/* Server-rendered auth + account pages — one shared frame: brand topbar,
   top-aligned content (no vertical centring → no layout shift), footer. */
.sso-shell {
  display: flex;
  flex-direction: column;
  min-block-size: 100dvh;
  background-color: var(--background-alt-grey);
}

.sso-shell__main {
  flex: 1 1 auto;
  inline-size: 100%;
  padding: 1.5rem;
}

.sso-shell__main--focus {
  max-inline-size: 25rem;
  margin-inline: auto;
}

.sso-shell__main--wide {
  max-inline-size: 48rem;
  margin-inline: auto;
}

/* No topbar — the dataesr wordmark sits above the content and links home. The
   word is inlined SVG with `fill: currentColor`, so `color` themes it
   (light/dark); the point stays émeraude. Height drives the size. */
.sso-logo {
  display: inline-flex;
  background-image: none;
  view-transition-name: sso-logo;
  margin: var(--title-spacing);
}

.sso-logo svg {
  display: block;
  block-size: 2.25rem;
  inline-size: auto;
  color: var(--text-title-grey);
  margin-left: -0.25rem;
}

.sso-footer {
  align-items: center;
  box-shadow: inset 0 1px 0 0 var(--border-default-grey);
  display: flex;
  flex-direction: row;
  flex-wrap: wrap;
  margin-top: 2.5rem;
  justify-content: center;
  padding: 0.375rem 0;
  view-transition-name: sso-footer;
}
.sso-footer ul {
  width: auto !important;
  margin: 0;
  padding: 0;
}
.sso-header {
  view-transition-name: sso-header;
  padding: 1rem 1.5rem;
}
.sso-header .fr-logo {
  font-size: 0.7875rem;
}

/* --- Account page sections ---------------------------------------------- */
.sso-account__header {
  display: flex;
  align-items: flex-end;
  justify-content: space-between;
  gap: 1rem 1.5rem;
  flex-wrap: wrap;
  margin-block-end: 0;
}

/* Settings sections (no cards, no borders): a titled/described header over a
   stack of rows. Sections are told apart by spacing alone — the hairline +
   rhythm live on the row, not the section. */
.sso-account__grid {
  display: flex;
  flex-direction: column;
}

/* Every section (the first included) sits 4rem below what precedes it — the
   account header for the first, the previous section otherwise. */
.sso-section {
  margin-block-start: 4rem;
}

.sso-section__intro {
  margin-block-end: 0.75rem;
}

.sso-section__action {
  margin-block-start: 1.5rem;
}

/* Theme picker — a DSFR segmented control, RESPONSIVE. The artwork sits to the
   LEFT of the label at every width; only the segment flow changes. Below 48rem
   the segments STACK full-width (a horizontal row would squeeze the labels into
   wrapping); from 48rem up they sit SIDE BY SIDE as equal-width columns. */
.sso-scheme-seg {
  display: flex;
  padding-block: 1.5rem;
}

.sso-scheme-seg .fr-segmented__elements {
  width: 100%;
  flex-direction: column;
}

/* Artwork left of the label, at every width. */
.sso-scheme-seg input + label {
  justify-content: flex-start;
  gap: 1rem;
  padding: 0.75rem 1rem;
  white-space: normal;
}

.sso-scheme-seg__img {
  display: flex;
  flex: 0 0 auto;
}

.sso-scheme-seg__img svg {
  display: block;
  inline-size: 2.5rem;
  block-size: 2.5rem;
}

/* From 48rem: equal-width segments side by side. Each element is a flex box so
   its label fills the row's stretched height (segments stay equal if one wraps). */
@media (min-width: 48rem) {
  .sso-scheme-seg .fr-segmented__elements {
    flex-direction: row;
  }

  .sso-scheme-seg .fr-segmented__element {
    display: flex;
    flex: 1 1 0;
  }

  .sso-scheme-seg input + label {
    inline-size: 100%;
  }
}

/* The row — the repeated unit across every section. Icon · body (bold title +
   grey meta) · actions. Each row is fenced from the one above by a top hairline
   and padded top/bottom; the first row in a group drops the rule (the section
   header already separates it). */
.sso-rows {
  display: flex;
  flex-direction: column;
}

.sso-row {
  display: flex;
  align-items: flex-start;
  gap: 1rem;
  padding-block: 1.25rem;
  border-block-start: 1px solid var(--border-default-grey);
}

/* First row keeps its top padding (air under the section title) but drops the
   rule — the header already separates it. */
.sso-rows > .sso-row:first-child {
  border-block-start: none;
}

.sso-row__icon {
  flex: 0 0 auto;
  margin-block-start: 0.125rem;
  color: var(--text-title-grey);
}

.sso-row__icon::before {
  --icon-size: 1.25rem;
}

.sso-row__body {
  flex: 1 1 auto;
  min-inline-size: 0;
}

.sso-row__title {
  font-weight: 700;
}

.sso-row__title .fr-badge {
  margin-inline-start: 0.5rem;
  vertical-align: middle;
}

.sso-row__meta {
  margin-block-start: 0.25rem;
  color: var(--text-mention-grey);
  font-size: 0.875rem;
  line-height: 1.5;
  overflow-wrap: anywhere;
}

.sso-row__meta .fr-hint-text {
  display: block;
  margin: 0;
}

.sso-row__with-badge .fr-badge {
  margin-inline-start: 0.5rem;
  vertical-align: middle;
}

.sso-row__actions {
  flex: 0 0 auto;
}

/* API keys list: the short prefix shown per row (rows use the generic .sso-row). */
.sso-key__prefix {
  font-size: 0.75rem;
  color: var(--text-mention-grey);
}

/* A copyable secret: a boxed <code> value with a copy icon tucked into its
   trailing padding (CopyField) — same pattern as the password reveal toggle. No
   separate button. Used for the one-time API key, the 2FA manual-entry secret. */
.sso-code {
  position: relative;
}

.sso-code__value {
  display: block;
  padding: 0.5rem 2.75rem 0.5rem 0.75rem;
  background-color: var(--background-default-grey);
  border: 1px solid var(--border-default-grey);
  font-family: ui-monospace, monospace;
  font-size: 0.875rem;
  overflow-wrap: anywhere;
}

.sso-code__copy {
  position: absolute;
  inset-block-start: 0.25rem;
  inset-inline-end: 0.25rem;
  display: inline-flex;
  align-items: center;
  justify-content: center;
  inline-size: 2rem;
  block-size: 2rem;
  padding: 0;
  color: var(--text-mention-grey);
  background: none;
  border: none;
  cursor: pointer;
}

.sso-code__copy::before {
  --icon-size: 1rem;
}

.sso-code__copy:hover {
  color: var(--text-title-grey);
  background: none !important;
}

/* One-time code (OTP) entry: a classic `.fr-input` whose content is a fixed
   6-cell, left-aligned monospace group, padded so it sits centred in the box.
   The island overlays a `.sso-otp__ghost` showing "-" in the not-yet-filled
   cells (same font/spacing/left-pad → the cells line up), so the typed digits
   progressively replace the dashes. Without JS it's a plain (dash-less) field. */
.sso-otp,
.sso-otp__ghost {
  font-family: ui-monospace, "Courier New", monospace;
  letter-spacing: 0.5ch;
  text-align: left;
  padding-inline-start: calc(50% - 4.25ch);
  font-variant-numeric: tabular-nums;
}

.sso-otp-wrap {
  position: relative;
}
.sso-otp-wrap input {
  margin-top: 0.5rem;
}

.sso-otp__ghost {
  position: absolute;
  inset: 0;
  display: flex;
  align-items: center;
  color: var(--text-disabled-grey);
  pointer-events: none;
  white-space: pre;
}

/* --- Modal ---------------------------------------------------------------
   A native <dialog> opened by the island via `showModal()` — top layer + focus
   trap + Esc + `::backdrop` for free. The PANEL inside is DSFR's own modal
   structure (fr-container > fr-grid-row > fr-col > fr-modal__body/__header/
   __content/__footer), so the responsive width, near-full-height mobile body,
   internal scroll and sticky footer all come from DSFR. We only make the
   <dialog> fill the viewport and vertically centre that structure. The UA caps a
   `:modal` dialog's size, so width/height/max are set explicitly. */
.sso-modal {
  width: 100%;
  height: 100%;
  max-width: 100%;
  max-height: 100%;
  margin: 0;
  padding: 0;
  border: none;
  background: transparent;
}

.sso-modal[open] {
  display: flex;
}

.sso-modal::backdrop {
  background-color: rgba(22, 22, 22, 0.64);
}

/* DSFR's container fills the dialog; auto block-margins centre the panel when
   it's shorter than the viewport (desktop), while its own max-height keeps it
   scrolling within near-full height on mobile. */
.sso-modal > .fr-container {
  width: 100%;
  margin-block: auto;
}

/* Lock the page scroll while any modal is open. */
html:has(dialog.sso-modal[open]) {
  overflow: hidden;
}

/* Destructive action button (confirm / delete). Two classes beat DSFR's single
   `.fr-btn`, so the red wins without `!important`. */
.fr-btn.sso-btn-danger {
  background-color: var(--background-action-high-error);
  color: var(--text-inverted-error);
}

.fr-btn.sso-btn-danger:hover {
  background-color: var(--background-action-high-error-hover);
}
.fr-btn.sso-btn-danger:active {
  background-color: var(--background-action-high-error-active);
}

/* Cross-document view transitions — smooth, no white flash between pages. */
@view-transition {
  navigation: auto;
}

/* Flash toast (bottom-right), matched to the kit toaster — server-rendered,
   auto-dismissed by a pure CSS animation (island adds click-close + URL cleanup). */
.sso-toaster {
  position: fixed;
  inset-block-end: 1.5rem;
  inset-inline: 0;
  z-index: 10001;
  display: flex;
  justify-content: flex-end;
  padding: 0 1rem;
  pointer-events: none;
}

.sso-toast {
  display: flex;
  align-items: center;
  gap: 0.5rem;
  padding: 1rem 1.5rem;
  max-inline-size: min(420px, 100%);
  /*background: var(--background-overlap-grey, var(--background-default-grey, #fff));*/
  /*box-shadow: var(--overlap-shadow, 0 4px 16px rgba(0, 0, 18, 0.24));*/
  /*border: 1px solid var(--border-default-grey);*/
  pointer-events: auto;
  animation: sso-toast-life 4.5s ease forwards;
}

.sso-toast__icon {
  flex-shrink: 0;
}

.sso-toast__icon::before {
  --icon-size: 1.5rem;
}

.sso-toast--success {
  background-position: 0 0;
  background-repeat: no-repeat;
  background-size: 0.25rem 100%;
  background-color: var(--background-contrast-green-emeraude);
  background-image: linear-gradient(
    0deg,
    var(--border-default-green-emeraude),
    var(--border-default-green-emeraude)
  );
}

.sso-toast--error {
  background-position: 0 0;
  background-repeat: no-repeat;
  background-size: 0.25rem 100%;
  background-color: var(--background-contrast-orange-terre-battue);
  background-image: linear-gradient(
    0deg,
    var(--border-default-orange-terre-battue),
    var(--border-default-orange-terre-battue)
  );
}

.sso-toast--success .sso-toast__icon {
  color: var(--border-default-green-emeraude);
}

.sso-toast--error .sso-toast__icon {
  color: var(--border-default-orange-terre-battue);
}

.sso-toast__content {
  flex: 1;
  min-inline-size: 0;
  margin: 0;
  font-size: 0.875rem;
  line-height: 1.5;
  color: var(--text-title-grey);
}

.sso-toast__close {
  flex-shrink: 0;
  inline-size: 1.5rem;
  block-size: 1.5rem;
  margin: -0.5rem -0.5rem -0.5rem 0;
  padding: 0;
  border: none;
  background: none;
  color: var(--text-mention-grey);
  cursor: pointer;
}

.sso-toast__close::before {
  --icon-size: 1rem;
}

.sso-toast__close:hover {
  color: var(--text-title-grey);
}

.sso-toast.is-dismissed {
  animation: sso-toast-exit 0.2s ease-in forwards;
}

@keyframes sso-toast-life {
  0% {
    opacity: 0;
    transform: translateY(1rem);
  }
  6% {
    opacity: 1;
    transform: translateY(0);
  }
  92% {
    opacity: 1;
    transform: translateY(0);
  }
  100% {
    opacity: 0;
    transform: translateY(1rem);
    visibility: hidden;
  }
}

@keyframes sso-toast-exit {
  to {
    opacity: 0;
    transform: translateY(1rem);
    visibility: hidden;
  }
}

@media (prefers-reduced-motion: reduce) {
  .sso-toast {
    animation: none;
  }
}

/* Top navigation progress bar (added by the island during navigation). */
.sso-progress {
  position: fixed;
  inset-block-start: 0;
  inset-inline-start: 0;
  block-size: 4px;
  inline-size: 0;
  background-color: var(--artwork-minor-green-emeraude);
  z-index: 2000;
  transition: width 0.3s ease-out;
}

@media (prefers-reduced-motion: reduce) {
  .sso-progress {
    transition: none;
  }
}

/* Password field: reveal toggle sits inside the input's right edge. */
.sso-password {
  position: relative;
}

.sso-password input {
  margin-top: 0.5rem;
  padding-inline-end: 2.75rem;
}

.sso-password__toggle {
  position: absolute;
  inset-block-start: 50%;
  inset-inline-end: 0.25rem;
  transform: translateY(-50%);
  display: inline-flex;
  align-items: center;
  justify-content: center;
  inline-size: 2rem;
  block-size: 2rem;
  padding: 0;
  color: var(--text-mention-grey);
  background: none;
  border: none;
  cursor: pointer;
}

.sso-password__toggle::before {
  --icon-size: 1rem;
}

.sso-password__toggle:hover {
  color: var(--text-title-grey);
  background: none !important;
}

/* Live password requirements checklist. */
.sso-pw-rules {
  margin: 0.5rem 0 0;
  padding: 0;
  list-style: none;
  font-size: 0.75rem;
  line-height: 1.6;
  color: var(--text-mention-grey);
}

.sso-pw-rules li {
  display: flex;
  align-items: center;
  gap: 0.5rem;
}

.sso-rule__icon {
  flex: 0 0 auto;
  inline-size: 0.5rem;
  block-size: 0.5rem;
  border-radius: 50%;
  background-color: var(--border-default-grey);
}

.sso-pw-rules li.is-valid {
  color: var(--text-default-success);
}

.sso-pw-rules li.is-valid .sso-rule__icon {
  background-color: var(--background-flat-success, var(--text-default-success));
}

/* 2FA enrollment: centred QR + one-time recovery codes. */
.sso-2fa-qr {
  display: flex;
  justify-content: center;
  margin: 1rem 0;
}

.sso-2fa-qr img {
  border: 1px solid var(--border-default-grey);
}

/* Recovery codes: a boxed grid with a copy icon tucked into its top-right
   corner (same affordance as .sso-code, sized for the block). */
.sso-recovery {
  position: relative;
  margin: 1rem 0;
}

.sso-recovery__copy {
  position: absolute;
  inset-block-start: 0.5rem;
  inset-inline-end: 0.5rem;
  z-index: 1;
  display: inline-flex;
  align-items: center;
  justify-content: center;
  inline-size: 2rem;
  block-size: 2rem;
  padding: 0;
  color: var(--text-mention-grey);
  background: none;
  border: none;
  cursor: pointer;
}

.sso-recovery__copy::before {
  --icon-size: 1rem;
}

.sso-recovery__copy:hover {
  color: var(--text-title-grey);
  background: none !important;
}

.sso-recovery-codes {
  display: grid;
  grid-template-columns: repeat(2, 1fr);
  gap: 0.25rem 1rem;
  margin: 0;
  padding: 2.5rem 1rem 1rem;
  list-style: none;
  background-color: var(--background-alt-grey);
  font-family: monospace;
  text-align: center;
}

.sso-caps {
  color: var(--text-default-warning);
}

.sso-submitting {
  opacity: 0.7;
  pointer-events: none;
}