/* The centred card shared by every unauthenticated or half-authenticated door:
 * operator sign in, end-user sign in, and the bootstrap password change.
 *
 * Shared rather than repeated, because these three pages have drifted apart
 * once already by each carrying its own <style> block. No literal colours: if
 * a value is missing here, it belongs in tokens.css. */

.auth-page {
  min-height: 100vh;
  display: grid;
  place-items: center;
  padding: var(--s-4);
}

.auth-card {
  width: min(26rem, 100%);
  background: var(--ink-2);
  border: 1px solid var(--line);
  border-radius: var(--radius);
  padding: var(--s-6) var(--s-6) var(--s-5);
  box-shadow: 0 1px 2px rgba(14, 27, 46, 0.04), 0 8px 24px rgba(14, 27, 46, 0.06);
}

.auth-brand {
  display: flex;
  align-items: center;
  justify-content: center;
  gap: var(--s-2);
  margin-bottom: var(--s-1);
}
.auth-brand img { height: 26px; width: auto; }
.auth-brand .word {
  font-family: var(--font-display);
  font-size: 1.05rem;
  letter-spacing: 0.02em;
  color: var(--fg);
}

.auth-sub {
  font-family: var(--font-display);
  font-size: 0.58rem;
  letter-spacing: 0.26em;
  text-transform: uppercase;
  color: var(--fg-3);
  text-align: center;
  margin: 0 0 var(--s-5);
}

/* Explains why a door is closed. Amber-bordered rather than red: this is a
   required next step, not a failure. */
.auth-note {
  border: 1px solid var(--st-degraded);
  border-left-width: 3px;
  border-radius: var(--radius-sm);
  background: rgba(138, 90, 0, 0.05);
  padding: var(--s-3);
  font-size: 0.86rem;
  margin: 0 0 var(--s-4);
  color: var(--fg-2);
}
.auth-note strong { display: block; color: var(--fg); margin-bottom: var(--s-1); }

.auth-who {
  font-family: var(--font-mono);
  font-size: 0.82rem;
  color: var(--fg-3);
  text-align: center;
  margin: 0 0 var(--s-4);
  word-break: break-all;
}

.auth-card label {
  display: block;
  font-size: 0.74rem;
  color: var(--fg-2);
  margin: var(--s-3) 0 var(--s-1);
}

.auth-card input {
  width: 100%;
  padding: 0.55rem 0.6rem;
  border: 1px solid var(--line-2);
  border-radius: var(--radius-sm);
  font: inherit;
  background: var(--ink-2);
  color: var(--fg);
}
.auth-card input.mono { font-family: var(--font-mono); font-size: 0.9rem; }

.auth-card button[type="submit"] {
  margin-top: var(--s-5);
  width: 100%;
  padding: 0.62rem;
  border: 0;
  border-radius: var(--radius-sm);
  color: #fff;
  font: inherit;
  font-weight: 600;
  cursor: pointer;
}
.auth-card button[type="submit"]:hover { opacity: 0.9; }

/* Announced by role="alert", so it must not be display:none when empty or a
   screen reader will not hear the change. min-height reserves the line. */
.auth-msg {
  margin-top: var(--s-3);
  font-size: 0.85rem;
  min-height: 1.2em;
  text-align: center;
  color: var(--fg-2);
}
.auth-msg.err { color: var(--st-offline); }
.auth-msg.ok { color: var(--st-in-use); }

.auth-alt {
  display: block;
  text-align: center;
  margin-top: var(--s-4);
  font-size: 0.8rem;
  color: var(--fg-3);
}

/* Single sign-on buttons, on the end-user door ---------------------------- */
.auth-divider {
  text-align: center; color: var(--fg-3); font-size: 0.78rem;
  margin: var(--s-3) 0; position: relative;
}
#sso-buttons { display: flex; flex-direction: column; gap: var(--s-2); margin-top: var(--s-3); }
.sso-btn {
  display: flex; align-items: center; gap: var(--s-2);
  border: 1px solid var(--line-2); border-radius: var(--radius-sm);
  padding: 0.45rem 0.7rem; font-size: 0.88rem; color: var(--fg);
}
.sso-btn:hover { border-color: var(--accent); text-decoration: none; }
/* Home-realm discovery highlights the connection that claims the typed
   domain. A class rather than inline styles, and it highlights rather than
   filters: a contractor with that domain may still need another door. */
.sso-btn.discovered { border-color: var(--accent); font-weight: 700; }
.mark { width: 1rem; height: 1rem; border-radius: 3px; flex: none; background: var(--ink-3); }
.mark-microsoft { background: linear-gradient(135deg, #f25022 50%, #00a4ef 50%); }
.mark-google { background: linear-gradient(135deg, #ea4335 50%, #4285f4 50%); }
.mark-okta { background: #007dc1; }
.mark-generic { background: var(--fg-3); }