/*
 * Auth-screen Oat variant — `[data-oat-root][data-oat-auth]`.
 *
 * Why this file exists rather than reusing the admin theme wholesale:
 *
 * The vendored Oat bundle (oat-admin.css) prefixes EVERY selector with
 * `[data-oat-root] `, so that attribute is the only way to opt a subtree into
 * Oat's component styling. But admin.css hangs three full-bleed *app-shell*
 * rules off the bare presence of that same attribute anywhere inside #app:
 *
 *   [data-oat-root]                     { height: 100dvh }
 *   #app:has([data-oat-root])           { padding: 0; display: block }
 *   body:has(#app [data-oat-root]) peppi-app-header { display: none }
 *
 * Those exist for the operator console, where screens/admin/adminShell.ts owns
 * the whole viewport (topnav + sidebar + main). An auth screen is not that: it
 * is one centred column inside the ordinary patient app frame, and it is seen
 * by every staff and partner-admin user during MFA enrolment — not just
 * operators. Inheriting the rules above would silently hide the app header and
 * strip the layout padding base.css reserves for it.
 *
 * So auth screens carry BOTH attributes: `data-oat-root` buys the vendored
 * component styling, and `data-oat-auth` opts back out of the shell chrome
 * below. admin.css is left untouched, so the ten admin screens are unaffected.
 *
 * Loaded after admin.css in index.html; every override below also wins on
 * specificity (two attribute selectors vs one), so file order is not the only
 * thing holding it up.
 */

/* ---------------------------------------------------------------------------
 * Opt out of the admin console's full-bleed shell chrome
 * ------------------------------------------------------------------------- */

/* The admin shell is the viewport; an auth card is only as tall as it needs. */
[data-oat-root][data-oat-auth] {
  height: auto;
}

/* Restore the frame base.css gives #app — the app header and tab bar still
 * render on auth routes, so their reserved space has to come back. Values are
 * mirrored from base.css #app; keep them in sync if that block changes. */
#app:has([data-oat-root][data-oat-auth]) {
  display: flex;
  padding-top: calc(56px + env(safe-area-inset-top, 0px));
  padding-bottom: 92px;
}

/* Mirrors components.css `peppi-app-header { display: block }`. The component
 * still hides itself imperatively (inline `display: none`) when it decides it
 * should not show, and an inline style outranks this rule — so this restores
 * the default without overriding the component's own decision. */
body:has(#app [data-oat-root][data-oat-auth]) peppi-app-header {
  display: block;
}

/* ---------------------------------------------------------------------------
 * TOTP enrolment (screens/totp-enroll/TotpEnrollScreen.ts)
 * ------------------------------------------------------------------------- */

[data-oat-root][data-oat-auth] .totp-enroll {
  display: flex;
  flex-direction: column;
  gap: var(--space-4);
}

[data-oat-root][data-oat-auth] .totp-enroll__header h1 {
  margin: 0 0 var(--space-2);
  font-size: var(--text-3);
  line-height: 1.25;
}

[data-oat-root][data-oat-auth] .totp-enroll__lede {
  margin: 0;
  color: var(--muted-foreground);
  font-size: var(--text-7);
}

/* Status text for the loading branch. */
[data-oat-root][data-oat-auth] .totp-enroll__status {
  margin: 0;
  color: var(--muted-foreground);
}

/* ----- Step cards ----- */

[data-oat-root][data-oat-auth] .totp-enroll .card {
  padding: var(--space-5);
}

/* ----- QR ----- */

/* The QR must sit on plain white with a quiet zone regardless of the surface
 * colour behind it, or scanners lose the finder patterns. */
[data-oat-root][data-oat-auth] .totp-enroll-qr {
  display: grid;
  place-items: center;
  padding: var(--space-4);
  background-color: #fff;
  border: 1px solid var(--border);
  border-radius: var(--radius-medium);
}

[data-oat-root][data-oat-auth] .totp-enroll-qr svg {
  width: 100%;
  max-width: 220px;
  height: auto;
}

[data-oat-root][data-oat-auth] .totp-enroll-qr-fallback {
  margin: 0;
  color: var(--muted-foreground);
  font-size: var(--text-8);
  text-align: center;
}

/* ----- Manual key disclosure ----- */

[data-oat-root][data-oat-auth] .totp-enroll-manual-key {
  margin-block-start: var(--space-4);
}

[data-oat-root][data-oat-auth] .totp-enroll-manual-key__label {
  padding: var(--space-3) var(--space-4);
  font-size: var(--text-8);
}

/* Oat's `details > *:not(summary)` margin would double up with the field gaps;
 * one body element owns the padding instead. */
[data-oat-root][data-oat-auth] .totp-enroll-manual-key__body {
  display: flex;
  flex-direction: column;
  gap: var(--space-1);
  margin: var(--space-4);
}

[data-oat-root][data-oat-auth] .totp-enroll-manual-key__caption {
  margin: 0;
  color: var(--muted-foreground);
  font-size: var(--text-8);
  font-weight: var(--font-medium);
}

[data-oat-root][data-oat-auth] .totp-enroll-manual-key__caption + * {
  margin-block-end: var(--space-3);
}

/* Long unbroken strings — a base32 secret and an otpauth:// URL — must stay
 * inside the card. Wrap anywhere, and cap the height so a very long issuer
 * label scrolls in place instead of pushing the CTA off screen. */
[data-oat-root][data-oat-auth] .totp-enroll-manual-key__value,
[data-oat-root][data-oat-auth] .totp-enroll-manual-key__url {
  display: block;
  padding: var(--space-2) var(--space-3);
  font-family: var(--font-mono);
  font-size: var(--text-8);
  line-height: 1.7;
  overflow-wrap: anywhere;
  word-break: break-word;
  background-color: var(--faint);
  color: var(--foreground);
  border: 1px solid var(--border);
  border-radius: var(--radius-small);
  max-height: 7.5rem;
  overflow-y: auto;
}

[data-oat-root][data-oat-auth] .totp-enroll-manual-key__value {
  letter-spacing: 0.08em;
  font-weight: var(--font-medium);
}

/* Value + copy button on one row; the value takes the slack. */
[data-oat-root][data-oat-auth] .totp-enroll-copyrow {
  display: flex;
  align-items: flex-start;
  gap: var(--space-2);
}

[data-oat-root][data-oat-auth] .totp-enroll-copyrow > code {
  flex: 1;
  min-width: 0;
}

[data-oat-root][data-oat-auth] .totp-enroll-copyrow > button {
  flex-shrink: 0;
}

/* ----- Recovery codes ----- */

/* Warning-toned surface: these are single-use credentials shown once, and the
 * box has to read as "write this down" rather than as more body copy. */
[data-oat-root][data-oat-auth] .totp-enroll-recovery {
  border-inline-start: 3px solid var(--warning);
}

[data-oat-root][data-oat-auth] .totp-enroll-recovery__title {
  margin: 0 0 var(--space-1);
  font-size: var(--text-5);
}

[data-oat-root][data-oat-auth] .totp-enroll-recovery__hint {
  margin: 0 0 var(--space-4);
  color: var(--muted-foreground);
  font-size: var(--text-8);
}

[data-oat-root][data-oat-auth] .totp-enroll-recovery-codes {
  display: grid;
  grid-template-columns: repeat(auto-fill, minmax(9.5rem, 1fr));
  gap: var(--space-2);
  margin: 0;
  padding: 0;
  list-style-position: inside;
}

[data-oat-root][data-oat-auth] .totp-enroll-recovery-code {
  padding: var(--space-2) var(--space-3);
  font-family: var(--font-mono);
  font-size: var(--text-8);
  letter-spacing: 0.06em;
  background-color: var(--faint);
  border: 1px solid var(--border);
  border-radius: var(--radius-small);
  overflow-wrap: anywhere;
}

[data-oat-root][data-oat-auth] .totp-enroll-recovery-code::marker {
  color: var(--muted-foreground);
  font-family: var(--font-sans);
  font-size: var(--text-8);
}

/* ----- Actions ----- */

[data-oat-root][data-oat-auth] .totp-enroll-actions {
  display: flex;
  flex-direction: column;
  gap: var(--space-2);
  margin-block-start: var(--space-2);
}

[data-oat-root][data-oat-auth] .totp-enroll-actions > button {
  width: 100%;
}