/* Login / MFA pages (application/_backend/modules/auth/auth/views/scripts/user/*.phtml).
   Lives in bloom (not bloom-console, which is being deprecated), served at
   /baseapp/css/auth.css - the /baseapp prefix is a symlink from
   bloom-console/httpdocs/baseapp into this repo's public/ dir (the same
   path recaptcha.min.js is already served through), since bare /css/* is
   served from a real, separate directory in bloom-console instead. */

:root {
    --auth-bg: #f4f5f7;
    --auth-card-bg: #ffffff;
    --auth-border: #e1e4e8;
    --auth-text: #1f2733;
    --auth-text-muted: #6b7280;
    --auth-primary: #2f6fed;
    --auth-primary-dark: #1f57c9;
    --auth-error-bg: #fdecea;
    --auth-error-text: #b3261e;
    --auth-radius: 10px;
}

* {
    box-sizing: border-box;
}

html, body {
    height: 100%;
}

body {
    margin: 0;
    padding: 32px 16px;
    display: flex;
    flex-direction: column;
    align-items: center;
    justify-content: center;
    min-height: 100vh;
    background: var(--auth-bg);
    font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
    color: var(--auth-text);
}

.authCard {
    width: 100%;
    max-width: 380px;
    background: var(--auth-card-bg);
    border: 1px solid var(--auth-border);
    border-radius: var(--auth-radius);
    box-shadow: 0 1px 3px rgba(16, 24, 40, 0.06), 0 8px 24px rgba(16, 24, 40, 0.06);
    padding: 32px 28px 24px;
}

.authCard-icon {
    display: flex;
    align-items: center;
    justify-content: center;
    width: 48px;
    height: 48px;
    margin: 0 auto 16px;
    border-radius: 50%;
    background: rgba(47, 111, 237, 0.1);
    color: var(--auth-primary);
    font-size: 24px;
}

.mfa-sent-to {
    text-align: center;
    font-size: 13px;
    color: var(--auth-text-muted);
    margin: 0 0 16px;
}

.mfa-sent-to strong {
    color: var(--auth-text);
    font-weight: 600;
}

.error {
    display: flex;
    align-items: center;
    gap: 8px;
    background: var(--auth-error-bg);
    color: var(--auth-error-text);
    border-radius: 8px;
    padding: 10px 14px;
    margin-bottom: 16px;
    font-size: 14px;
}

/* Zend_Form output: <dl class="zend_form"><div class="form-element ..."><label/><input/></div>...</dl>.
   Deliberately scoped to .authForm, NOT .loginBox - the legacy, still-separate
   /css/login.css (served from bloom-console/httpdocs/css/login.css) already
   has its own .loginBox rules used by /login.php and friends; reusing that
   class name here would collide with and stack on top of those. */
.authForm dl.zend_form {
    margin: 0;
    padding: 0;
}

/* Real markup nests each field as <dt><label></dt><dd><input></dd> - reset
   the browser's default <dd> left indent (~40px) and <dt>/<dl> spacing so
   fields lay out edge-to-edge inside the card instead of shifted right. */
.authForm dt,
.authForm dd {
    margin: 0;
    padding: 0;
}

.authForm legend,
.authForm .heading,
.authForm .baseapp-form h2 {
    font-size: 20px;
    font-weight: 600;
    margin: 0 0 20px;
    text-align: center;
}

.authForm .form-element {
    margin-bottom: 16px;
}

.authForm label {
    display: block;
    font-size: 13px;
    font-weight: 600;
    color: var(--auth-text-muted);
    margin-bottom: 6px;
}

.authForm input[type="text"],
.authForm input[type="password"],
.authForm input[type="email"] {
    width: 100%;
    padding: 10px 12px;
    font-size: 15px;
    border: 1px solid var(--auth-border);
    border-radius: 8px;
    background: #fff;
    color: var(--auth-text);
    transition: border-color 0.15s ease, box-shadow 0.15s ease;
}

.authForm input[type="text"]:focus,
.authForm input[type="password"]:focus,
.authForm input[type="email"]:focus {
    outline: none;
    border-color: var(--auth-primary);
    box-shadow: 0 0 0 3px rgba(47, 111, 237, 0.15);
}

/* Show/hide password toggle icon - injected by TOOLBOX.togglePasswordField()
   as a sibling of the password <input> inside its <dd>. */
.authForm dd {
    position: relative;
}

.authForm input[type="password"] {
    padding-right: 38px;
}

.authForm .toggle-pwd-field-btn {
    position: absolute;
    top: 50%;
    right: 12px;
    transform: translateY(-50%);
    cursor: pointer;
    font-size: 18px;
    color: var(--auth-text-muted);
}

.authForm .toggle-pwd-field-btn:hover {
    color: var(--auth-text);
}

.authForm .form-element.checkbox-container,
.authForm input[type="checkbox"] {
    width: auto;
    display: inline-block;
    vertical-align: middle;
    margin-right: 6px;
}

.authForm ul.errors {
    list-style: none;
    margin: 6px 0 0;
    padding: 0;
    color: var(--auth-error-text);
    font-size: 13px;
}

.authForm input[type="submit"],
.authForm button[type="submit"],
.authForm .SubmitButton input {
    width: 100%;
    padding: 11px 16px;
    margin-top: 4px;
    font-size: 15px;
    font-weight: 600;
    color: #fff;
    background: var(--auth-primary);
    border: none;
    border-radius: 8px;
    cursor: pointer;
    transition: background 0.15s ease;
}

.authForm input[type="submit"]:hover,
.authForm button[type="submit"]:hover,
.authForm .SubmitButton input:hover {
    background: var(--auth-primary-dark);
}

.authForm input[type="submit"]:disabled {
    cursor: default;
    opacity: 0.85;
}

/* Login JS toggles this on the submit button for the duration of the XHR
   request - the button's own text is hidden in favour of a spinner so
   there's visible feedback while the server is doing real work. The
   spinner itself (.btn-spinner) is a real element the JS inserts as a
   sibling of the button, not a ::after on it - ::after can't render
   generated content on <input>, which is a replaced element with no
   content model, so that approach never actually showed anything. */
.authForm input[type="submit"].is-submitting {
    color: transparent;
}

.authForm .btn-spinner {
    position: absolute;
    top: 50%;
    left: 50%;
    transform: translate(-50%, -50%);
    font-size: 18px;
    line-height: 1;
    color: #fff;
    pointer-events: none;
}

.sso {
    display: flex;
    flex-direction: column;
    gap: 8px;
    margin-top: 20px;
}

.sso a {
    display: flex;
    align-items: center;
    justify-content: center;
    gap: 8px;
    padding: 9px 14px;
    border: 1px solid var(--auth-border);
    border-radius: 8px;
    color: var(--auth-text);
    text-decoration: none;
    font-size: 14px;
    font-weight: 500;
    transition: background 0.15s ease, border-color 0.15s ease;
}

.sso a:hover {
    background: var(--auth-bg);
    border-color: var(--auth-text-muted);
}

.sso a .mdi {
    font-size: 18px;
}

/* Ambiguous-email SSO account picker (Auth_SsoController::callbackAction()) -
   one button per linked account, each its own <form> posting the chosen
   userId to /auth/choose-account. */
.account-choices {
    list-style: none;
    margin: 0;
    padding: 0;
    display: flex;
    flex-direction: column;
    gap: 8px;
}

.account-choice {
    width: 100%;
    display: flex;
    align-items: center;
    justify-content: space-between;
    gap: 8px;
    padding: 10px 14px;
    border: 1px solid var(--auth-border);
    border-radius: 8px;
    background: #fff;
    color: var(--auth-text);
    font-size: 14px;
    cursor: pointer;
    transition: background 0.15s ease, border-color 0.15s ease;
}

.account-choice:hover {
    background: var(--auth-bg);
    border-color: var(--auth-primary);
}

.account-choice-name {
    font-weight: 600;
    text-align: left;
}

.account-choice-type {
    font-size: 12px;
    color: var(--auth-text-muted);
}

.forgotPassword {
    margin-top: 18px;
    text-align: center;
    font-size: 13px;
    color: var(--auth-text-muted);
}

.forgotPassword a {
    color: var(--auth-primary);
    text-decoration: none;
}

.forgotPassword a:hover {
    text-decoration: underline;
}

.forgotPassword a.is-disabled {
    color: var(--auth-text-muted);
    cursor: default;
    pointer-events: none;
}

.forgotPassword a.is-disabled:hover {
    text-decoration: none;
}

.forgotPassword span {
    margin: 0 6px;
}