs {
  display: flex;
  justify-content: flex-end;
  order: -1;
}
.langs-menu {
  position: relative;
}
#kc-current-locale-link {
  font: inherit;
  font-size: var(--t-sm);
  font-weight: 500;
  padding: var(--s-1) var(--s-2);
  border: 1px solid transparent;
  border-radius: var(--r-sm);
  background: transparent;
  color: var(--muted);
  cursor: pointer;
}
#kc-current-locale-link:hover {
  background: var(--bg-soft);
  color: var(--fg);
}
#kc-current-locale-link[aria-expanded='true'] {
  background: var(--accent-soft);
  color: var(--accent);
}
/* The closed state is the theme's to declare: menu-button-links.js opens the
   menu with an inline `display: block` and closes it by removing that property
   again — so a list with no `display: none` of its own is a list that is always
   open, sitting on top of the page title. */
.langs-list {
  display: none;
  position: absolute;
  right: 0;
  top: calc(100% + var(--s-1));
  z-index: var(--z-overlay);
  margin: 0;
  padding: var(--s-1);
  min-width: 8rem;
  list-style: none;
  background: var(--bg);
  border: 1px solid var(--line);
  border-radius: var(--r-sm);
  box-shadow: var(--shadow-lg);
}
.langs-link {
  display: block;
  padding: var(--s-1) var(--s-2);
  border-radius: var(--r-xs);
  color: var(--fg);
  font-size: var(--t-sm);
}
.langs-link:hover {
  text-decoration: none;
  background: var(--bg-soft);
}

/* ------------------------------------------------------------------ fields */

.field {
  margin: 0 0 var(--s-4);
}
.label,
.field > label {
  display: block;
  font-weight: 600;
  font-size: var(--t-md);
  margin-bottom: var(--s-1);
}
.required {
  color: var(--danger);
}

.input,
input[type='text'],
input[type='email'],
input[type='password'],
input[type='number'],
select,
textarea {
  font: inherit;
  /* Same reason as the app's control rule: `font: inherit` gives an input the
     body's line-height and a select `normal`, so the two disagree on height. */
  line-height: 1.5;
  width: 100%;
  padding: var(--s-2) var(--s-3);
  /* --line is a seam between surfaces; a control's edge has to clear 3:1. This
     theme mounts the app's tokens.css (see `kc:up`), so it gets the same token
     the app uses — the first field anyone touches should not be the faintest.
     The fallback matters here and nowhere else: this file and that tokens.css
     are mounted separately and can be a version apart, and a bare var() the
     mounted file has never heard of would drop the whole declaration and leave
     the login fields with no border at all. */
  border: 1px solid var(--line-control, var(--line));
  border-radius: var(--r-sm);
  background: var(--bg);
  color: var(--fg);
}
input:focus-visible,
select:focus-visible,
textarea:focus-visible {
  outline: 2px solid transparent;
  outline-offset: 2px;
  border-color: var(--accent);
  box-shadow: var(--focus);
}
/* aria-invalid is the field's own statement about itself — better to colour
   from it than to hang a class on the element from the template. */
input[aria-invalid='true'] {
  border-color: var(--danger);
}
input[aria-invalid='true']:focus-visible {
  box-shadow: var(--focus-danger);
}

.input-error {
  display: block;
  margin-top: var(--s-1);
  font-size: var(--t-sm);
  color: var(--danger);
}
.helper {
  margin-top: var(--s-1);
  font-size: var(--t-sm);
  color: var(--muted);
}
.helper-item.err .helper-text {
  color: var(--danger);
}

/* The password field and its reveal button are one control, so they share one
   border and one focus ring rather than sitting in two boxes side by side. */
.input-group {
  display: flex;
  align-items: stretch;
  border: 1px solid var(--line);
  border-radius: var(--r-sm);
  background: var(--bg);
}
.input-group:focus-within {
  border-color: var(--accent);
  box-shadow: var(--focus);
}
.input-group .input {
  border: none;
  background: transparent;
  border-radius: var(--r-sm);
}
.input-group .input:focus-visible {
  box-shadow: none;
}
.input-group:has(input[aria-invalid='true']) {
  border-color: var(--danger);
}
.btn.reveal {
  flex: none;
  padding: 0 var(--s-3);
  border: none;
  background: transparent;
  color: var(--muted);
}
.btn.reveal:hover {
  background: transparent;
  color: var(--fg);
  filter: none;
}

/* --------------------------------------------------------- options & links */

.form-setting {
  display: flex;
  align-items: center;
  justify-content: space-between;
  gap: var(--s-3);
}
.form-setting .field,
.form-setting {
  margin-bottom: var(--s-5);
}
#kc-form-options {
  font-size: var(--t-sm);
}
.form-options-side {
  font-size: var(--t-sm);
}

.checkbox label,
.check {
  display: flex;
  gap: var(--s-2);
  align-items: center;
  cursor: pointer;
  font-size: var(--t-sm);
  margin: 0;
  font-weight: 400;
}
.checkbox input[type='checkbox'],
.check-box {
  width: 1rem;
  height: 1rem;
  accent-color: var(--accent);
  flex: none;
}

/* ----------------------------------------------------------------- buttons */

.btn {
  font: inherit;
  font-weight: 500;
  padding: var(--s-2) var(--s-4);
  border: 1px solid var(--accent);
  border-radius: var(--r-sm);
  background: var(--accent);
  color: var(--accent-fg);
  cursor: pointer;
  text-align: center;
}
.btn:hover {
  filter: brightness(1.08);
  text-decoration: none;
}
.btn:disabled,
.btn.disabled,
.btn[aria-disabled='true'] {
  opacity: 0.5;
  cursor: not-allowed;
  filter: none;
}
.btn.secondary {
  background: var(--bg);
  color: var(--fg);
  border-color: var(--line);
}
.btn.secondary:hover {
  background: var(--bg-soft);
  filter: none;
}
.btn.ghost {
  background: transparent;
  border-color: transparent;
  color: var(--muted);
}
.btn.ghost:hover {
  background: var(--bg-soft);
  color: var(--fg);
  filter: none;
}
.btn.block {
  display: block;
  width: 100%;
}
.btn.large {
  padding: var(--s-3) var(--s-4);
}

#kc-form-buttons {
  margin: 0;
}
.form-actions {
  display: flex;
  gap: var(--s-2);
  margin-top: var(--s-5);
}
.form-actions .btn {
  flex: 1;
}

/* ------------------------------------------------------------- the message */

/* The app's Banner: a tinted field with an edge of the same hue, and the icon
   in the tone's own colour. Keycloak names the tone twice — `alert-${type}` and
   a PatternFly `pf-m-*` modifier — and we answer to the first. */
.banner {
  display: flex;
  align-items: flex-start;
  gap: var(--s-2);
  padding: var(--s-3);
  margin: 0 0 var(--s-5);
  border: 1px solid var(--line);
  border-radius: var(--r-md);
  background: var(--bg-soft);
  font-size: var(--t-md);
}
.banner .icon {
  margin-top: var(--s-05);
  flex: none;
} /* optical: the icon to the first line, not the box */
.banner-text {
  font-weight: 500;
}
.banner-desc {
  color: var(--muted);
}

.alert-error,
.banner.err {
  background: var(--danger-soft);
  border-color: var(--danger-line);
  color: var(--danger);
}
.alert-warning,
.banner.warn {
  background: var(--warn-soft);
  border-color: var(--warn-line);
  color: var(--warn);
}
.alert-success {
  background: var(--ok-soft);
  border-color: var(--ok-line);
  color: var(--ok);
}
.alert-info {
  background: var(--accent-soft);
  border-color: var(--accent-line);
  color: var(--accent);
}

/* ------------------------------------------------------------------- lists */

/* select-authenticator and the OTP chooser: a list of choices, each a row that
   behaves like the app's pager links do — accent edge on hover, nothing else. */
.auth-list {
  list-style: none;
  margin: 0;
  padding: 0;
  display: flex;
  flex-direction: column;
  gap: var(--s-2);
}
.auth-item,
.auth-item-wrap {
  display: flex;
  align-items: center;
  gap: var(--s-3);
  padding: var(--s-3);
  border: 1px solid var(--line);
  border-radius: var(--r-md);
  background: var(--bg);
}
.auth-item-wrap:hover,
.auth-item:hover {
  border-color: var(--accent);
}
.auth-item-title {
  font-weight: 600;
}
.auth-item-desc {
  color: var(--muted);
  font-size: var(--t-sm);
}
.auth-item.selected {
  border-color: var(--accent);
  background: var(--accent-soft);
}

.panel {
  padding: var(--s-4);
  border: 1px solid var(--line);
  border-radius: var(--r-md);
  background: var(--bg-soft);
}
kbd,
code,
.copy-content {
  font: var(--t-sm) / 1.5 var(--font-mono);
  background: var(--bg-inset);
  border-radius: var(--r-xs);
  padding: var(--s-05) var(--s-1-5); /* the app's kbd inset, not a fourth one */
}

/* -------------------------------------------------------------------- info */

/* "No account yet?" and the like: below the form, quiet, separated by the rule
   the card already implies rather than by a border of its own. */
.info,
#kc-info {
  margin-top: var(--s-5);
  padding-top: var(--s-4);
  border-top: 1px solid var(--line);
  font-size: var(--t-sm);
  color: var(--muted);
  text-align: center;
}
#kc-select-try-another-way-form {
  margin-top: var(--s-4);
  text-align: center;
  font-size: var(--t-sm);
}

.social {
  margin-top: var(--s-5);
}
.social hr {
  border: none;
  border-top: 1px solid var(--line);
  margin: 0 0 var(--s-4);
}
.social h2 {
  font-size: var(--t-md);
  font-weight: 600;
  color: var(--muted);
  margin: 0 0 var(--s-3);
}
.social-list {
  list-style: none;
  margin: 0;
  padding: 0;
  display: flex;
  flex-direction: column;
  gap: var(--s-2);
}
.social-grid {
  display: grid;
  grid-template-columns: 1fr 1fr;
  gap: var(--s-2);
}

/* ------------------------------------------------------------------- icons */

/* Every icon is one mask over currentColor, so an icon in a danger banner is
   danger-coloured for the same reason its text is, and there is no icon font to
   load, fail, and leave a row of tofu behind. */
.icon {
  display: inline-block;
  width: 1em;
  height: 1em;
  background: currentColor;
  -webkit-mask: var(--icon) center / contain no-repeat;
  mask: var(--icon) center / contain no-repeat;
  vertical-align: -0.125em;
}
.icon-eye {
  --icon: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24' fill='none' stroke='%23000' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Cpath d='M2 12s3.5-7 10-7 10 7 10 7-3.5 7-10 7-10-7-10-7Z'/%3E%3Ccircle cx='12' cy='12' r='3'/%3E%3C/svg%3E");
}
.icon-eye-off {
  --icon: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24' fill='none' stroke='%23000' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Cpath d='M10.6 6.2A9.9 9.9 0 0 1 12 5c6.5 0 10 7 10 7a15.3 15.3 0 0 1-3.4 4.3M6.6 6.6A15.4 15.4 0 0 0 2 12s3.5 7 10 7a9.7 9.7 0 0 0 4.9-1.3'/%3E%3Cpath d='M9.9 9.9a3 3 0 0 0 4.2 4.2'/%3E%3Cpath d='m2 2 20 20'/%3E%3C/svg%3E");
}
.icon-err {
  --icon: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24' fill='none' stroke='%23000' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Ccircle cx='12' cy='12' r='10'/%3E%3Cpath d='M12 8v5M12 16h.01'/%3E%3C/svg%3E");
}
.icon-warn {
  --icon: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24' fill='none' stroke='%23000' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Cpath d='M10.3 3.9 1.8 18a2 2 0 0 0 1.7 3h17a2 2 0 0 0 1.7-3L13.7 3.9a2 2 0 0 0-3.4 0Z'/%3E%3Cpath d='M12 9v4M12 17h.01'/%3E%3C/svg%3E");
}
.icon-ok {
  --icon: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24' fill='none' stroke='%23000' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Cpath d='M22 11.1V12a10 10 0 1 1-5.9-9.1'/%3E%3Cpath d='m9 11 3 3L22 4'/%3E%3C/svg%3E");
}
.icon-info {
  --icon: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24' fill='none' stroke='%23000' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Ccircle cx='12' cy='12' r='10'/%3E%3Cpath d='M12 16v-4M12 8h.01'/%3E%3C/svg%3E");
}
.icon-restart {
  --icon: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24' fill='none' stroke='%23000' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Cpath d='M3 12a9 9 0 1 0 3-6.7L3 8'/%3E%3Cpath d='M3 3v5h5'/%3E%3C/svg%3E");
}
.icon-key {
  --icon: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24' fill='none' stroke='%23000' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Ccircle cx='7.5' cy='15.5' r='4.5'/%3E%3Cpath d='m10.7 12.3 8.8-8.8M17 6l3 3'/%3E%3C/svg%3E");
}
.icon-copy {
  --icon: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24' fill='none' stroke='%23000' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Crect x='9' y='9' width='12' height='12' rx='2'/%3E%3Cpath d='M5 15H4a2 2 0 0 1-2-2V4a2 2 0 0 1 2-2h9a2 2 0 0 1 2 2v1'/%3E%3C/svg%3E");
}
.icon-right {
  --icon: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24' fill='none' stroke='%23000' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Cpath d='m9 18 6-6-6-6'/%3E%3C/svg%3E");
}
.icon-down {
  --icon: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24' fill='none' stroke='%23000' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Cpath d='m6 9 6 6 6-6'/%3E%3C/svg%3E");
}

/* ------------------------------------------------------------------ footer */

/* The app's footer says its own name quietly and links the API. Here there is
   no API to link and no theme to toggle — only the reassurance that this page
   belongs to the thing you were trying to open. */
.card-foot {
  margin-top: var(--s-5);
  font-size: var(--t-sm);
  color: var(--muted);
  text-align: center;
}
.muted {
  color: var(--muted);
}