/* Auth pages.
   compliance.css targets the full-width onboarding wizard; these rules add the
   narrow centred card the sign-in screens need. Everything below reuses the
   variables and component classes already defined in compliance.css. */

.gp-auth-wrap {
  display: flex;
  justify-content: center;
  padding: 48px 20px 80px;
  background: var(--bg-subtle);
  /* Was 100vh - 64px to allow for the branded header, which is
     currently commented out in templates/accounts/base.html. */
  min-height: 100vh;
}

.gp-auth-card {
  width: 100%;
  max-width: 460px;
  margin-bottom: 0;
  align-self: flex-start;
}

.gp-auth-card .gp-panel-head {
  display: block;
  padding: 22px 26px 18px;
  border-bottom: 1px solid var(--line);
  background: var(--bg-card);
}

.gp-auth-title {
  font-family: 'Plus Jakarta Sans', sans-serif;
  font-size: 20px;
  font-weight: 700;
  letter-spacing: -0.01em;
  color: var(--ink);
  margin: 0;
}

.gp-auth-lede {
  font-size: 13px;
  color: var(--muted);
  line-height: 1.5;
  margin: 6px 0 0;
}

.gp-auth-inner {
  padding: 8px 26px 26px;
}

.gp-auth-inner .gp-btn {
  width: 100%;
  margin-top: 24px;
}

/* Non-field errors, e.g. the generic credentials message. */
.gp-auth-alert {
  display: flex;
  align-items: flex-start;
  gap: 8px;
  margin: 18px 0 0;
  padding: 11px 13px;
  border: 1px solid #FBD5D5;
  border-left: 3px solid var(--danger);
  border-radius: var(--radius-md);
  background: #FEF2F2;
  font-size: 13px;
  color: #991B1B;
  line-height: 1.45;
}

.gp-auth-alert i {
  margin-top: 1px;
}

.gp-auth-foot {
  margin: 22px 0 0;
  padding-top: 18px;
  border-top: 1px solid var(--line-soft);
  font-size: 13px;
  color: var(--muted);
  text-align: center;
}

.gp-auth-foot p {
  margin: 0 0 7px;
}

.gp-auth-foot p:last-child {
  margin-bottom: 0;
}

.gp-auth-link {
  color: var(--brass-dark);
  font-weight: 600;
  text-decoration: none;
}

.gp-auth-link:hover {
  color: var(--brass-hover);
  text-decoration: underline;
}

/* ---- Two-factor ---- */

.gp-auth-qr {
  display: block;
  width: 208px;
  height: 208px;
  margin: 20px auto 6px;
  padding: 12px;
  border: 1px solid var(--line);
  border-radius: var(--radius-md);
  background: #FFFFFF;
}

.gp-auth-secret {
  margin-top: 14px;
  font-size: 12px;
  color: var(--muted);
}

.gp-auth-secret summary {
  cursor: pointer;
  font-weight: 600;
  color: var(--slate-700);
}

.gp-auth-secret code {
  display: block;
  margin-top: 9px;
  padding: 10px;
  border: 1px solid var(--line);
  border-radius: var(--radius-md);
  background: var(--bg-raised);
  font-family: 'IBM Plex Mono', monospace;
  font-size: 11px;
  line-height: 1.5;
  word-break: break-all;
  color: var(--slate-700);
}

/* One-time code entry: wide tracking makes six digits readable. */
.gp-input.gp-auth-otp {
  padding-right: 14px;
  font-family: 'IBM Plex Mono', monospace;
  font-size: 22px;
  letter-spacing: 0.34em;
  text-align: center;
}

/* ---- Recovery codes ---- */

.gp-auth-warn {
  display: flex;
  align-items: flex-start;
  gap: 8px;
  margin: 18px 0 0;
  padding: 12px 13px;
  border: 1px solid var(--brass-border);
  border-left: 3px solid var(--brass);
  border-radius: var(--radius-md);
  background: var(--brass-light);
  font-size: 13px;
  color: var(--brass-dark);
  line-height: 1.5;
}

.gp-auth-codes {
  display: grid;
  grid-template-columns: repeat(2, 1fr);
  gap: 8px;
  margin: 20px 0 0;
  padding: 0;
  list-style: none;
}

.gp-auth-codes li {
  padding: 10px 8px;
  border: 1px solid var(--line);
  border-radius: var(--radius-md);
  background: var(--bg-raised);
  font-family: 'IBM Plex Mono', monospace;
  font-size: 13px;
  text-align: center;
  color: var(--ink);
}

@media (max-width: 420px) {
  .gp-auth-codes {
    grid-template-columns: 1fr;
  }

  .gp-auth-wrap {
    padding: 24px 14px 60px;
  }
}