/*
 * Auth pages (Account/Login, Account/Register).
 *
 * Served by the standalone _LayoutAuth, which deliberately loads neither Bootstrap nor
 * styles-0.1.css, so this sheet owns the page-level defaults those normally provide.
 */
.auth-body,
.auth-page {
    --auth-primary: #345C6F;
    --auth-primary-dark: #274756;
    --auth-surface: #ffffff;
    --auth-text: #222222;
    --auth-text-muted: #5a5a5a;
    --auth-border: #cfd6da;
    --auth-border-strong: #7F8B93;
    --auth-error: #9C1C28;
    --auth-success: #165A26;
    --auth-focus: #11547b;
    --auth-radius: 10px;
    --auth-gap: 1.25rem;
}

/* ---------- Page defaults (normally from Bootstrap reboot + styles-0.1.css) ---------- */

.auth-body {
    margin: 0;
    min-height: 100vh;
    /* Brand blue full bleed -- same #345C6F as the portal header, so the standalone
       auth pages still read as CitiSen even without the header. */
    background: var(--auth-primary);
    color: var(--auth-text);
    font-family: "Roboto Slab", Georgia, serif;
    font-size: .9rem;
    line-height: 1.7;
    -webkit-text-size-adjust: 100%;
}

.auth-body *,
.auth-body *::before,
.auth-body *::after {
    box-sizing: border-box;
}

.auth-card h1,
.auth-card h2,
.auth-card p,
.auth-card ul {
    margin-top: 0;
}

/* ---------- Layout ---------- */

.auth-page {
    display: flex;
    justify-content: center;
    min-height: 100vh;
    padding: 2rem 1rem 3rem;
}

/*
 * Both auth pages stack the card and the off-card social block, and .auth-page is a row flex
 * container, so the two need a wrapper or they lay out side by side. The shell owns the column
 * width and the centring for everything inside it.
 */
.auth-shell {
    width: 100%;
    max-width: 30rem;
    /* auto margins centre the column vertically when there is room and fall back to the
       top when the content is taller than the viewport. align-items:center would clip
       the top of the tall register card on short screens. */
    margin: auto;
}

.auth-card {
    width: 100%;
    background: var(--auth-surface);
    border-radius: var(--auth-radius);
    box-shadow: 0 10px 34px rgba(0, 0, 0, .28);
    padding: 2rem;
    box-sizing: border-box;
}

.auth-card__brand {
    display: flex;
    justify-content: center;
    margin-bottom: 1.5rem;
}

/* The clamp keeps the logo from outgrowing the narrower mobile card, where an over-large
   logo wraps onto two lines. It also inherits the sub-AA #777 body colour, so recolour it. */
.auth-card__brand .site-logo {
    font-size: clamp(2rem, 8vw, 2.875rem);
    color: var(--auth-primary);
}

/*
 * .icon-s:before hard-codes color:#ffffff because the logo normally sits on the dark header.
 * On the white card that renders the "S" invisible, so it has to be recoloured here.
 */
.auth-card__brand .site-logo__icon::before {
    color: var(--auth-primary);
}

.auth-card__title {
    font-family: "Roboto Slab", serif;
    font-size: 1.5rem;
    color: var(--auth-text);
    text-align: center;
    margin: 0 0 1.5rem;
}

/* ---------- Fields ---------- */

.auth-field {
    margin-bottom: var(--auth-gap);
}

.auth-field__label {
    display: block;
    font-family: "Roboto", sans-serif;
    font-size: .875rem;
    font-weight: 600;
    color: var(--auth-text);
    margin-bottom: .35rem;
}

.auth-input {
    display: block;
    width: 100%;
    padding: .625rem .75rem;
    font-family: "Roboto", sans-serif;
    font-size: 1rem;
    line-height: 1.4;
    color: var(--auth-text);
    background-color: var(--auth-surface);
    border: 1px solid var(--auth-border-strong);
    border-radius: 6px;
    box-sizing: border-box;
    transition: border-color .15s ease, box-shadow .15s ease;
}

.auth-input:hover {
    border-color: var(--auth-primary);
}

.auth-input:focus {
    outline: none;
    border-color: var(--auth-focus);
    box-shadow: 0 0 0 3px rgba(17, 84, 123, .25);
}

.auth-input.input-validation-error {
    border-color: var(--auth-error);
}

/*
 * Floating labels. The inputs carry placeholder=" " purely so :placeholder-shown can detect
 * emptiness, which is why the label must follow the input in the DOM.
 */
.auth-float {
    position: relative;
}

.auth-float .auth-input {
    padding: 1.4rem .75rem .45rem;
}

.auth-float .auth-field__label {
    position: absolute;
    left: calc(.75rem + 1px);
    top: 50%;
    transform: translateY(-50%);
    margin: 0;
    font-size: 1rem;
    font-weight: 400;
    color: var(--auth-text-muted);
    white-space: nowrap;
    pointer-events: none;
    transition: top .15s ease, font-size .15s ease, transform .15s ease, color .15s ease;
}

.auth-float .auth-input:focus + .auth-field__label,
.auth-float .auth-input:not(:placeholder-shown) + .auth-field__label {
    top: .4rem;
    transform: none;
    font-size: .7rem;
    font-weight: 600;
    color: var(--auth-text);
}

/* Autofill fills the field without firing input events, so float the label for it too.
   Kept in their own rules: an unsupported selector would invalidate the whole list. */
.auth-float .auth-input:-webkit-autofill + .auth-field__label {
    top: .4rem;
    transform: none;
    font-size: .7rem;
    font-weight: 600;
    color: var(--auth-text);
}

.auth-float .auth-input:autofill + .auth-field__label {
    top: .4rem;
    transform: none;
    font-size: .7rem;
    font-weight: 600;
    color: var(--auth-text);
}

@media (prefers-reduced-motion: reduce) {
    .auth-float .auth-field__label {
        transition: none;
    }
}

/* Password field with the show/hide affordance */
.auth-password {
    position: relative;
}

.auth-password .auth-input {
    padding-right: 3rem;
}

/* Keep the floating label clear of the show/hide button. */
.auth-password .auth-field__label {
    max-width: calc(100% - 3.75rem);
}

.auth-password__toggle {
    position: absolute;
    top: 0;
    right: 0;
    height: 100%;
    width: 2.75rem;
    display: flex;
    align-items: center;
    justify-content: center;
    background: transparent;
    border: none;
    border-radius: 0 6px 6px 0;
    color: var(--auth-text-muted);
    cursor: pointer;
}

.auth-password__toggle:hover {
    color: var(--auth-primary);
}

.auth-password__toggle .auth-icon {
    width: 1.25rem;
    height: 1.25rem;
    display: block;
    fill: currentColor;
}

/* auth.js toggles .is-revealed to swap which glyph shows. */
.auth-password__toggle .auth-icon--hide {
    display: none;
}

.auth-password__toggle.is-revealed .auth-icon--show {
    display: none;
}

.auth-password__toggle.is-revealed .auth-icon--hide {
    display: block;
}

/* ---------- Buttons ---------- */

/*
 * Deliberately not reusing .dark-blue-button: it sets outline:none and its :focus style is
 * identical to :hover, which is not a WCAG 2.4.7 focus indicator.
 */
.auth-btn {
    display: inline-flex;
    align-items: center;
    justify-content: center;
    width: 100%;
    padding: .75rem 1.25rem;
    font-family: "Roboto", sans-serif;
    font-size: 1rem;
    font-weight: 600;
    line-height: 1.2;
    border: 2px solid transparent;
    border-radius: 15px;
    cursor: pointer;
    text-decoration: none;
    text-align: center;
    transition: background-color .2s ease, color .2s ease, border-color .2s ease;
}

.auth-btn--primary {
    color: #ffffff;
    background-color: var(--auth-primary);
}

.auth-btn--primary:hover {
    color: #ffffff;
    background-color: var(--auth-primary-dark);
    text-decoration: none;
}

.auth-btn--secondary {
    color: var(--auth-primary);
    background-color: var(--auth-surface);
    border-color: var(--auth-primary);
}

.auth-btn--secondary:hover {
    color: #ffffff;
    background-color: var(--auth-primary);
    text-decoration: none;
}

/*
 * Busy state for the reCAPTCHA round trip; auth.js disables the button and swaps its label.
 *
 * Deliberately no opacity: the convention elsewhere in the app dims disabled content to 0.3
 * (.disabled-content in Default-0.5.css), which on the brand blue would drop the white label
 * below AA contrast. The label change is the signal, so the colours stay put.
 */
.auth-btn:disabled {
    cursor: progress;
}

.auth-btn--primary:disabled:hover {
    background-color: var(--auth-primary);
}

.auth-btn--secondary:disabled:hover {
    color: var(--auth-primary);
    background-color: var(--auth-surface);
}

/* ---------- Focus visibility (WCAG 2.4.7) ---------- */

.auth-page a:focus-visible,
.auth-page button:focus-visible,
.auth-page input:focus-visible,
.auth-page [type="submit"]:focus-visible {
    outline: 3px solid var(--auth-focus);
    outline-offset: 2px;
}

/* Older engines without :focus-visible still get a visible ring. */
.auth-page a:focus,
.auth-page button:focus,
.auth-page [type="submit"]:focus {
    outline: 3px solid var(--auth-focus);
    outline-offset: 2px;
}

.auth-page a:focus:not(:focus-visible),
.auth-page button:focus:not(:focus-visible),
.auth-page [type="submit"]:focus:not(:focus-visible) {
    outline: none;
}

/* ---------- Secondary actions / links ---------- */

.auth-actions {
    display: flex;
    flex-direction: column;
    gap: .75rem;
    margin-top: 1.5rem;
}

.auth-inline-link {
    color: var(--auth-primary);
    text-decoration: underline;
}

.auth-inline-link:hover,
.auth-inline-link:focus {
    color: var(--auth-primary-dark);
}

/* ---------- Switch-to-the-other-page call-out ---------- */

/*
 * The card's footer zone, carrying the entry point to the other auth page.
 *
 * The negative insets pull the panel out to the card edges and must track .auth-card's
 * padding, including the smaller value in the mobile block. The tint is what lets the button
 * work: .auth-btn--secondary is a white outlined button, so on the card's own white it would
 * read as an outline rather than as a control.
 */
.auth-switch {
    margin: 2rem -2rem -2rem;
    padding: 1.5rem 2rem;
    text-align: center;
    background: #f5f7f8;
    border-top: 1px solid var(--auth-border);
    border-radius: 0 0 var(--auth-radius) var(--auth-radius);
}

.auth-switch__title {
    font-family: "Roboto Slab", serif;
    font-size: 1.125rem;
    color: var(--auth-text);
    margin: 0 0 .35rem;
}

/*
 * The "S" is set from the icon font like the card logo above. This undoes the two things
 * .icon-s assumes about its surroundings: a fixed pixel size (sized for the header logo, not a
 * run of 18px text) and white, which the tinted footer would swallow.
 */
.auth-switch__logo-s {
    font-size: 1em;
}

.auth-switch__logo-s::before {
    /* Default-0.5.css jumps .icon-s:before to 30px under 360px, which on an 18px heading
       overflows the line -- pin it to the run of text instead. */
    font-size: 1em;
    color: var(--auth-text);
}

.auth-switch__text {
    font-size: .9375rem;
    line-height: 1.5;
    color: var(--auth-text-muted);
    margin: 0 0 1rem;
}

/* ---------- Off-card block, on the blue field ---------- */

/*
 * Third-party sign-in renders outside .auth-card, straight onto the brand blue, so everything
 * in here needs light-on-dark treatment: the card's muted greys and the #11547b focus ring are
 * both near-invisible on #345C6F. White on the brand blue is 7.2:1.
 */
.auth-external {
    margin-top: 1.75rem;
    text-align: center;
}

.auth-external__heading {
    font-family: "Roboto Slab", serif;
    font-size: 1rem;
    font-weight: 500;
    color: #ffffff;
    margin: 0 0 .75rem;
}

/* .auth-actions' top margin spaces it off a form; out here the heading already does. */
.auth-external .auth-actions {
    margin-top: 0;
}

/*
 * Equal specificity to the .auth-page focus rules, so these must stay after them in the file.
 * Only the colour is overridden -- width/style still come from that block, as does the
 * :focus:not(:focus-visible) reset, which is more specific and so still wins for mouse focus.
 * The ring lands on blue rather than on the white button because of the 2px outline-offset.
 */
.auth-external a:focus-visible,
.auth-external button:focus-visible,
.auth-external a:focus,
.auth-external button:focus {
    outline-color: #ffffff;
}

/* ---------- Utilities ---------- */

/*
 * Visually hidden but still announced. Bootstrap normally supplies .sr-only, but the
 * standalone auth layout does not load Bootstrap, so it is defined here.
 */
.auth-sr-only {
    position: absolute;
    width: 1px;
    height: 1px;
    padding: 0;
    margin: -1px;
    overflow: hidden;
    clip: rect(0, 0, 0, 0);
    clip-path: inset(50%);
    white-space: nowrap;
    border: 0;
}

/* ---------- Validation ---------- */

.auth-summary {
    margin-bottom: 1.25rem;
}

.auth-summary ul {
    margin: 0;
    padding-left: 1.25rem;
}

.auth-summary:empty,
.auth-summary .validation-summary-valid {
    display: none;
}

.auth-error {
    display: block;
    margin-top: .35rem;
    font-size: .875rem;
    color: var(--auth-error);
}


/*
 * The error red is 1.1:1 against the blue field, so it gets a white surface to sit on rather
 * than a recoloured text style -- the red stays the error red everywhere it appears.
 */
.auth-error--on-dark {
    margin: 0 0 1rem;
    padding: .625rem .75rem;
    text-align: left;
    background: var(--auth-surface);
    border-left: 4px solid var(--auth-error);
    border-radius: 6px;
}

.auth-field__meta {
    display: flex;
    flex-wrap: wrap;
    align-items: baseline;
    justify-content: space-between;
    gap: .25rem .5rem;
    margin-top: .5rem;
}

.auth-field__meta .auth-legal {
    margin: 0;
    text-align: left;
}

.auth-field__meta .auth-field__helper {
    margin: 0;
    margin-left: auto;
}

.auth-field__helper {
    margin: .5rem 0 0;
    text-align: right;
    font-size: .875rem;
}

.auth-required-note {
    font-size: .875rem;
    color: var(--auth-text-muted);
    margin-bottom: 1.25rem;
}

/* ---------- Password rules checklist ---------- */

/*
 * Visibility is driven by .password-validation-hide / .password-validation-show from
 * Default-0.5.css, which PasswordValdation.js toggles. Do not set max-height here: this
 * sheet loads after Default-0.5.css, so an equal-specificity rule would win and the
 * checklist would never expand.
 */
.auth-password-rules {
    margin-top: .625rem;
}

/*
 * .password-validation-show caps the list at 200px, which clips the last rule once its text
 * wraps on narrow screens. Two classes beat the single-class rule in Default-0.5.css, so this
 * lifts the cap for the auth pages only and leaves ResetPassword untouched.
 */
.auth-password-rules.password-validation-show {
    max-height: 30rem;
}

.auth-password-rules ul {
    list-style: none;
    margin: 0;
    padding: .625rem .75rem;
    background: #f5f7f8;
    border-radius: 6px;
    font-size: .875rem;
}

.auth-password-rules li {
    padding: .125rem 0;
    /* The special-character example (!@#$%^&*) is one unbreakable token; without this it
       is clipped by the overflow:hidden that .password-validation-hide applies. */
    overflow-wrap: anywhere;
}

.auth-password-rules li.correct-format {
    color: var(--auth-success);
}

.auth-password-rules li.wrong-format {
    color: var(--auth-error);
}

/* ---------- Terms ---------- */

.auth-terms {
    display: flex;
    align-items: flex-start;
    gap: .5rem;
    margin-top: 1.25rem;
}

.auth-terms input[type="checkbox"] {
    margin-top: .25rem;
    width: 1.125rem;
    height: 1.125rem;
    flex: 0 0 auto;
}

.auth-terms label {
    font-size: .9375rem;
    color: var(--auth-text);
    margin: 0;
}

.auth-privacy {
    margin-top: 1.25rem;
    font-size: .875rem;
    font-style: italic;
    line-height: 1.5;
    color: var(--auth-text-muted);
}

/* ---------- Social providers ---------- */

.auth-social__button {
    display: flex;
    align-items: center;
    justify-content: center;
    gap: .5rem;
    width: 100%;
    padding: .625rem 1rem;
    font-family: "Roboto", sans-serif;
    font-size: .9375rem;
    color: var(--auth-primary);
    background: var(--auth-surface);
    border: 1px solid var(--auth-border-strong);
    border-radius: 15px;
    cursor: pointer;
}

.auth-social__button:hover {
    background: #eef3f5;
    border-color: var(--auth-primary);
}

/* reCAPTCHA v3 renders its inline badge here. */
/*
 * The badge is hidden; Google's terms allow that only while .auth-legal stays visible.
 *
 * visibility:hidden on .grecaptcha-badge is the method Google documents -- display:none is
 * explicitly not it, and the badge must still render because renderCaptchaToElement is what
 * gives executeV3 its client id. This sheet only loads on the auth pages, so the unscoped
 * selector cannot reach the badges on Checkout, Gateway or the other captcha pages.
 */
.grecaptcha-badge {
    visibility: hidden;
}

/* The badge renders inline into this box, so collapse the box or it leaves a 75px gap
   (see the #grecaptcha-box height in Default-0.5.css). */
.auth-captcha {
    height: 0;
    overflow: hidden;
}

.auth-legal {
    margin: 1.5rem 0 0;
    text-align: center;
    font-size: .75rem;
    line-height: 1.5;
    color: var(--auth-text-muted);
}

.auth-actions + .auth-legal {
    margin-top: .75rem;
}

/* ---------- Small screens ---------- */

@media (max-width: 575.98px) {
    .auth-page {
        padding: 1rem .75rem 2rem;
    }

    .auth-card {
        padding: 1.25rem;
    }

    .auth-switch {
        margin: 1.5rem -1.25rem -1.25rem;
        padding: 1.25rem;
    }
}