/* ─────────────────────────────────────────────────────────────────────────
   AUTH PAGES — set password, forgot password.

   The same room as the login screen: photograph behind, dark scrim over it,
   one white card in the middle. Someone following a reset link should not feel
   they have been handed off to a different system halfway through.

   Written against the design-system tokens rather than repeating login.ejs's
   inline <style> block, so these pages track the brand when it moves. login.ejs
   itself is left alone — it works, and rewriting a page nobody can sign in
   without is not a change to make alongside a feature.
   ───────────────────────────────────────────────────────────────────────── */

body.auth-body {
  margin: 0;
  min-height: 100vh;
  padding: 20px;
  display: flex;
  align-items: center;
  justify-content: center;
  position: relative;
  font-family: var(--ds-font-family);
  color: var(--ds-text-primary);
  background: url("/img/login-bg.jpg") no-repeat center center fixed;
  background-size: cover;
  background-color: var(--ds-color-navy); /* while the photo loads, and if it 404s */
}

body.auth-body::before {
  content: "";
  position: fixed;
  inset: 0;
  background: rgba(0, 0, 0, 0.65);
  z-index: 0;
  pointer-events: none;
}

.auth-card {
  /* design-system.css sets no global border-box, so this is stated here.
     Without it the padding lands OUTSIDE max-width and the card renders 540px
     wide when it was asked for 460. */
  box-sizing: border-box;
  position: relative;
  z-index: 1;
  width: 100%;
  max-width: 460px;
  background: var(--ds-bg-card);
  border-radius: 16px;
  box-shadow: 0 4px 20px rgba(0, 0, 0, 0.15);
  padding: 44px 40px;
}

.auth-logo {
  display: block;
  width: 168px;
  margin: 0 auto 28px;
}

.auth-title {
  margin: 0 0 8px;
  font-size: var(--ds-font-size-h3);
  font-weight: var(--ds-font-weight-bold);
  line-height: 1.25;
  text-align: center;
  color: var(--ds-text-primary);
}

.auth-sub {
  margin: 0 0 28px;
  font-size: var(--ds-font-size-small);
  line-height: 1.6;
  text-align: center;
  color: var(--ds-text-secondary);
}

.auth-field {
  margin-bottom: 20px;
}

.auth-label {
  display: block;
  margin-bottom: 8px;
  font-size: var(--ds-font-size-small);
  font-weight: var(--ds-font-weight-semibold);
  color: var(--ds-text-primary);
}

.auth-input {
  box-sizing: border-box;
  width: 100%;
  padding: 13px 15px;
  border: 2px solid var(--ds-border-default);
  border-radius: var(--ds-radius-md);
  font-family: inherit;
  font-size: var(--ds-font-size-body);
  color: var(--ds-text-primary);
  background: var(--ds-bg-card);
  transition: border-color var(--ds-transition-base);
}

.auth-input:focus {
  border-color: var(--ds-color-brand);
  outline: none;
}

.auth-input:focus-visible {
  outline: 2px solid var(--ds-color-brand);
  outline-offset: 2px;
}

/* The rule, stated before it is broken rather than after. Sitting under the
   first password field, where it is read while choosing one. */
.auth-hint {
  margin: 6px 0 0;
  font-size: var(--ds-font-size-label);
  line-height: 1.5;
  color: var(--ds-text-tertiary);
}

.auth-btn {
  width: 100%;
  min-height: var(--ds-h-input);
  padding: 14px 20px;
  border: none;
  border-radius: var(--ds-radius-md);
  background: var(--ds-color-brand);
  color: var(--ds-text-on-brand);
  font-family: inherit;
  font-size: var(--ds-font-size-body);
  font-weight: var(--ds-font-weight-semibold);
  cursor: pointer;
  transition: background var(--ds-transition-base), transform var(--ds-transition-fast);
}

.auth-btn:hover {
  background: var(--ds-color-brand-hover);
}

.auth-btn:active {
  transform: translateY(1px);
}

.auth-btn:focus-visible {
  outline: 2px solid var(--ds-color-brand);
  outline-offset: 2px;
}

.auth-alert {
  margin: 0 0 20px;
  padding: 12px 14px;
  border-radius: var(--ds-radius-sm);
  font-size: var(--ds-font-size-small);
  line-height: 1.5;
  border: 1px solid;
}

.auth-alert.is-error {
  background: rgba(198, 53, 39, 0.06);
  border-color: rgba(198, 53, 39, 0.25);
  color: var(--ds-status-danger-text);
}

.auth-alert.is-success {
  background: rgba(16, 185, 129, 0.07);
  border-color: rgba(16, 185, 129, 0.3);
  color: var(--ds-status-success-text);
}

.auth-back {
  display: block;
  margin: 22px 0 0;
  text-align: center;
  font-size: var(--ds-font-size-small);
  color: var(--ds-text-tertiary);
  text-decoration: none;
}

.auth-back:hover {
  color: var(--ds-color-brand);
  text-decoration: underline;
}

.auth-back:focus-visible {
  outline: 2px solid var(--ds-color-brand);
  outline-offset: 2px;
  border-radius: var(--ds-radius-xs);
}

/* The dead-link state. No form, because there is nothing useful to type. */
.auth-dead {
  text-align: center;
}

.auth-dead .material-icons {
  font-size: 44px;
  color: var(--ds-text-faint); /* non-text, per the design system */
  margin-bottom: 12px;
}

@media (max-width: 600px) {
  .auth-card {
    padding: 32px 24px;
  }
  .auth-logo {
    width: 140px;
    margin-bottom: 22px;
  }
}