/* Shared login card — the one source both sign-in screens consume (FR-DES-3).
 *
 * Served from /shared/static, which is mounted unconditionally: the admin panel is
 * available wherever the app is, but frontend/ is behind SERVE_FRONTEND (off by
 * default), so anything under frontend/css/ is unreachable to the admin login in dev
 * and in the whole unit suite.
 *
 * Two hard constraints on what may go in this file, because it loads alongside BOTH
 * css/styles.css and admin/admin.css:
 *   1. No :root block. Those two stylesheets define colliding tokens under identical
 *      names (--radius-sm is 8px vs 6px, --radius-md 12px vs 8px), so a shared custom
 *      property would silently restyle the other surface. Every value here is literal.
 *   2. No bare class names. Everything is .auth-*-scoped or a descendant of it, which
 *      is also what out-specifies admin.css's own .subtitle/label/input/button rules.
 * The @font-face blocks are the deliberate exception to (2) — see below.
 */

/* Poppins, self-hosted (SIL OFL 1.1 — fonts/OFL.txt). Duplicated from styles.css
 * rather than shared because styles.css is unreachable when the frontend is unserved.
 * A duplicate @font-face with an identical src is deduplicated by the browser, so the
 * participant login pays nothing for this. Only the three weights the card renders,
 * latin subset only — carrying all eight blocks would ship ~100KB of glyphs unused.
 * Self-hosted rather than a CDN because NFR-SEC-7 forbids external egress. */
@font-face {
    font-family: 'Poppins'; font-style: normal; font-weight: 400; font-display: swap;
    src: url('fonts/poppins-400-latin.woff2') format('woff2');
    unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
}
@font-face {
    font-family: 'Poppins'; font-style: normal; font-weight: 600; font-display: swap;
    src: url('fonts/poppins-600-latin.woff2') format('woff2');
    unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
}
@font-face {
    font-family: 'Poppins'; font-style: normal; font-weight: 700; font-display: swap;
    src: url('fonts/poppins-700-latin.woff2') format('woff2');
    unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
}

/* --- Card ---------------------------------------------------------------- */
.auth-wrap {
    max-width: 420px;
    margin: 4rem auto;
    padding: 0 1rem;
}

.auth-card {
    background: #fff;
    border-radius: 12px;
    padding: 2rem;
    box-shadow: 0 4px 20px rgba(0, 0, 0, 0.08);
    font-family: 'Poppins', -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;
    line-height: 1.6;
    color: #2C3E50;
}

.auth-card h1,
.auth-card h2 {
    font-size: 1.6rem;
    font-weight: 700;
    margin: 0 0 0.5rem;
}

.auth-card .subtitle {
    margin: 0 0 1.5rem;
    color: #555;
}

/* Start-hidden panel (the forced password-change view). A class rather than the
   hidden attribute because login.js reveals it with an inline style.display, which
   beats a class rule but would leave a hidden attribute semantically stale. */
.auth-card.auth-collapsed {
    display: none;
}

/* --- Feedback ------------------------------------------------------------ */
/* Hidden until login.js adds .show; the admin login renders its flash server-side
   and therefore emits .auth-error.show directly. */
.auth-error {
    display: none;
    background: #fde8e8;
    color: #9b1c1c;
    border-radius: 8px;
    padding: 0.75rem 1rem;
    margin-bottom: 1rem;
    font-size: 0.95rem;
}

.auth-error.show {
    display: block;
}

.auth-hint {
    font-size: 0.85rem;
    color: #666;
    margin-top: 1rem;
    text-align: center;
}

/* --- Form controls ------------------------------------------------------- */
/* Descendant-scoped so these out-specify admin.css's bare label/input rules on the
   admin login without touching any other admin screen. */
.auth-card .auth-field {
    margin-bottom: 2rem;
}

.auth-card .auth-field label {
    display: block;
    font-weight: 600;
    font-size: 1rem;
    color: #2C3E50;
    margin: 0 0 0.5rem;
    text-transform: none;
}

.auth-card .auth-field input {
    width: 100%;
    padding: 12px 16px;
    border: 2px solid #E0E6ED;
    border-radius: 8px;
    font-family: inherit;
    font-size: 1rem;
    color: #2C3E50;
    background: #fff;
    transition: all 0.3s ease;
}

.auth-card .auth-field input:focus {
    outline: none;
    border-color: #4A90E2;
    box-shadow: 0 0 0 3px rgba(74, 144, 226, 0.1);
}

.auth-card .auth-submit {
    display: inline-block;
    width: 100%;
    margin-top: 0.5rem;
    padding: 1rem 2rem;
    border: none;
    border-radius: 8px;
    font-family: inherit;
    font-size: 1rem;
    font-weight: 600;
    cursor: pointer;
    background-color: #2B6CB0;
    color: #fff;
    text-decoration: none;
    transition: all 0.3s ease;
}

.auth-card .auth-submit:hover {
    background-color: #2E5C8A;
    transform: translateY(-2px);
    box-shadow: 0 8px 24px rgba(0, 0, 0, 0.2);
}

/* --- Sign-in header ------------------------------------------------------ */
/* Mirrors the participant navbar (css/styles.css header/.navbar) so the admin login
   carries the same brand bar. The admin login cannot load styles.css (unreachable when
   the frontend is unserved, and its :root collides with admin.css), so this is a scoped
   parallel with literal values — same rule as the card. The participant program links
   inside render only when the frontend is served (the route passes frontend_served);
   otherwise the bar is brand-only. */
.auth-header {
    background: linear-gradient(135deg, #6B5B95, #4A90E2);
    box-shadow: 0 4px 12px rgba(0, 0, 0, 0.15);
    font-family: 'Poppins', -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;
    position: sticky;
    top: 0;
    z-index: 1000;
}

.auth-header-inner {
    max-width: 1200px;
    margin: 0 auto;
    padding: 1rem 2rem;
    display: flex;
    justify-content: space-between;
    align-items: center;
    gap: 1rem;
    flex-wrap: wrap;
}

.auth-brand {
    display: flex;
    align-items: center;
    gap: 1rem;
    color: #fff;
    flex-shrink: 0;
}

.auth-logo {
    font-size: 2rem;
    line-height: 1;
    animation: pulse 2s ease-in-out infinite;
}

/* Mirrors styles.css's .logo-icon pulse; redeclared because styles.css is unreachable here. */
@keyframes pulse {
    0%, 100% { transform: scale(1); }
    50% { transform: scale(1.1); }
}

.auth-brand-name {
    font-size: 1.8rem;
    font-weight: 700;
    letter-spacing: 1px;
    white-space: nowrap;
}

.auth-nav {
    display: flex;
    flex-wrap: wrap;
    list-style: none;
    gap: 0.5rem;
    margin: 0;
    padding: 0;
}

.auth-nav a {
    color: #fff;
    text-decoration: none;
    font-weight: 500;
    padding: 0.5rem 1rem;
    border-radius: 8px;
    white-space: nowrap;
    transition: background-color 0.3s ease;
}

.auth-nav a:hover {
    background-color: rgba(255, 255, 255, 0.2);
}

/* --- Cross-login link ---------------------------------------------------- */
/* The discreet cross-login doors (FR-NAV-2 login-page carve-out): participant login
   -> admin login, and admin login -> participant login. Colour is fixed here rather
   than inherited so contrast is the same on both surfaces; 4.83:1 on #fff, WCAG AA. */
.auth-admin-link {
    color: #5C636A;
    text-decoration: underline;
}

.auth-admin-link:hover {
    color: #2B6CB0;
}