/* =====================================================================
   Roboda CNC — authentication pages (SPEC-AUTH.md)

   Loaded *after* owner.css by reset.html, enrol.html, mfa.html and
   login.html, and *before* print.css. It adds only what the four sign-in
   pages need on top of the gated area's tokens: nothing here redefines a
   colour, a font or a control, so the sign-in screens and the console
   stay visibly one system.

   Two constraints shape this file:

     1. `style-src 'self'` — there is no inline <style> and no style="",
        and the scripts never set one either. Anything that varies at
        runtime (password strength, which step you are on) varies through
        a data-* attribute matched here, not through element.style.

     2. The QR code is a *scannable object*, not decoration. The server
        draws it with dark modules and a transparent light side, so the
        frame below is white in both colour schemes. A QR rendered dark
        on dark is a QR that does not scan.
   ===================================================================== */

/* ---------------------------------------------------------------------
   Shell
   --------------------------------------------------------------------- */

.auth-card-wide { max-width: 560px; }

.auth-card h1 + .login-lede { margin-top: 2px; }

/* Where you are in a flow that has more than one page. Text carries it;
   the pips are a second, redundant cue. */
.auth-steps {
  display: flex;
  align-items: center;
  gap: 8px;
  flex-wrap: wrap;
  margin: 0 0 18px;
  padding: 0;
  list-style: none;
  font-size: .74rem;
  font-weight: 700;
  letter-spacing: .08em;
  text-transform: uppercase;
  color: var(--muted);
}

.auth-steps li {
  display: inline-flex;
  align-items: center;
  gap: 6px;
}

.auth-steps li::before {
  content: "";
  width: 9px;
  height: 9px;
  border-radius: 50%;
  border: 2px solid var(--line-2);
  background: transparent;
  flex: none;
}

.auth-steps li[aria-current="step"] { color: var(--accent); }
.auth-steps li[aria-current="step"]::before {
  border-color: var(--accent);
  background: var(--accent);
}

.auth-steps li[data-state="done"] { color: var(--ok); }
.auth-steps li[data-state="done"]::before {
  border-color: var(--ok);
  background: var(--ok);
}

.auth-steps .auth-steps-sep {
  color: var(--line-2);
  letter-spacing: 0;
}

/* A block of explanation that is not an error and not a success. */
.auth-note {
  font-size: .82rem;
  color: var(--ink-2);
  background: var(--sunken);
  border: 1px solid var(--line);
  border-left: 3px solid var(--line-2);
  border-radius: var(--radius);
  padding: 10px 12px;
  margin: 0 0 16px;
}
.auth-note p { margin: 0 0 .5em; }
.auth-note p:last-child { margin-bottom: 0; }

.auth-links {
  margin: 16px 0 0;
  font-size: .8rem;
  display: flex;
  gap: 14px;
  flex-wrap: wrap;
  align-items: baseline;
}

/* A link that behaves like a button but must not look like the primary
   action (e.g. "use a recovery code instead"). */
.linkish {
  font: inherit;
  font-size: .8rem;
  background: none;
  border: 0;
  padding: 0;
  color: var(--accent);
  text-decoration: underline;
  cursor: pointer;
}
.linkish:hover { text-decoration: none; }

.auth-actions {
  display: flex;
  gap: 10px;
  flex-wrap: wrap;
  align-items: center;
  margin-top: 16px;
}

/* ---------------------------------------------------------------------
   Password entry — reveal control and the strength hint
   --------------------------------------------------------------------- */

.pw-wrap { position: relative; }
.pw-wrap .input { padding-right: 5.2rem; }

.pw-toggle {
  position: absolute;
  top: 50%;
  right: 6px;
  transform: translateY(-50%);
  font: inherit;
  font-size: .74rem;
  font-weight: 650;
  padding: 5px 9px;
  border: 1px solid var(--line-2);
  border-radius: var(--radius);
  background: var(--surface-2);
  color: var(--ink-2);
  cursor: pointer;
}
.pw-toggle:hover { background: var(--line); }

/* Strength is advice, so it is quiet. The server decides; see reset.js. */
.meter {
  display: flex;
  gap: 4px;
  margin: 9px 0 5px;
}

.meter i {
  display: block;
  height: 5px;
  flex: 1 1 0;
  border-radius: 999px;
  background: var(--surface-2);
  border: 1px solid var(--line);
}

.meter[data-level="1"] i:nth-child(-n+1),
.meter[data-level="2"] i:nth-child(-n+2),
.meter[data-level="3"] i:nth-child(-n+3),
.meter[data-level="4"] i:nth-child(-n+4) {
  border-color: transparent;
}

.meter[data-level="1"] i:nth-child(-n+1) { background: var(--hazard); }
.meter[data-level="2"] i:nth-child(-n+2) { background: var(--warn); }
.meter[data-level="3"] i:nth-child(-n+3) { background: var(--accent); }
.meter[data-level="4"] i:nth-child(-n+4) { background: var(--ok); }

.meter-label { font-size: .76rem; color: var(--muted); margin: 0; }
.meter-label b { font-weight: 700; color: var(--ink-2); }

.field-err {
  font-size: .78rem;
  color: var(--hazard);
  font-weight: 600;
  margin: 6px 0 0;
}

/* ---------------------------------------------------------------------
   One-time code
   --------------------------------------------------------------------- */

.otp {
  font-family: var(--mono);
  font-size: 1.7rem;
  font-weight: 700;
  line-height: 1.3;
  letter-spacing: .34em;
  text-indent: .34em;          /* re-centre: letter-spacing pads the right */
  text-align: center;
  padding: 12px 10px;
  font-variant-numeric: tabular-nums;
}

/* The recovery-code variant of the same field: longer, less spaced out. */
.otp-recovery {
  font-size: 1.12rem;
  letter-spacing: .12em;
  text-indent: .12em;
  text-transform: uppercase;
}

.otp-help {
  font-size: .76rem;
  color: var(--muted);
  margin: 8px 0 0;
  text-align: center;
}

/* ---------------------------------------------------------------------
   Enrolment — QR frame and the typed fallback
   --------------------------------------------------------------------- */

/* Always white, in both colour schemes and on paper: the modules are
   drawn dark with a transparent light side, so the frame IS the light
   side. Do not make this var(--surface). */
.qr-frame {
  background: #ffffff;
  color-scheme: light;
  border: 1px solid var(--line-2);
  border-radius: 8px;
  padding: 14px;
  margin: 0 auto 14px;
  max-width: 292px;
  -webkit-print-color-adjust: exact;
  print-color-adjust: exact;
}

/* enrol.js gives the server's SVG a viewBox and drops its width/height,
   so it scales down on a narrow phone instead of being clipped. */
.qr-svg {
  display: block;
  width: 100%;
  height: auto;
  max-width: 260px;
  margin: 0 auto;
}

.qr-cap {
  font-size: .76rem;
  color: var(--muted);
  text-align: center;
  margin: 0 0 16px;
}

/* The base32 secret. Selectable in one gesture, because the fallback for
   a camera that will not focus is a human typing this into a phone. */
.secret {
  display: block;
  font-family: var(--mono);
  font-size: 1rem;
  font-weight: 700;
  letter-spacing: .09em;
  word-break: break-all;
  user-select: all;
  -webkit-user-select: all;
  background: var(--sunken);
  border: 1px dashed var(--line-2);
  border-radius: var(--radius);
  padding: 10px 12px;
  margin: 0 0 8px;
  text-align: center;
}

.manual-kv {
  display: grid;
  grid-template-columns: max-content 1fr;
  gap: 3px 14px;
  font-size: .8rem;
  margin: 10px 0 0;
}
.manual-kv dt { color: var(--muted); font-weight: 600; }
.manual-kv dd { margin: 0; font-weight: 650; }

.auth-sub {
  font-size: .74rem;
  font-weight: 800;
  letter-spacing: .12em;
  text-transform: uppercase;
  color: var(--muted);
  border-bottom: 1px solid var(--line);
  padding-bottom: 5px;
  margin: 26px 0 14px;
}
.auth-sub:first-child { margin-top: 0; }

/* ---------------------------------------------------------------------
   Recovery codes — shown once, so they are the loudest thing on screen
   --------------------------------------------------------------------- */

.codes-panel {
  border: 2px solid var(--hazard);
  border-radius: 8px;
  background: var(--hazard-soft);
  padding: 16px 18px;
  margin: 0 0 18px;
  -webkit-print-color-adjust: exact;
  print-color-adjust: exact;
}

.codes-panel h2 {
  color: var(--hazard);
  font-size: 1.02rem;
  margin-bottom: 6px;
}

.codes-warn {
  font-size: .85rem;
  font-weight: 650;
  color: var(--ink);
  margin: 0 0 12px;
}

/* The column has to hold XXXX-XXXX-XXXX on ONE line. A recovery code that
   wraps mid-group is a code that gets transcribed wrong, so the track is
   sized for the whole thing and the code itself never wraps. */
.codes {
  list-style: none;
  margin: 0 0 14px;
  padding: 0;
  display: grid;
  grid-template-columns: repeat(auto-fill, minmax(172px, 1fr));
  gap: 7px;
  counter-reset: rc;
}

.codes li {
  counter-increment: rc;
  display: flex;
  align-items: baseline;
  gap: 8px;
  background: var(--surface);
  border: 1px solid var(--hazard-line);
  border-radius: var(--radius);
  padding: 7px 10px;
  font-family: var(--mono);
  font-size: .92rem;
  font-weight: 700;
  letter-spacing: .04em;
  user-select: all;
  -webkit-user-select: all;
  break-inside: avoid;
  page-break-inside: avoid;
}

.codes li span { white-space: nowrap; }

.codes li::before {
  content: counter(rc);
  font-family: var(--sans);
  font-size: .68rem;
  font-weight: 700;
  color: var(--muted);
  min-width: 1.3em;
  text-align: right;
  user-select: none;
  -webkit-user-select: none;
  flex: none;
}

.codes-ack {
  display: flex;
  align-items: flex-start;
  gap: 10px;
  font-size: .86rem;
  font-weight: 650;
  margin: 14px 0 0;
  cursor: pointer;
}

.codes-ack input[type="checkbox"] {
  width: 18px;
  height: 18px;
  margin: 2px 0 0;
  flex: none;
  accent-color: var(--hazard);
  cursor: pointer;
}

.copied {
  font-size: .78rem;
  font-weight: 650;
  color: var(--ok);
  margin: 0;
}

/* ---------------------------------------------------------------------
   Motion
   --------------------------------------------------------------------- */

@media (prefers-reduced-motion: reduce) {
  *,
  *::before,
  *::after {
    animation-duration: .001ms !important;
    animation-iteration-count: 1 !important;
    transition-duration: .001ms !important;
    scroll-behavior: auto !important;
  }
}

/* ---------------------------------------------------------------------
   Print — the recovery-code sheet is a legitimate way to keep them, so
   it has to survive a printer. print.css already hides .btn and forces a
   light palette; these rules keep the codes on the page and readable.
   --------------------------------------------------------------------- */

@media print {
  .auth-steps,
  .pw-toggle,
  .linkish,
  .codes-ack,
  .copied,
  .auth-links { display: none !important; }

  .login-card,
  .auth-card-wide {
    max-width: none;
    border: 0;
    box-shadow: none;
    padding: 0;
  }

  .codes-panel {
    border: 1.5pt solid #000 !important;
    background: #fff !important;
    break-inside: avoid;
    page-break-inside: avoid;
  }

  .codes { grid-template-columns: repeat(2, 1fr); }
  .codes li { border: .5pt solid #666 !important; background: #fff !important; }

  .qr-frame { border: .5pt solid #666; }
  .secret { border: .5pt dashed #666; }
}

@media (max-width: 460px) {
  /* One code per row on a phone: two columns forces XXXX-XXXX-XXXX to wrap
     across three lines, which is how a code gets typed in wrong. */
  .codes { grid-template-columns: 1fr; }
  .otp { font-size: 1.4rem; letter-spacing: .26em; text-indent: .26em; }
}