/* Two-step sign-in chrome.

   SHARED SHEET because these classes render on three surfaces that do not
   share a layout: the sign-in page, the standalone enrolment page, and the
   Security page inside AdminShell. Styling them in any one page's <style>
   block would leave the other two rendering naked, and nothing would fail:
   the build passes, the page returns 200, the script works perfectly.

   Tokens are used with fallbacks throughout, because those three surfaces do
   not agree on a palette. The sign-in and enrolment pages are standalone and
   carry only their own small theme block. */

/* Visually hidden, still read aloud. Deliberately NOT called .sr-only: that
   name is defined in exactly one page's style block (TeamShell), so borrowing
   it here would render this label at full size on the sign-in page and nothing
   would fail to warn us. */
.mfa-sr {
  position: absolute;
  width: 1px;
  height: 1px;
  padding: 0;
  margin: -1px;
  overflow: hidden;
  clip: rect(0 0 0 0);
  white-space: nowrap;
  border: 0;
}

/* Gated behind :not([hidden]) so the attribute still wins. A bare `display:`
   beats [hidden] and would render the code step under the password form on
   every load. */
.mfa-step:not([hidden]) {
  display: grid;
  gap: 12px;
}

/* The code itself. 16px MINIMUM and not negotiable: below that, iOS Safari
   zooms the page on focus and does not zoom back, which on the one screen
   standing between somebody and their own payroll is a bad place to be. Set
   well above it because six digits read badly small.

   THE CLASS IS DOUBLED TO WIN A SPECIFICITY FIGHT, and that is not a tidying
   opportunity. Astro rewrites a page's scoped `input { }` rule into
   `input[data-astro-cid-xxxx] { }`, which is specificity (0,1,1) and therefore
   beats a plain `.mfa-code` (0,1,0) from this shared sheet no matter what
   order they load in. The sign-in page has exactly such a rule, so without
   this the code field silently rendered as an ordinary 16px input: the right
   markup, the right stylesheet, the wrong size, and nothing failing anywhere.
   Doubling the class makes it (0,2,0), which wins cleanly. */
.mfa-code,
.mfa-code.mfa-code {
  font-size: 1.6rem;
  letter-spacing: 0.28em;
  text-align: center;
  font-variant-numeric: tabular-nums;
  padding: 12px 10px;
  width: 100%;
  box-sizing: border-box;
  border: 1px solid var(--line, #d9d2c8);
  border-radius: var(--r-md, 10px);
  background: var(--card, #fff);
  color: var(--ink, #23201c);
}

.mfa-code::placeholder {
  letter-spacing: 0.18em;
  opacity: 0.45;
}

.mfa-code:focus-visible {
  outline: 2px solid var(--ember, #b4531f);
  outline-offset: 2px;
}

/* The alternatives, laid out as a row of plain text buttons rather than hidden
   behind a link. Somebody reaching for a backup code has usually already had
   one thing go wrong; making them hunt is the wrong moment for it. */
.mfa-alts,
.mfa-alts.mfa-alts {
  margin-top: 4px;
  display: flex;
  flex-wrap: wrap;
  gap: 6px 16px;
  justify-content: center;
  font-size: 0.85rem;
}

/* Doubled for the same reason .mfa-code is: a page's scoped `button { }`
   becomes `button[data-astro-cid-xxxx]` at (0,1,1) and would otherwise paint
   these as full-width ember buttons. Three of them stacked under the real
   submit is not a smaller decision than it sounds: it makes "use a backup
   code" look like the main action. */
.mfa-alt,
.mfa-alt.mfa-alt {
  background: none;
  border: 0;
  width: auto;
  margin: 0;
  padding: 4px 2px;
  color: var(--ember, #b4531f);
  text-decoration: underline;
  cursor: pointer;
  font: inherit;
  font-size: 0.85rem;
  font-weight: 400;
  transform: none;
}

.mfa-alt.mfa-alt:hover {
  background: none;
  transform: none;
}

.mfa-alt:disabled {
  opacity: 0.5;
  cursor: default;
}

.mfa-note {
  font-size: 0.85rem;
  color: var(--muted, #6b6257);
  text-align: center;
  margin: 0;
}

/* The QR. White plate always, even in dark mode: a scanner needs the contrast
   and an inverted QR does not read on many phones. */
.mfa-qr {
  display: grid;
  place-items: center;
  background: #fff;
  padding: 14px;
  border-radius: var(--r-md, 10px);
  border: 1px solid var(--line, #d9d2c8);
  margin: 0 auto;
  width: fit-content;
}

.mfa-qr img,
.mfa-qr canvas,
.mfa-qr table {
  display: block;
  width: 208px;
  height: 208px;
  image-rendering: pixelated;
}

/* The typed-out secret, for a password manager or a phone that will not scan. */
.mfa-secret {
  font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
  font-size: 0.95rem;
  letter-spacing: 0.08em;
  word-break: break-all;
  background: var(--tint, rgba(0, 0, 0, 0.04));
  border-radius: var(--r-md, 10px);
  padding: 10px 12px;
  text-align: center;
}

/* Backup codes. Shown once, so they are laid out to be read off paper and
   typed back by somebody who is already having a bad day. */
.mfa-codes {
  display: grid;
  grid-template-columns: repeat(auto-fit, minmax(140px, 1fr));
  gap: 8px;
  font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
  font-size: 1rem;
  letter-spacing: 0.06em;
  background: var(--tint, rgba(0, 0, 0, 0.04));
  border-radius: var(--r-md, 10px);
  padding: 14px;
  margin: 0;
  list-style: none;
}

.mfa-codes li {
  text-align: center;
  padding: 4px 0;
}

.mfa-used {
  opacity: 0.45;
  text-decoration: line-through;
}

/* The one warning that has to land. */
.mfa-warn {
  border: 1px solid var(--ember, #b4531f);
  border-radius: var(--r-md, 10px);
  padding: 12px 14px;
  font-size: 0.9rem;
  line-height: 1.45;
}

.mfa-warn strong {
  display: block;
  margin-bottom: 4px;
}

.mfa-status {
  display: inline-flex;
  align-items: center;
  gap: 7px;
  font-size: 0.9rem;
  font-weight: 600;
}

.mfa-dot {
  width: 9px;
  height: 9px;
  border-radius: 50%;
  background: var(--muted, #6b6257);
  flex: none;
}

.mfa-on .mfa-dot { background: #2e7d47; }
.mfa-off .mfa-dot { background: var(--ember, #b4531f); }

@media print {
  /* Printing the backup codes is a supported way to keep them. */
  .mfa-alts, .mfa-alt, button { display: none !important; }
  .mfa-codes { border: 1px solid #000; }
}