/*
  Sign-in flow (Pages/Shared/_AuthLayout.cshtml): login, 2FA, recovery code, forgot/reset password,
  locked out, log out, confirm e-mail, create account, redirect and error pages.
  Plain CSS on purpose: no Bootstrap, no build step. Brand colours from the Kentaurus look:
  teal #007E93, light teal #61C3D7, dark #09181C / #102A31.
*/

:root {
    --auth-bg: #f2f6f7;
    --auth-glow: rgba(97, 195, 215, 0.24);
    --auth-surface: #ffffff;
    --auth-border: #dde7ea;
    --auth-input-border: #7c949a;
    --auth-text: #0b2025;
    --auth-muted: #4a6168;
    --auth-placeholder: #9fb2b7;
    --auth-primary: #007e93;
    --auth-primary-hover: #00687a;
    --auth-on-primary: #ffffff;
    --auth-link: #00687a;
    --auth-focus: rgba(0, 126, 147, 0.32);
    --auth-icon-bg: #e2f3f6;
    --auth-error: #b42318;
    --auth-error-bg: #fef3f2;
    --auth-error-border: #fecdca;
    --auth-error-focus: rgba(180, 35, 24, 0.22);
    --auth-shadow: 0 1px 2px rgba(11, 32, 37, 0.05), 0 16px 40px -12px rgba(11, 32, 37, 0.16);
    --auth-font: "Segoe UI Variable Text", "Segoe UI", system-ui, -apple-system, BlinkMacSystemFont, "Helvetica Neue", Arial, sans-serif;
    --auth-mono: ui-monospace, "Cascadia Mono", "SF Mono", Menlo, Consolas, monospace;
}

@media (prefers-color-scheme: dark) {
    :root {
        --auth-bg: #09181c;
        --auth-glow: rgba(0, 126, 147, 0.3);
        --auth-surface: #102a31;
        --auth-border: #1e3c44;
        --auth-input-border: #5a8590;
        --auth-text: #ffffff;
        --auth-muted: #a9c9d0;
        --auth-placeholder: #5f8189;
        --auth-primary: #61c3d7;
        --auth-primary-hover: #8ad4e3;
        --auth-on-primary: #09181c;
        --auth-link: #61c3d7;
        --auth-focus: rgba(97, 195, 215, 0.4);
        --auth-icon-bg: #17343b;
        --auth-error: #fda29b;
        --auth-error-bg: rgba(240, 68, 56, 0.12);
        --auth-error-border: rgba(253, 162, 155, 0.35);
        --auth-error-focus: rgba(253, 162, 155, 0.3);
        --auth-shadow: 0 1px 2px rgba(0, 0, 0, 0.3), 0 20px 48px -16px rgba(0, 0, 0, 0.6);
    }
}

*,
*::before,
*::after {
    box-sizing: border-box;
}

html {
    -webkit-text-size-adjust: 100%;
}

.auth-body {
    margin: 0;
    min-height: 100vh;
    min-height: 100dvh;
    display: flex;
    flex-direction: column;
    font-family: var(--auth-font);
    font-size: 16px;
    line-height: 1.5;
    color: var(--auth-text);
    background:
        radial-gradient(1100px 560px at 50% -12%, var(--auth-glow), transparent 70%),
        var(--auth-bg);
    -webkit-font-smoothing: antialiased;
}

.auth-shell {
    flex: 1;
    display: flex;
    flex-direction: column;
    align-items: center;
    justify-content: center;
    gap: 24px;
    padding: 48px 16px 24px;
}

/* Brand */

.auth-brand {
    display: flex;
    align-items: center;
    gap: 10px;
    font-size: 1.125rem;
    font-weight: 600;
    letter-spacing: -0.01em;
}

.auth-brand img {
    display: block;
    width: 32px;
    height: 30px;
}

/* Card */

.auth-card {
    width: 100%;
    max-width: 420px;
    padding: 40px 36px 28px;
    background: var(--auth-surface);
    border: 1px solid var(--auth-border);
    border-radius: 20px;
    box-shadow: var(--auth-shadow);
}

.auth-icon {
    display: grid;
    place-items: center;
    width: 56px;
    height: 56px;
    margin: 0 auto 20px;
    border-radius: 16px;
    background: var(--auth-icon-bg);
    color: var(--auth-primary);
}

.auth-icon svg {
    width: 28px;
    height: 28px;
}

.auth-title {
    margin: 0 0 8px;
    text-align: center;
    font-size: 1.5rem;
    line-height: 1.25;
    font-weight: 650;
    letter-spacing: -0.02em;
    text-wrap: balance;
}

.auth-lead {
    margin: 0 0 28px;
    text-align: center;
    font-size: 0.9375rem;
    color: var(--auth-muted);
    text-wrap: balance;
}

/* Form */

.auth-form {
    display: flex;
    flex-direction: column;
    gap: 20px;
}

.auth-field {
    display: flex;
    flex-direction: column;
    gap: 8px;
}

.auth-label {
    font-size: 0.875rem;
    font-weight: 600;
}

/* Label with a link on the right ("Forgot password?"). */
.auth-label-row {
    display: flex;
    flex-wrap: wrap;
    align-items: baseline;
    justify-content: space-between;
    gap: 4px 12px;
}

.auth-card a.auth-label-link {
    font-size: 0.875rem;
}

.auth-input {
    width: 100%;
    height: 48px;
    padding: 0 14px;
    font: inherit;
    color: var(--auth-text);
    background: var(--auth-surface);
    border: 1.5px solid var(--auth-input-border);
    border-radius: 12px;
    transition: border-color 0.15s ease, box-shadow 0.15s ease;
}

.auth-input::placeholder {
    color: var(--auth-placeholder);
    opacity: 1;
}

.auth-input:focus {
    outline: none;
    border-color: var(--auth-primary);
    box-shadow: 0 0 0 4px var(--auth-focus);
}

.auth-input[aria-invalid="true"] {
    border-color: var(--auth-error);
}

.auth-input[aria-invalid="true"]:focus {
    box-shadow: 0 0 0 4px var(--auth-error-focus);
}

/* The 6 digits: big, evenly spaced, centred. The left padding offsets the letter-spacing after the last digit. */
.auth-input--code {
    height: 64px;
    padding: 0 14px 0 calc(14px + 0.32em);
    text-align: center;
    font-family: var(--auth-mono);
    font-size: 1.75rem;
    font-weight: 600;
    font-variant-numeric: tabular-nums;
    letter-spacing: 0.32em;
}

.auth-input--recovery {
    font-family: var(--auth-mono);
    letter-spacing: 0.04em;
}

/* Password with a show/hide button inside the field (auth.js). */
.auth-password {
    position: relative;
}

.auth-password .auth-input {
    padding-right: 52px;
}

/* Edge/IE draw their own eye; ours is the same on every browser. */
.auth-password input::-ms-reveal,
.auth-password input::-ms-clear {
    display: none;
}

.auth-reveal {
    position: absolute;
    top: 4px;
    right: 4px;
    display: grid;
    place-items: center;
    width: 40px;
    height: 40px;
    padding: 0;
    color: var(--auth-muted);
    background: transparent;
    border: 0;
    border-radius: 9px;
    cursor: pointer;
}

.auth-reveal:hover {
    color: var(--auth-text);
    background: var(--auth-icon-bg);
}

.auth-reveal:focus-visible {
    outline: 2px solid var(--auth-primary);
    outline-offset: -2px;
}

.auth-reveal svg {
    width: 20px;
    height: 20px;
}

.auth-reveal .auth-reveal-hide,
.auth-reveal[aria-pressed="true"] .auth-reveal-show {
    display: none;
}

.auth-reveal[aria-pressed="true"] .auth-reveal-hide {
    display: block;
}

[hidden] {
    display: none !important;
}

.auth-error {
    display: flex;
    align-items: flex-start;
    gap: 8px;
    margin: 0;
    padding: 10px 12px;
    font-size: 0.875rem;
    font-weight: 500;
    color: var(--auth-error);
    background: var(--auth-error-bg);
    border: 1px solid var(--auth-error-border);
    border-radius: 10px;
}

.auth-error svg {
    flex: none;
    width: 18px;
    height: 18px;
    margin-top: 1px;
}

/* An error for the whole form (wrong user name or password), above the fields. */
.auth-error--form {
    margin-bottom: 20px;
}

/* Calm notice (e.g. "you are signed out"). */
.auth-note {
    margin: 0 0 20px;
    padding: 12px 14px;
    font-size: 0.875rem;
    color: var(--auth-muted);
    background: var(--auth-icon-bg);
    border-radius: 10px;
}

.auth-icon--error {
    color: var(--auth-error);
    background: var(--auth-error-bg);
}

/* Remember device */

.auth-check {
    display: flex;
    align-items: flex-start;
    gap: 12px;
    cursor: pointer;
}

.auth-check input {
    flex: none;
    width: 20px;
    height: 20px;
    margin: 1px 0 0;
    accent-color: var(--auth-primary);
    cursor: pointer;
}

.auth-check input:focus-visible {
    outline: 2px solid var(--auth-primary);
    outline-offset: 2px;
}

.auth-check-text {
    display: flex;
    flex-direction: column;
    gap: 2px;
    font-size: 0.9375rem;
}

.auth-hint {
    font-size: 0.8125rem;
    color: var(--auth-muted);
}

/* Primary button */

.auth-button {
    display: inline-flex;
    align-items: center;
    justify-content: center;
    gap: 10px;
    width: 100%;
    height: 48px;
    padding: 0 20px;
    font: inherit;
    font-size: 1rem;
    font-weight: 600;
    color: var(--auth-on-primary);
    background: var(--auth-primary);
    border: 0;
    border-radius: 12px;
    cursor: pointer;
    transition: background-color 0.15s ease, box-shadow 0.15s ease, transform 0.05s ease;
}

.auth-button:hover {
    background: var(--auth-primary-hover);
}

.auth-button:active {
    transform: translateY(1px);
}

.auth-button:focus-visible {
    outline: none;
    box-shadow: 0 0 0 4px var(--auth-focus);
}

/* Set by auth.js while the form posts. */
.auth-button[aria-busy="true"] {
    cursor: progress;
}

.auth-button[aria-busy="true"]::before {
    content: "";
    width: 16px;
    height: 16px;
    border: 2px solid currentColor;
    border-right-color: transparent;
    border-radius: 50%;
    animation: auth-spin 0.7s linear infinite;
}

@keyframes auth-spin {
    to {
        transform: rotate(360deg);
    }
}

/* A link that looks like a button (e.g. "Go to Mit Kentaurus"). */
.auth-card a.auth-button {
    color: var(--auth-on-primary);
    text-decoration: none;
}

.auth-button--secondary,
.auth-card a.auth-button--secondary {
    color: var(--auth-text);
    background: var(--auth-surface);
    border: 1.5px solid var(--auth-input-border);
}

.auth-button--secondary:hover,
.auth-card a.auth-button--secondary:hover {
    background: var(--auth-icon-bg);
}

/* A button that looks like a link (e.g. "Sign in as someone else"). */
.auth-link-button {
    padding: 0;
    font: inherit;
    font-weight: 600;
    color: var(--auth-link);
    background: none;
    border: 0;
    text-decoration: underline;
    text-decoration-thickness: 1px;
    text-underline-offset: 3px;
    cursor: pointer;
}

.auth-link-button:hover {
    text-decoration-thickness: 2px;
}

.auth-link-button:focus-visible {
    outline: 2px solid var(--auth-primary);
    outline-offset: 2px;
    border-radius: 4px;
}

.auth-actions {
    display: flex;
    flex-direction: column;
    gap: 12px;
}

/* "or" between the password form and external sign-in. */
.auth-divider {
    display: flex;
    align-items: center;
    gap: 12px;
    margin: 24px 0;
    font-size: 0.8125rem;
    color: var(--auth-muted);
}

.auth-divider::before,
.auth-divider::after {
    content: "";
    flex: 1;
    height: 1px;
    background: var(--auth-border);
}

.auth-providers {
    display: flex;
    flex-direction: column;
    gap: 12px;
}

/* Front-channel sign-out iframes on the signed-out page: they must load, never show. */
iframe.signout {
    display: none;
}

/* Error page: the technical details support asks for. */
.auth-details {
    margin: 0 0 20px;
    padding: 12px 14px;
    font-family: var(--auth-mono);
    font-size: 0.8125rem;
    color: var(--auth-muted);
    background: var(--auth-bg);
    border: 1px solid var(--auth-border);
    border-radius: 10px;
    overflow-wrap: anywhere;
}

.auth-details p {
    margin: 0;
}

.auth-details p + p {
    margin-top: 4px;
}

/* Links */

.auth-card a,
.auth-back,
.auth-footer a {
    color: var(--auth-link);
    font-weight: 600;
    text-decoration: underline;
    text-decoration-thickness: 1px;
    text-underline-offset: 3px;
}

.auth-card a:hover,
.auth-back:hover,
.auth-footer a:hover {
    text-decoration-thickness: 2px;
}

.auth-card a:focus-visible,
.auth-back:focus-visible,
.auth-footer a:focus-visible {
    outline: 2px solid var(--auth-primary);
    outline-offset: 2px;
    border-radius: 4px;
}

.auth-card-footer {
    margin: 24px 0 0;
    padding-top: 20px;
    border-top: 1px solid var(--auth-border);
    text-align: center;
    font-size: 0.875rem;
    color: var(--auth-muted);
}

.auth-back {
    display: inline-flex;
    align-items: center;
    gap: 4px;
    font-size: 0.875rem;
    text-decoration: none;
}

.auth-back:hover {
    text-decoration: underline;
}

.auth-back svg {
    width: 16px;
    height: 16px;
}

/* Footer */

.auth-footer {
    padding: 16px;
    text-align: center;
    font-size: 0.8125rem;
    color: var(--auth-muted);
}

.auth-footer a {
    color: inherit;
    font-weight: 500;
}

/* Phones */

@media (max-width: 480px) {
    .auth-shell {
        justify-content: flex-start;
        padding-top: 32px;
    }

    .auth-card {
        padding: 32px 22px 24px;
        border-radius: 16px;
    }
}

@media (prefers-reduced-motion: reduce) {
    .auth-input,
    .auth-button {
        transition: none;
    }

    .auth-button[aria-busy="true"]::before {
        animation-duration: 1.6s;
    }
}