/* Styling for the SSO auth-server UI (login, register, password reset, TOTP;
   peep/authentication/templates/authentication/*), in two layers:

   (1) LAYOUT -- applied to every auth page, including the login|register
       side-by-side columns the storefronts use.
   (2) NEUTRAL SKIN -- card, inputs, buttons, links. Applied ONLY when the RP's
       own brand sheet does not fully style the login. Storefronts whose sheet
       owns the login look (LOGIN_BRANDING own_login_skin=True: mct, mcc) render
       <main class="own-skin">, which turns the neutral skin OFF so their sheet
       reproduces the exact storefront login (fonts, inputs, transparent-border
       buttons, colors). RPs that ship only tokens/a logo (e.g. dfx) and the
       unbranded reset/TOTP pages keep the neutral skin.

   Lives in the `authentication` app (NOT sso/static/) so it travels with the
   templates that use it. Referenced from authentication/base.html. */

:root {
  --auth-bg: #f4f5f7;
  --auth-card: #ffffff;
  --auth-border: #d0d4da;
  --auth-text: #1f2328;
  --auth-muted: #59636e;
  --auth-accent: #2f5bd0;
  --auth-accent-hover: #23479f;
  --auth-hot: #b8690a;
  --auth-hot-hover: #955508;
  --auth-error: #c23a1c;
}

*,
*::before,
*::after {
  box-sizing: border-box;
}

/* Neutral baseline; a brand sheet (loaded after) overrides body for own-skin RPs. */
body {
  margin: 0;
  font-family: system-ui, -apple-system, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
  background: var(--auth-bg);
  color: var(--auth-text);
  line-height: 1.5;
}

/* ------------------------------------------------------------------ layout */

main.auth-server {
  /* Wide enough for two side-by-side columns (login | register); text-align
     centers the inline-block columns and the brand mark as a group. */
  max-width: 52rem;
  margin: 3rem auto;
  padding: 0 1rem;
  text-align: center;
}

.auth-brand-logo {
  text-align: center;
}

.auth-brand-logo img {
  max-height: 44px;
  width: auto;
}

/* Login|register side-by-side, globally: the storefronts lay these two
   containers out as inline-block fixed-width columns, so mirror that here. A
   single-container page (password reset, TOTP, standalone register) just
   centers one column; two wrap to stacked when the viewport can't fit them. */
.login-register-form-container {
  display: inline-block;
  vertical-align: top;
  text-align: left;
  width: min(22rem, 100%);
  margin: 0 0.75rem 1.5rem;
}

/* own-skin storefront sheets margin these containers for a full-width header
   page (e.g. mct.css uses margin-left:100px), too wide to fit two centered
   columns and forcing a wrap. Neutralize to a symmetric gutter -- higher
   specificity (main.auth-server.own-skin + class) than the sheet's single-class
   rule, so it wins regardless of load order; the sheet keeps its column width. */
main.auth-server.own-skin .login-register-form-container {
  margin: 0 0.75rem 1.5rem;
}

.login-register-button-container {
  margin-top: 0.25rem;
}

/* ------------------------------------------------------ neutral skin only */

main.auth-server:not(.own-skin) .login-register-form-container {
  background: var(--auth-card);
  border: 1px solid var(--auth-border);
  border-radius: 8px;
  padding: 1.5rem;
}

main.auth-server:not(.own-skin) .login-register-form-container h2 {
  margin: 0 0 1rem;
  font-size: 1.25rem;
}

main.auth-server:not(.own-skin) .login-register-form {
  display: flex;
  flex-direction: column;
  gap: 0.75rem;
}

main.auth-server:not(.own-skin) .login-register-form input[type="text"],
main.auth-server:not(.own-skin) .login-register-form input[type="email"],
main.auth-server:not(.own-skin) .login-register-form input[type="password"] {
  width: 100%;
  padding: 0.55rem 0.7rem;
  border: 1px solid var(--auth-border);
  border-radius: 6px;
  font-size: 1rem;
  color: var(--auth-text);
  background: #fff;
}

main.auth-server:not(.own-skin) .login-register-form input:focus-visible {
  outline: 2px solid var(--auth-accent);
  outline-offset: 1px;
  border-color: var(--auth-accent);
}

/* .nope flags an error: a red border on inputs, red text on messages. */
main.auth-server:not(.own-skin) input.nope {
  border-color: var(--auth-error);
}

main.auth-server:not(.own-skin) p.nope {
  margin: 0;
  color: var(--auth-error);
  font-weight: 600;
}

main.auth-server:not(.own-skin) .button,
main.auth-server:not(.own-skin) button.login-register-button {
  display: inline-block;
  padding: 0.6rem 1.25rem;
  border: none;
  border-radius: 6px;
  background: var(--auth-accent);
  color: #fff;
  font-size: 1rem;
  font-weight: 600;
  cursor: pointer;
  text-decoration: none;
}

main.auth-server:not(.own-skin) .button:hover,
main.auth-server:not(.own-skin) button.login-register-button:hover {
  background: var(--auth-accent-hover);
}

/* "hot" = emphasised action (matches the storefronts' hot-button convention). */
main.auth-server:not(.own-skin) .button.hot-button,
main.auth-server:not(.own-skin) button.login-register-button.hot-button {
  background: var(--auth-hot);
}

main.auth-server:not(.own-skin) .button.hot-button:hover,
main.auth-server:not(.own-skin) button.login-register-button.hot-button:hover {
  background: var(--auth-hot-hover);
}

/* Text links, but not anchors styled as buttons (e.g. the blocked-page Cancel). */
main.auth-server:not(.own-skin) a:not(.button) {
  color: var(--auth-accent);
}

main.auth-server:not(.own-skin) a:not(.button):hover {
  color: var(--auth-accent-hover);
}

main.auth-server:not(.own-skin) label {
  color: var(--auth-muted);
}