/*
 * GiG login theme — brand-agnostic.
 *
 * Every visual value here reads from a `--gig-*` CSS variable that Template
 * sets per active brand (see brands/types.ts -> brandCssVars). To restyle a
 * brand, edit its tokens file; to restructure, edit Template/Login. Avoid
 * hard-coding brand colours in this file.
 *
 * Rules are scoped under `.gig-login-root` so they win over Keycloak's
 * default PatternFly stylesheet (doUseDefaultCss=true) without !important.
 */

/* Reset the browser default `body { margin: 8px }`, which otherwise frames the
 * full-viewport login root and causes a slight overflow/scrollbar. */
html,
body {
    margin: 0;
    padding: 0;
}

.gig-login-root {
    --gig-radius: 14px;
    --gig-radius-sm: 9px;
    --gig-gap: 18px;

    min-height: 100vh;
    margin: 0;
    display: flex;
    flex-direction: column;
    align-items: center;
    justify-content: center;
    gap: var(--gig-gap);
    padding: 32px 16px;
    box-sizing: border-box;
    font-family: var(--gig-font);
    color: var(--gig-text);
    background: radial-gradient(1200px 600px at 50% -10%, var(--gig-bg-to), var(--gig-bg-from)) fixed;
}

.gig-login-root *,
.gig-login-root *::before,
.gig-login-root *::after {
    box-sizing: border-box;
}

/* ---- Header / logo ---- */
.gig-login-root #kc-header {
    width: 100%;
    max-width: 420px;
    display: flex;
    justify-content: center;
}
.gig-login-root #kc-header-wrapper {
    padding: 0;
    text-transform: none;
    letter-spacing: normal;
}
.gig-login-root .gig-logo {
    display: block;
    height: 44px;
    width: auto;
}

/* ---- Card ---- */
.gig-login-root .card-pf,
.gig-login-root #kc-form-card,
.gig-login-root .login-pf-page .card-pf {
    width: 100%;
    max-width: 420px;
    margin: 0;
    padding: 32px 32px 28px;
    background: var(--gig-surface);
    border: 1px solid var(--gig-surface-border);
    border-radius: var(--gig-radius);
    box-shadow: var(--gig-shadow);
}

.gig-login-root #kc-page-title {
    margin: 0 0 22px;
    font-size: 1.5rem;
    font-weight: 700;
    text-align: center;
    color: var(--gig-text);
}

/* "Required fields" header (profile pages, displayRequiredFields): the note +
 * title sit in grid columns (flattened by the global col reset above); style
 * the note as a small muted line above the centred title. */
.gig-login-root .login-pf-header .subtitle {
    display: block;
    margin: 0 0 4px;
    text-align: right;
    font-size: 0.8rem;
    font-weight: 500;
    color: var(--gig-text-muted);
}
.gig-login-root .login-pf-header .required {
    color: var(--gig-danger);
    margin-right: 2px;
}

/* Keycloak wraps many fields/rows in Bootstrap grid columns (col-*-12), which
 * carry float + ~15px gutters. We never want those inside the card, so strip
 * them everywhere — fields, the required-fields header, and the recovery-codes
 * confirmation checkbox all sit as clean full-width, flush-left blocks. */
.gig-login-root [class*="col-"] {
    float: none;
    width: 100%;
    padding-left: 0;
    padding-right: 0;
}
/* `form-horizontal` gives its .form-group rows -15px side gutters, which makes
 * e.g. the reset-otp submit button stretch past the option cards. Remove them. */
.gig-login-root .form-horizontal .form-group {
    margin-left: 0;
    margin-right: 0;
}

/* Forgot-password (reset) and update-password pages: inset the fields +
 * buttons a little from the card edges for a bit more breathing room. */
.gig-login-root #kc-reset-password-form,
.gig-login-root #kc-passwd-update-form {
    padding-left: 10px;
    padding-right: 10px;
}

/* Update-password page: separate the "sign out other devices" checkbox from
 * the buttons, and space the Submit / Cancel buttons apart when both show
 * (app-initiated action). */
.gig-login-root #kc-passwd-update-form #kc-form-buttons {
    margin-top: 20px;
    display: flex;
    gap: 12px;
}

/* ---- Labels & inputs ---- */
.gig-login-root label {
    color: var(--gig-text);
    font-weight: 600;
    font-size: 0.875rem;
}
.gig-login-root .form-group,
.gig-login-root #kc-form-wrapper .form-group {
    margin-bottom: var(--gig-gap);
}
.gig-login-root .control-label {
    margin-bottom: 6px;
    display: block;
}

.gig-login-root input[type="text"],
.gig-login-root input[type="email"],
.gig-login-root input[type="password"],
.gig-login-root .pf-c-form-control {
    width: 100%;
    height: 44px;
    padding: 0 14px;
    background: var(--gig-input-bg);
    color: var(--gig-text);
    border: 1px solid var(--gig-input-border);
    border-radius: var(--gig-radius-sm);
    font-size: 0.95rem;
    transition: border-color 0.15s ease, box-shadow 0.15s ease;
}
.gig-login-root input::placeholder {
    color: var(--gig-text-muted);
}
/* Autofilled inputs: browsers (especially in dark mode) paint their own
 * background + text colour on autofill, which clashes with the brand. Force the
 * brand's input colours instead. Paired with `color-scheme` on the login root
 * (set per brand in Template) this keeps autofill on-brand in light and dark. */
.gig-login-root input:-webkit-autofill,
.gig-login-root input:-webkit-autofill:hover,
.gig-login-root input:-webkit-autofill:focus,
.gig-login-root input:-webkit-autofill:active {
    -webkit-text-fill-color: var(--gig-text);
    caret-color: var(--gig-text);
    /* Overpaint the UA autofill background with the brand input background. */
    -webkit-box-shadow: 0 0 0 1000px var(--gig-input-bg) inset;
    box-shadow: 0 0 0 1000px var(--gig-input-bg) inset;
    /* Defer the autofill background swap effectively forever. */
    transition: background-color 9999s ease-out 0s;
}
.gig-login-root input[type="text"]:focus,
.gig-login-root input[type="email"]:focus,
.gig-login-root input[type="password"]:focus,
.gig-login-root .pf-c-form-control:focus {
    outline: none;
    border-color: var(--gig-primary);
    box-shadow: 0 0 0 3px color-mix(in srgb, var(--gig-primary) 30%, transparent);
}

/* Password reveal input group */
.gig-login-root .pf-c-input-group {
    display: flex;
    align-items: stretch;
}
.gig-login-root .pf-c-input-group input {
    border-top-right-radius: 0;
    border-bottom-right-radius: 0;
    border-right: none;
}
.gig-login-root .pf-c-input-group {
    background: transparent;
}
.gig-login-root .pf-c-input-group button {
    display: inline-flex;
    align-items: center;
    justify-content: center;
    min-width: 44px;
    padding: 0 12px;
    background: var(--gig-input-bg);
    color: var(--gig-text-muted);
    border: 1px solid var(--gig-input-border);
    border-left: none;
    border-top-right-radius: var(--gig-radius-sm);
    border-bottom-right-radius: var(--gig-radius-sm);
    cursor: pointer;
}
/* PatternFly's pf-m-control button paints its border + bottom accent via an
 * ::after/::before pseudo and ships a white background var. This affects both
 * the password reveal button and the social/identity-provider buttons, so kill
 * the pseudo border everywhere within the login. */
.gig-login-root .pf-c-button.pf-m-control::after,
.gig-login-root .pf-c-button.pf-m-control::before {
    display: none;
}
.gig-login-root .pf-c-input-group .pf-c-button.pf-m-control {
    background: var(--gig-input-bg);
    border: 1px solid var(--gig-input-border);
    border-left: none;
    box-shadow: none;
}
.gig-login-root .pf-c-input-group button:hover {
    color: var(--gig-text);
}

/* ---- Options row (remember me / forgot password) ---- */
.gig-login-root #kc-form-options,
.gig-login-root .kc-form-options {
    display: flex;
    align-items: center;
}
.gig-login-root #kc-form-buttons {
    margin-top: 4px;
}
.gig-login-root .checkbox {
    margin: 0;
    padding-left: 0;
}
.gig-login-root .checkbox label {
    display: inline-flex;
    align-items: center;
    gap: 8px;
    /* Drop Bootstrap's padding-left:20px (meant for an absolutely-positioned
     * checkbox) so the box sits flush-left with the inputs. */
    padding-left: 0;
    margin: 0;
    font-weight: 500;
    color: var(--gig-text-muted);
}
/* Custom checkbox for ALL brands — token-driven, so it suits light and dark
 * surfaces alike, and avoids the native checkbox's OS-white box and default
 * margins (which caused alignment/overflow quirks on the light brands).
 * Unchecked matches the input fields; checked shows the brand colour + tick. */
.gig-login-root input[type="checkbox"] {
    appearance: none;
    -webkit-appearance: none;
    width: 18px;
    height: 18px;
    margin: 0;
    flex-shrink: 0;
    border: 1px solid var(--gig-input-border);
    border-radius: 5px;
    background: var(--gig-input-bg);
    cursor: pointer;
    position: relative;
    vertical-align: middle;
    transition: background-color 0.12s ease, border-color 0.12s ease;
}
.gig-login-root input[type="checkbox"]:checked {
    background: var(--gig-primary);
    border-color: var(--gig-primary);
}
.gig-login-root input[type="checkbox"]:checked::after {
    content: "";
    position: absolute;
    left: 50%;
    top: 45%;
    width: 5px;
    height: 9px;
    border: solid var(--gig-primary-text);
    border-width: 0 2.5px 2.5px 0;
    /* Centre the rotated tick in the box rather than fixed offsets. */
    transform: translate(-50%, -50%) rotate(45deg);
}
.gig-login-root input[type="checkbox"]:focus-visible {
    outline: none;
    box-shadow: 0 0 0 3px color-mix(in srgb, var(--gig-primary) 30%, transparent);
}
/* Checkbox immediately followed by its label (sibling pattern, e.g. the
 * recovery-codes "I have saved these codes" confirmation) — space the label
 * off the box and align them. */
.gig-login-root input[type="checkbox"] + label {
    margin-left: 8px;
    vertical-align: middle;
}

/* ---- Links ---- */
.gig-login-root a {
    color: var(--gig-link);
    text-decoration: none;
    font-weight: 600;
}
.gig-login-root a:hover {
    color: var(--gig-link-hover);
    text-decoration: underline;
}

/* ---- Buttons ----
 * Keycloakify maps button classes to a mix of PatternFly (pf-c-button,
 * pf-m-primary / pf-m-secondary / pf-m-block) and Bootstrap leftovers
 * (btn-default, btn-lg). We target those actual classes — NOT .btn/.btn-primary,
 * which Keycloak no longer emits — so every page's buttons brand correctly, not
 * just the login button (which happens to also carry id="kc-login"). */
.gig-login-root .pf-c-button.pf-m-primary,
.gig-login-root .pf-c-button.pf-m-secondary,
.gig-login-root .pf-c-button.btn-default,
.gig-login-root input[type="submit"],
.gig-login-root #kc-login {
    height: 46px;
    padding: 0 18px;
    border-radius: var(--gig-radius-sm);
    border: 1px solid transparent;
    font-weight: 700;
    font-size: 0.95rem;
    cursor: pointer;
    transition: background-color 0.15s ease, transform 0.05s ease;
}
/* Full-width whenever Keycloak requests a block button. */
.gig-login-root .pf-c-button.pf-m-block,
.gig-login-root #kc-login {
    width: 100%;
}
/* Primary action. */
.gig-login-root .pf-c-button.pf-m-primary,
.gig-login-root input[type="submit"],
.gig-login-root #kc-login {
    background: var(--gig-primary);
    color: var(--gig-primary-text);
}
.gig-login-root .pf-c-button.pf-m-primary:hover:not([disabled]),
.gig-login-root input[type="submit"]:hover:not([disabled]),
.gig-login-root #kc-login:hover:not([disabled]) {
    background: var(--gig-primary-hover);
    color: var(--gig-primary-text);
}
.gig-login-root .pf-c-button.pf-m-primary:active:not([disabled]),
.gig-login-root #kc-login:active:not([disabled]) {
    transform: translateY(1px);
}
.gig-login-root .pf-c-button[disabled],
.gig-login-root input[type="submit"][disabled] {
    opacity: 0.6;
    cursor: not-allowed;
}
/* Secondary / default (passkey "Sign in with passkey", cancel buttons). */
.gig-login-root .pf-c-button.pf-m-secondary,
.gig-login-root .pf-c-button.btn-default {
    background: transparent;
    color: var(--gig-text);
    border-color: var(--gig-input-border);
}
.gig-login-root .pf-c-button.pf-m-secondary:hover,
.gig-login-root .pf-c-button.btn-default:hover {
    border-color: var(--gig-primary);
    color: var(--gig-primary);
}
/* Link-style buttons (e.g. recovery-codes Print / Download / Copy). */
.gig-login-root .pf-c-button.pf-m-link {
    display: inline-flex;
    align-items: center;
    gap: 4px;
    padding: 0;
    background: transparent;
    border: none;
    color: var(--gig-link);
    font-weight: 600;
    cursor: pointer;
}
.gig-login-root .pf-c-button.pf-m-link:hover {
    color: var(--gig-link-hover);
    text-decoration: underline;
}

/* ---- Recovery codes page spacing ---- */
.gig-login-root .kc-recovery-codes-list {
    margin: 16px 0;
    padding: 14px 16px;
    border: 1px solid var(--gig-surface-border);
    border-radius: var(--gig-radius-sm);
    background: var(--gig-subtle-bg);
}
/* Print / Download / Copy row: space the actions apart from each other. */
.gig-login-root .kc-recovery-codes-actions {
    display: flex;
    flex-wrap: wrap;
    gap: 24px;
    margin: 4px 0 20px;
}
/* Separate the settings form (logout-other-sessions + Complete setup) from the
 * confirmation checkbox above it, and the button from that checkbox. */
.gig-login-root #kc-recovery-codes-settings-form {
    margin-top: 20px;
}
.gig-login-root #saveRecoveryAuthnCodesBtn {
    margin-top: 16px;
}

/* ---- OTP credential picker (login-reset-otp, and login-otp with several
 * credentials) — PatternFly "tiles": a radio + a label card each. Render them
 * as a clean vertical list of selectable cards with the native radio hidden. */
.gig-login-root #kc-otp-reset-form-description {
    margin: 0 0 14px;
    color: var(--gig-text-muted);
}
.gig-login-root .pf-c-tile__input {
    position: absolute;
    opacity: 0;
    width: 0;
    height: 0;
}
.gig-login-root .pf-c-tile {
    display: flex;
    align-items: center;
    width: 100%;
    margin: 0 0 10px;
    padding: 14px 16px;
    border: 1px solid var(--gig-input-border);
    border-radius: var(--gig-radius-sm);
    background: var(--gig-input-bg);
    color: var(--gig-text);
    cursor: pointer;
    transition: border-color 0.15s ease, background-color 0.15s ease;
}
.gig-login-root .pf-c-tile:hover {
    border-color: var(--gig-primary);
}
.gig-login-root .pf-c-tile__input:checked + .pf-c-tile {
    border-color: var(--gig-primary);
    background: color-mix(in srgb, var(--gig-primary) 12%, transparent);
}
.gig-login-root .pf-c-tile__input:focus-visible + .pf-c-tile {
    box-shadow: 0 0 0 3px color-mix(in srgb, var(--gig-primary) 30%, transparent);
}
.gig-login-root .pf-c-tile__header {
    display: flex;
    align-items: center;
    gap: 10px;
}
.gig-login-root .pf-c-tile__icon {
    display: inline-flex;
    color: var(--gig-primary);
    font-size: 1.1rem;
}
.gig-login-root .pf-c-tile__title {
    font-weight: 600;
}

/* ---- OAuth consent / grant page (login-oauth-grant) ---- */
.gig-login-root #kc-oauth h3 {
    margin: 0 0 12px;
    font-size: 1rem;
    font-weight: 600;
    color: var(--gig-text);
}
.gig-login-root #kc-oauth ul {
    list-style: none;
    margin: 0 0 var(--gig-gap);
    padding: 0;
    display: flex;
    flex-direction: column;
    gap: 8px;
}
.gig-login-root #kc-oauth li {
    padding: 10px 14px;
    border: 1px solid var(--gig-surface-border);
    border-radius: var(--gig-radius-sm);
    background: var(--gig-subtle-bg);
    color: var(--gig-text);
    font-size: 0.92rem;
}
/* Yes / No side-by-side, equal width (override the global full-width #kc-login). */
.gig-login-root #kc-oauth #kc-form-buttons > div {
    display: flex;
    gap: 12px;
}
.gig-login-root #kc-oauth #kc-form-buttons input {
    flex: 1;
    width: auto;
}

/* ---- Inline field errors ---- */
.gig-login-root #input-error,
.gig-login-root .kc-feedback-text,
.gig-login-root .pf-c-form__helper-text.pf-m-error {
    display: block;
    margin-top: 6px;
    color: var(--gig-danger);
    font-size: 0.85rem;
}
.gig-login-root input[aria-invalid="true"] {
    border-color: var(--gig-danger);
}

/* ---- Alerts ----
 * Grid so the icon sits in column 1 and the title + (optional) description
 * stack in column 2. Flex would lay title and description side-by-side, which
 * breaks alerts that have both (e.g. the recovery-codes warning). */
.gig-login-root .alert,
.gig-login-root .pf-c-alert {
    display: grid;
    grid-template-columns: auto 1fr;
    column-gap: 10px;
    row-gap: 4px;
    align-items: start;
    padding: 12px 14px;
    margin-bottom: var(--gig-gap);
    border-radius: var(--gig-radius-sm);
    border: 1px solid var(--gig-surface-border);
    background: var(--gig-subtle-bg);
    font-size: 0.9rem;
}
.gig-login-root .pf-c-alert__icon {
    grid-column: 1;
    grid-row: 1;
}
.gig-login-root .pf-c-alert__title {
    grid-column: 2;
    grid-row: 1;
}
.gig-login-root .pf-c-alert__description {
    grid-column: 2;
    grid-row: 2;
    color: var(--gig-text-muted);
    line-height: 1.45;
}
.gig-login-root .pf-c-alert__description p {
    margin: 0;
}
.gig-login-root .alert-error,
.gig-login-root .pf-m-danger {
    border-color: color-mix(in srgb, var(--gig-danger) 50%, transparent);
    background: color-mix(in srgb, var(--gig-danger) 12%, transparent);
}
/* Alert body: readable navy at normal weight (PatternFly defaults to bold +
 * full-danger colour, which reads as cramped shouting). */
.gig-login-root .pf-c-alert .pf-c-alert__title,
.gig-login-root .alert .pf-c-alert__title {
    margin: 0;
    padding: 0;
    font-size: 0.9rem;
    font-weight: 400;
    line-height: 1.45;
    color: var(--gig-text);
    text-align: left;
}
/* Keep the icon as the colour signal, sized and aligned to the first line. */
.gig-login-root .pf-c-alert__icon {
    display: flex;
    align-items: flex-start;
    margin: 0;
    line-height: 1.45;
}
.gig-login-root .alert-error .pf-c-alert__icon,
.gig-login-root .pf-m-danger .pf-c-alert__icon {
    color: var(--gig-danger);
}

/* ---- Registration / info footer ----
 * PatternFly's defaults give #kc-info a white background + negative margins to
 * make a full-bleed footer; we neutralise those so it sits inside the card. */
.gig-login-root #kc-info {
    width: auto;
    max-width: none;
    margin: 22px 0 0;
    padding: 16px 0 0;
    background: transparent;
    border-top: 1px solid var(--gig-surface-border);
    box-shadow: none;
    text-align: center;
    color: var(--gig-text-muted);
    font-size: 0.9rem;
}
.gig-login-root #kc-info-wrapper {
    margin: 0;
    padding: 0;
    background: transparent;
}
.gig-login-root #kc-registration span {
    color: var(--gig-text-muted);
}
.gig-login-root #kc-info a {
    color: var(--gig-link);
}

/* ---- Social / identity providers ---- */
.gig-login-root #kc-social-providers {
    margin-top: 22px;
}
.gig-login-root #kc-social-providers hr {
    border: none;
    border-top: 1px solid var(--gig-surface-border);
    margin: 0 0 16px;
}
.gig-login-root #kc-social-providers h2 {
    font-size: 0.8rem;
    font-weight: 600;
    text-transform: uppercase;
    letter-spacing: 0.04em;
    color: var(--gig-text-muted);
    text-align: center;
    margin: 0 0 14px;
}
.gig-login-root #kc-social-providers ul {
    list-style: none;
    margin: 0;
    padding: 0;
    display: flex;
    flex-direction: column;
    gap: 10px;
}
.gig-login-root #kc-social-providers ul.pf-c-login__main-footer-links--inline,
.gig-login-root #kc-social-providers ul[class*="GridClass"] {
    flex-direction: row;
    flex-wrap: wrap;
}
.gig-login-root #kc-social-providers li {
    flex: 1 1 calc(50% - 5px);
}
.gig-login-root #kc-social-providers a {
    display: flex;
    align-items: center;
    justify-content: center;
    gap: 8px;
    height: 44px;
    padding: 0 14px;
    border: 1px solid var(--gig-input-border);
    border-radius: var(--gig-radius-sm);
    color: var(--gig-text);
    font-weight: 600;
    background: var(--gig-input-bg);
    transition: border-color 0.15s ease, background-color 0.15s ease;
}
.gig-login-root #kc-social-providers a:hover {
    border-color: var(--gig-primary);
    background: var(--gig-subtle-bg);
    text-decoration: none;
}
/* Provider icon: drop PatternFly's greyscale filter and size it to the text. */
.gig-login-root #kc-social-providers .kc-social-provider-logo,
.gig-login-root #kc-social-providers .kc-social-gray {
    filter: none;
}
.gig-login-root #kc-social-providers a i {
    font-size: 1.1rem;
    line-height: 1;
}
.gig-login-root .gig-social-icon {
    display: inline-flex;
    align-items: center;
}
.gig-login-root .gig-social-icon svg {
    display: block;
}
.gig-login-root #kc-social-providers .kc-social-provider-name {
    font-weight: 600;
}
/* Keycloak shifts the label left (left: -15px) to tuck it under a centered
 * icon; we lay the button out with flex + gap, so cancel that offset. */
.gig-login-root #kc-social-providers .kc-social-icon-text {
    left: 0;
}

/* ---- Terms & conditions page ----
 * We link out to the brand's hosted terms, so the page is a single "I agree"
 * checkbox above a Confirm button (disabled until ticked). */
.gig-login-root .gig-terms-intro {
    margin: 0 0 var(--gig-gap);
    line-height: 1.55;
    color: var(--gig-text-muted);
    font-size: 0.95rem;
    text-align: center;
}
.gig-login-root #kc-terms-form {
    display: flex;
    flex-direction: column;
    gap: 20px;
}
.gig-login-root .gig-terms-accept label {
    display: flex;
    align-items: flex-start;
    gap: 10px;
    font-weight: 500;
    line-height: 1.5;
    color: var(--gig-text-muted);
}
.gig-login-root .gig-terms-accept input[type="checkbox"] {
    margin-top: 2px;
    flex-shrink: 0;
}

/* ---- Versioned T&C page (t_and_c.ftl) — links out like terms.ftl, plus the
 * T&C version line. */
.gig-login-root .gig-tandc-form {
    display: flex;
    flex-direction: column;
    gap: 16px;
}
.gig-login-root .gig-terms-version {
    margin: 0;
    font-size: 0.8rem;
    color: var(--gig-text-muted);
    text-align: center;
}

/* Locale dropdown — keep it unobtrusive top-right of the card */
.gig-login-root #kc-locale {
    text-align: right;
    margin-bottom: 8px;
}
.gig-login-root #kc-locale ul {
    background: var(--gig-surface);
    border: 1px solid var(--gig-surface-border);
    border-radius: var(--gig-radius-sm);
}