/* ============================================================
   XiO Auth -- login, MFA, password recovery.

   Self-contained: this file is the ONLY stylesheet the auth pages load. It
   deliberately does not depend on the Hub (it used to link Bootstrap 3,
   font-awesome and xio_base.min.css off {hub_url}), so an acuity deploy can
   never restyle or break the login page.

   Token values are copied from the shared palette in
   xio/xiolaravel/resources/sass/base/_xio_colors.scss -- keep them in step
   by hand when the palette moves.
   ============================================================ */

/* ---- Fonts ------------------------------------------------ */

/* IBM Plex Sans -- self-hosted from @ibm/plex-sans (SIL OFL, see OFL.txt).
   Upright 400/500/600/700 only; the auth pages use no italics. */
@font-face {
    font-family: 'IBM Plex Sans';
    font-weight: 400;
    font-style: normal;
    font-display: swap;
    src: url('../fonts/ibm-plex-sans/IBMPlexSans-Regular.woff2') format('woff2');
}
@font-face {
    font-family: 'IBM Plex Sans';
    font-weight: 500;
    font-style: normal;
    font-display: swap;
    src: url('../fonts/ibm-plex-sans/IBMPlexSans-Medium.woff2') format('woff2');
}
@font-face {
    font-family: 'IBM Plex Sans';
    font-weight: 600;
    font-style: normal;
    font-display: swap;
    src: url('../fonts/ibm-plex-sans/IBMPlexSans-SemiBold.woff2') format('woff2');
}
@font-face {
    font-family: 'IBM Plex Sans';
    font-weight: 700;
    font-style: normal;
    font-display: swap;
    src: url('../fonts/ibm-plex-sans/IBMPlexSans-Bold.woff2') format('woff2');
}

/* Font Awesome Pro -- local webfonts, own family name so a Hub FA version
   bump cannot change what renders here. Only the glyphs below are declared. */
@font-face {
    font-family: 'XiO Auth Icons';
    font-weight: 400;
    font-style: normal;
    font-display: block;
    src: url('../fonts/fontawesome-pro/webfonts/fa-regular-400.woff2') format('woff2');
}
@font-face {
    font-family: 'XiO Auth Icons';
    font-weight: 900;
    font-style: normal;
    font-display: block;
    src: url('../fonts/fontawesome-pro/webfonts/fa-solid-900.woff2') format('woff2');
}

.auth-icon {
    font-family: 'XiO Auth Icons';
    font-weight: 400;
    font-style: normal;
    line-height: 1;
    display: inline-block;
    -webkit-font-smoothing: antialiased;
}
.auth-icon-solid          { font-weight: 900; }
.auth-icon-eye::before            { content: "\f06e"; }
.auth-icon-eye-slash::before      { content: "\f070"; }
.auth-icon-login::before          { content: "\f2f6"; }  /* right-to-bracket */
.auth-icon-circle-right::before   { content: "\f35a"; }
.auth-icon-check::before          { content: "\f00c"; }

/* ---- Tokens ----------------------------------------------- */

:root {
    --xio-navy-action:        #1B236B;
    --xio-navy-action-hover:  #141A52;
    --xio-navy-action-dark:   #161C57;
    --xio-navy-tint-border:   #C9CCE6;

    --xio-green-brand:        #77AA35;

    --xio-text-color:         #1F2A3D;
    --xio-grey-dark:          #54627A;
    --xio-grey-mid:           #6F7E97;
    --xio-grey-border:        #D9DDE3;
    --xio-grey-border-md:     #CBD2DC;
    --xio-grey-divider:       #E6E9EE;
    --xio-grey-bg:            #EEF0F3;
    --xio-grey-bg-sunken:     #F6F7F9;
    --xio-grey-bg-raised:     #FBFCFD;
    --xio-white:              #FFFFFF;

    --xio-red:                #C03026;
    --xio-red-tint:           #FBEDEC;
    --xio-red-tint-border:    #EECAC6;
    --xio-red-text:           #A32820;

    --xio-green-text:         #3F7A1F;
    --xio-green-tint:         #EEF6E6;
    --xio-green-tint-border:  #CFE4BB;

    --auth-radius-card:       10px;
    --auth-radius-control:    8px;
    --auth-card-width:        480px;
}

/* ---- Page ------------------------------------------------- */

*, *::before, *::after { box-sizing: border-box; }

html { -webkit-text-size-adjust: 100%; }

body {
    margin: 0;
    padding: 40px 16px 32px;
    background: var(--xio-grey-bg);
    color: var(--xio-text-color);
    font-family: 'IBM Plex Sans', -apple-system, BlinkMacSystemFont, 'Segoe UI', Helvetica, Arial, sans-serif;
    font-size: 15px;
    line-height: 1.5;
    -webkit-font-smoothing: antialiased;
}

.auth-shell {
    width: 100%;
    max-width: var(--auth-card-width);
    margin: 0 auto;
}

a {
    color: var(--xio-navy-action-dark);
    text-decoration: none;
}
a:hover, a:focus { color: var(--xio-navy-action-hover); text-decoration: underline; }

/* ---- Brand ------------------------------------------------ */

.auth-brand {
    text-align: center;
    margin-bottom: 28px;
}
.auth-brand-logo {
    width: 100px;
    height: auto;
    display: inline-block;
}
.auth-brand-app {
    margin: 10px 0 0;
    font-size: 13px;
    font-weight: 600;
    letter-spacing: 0.18em;
    text-transform: uppercase;
    color: var(--xio-green-brand);
}

/* ---- Card ------------------------------------------------- */

.auth-card {
    background: var(--xio-white);
    border: 1px solid var(--xio-grey-border);
    border-radius: var(--auth-radius-card);
    overflow: hidden;
}
.auth-card-header {
    padding: 18px 28px;
    background: var(--xio-grey-bg-raised);
    border-bottom: 1px solid var(--xio-grey-divider);
}
.auth-card-title {
    margin: 0;
    font-size: 19px;
    font-weight: 600;
    color: var(--xio-text-color);
}
.auth-card-body { padding: 24px 28px 28px; }

/* ---- Form ------------------------------------------------- */

.auth-field { margin-bottom: 18px; }

.auth-label {
    display: block;
    margin-bottom: 7px;
    font-size: 12px;
    font-weight: 600;
    letter-spacing: 0.08em;
    text-transform: uppercase;
    color: var(--xio-grey-dark);
}

.auth-input {
    display: block;
    width: 100%;
    padding: 12px 14px;
    font-family: inherit;
    font-size: 15px;
    color: var(--xio-text-color);
    background: var(--xio-grey-bg-sunken);
    border: 1px solid var(--xio-grey-border-md);
    border-radius: var(--auth-radius-control);
    transition: border-color .15s ease, box-shadow .15s ease, background-color .15s ease;
}
.auth-input:hover { border-color: var(--xio-grey-border-md); }
.auth-input:focus {
    outline: none;
    background: var(--xio-white);
    border-color: var(--xio-navy-action);
    box-shadow: 0 0 0 3px var(--xio-navy-tint-border);
}

/* Password show/hide toggle, right-aligned under the field. */
.auth-field-action {
    margin-top: 8px;
    text-align: right;
    font-size: 14px;
    font-weight: 600;
}
.auth-field-action .auth-icon { margin-right: 6px; }

/* Checkbox: the native box is hidden and redrawn so the checked state can
   carry the navy fill from the design. */
.auth-check {
    display: flex;
    align-items: center;
    gap: 11px;
    margin: 22px 0;
    font-size: 15px;
    cursor: pointer;
}
.auth-check input {
    position: absolute;
    opacity: 0;
    width: 0;
    height: 0;
}
.auth-check-box {
    flex: 0 0 auto;
    width: 22px;
    height: 22px;
    display: flex;
    align-items: center;
    justify-content: center;
    background: var(--xio-white);
    border: 1px solid var(--xio-grey-border-md);
    border-radius: 5px;
    color: transparent;
    font-size: 12px;
    transition: background-color .15s ease, border-color .15s ease;
}
.auth-check input:checked + .auth-check-box {
    background: var(--xio-navy-action);
    border-color: var(--xio-navy-action);
    color: var(--xio-white);
}
.auth-check input:focus-visible + .auth-check-box {
    box-shadow: 0 0 0 3px var(--xio-navy-tint-border);
}

/* ---- Button ----------------------------------------------- */

.auth-btn {
    display: flex;
    align-items: center;
    justify-content: center;
    gap: 10px;
    width: 100%;
    padding: 15px 20px;
    font-family: inherit;
    font-size: 16px;
    font-weight: 600;
    color: var(--xio-white);
    background: var(--xio-navy-action);
    border: 1px solid var(--xio-navy-action);
    border-radius: var(--auth-radius-control);
    cursor: pointer;
    transition: background-color .15s ease, border-color .15s ease;
}
.auth-btn:hover, .auth-btn:focus {
    background: var(--xio-navy-action-hover);
    border-color: var(--xio-navy-action-hover);
    color: var(--xio-white);
    text-decoration: none;
}
.auth-btn:focus-visible {
    outline: none;
    box-shadow: 0 0 0 3px var(--xio-navy-tint-border);
}
.auth-btn .auth-icon { font-size: 15px; }

.auth-form-footer {
    margin-top: 20px;
    text-align: center;
    font-weight: 600;
}

/* ---- Alerts ----------------------------------------------- */

.auth-alert {
    padding: 12px 16px;
    margin-bottom: 20px;
    border: 1px solid transparent;
    border-radius: var(--auth-radius-control);
    font-size: 14px;
}
/* Links inside an alert take the alert's own color, never navy. */
.auth-alert a { color: inherit; text-decoration: underline; }

.auth-alert-danger {
    color: var(--xio-red-text);
    background: var(--xio-red-tint);
    border-color: var(--xio-red-tint-border);
}
.auth-alert-success {
    color: var(--xio-green-text);
    background: var(--xio-green-tint);
    border-color: var(--xio-green-tint-border);
}

/* ---- MFA code entry --------------------------------------- */

.auth-lead {
    margin: 0 0 8px;
    color: var(--xio-grey-dark);
    font-size: 15px;
}
.auth-lead:last-of-type { margin-bottom: 22px; }
.auth-lead strong { color: var(--xio-text-color); font-weight: 600; }

.auth-code {
    display: flex;
    justify-content: center;
    gap: 10px;
    margin-bottom: 26px;
}
.auth-code input {
    width: 52px;
    padding: 14px 0;
    font-family: inherit;
    font-size: 24px;
    font-weight: 600;
    text-align: center;
    color: var(--xio-text-color);
    background: var(--xio-grey-bg-sunken);
    border: 1px solid var(--xio-grey-border-md);
    border-radius: var(--auth-radius-control);
    transition: border-color .15s ease, box-shadow .15s ease, background-color .15s ease;
}
.auth-code input:focus {
    outline: none;
    background: var(--xio-white);
    border-color: var(--xio-navy-action);
    box-shadow: 0 0 0 3px var(--xio-navy-tint-border);
}

/* ---- Password policy -------------------------------------- */

.auth-policy {
    padding: 16px 18px;
    margin-bottom: 22px;
    background: var(--xio-grey-bg-sunken);
    border: 1px solid var(--xio-grey-divider);
    border-radius: var(--auth-radius-control);
}
.auth-policy-title {
    margin: 0 0 8px;
    font-size: 12px;
    font-weight: 600;
    letter-spacing: 0.08em;
    text-transform: uppercase;
    color: var(--xio-grey-dark);
}
.auth-policy ul { margin: 0; padding-left: 20px; }
.auth-policy li { font-size: 14px; color: var(--xio-grey-dark); }

/* ---- Footer ----------------------------------------------- */

.auth-footer {
    max-width: var(--auth-card-width);
    margin: 28px auto 0;
    padding-top: 22px;
    border-top: 1px solid var(--xio-grey-border);
    text-align: center;
    font-size: 14px;
    color: var(--xio-grey-mid);
}
.auth-footer p { margin: 0; }
.auth-footer a { font-weight: 600; }

/* ---- Phone ------------------------------------------------ */

@media (max-width: 520px) {
    body { padding: 24px 12px 24px; }
    .auth-card-header { padding: 16px 18px; }
    .auth-card-body   { padding: 20px 18px 22px; }
    .auth-code { gap: 6px; }
    .auth-code input { width: 100%; font-size: 20px; padding: 12px 0; }
}