/*
 * psuite.identity login UI — styles derived from @psuite/design-tokens
 * (DM Sans, slate neutrals, radius/shadow scale). Identity is the neutral
 * suite surface, so it uses the suite-neutral primary (slate) — the apps
 * keep their own brand colours.
 */
:root {
  --color-slate-50: #f8fafc;
  --color-slate-100: #f1f5f9;
  --color-slate-200: #e2e8f0;
  --color-slate-300: #cbd5e1;
  --color-slate-400: #94a3b8;
  --color-slate-500: #64748b;
  --color-slate-600: #475569;
  --color-slate-700: #334155;
  --color-slate-800: #1e293b;
  --color-slate-900: #0f172a;
  --color-error-600: #e11d48;
  --color-error-50: #fff1f2;
  --radius-lg: 0.5rem;
  --radius-xl: 0.75rem;
  --shadow-card: 0 1px 3px 0 rgb(0 0 0 / 0.1), 0 1px 2px -1px rgb(0 0 0 / 0.1);
  --font-family-sans: 'DM Sans', system-ui, -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
}

* { box-sizing: border-box; }

body {
  margin: 0;
  font-family: var(--font-family-sans);
  background: var(--color-slate-50);
  color: var(--color-slate-900);
  -webkit-font-smoothing: antialiased;
}

.auth-shell {
  min-height: 100vh;
  display: flex;
  flex-direction: column;
  align-items: center;
  justify-content: center;
  padding: 1.5rem;
}

.auth-card {
  width: 100%;
  max-width: 400px;
  background: #ffffff;
  border: 1px solid var(--color-slate-200);
  border-radius: var(--radius-xl);
  box-shadow: var(--shadow-card);
  padding: 2rem;
}

.auth-brand {
  display: flex;
  align-items: center;
  gap: 0.625rem;
  margin-bottom: 1.5rem;
}

.auth-logo {
  display: inline-flex;
  align-items: center;
  justify-content: center;
  width: 40px;
  height: 40px;
  border-radius: var(--radius-lg);
  background: var(--color-slate-900);
  color: #ffffff;
  font-weight: 700;
  font-size: 1rem;
}

.auth-suite {
  font-weight: 600;
  font-size: 1.125rem;
}

.auth-title {
  margin: 0 0 0.25rem;
  font-size: 1.25rem;
  font-weight: 600;
}

.auth-subtitle {
  margin: 0 0 1.25rem;
  font-size: 0.875rem;
  color: var(--color-slate-500);
}

.auth-error {
  margin-bottom: 1rem;
  padding: 0.625rem 0.875rem;
  border-radius: var(--radius-lg);
  background: var(--color-error-50);
  color: var(--color-error-600);
  font-size: 0.8125rem;
}

/* Neutral notice (realm choice, existing-session switch banner). */
.auth-info {
  margin-bottom: 1rem;
  padding: 0.625rem 0.875rem;
  border-radius: var(--radius-lg);
  background: var(--color-slate-100, #f1f5f9);
  color: var(--color-slate-600);
  font-size: 0.8125rem;
}

.auth-label {
  display: block;
  margin: 0.875rem 0 0.375rem;
  font-size: 0.875rem;
  font-weight: 500;
  color: var(--color-slate-600);
}

.auth-input {
  width: 100%;
  padding: 0.5rem 0.75rem;
  font-size: 0.875rem;
  font-family: inherit;
  border: 1px solid var(--color-slate-200);
  border-radius: var(--radius-lg);
  background: var(--color-slate-50);
  transition: border-color 0.15s ease, box-shadow 0.15s ease;
}

.auth-input:focus {
  outline: none;
  border-color: var(--color-slate-500);
  box-shadow: 0 0 0 3px rgb(100 116 139 / 0.15);
}

.auth-remember {
  display: flex;
  align-items: center;
  gap: 0.5rem;
  margin-top: 1rem;
  font-size: 0.8125rem;
  color: var(--color-slate-600);
}

/* "Passwort vergessen?" — quiet by default, because most visits do not need it, but on its
   own line so it is findable at the moment someone does. */
.auth-link {
  display: inline-block;
  margin-top: 0.75rem;
  font-size: 0.8125rem;
  color: var(--color-slate-600);
  text-decoration: none;
}

.auth-link:hover {
  color: var(--color-slate-900);
  text-decoration: underline;
}

.auth-submit {
  width: 100%;
  margin-top: 1.25rem;
  padding: 0.625rem 1rem;
  font-size: 0.875rem;
  font-weight: 600;
  font-family: inherit;
  color: #ffffff;
  background: var(--color-slate-900);
  border: none;
  border-radius: var(--radius-lg);
  cursor: pointer;
  transition: background-color 0.15s ease;
}

.auth-submit:hover { background: var(--color-slate-700); }

.auth-footer {
  margin-top: 1.25rem;
  font-size: 0.75rem;
  color: var(--color-slate-400);
}

.tenant-list {
  display: flex;
  flex-direction: column;
  gap: 0.5rem;
}

.tenant-item {
  display: flex;
  align-items: center;
  justify-content: space-between;
  width: 100%;
  padding: 0.75rem 1rem;
  font-family: inherit;
  font-size: 0.875rem;
  background: var(--color-slate-50);
  border: 1px solid var(--color-slate-200);
  border-radius: var(--radius-lg);
  cursor: pointer;
  transition: border-color 0.15s ease, background-color 0.15s ease;
}

.tenant-item:hover {
  background: #ffffff;
  border-color: var(--color-slate-400);
}

.tenant-name { font-weight: 600; }
.tenant-code { color: var(--color-slate-400); font-size: 0.75rem; }

/* Passkey login */
.auth-divider {
  display: flex;
  align-items: center;
  gap: 0.75rem;
  margin: 1.25rem 0 1rem;
  color: var(--color-slate-400);
  font-size: 0.75rem;
  text-transform: uppercase;
  letter-spacing: 0.06em;
}
.auth-divider::before,
.auth-divider::after {
  content: "";
  flex: 1;
  height: 1px;
  background: var(--color-slate-200);
}

.auth-submit--secondary {
  background: #ffffff;
  color: var(--color-slate-700);
  border: 1px solid var(--color-slate-300);
}
.auth-submit--secondary:hover {
  background: var(--color-slate-50);
  border-color: var(--color-slate-400);
}


/* ---------------------------------------------------------------------------
   Login proof-of-work status.

   Nobody asked for a security check, so a passed one is not news: it sits quiet
   and grey, the size of fine print. The states that DO deserve attention are the
   two where the person has to wait or act — and only the failure gets colour.
   --------------------------------------------------------------------------- */
.auth-shield {
  display: flex;
  align-items: center;
  gap: 0.4375rem;
  margin-top: 0.875rem;
  font-size: 0.75rem;
  color: var(--color-slate-400);
  /* Reserved so the button does not jump when the state changes. */
  min-height: 1.125rem;
  transition: color 0.2s;
}

.auth-shield__icon {
  flex: 0 0 auto;
  width: 0.875rem;
  height: 0.875rem;
}

/* Working: the spinner is the only moving part, and only while it matters. */
.auth-shield--busy { color: var(--color-slate-500); }
.auth-shield--busy .auth-shield__icon {
  animation: auth-shield-spin 0.9s linear infinite;
}

@keyframes auth-shield-spin {
  to { transform: rotate(360deg); }
}

/* Passed: deliberately the most muted state on the page. */
.auth-shield--done { color: var(--color-slate-400); }

/* Failed: the one case the person must notice and can act on. */
.auth-shield--failed {
  color: var(--color-error-600);
  font-weight: 500;
}

@media (prefers-reduced-motion: reduce) {
  .auth-shield--busy .auth-shield__icon { animation: none; }
}