/* auth.css — sign-in and the other password screens. Black page, small label, 30px heading, two tall
   fields, one quiet grey link, and one white pill pinned to the bottom of the screen. On a desktop the
   same column is 420px and centred. Colours come from brand/dpt.v5.css. */

/* The app footer would sit in the middle of this short screen; the auth screens carry
   their own one-line foot above the pill instead. */
body:has(.auth) .footer { display: none; }
/* Every sign-in screen carries its own lockup; the top bar's mark would be a second logo off the column's edge. */
body:has(.auth) .topbar { display: none; }
main:has(.auth) { padding: 0 16px; }

.auth {
  display: flex;
  flex-direction: column;
  max-width: 400px;
  min-height: 0;
  margin: 0 auto;
  padding: 24px 8px 32px;
  /* Heading, labels, links and notes start where the typed text starts inside a field. */
  --auth-inset: 22px;
}
.auth-label { display: block; margin: 0 0 6px; color: var(--dp5-text-2); font-size: 13px; font-weight: 600; }

.auth-lockup { display: block; height: 32px; width: auto; margin: 0 auto 32px; }

.auth .dp4-eyebrow { display: block; margin-left: var(--auth-inset); }

.auth h1 {
  font-size: var(--dp4-t-h1);
  font-weight: 500;
  letter-spacing: -.01em;
  margin: 10px 0 28px var(--auth-inset);
}

.auth-form { display: block; }
.auth > .auth-bottom { margin-top: 16px; }
.auth .dp4-field { margin-bottom: 12px; }
.auth .dp4-field-wrap { margin-bottom: 12px; }
.auth .dp4-field-wrap .dp4-field { margin-bottom: 0; padding-right: 88px; }

/* Show sits inside the trailing 44px of the PIN field, so the PIN field, the email field and the
   button share one right edge. */
.auth .dp4-field-wrap { position: relative; }
.auth .dp4-field-wrap .dp4-field { width: 100%; padding-right: 56px; }
.auth .dp4-field-aux {
  position: absolute;
  right: 0;
  top: 50%;
  transform: translateY(-50%);
  min-width: 44px;
  min-height: 44px;
  height: 44px;
  padding: 0 8px;
  display: inline-flex;
  align-items: center;
  justify-content: center;
  color: var(--dp5-text-2);
}

/* Known device: the address is plain text with one quiet link under it. */
.auth-who { margin: -12px 0 6px var(--auth-inset); font-size: 17px; line-height: 1.4; color: var(--dp5-text); overflow-wrap: anywhere; }
.auth-switch { display: inline-block; margin: 0 0 20px var(--auth-inset); font-size: 14px; }

/* Grey is allowed on sign-in only. */
.auth-quiet {
  display: inline-block;
  margin: 6px 0 0 var(--auth-inset);
  text-align: left;
}
/* One quiet line of help under the PIN field and under the code link. */
.auth-hint { margin: 0 0 0 var(--auth-inset); font-size: 13px; line-height: 1.4; color: var(--dp5-text-3); }
.auth-hint--link { margin-top: 2px; }
.auth-links .dp4-link:disabled { color: var(--dp5-text-off); cursor: default; text-decoration: none; }
.auth-links { display: flex; flex-direction: column; align-items: flex-start; gap: 14px; margin: 18px 0 0 var(--auth-inset); }

.auth .field-error { margin: 2px 0 0 var(--auth-inset); }
/* Sign-in keeps the room for its red message open all the time, so a wrong PIN or code never
   moves the link or the Sign in button. Two lines of its own type (14px / 1.3 = 36.4px): the longest message,
   "That email and PIN didn't work. You can email yourself a code instead.", is two lines at every width.
   Sign-in and its code step only (login.ejs prints the line empty when there is no message). */
.auth[data-login-step] .field-error { min-height: 2.6em; }
.auth[data-wp-step] .field-error { min-height: 4em; }

.auth-bottom { margin-top: 16px; padding-top: 0; }
.auth-foot {
  margin: 0 0 20px var(--auth-inset);
  text-align: left;
  font-size: 13px;
  line-height: 1.5;
  color: var(--dp5-text-3);
}
.auth-foot a { display: inline-flex; align-items: center; min-height: 44px; color: var(--dp4-text-2); white-space: nowrap; }
/* FAQ and Privacy are one unit: when the line has to wrap, it wraps before them, never between them. */
.auth-foot .auth-nowrap { white-space: nowrap; }
/* On a phone the pair takes its own line, so the dot that joins it to the email line would start that line. */
@media (max-width: 480px) { .auth-foot .auth-nowrap { display: block; } .auth-foot .auth-lead { display: none; } }
.auth-foot a:hover { color: var(--dp4-text); }
.auth-btn { width: 100%; height: 40px; min-height: 40px; border-radius: var(--dp4-r-pill, 999px); margin-bottom: 12px; }
.auth .dp4-link, .auth-foot a {
  color: var(--dp4-link);
  text-decoration: none;
  text-underline-offset: 2px;
  text-decoration-thickness: 1px;
}
.auth .dp4-link:hover, .auth .dp4-link:focus-visible, .auth-foot a:hover, .auth-foot a:focus-visible { color: var(--dp4-link-hover); text-decoration: underline; }

@media (max-width: 768px), (pointer: coarse) {
  main:has(.auth) { padding-bottom: 24px; }
  .auth { min-height: 0; padding-bottom: 24px; }
  .auth-btn { min-height: 44px; height: 44px; }
  .auth-bottom { position: static; left: auto; right: auto; bottom: auto; }
}

/* The credential pages that are not sign-in keep the same column and type, and read
   as prose: a short line under the h1 is allowed there (it is the whole screen). */
.auth-say { color: var(--dp4-text-2); font-size: 15px; line-height: 1.5; margin: -16px 0 24px var(--auth-inset); overflow-wrap: anywhere; }
.auth-say strong { color: var(--dp4-text); font-weight: 500; }
.auth .dp4-pill { margin: 0 0 18px; }
.auth label:not(.dp-sr) { margin: 0 0 8px var(--auth-inset); }