/* =====================================================================
   RAG Solutions — Keycloak login skin (§41)

   Loaded AFTER the stock theme's own login.css (see theme.properties), so
   this file only overrides; it never has to reproduce the layout.

   The tokens are copied from public/stylesheets/theme.css rather than
   imported — a Keycloak theme is served from the Keycloak container and
   cannot reach the app's stylesheet. ⚠ If the brand palette changes there,
   change it here too; these are the only two places it lives.

   Selectors deliberately favour Keycloak's stable ELEMENT IDS (#kc-*) over
   its PatternFly utility classes, which have been renamed twice across
   recent majors (pf-c-* → pf-v5-*). Anything class-based here is written
   to degrade to "unstyled but working", never to broken.
   ===================================================================== */

/* ⚠ THIS BLOCK HAD DRIFTED. It still carried the pre-§28 navy/steel palette
   (#1e2b4a / #16498f / #f5f8ff) long after theme.css had moved on, so a
   customer who signed in with Google crossed a visible seam between two
   different products. Re-synced with the warm re-tone; the names are kept
   as-is because the selectors below reference them. */
:root {
  --brand-navy:        #201d1a;   /* = theme.css --ink (a warm near-black now) */
  --brand-navy-deep:   #141210;
  --brand-accent:      #b0563a;   /* = --accent (clay) */
  --app-bg:            #f7f4ed;   /* = --canvas (ivory) */
  --surface:           #fffcf7;
  --surface-muted:     #f3efe6;
  --border:            #e8e0d2;
  --border-soft:       #f2eee5;
  --ink:               #201d1a;
  --ink-muted:         #6b6257;
  --error-color:       #b3261e;   /* = --danger */
}

/* ------------------------------------------------------------ canvas -- */

html,
body,
body.login-pf,
.login-pf body,
.login-pf-page {
  background: var(--app-bg) !important;
  color: var(--ink);
}

body,
input,
button,
select {
  font-family: "Roboto", "Helvetica Neue", Arial, sans-serif;
}

/* The stock theme paints a background image on the html element. */
html.login-pf {
  background-image: none !important;
}

/* ------------------------------------------------------------- logo --- */

/*
 * The header carries the realm's display name. We keep that text in the
 * accessibility tree (font-size:0 hides it visually without removing it) and
 * draw the logo above it, so the page needs no template override to be branded.
 */
#kc-header-wrapper {
  padding: 2rem 1rem 1.25rem;
  font-size: 0;
  line-height: 0;
  color: transparent;
  text-shadow: none;
}

#kc-header-wrapper::before {
  content: "";
  display: block;
  width: 200px;
  height: 56px;
  margin: 0 auto;
  background: url("../img/logo.webp") center / contain no-repeat;
}

/* -------------------------------------------------------------- card -- */

.login-pf-page .card-pf,
#kc-form-wrapper,
.login-pf-page .login-pf-page-header + .card-pf {
  background: var(--surface);
  border: 1px solid var(--border);
  border-radius: 10px;
  /* Hairlines separate, shadows do not lift (the app's rule). */
  box-shadow: 0 1px 2px rgba(32, 29, 26, .04), 0 6px 18px rgba(32, 29, 26, .05);
  padding: 1.75rem 1.75rem 1.5rem;
  max-width: 27rem;
  margin: 0 auto;
}

.login-pf-page {
  padding-bottom: 3rem;
}

#kc-page-title {
  font-size: 1.15rem;
  font-weight: 600;
  color: var(--ink);
  text-align: center;
  margin: 0 0 1.25rem;
}

/* ------------------------------------------------------------ fields -- */

.login-pf-page label,
#kc-form-login label,
#kc-register-form label {
  font-size: .72rem;
  font-weight: 600;
  letter-spacing: .06em;
  text-transform: uppercase;
  color: var(--ink-muted);
  margin-bottom: .3rem;
}

#kc-form-login input[type="text"],
#kc-form-login input[type="email"],
#kc-form-login input[type="password"],
#kc-register-form input[type="text"],
#kc-register-form input[type="email"],
#kc-register-form input[type="password"],
input.pf-c-form-control,
input.pf-v5-c-form-control {
  width: 100%;
  background: var(--surface);
  border: 1px solid var(--border);
  border-radius: 6px;
  padding: .55rem .7rem;
  font-size: .95rem;
  color: var(--ink);
  box-shadow: none;
}

#kc-form-login input[type="text"]:focus,
#kc-form-login input[type="email"]:focus,
#kc-form-login input[type="password"]:focus,
#kc-register-form input:focus,
input.pf-c-form-control:focus,
input.pf-v5-c-form-control:focus {
  border-color: var(--brand-accent);
  outline: none;
  box-shadow: 0 0 0 3px rgba(176, 86, 58, .15);
}

/* ------------------------------------------------- primary action ----- */

#kc-login,
input[type="submit"],
button[type="submit"],
.pf-c-button.pf-m-primary,
.pf-v5-c-button.pf-m-primary {
  width: 100%;
  /* Clay, not ink: this IS the app's .btn-primary wearing Keycloak's markup.
     A Google customer meets this screen between two of ours, so the one
     action on it has to be the same colour the action is everywhere else. */
  background: var(--brand-accent) !important;
  border: 1px solid var(--brand-accent) !important;
  border-radius: 6px;
  color: #fff !important;
  font-weight: 500;
  letter-spacing: .01em;
  padding: .6rem 1rem;
  cursor: pointer;
}

#kc-login:hover,
input[type="submit"]:hover,
button[type="submit"]:hover,
.pf-c-button.pf-m-primary:hover,
.pf-v5-c-button.pf-m-primary:hover {
  background: #98462d !important;   /* = --accent-600 */
  border-color: #98462d !important;
}

a {
  color: var(--brand-accent);
}

a:hover {
  color: var(--brand-navy);
}

/* --------------------------------------------------- Google / social -- */

/*
 * The password form stays exactly where it is; Google sits below it under a
 * hairline, introduced by a line of copy that tells a NEW visitor what the
 * button actually does (the identityProviderLoginLabel message override).
 */
#kc-social-providers {
  margin-top: 1.5rem;
  padding-top: 1.25rem;
  border-top: 1px solid var(--border-soft);
}

#kc-social-providers hr {
  display: none;
}

#kc-social-providers h2,
#kc-social-providers h4 {
  font-size: .82rem;
  font-weight: 400;
  line-height: 1.45;
  color: var(--ink-muted);
  text-align: center;
  text-transform: none;
  letter-spacing: 0;
  margin: 0 0 .85rem;
}

#kc-social-providers ul {
  list-style: none;
  margin: 0;
  padding: 0;
}

#kc-social-providers li {
  margin: 0 0 .5rem;
}

/* Google's brand guidance: neutral surface, never recolour the mark — the same
   rule the app's own login button follows (views/login.ejs). */
#kc-social-providers a[id^="social-"] {
  display: flex;
  align-items: center;
  justify-content: center;
  gap: .55rem;
  width: 100%;
  background: var(--surface);
  border: 1px solid var(--border);
  border-radius: 6px;
  padding: .55rem 1rem;
  color: var(--ink) !important;
  font-size: .95rem;
  font-weight: 500;
  text-decoration: none;
}

#kc-social-providers a[id^="social-"]:hover {
  background: var(--surface-muted);
  border-color: var(--ink-muted);
}

/* Whatever icon element the stock theme ships (its class names have moved
   between majors) is hidden, and the mark is drawn here instead — self-hosted
   as a data URI, so the page still makes zero third-party requests (§28). */
#kc-social-providers a[id^="social-"] i,
#kc-social-providers .kc-social-provider-logo {
  display: none !important;
}

#kc-social-providers a#social-google::before {
  content: "";
  flex: 0 0 auto;
  width: 18px;
  height: 18px;
  background: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 48 48'%3E%3Cpath fill='%23EA4335' d='M24 9.5c3.54 0 6.71 1.22 9.21 3.6l6.85-6.85C35.9 2.38 30.47 0 24 0 14.62 0 6.51 5.38 2.56 13.22l7.98 6.19C12.43 13.72 17.74 9.5 24 9.5z'/%3E%3Cpath fill='%234285F4' d='M46.98 24.55c0-1.57-.15-3.09-.38-4.55H24v9.02h12.94c-.58 2.96-2.26 5.48-4.78 7.18l7.73 6c4.51-4.18 7.09-10.36 7.09-17.65z'/%3E%3Cpath fill='%23FBBC05' d='M10.53 28.59c-.48-1.45-.76-2.99-.76-4.59s.27-3.14.76-4.59l-7.98-6.19C.92 16.46 0 20.12 0 24c0 3.88.92 7.54 2.56 10.78l7.97-6.19z'/%3E%3Cpath fill='%2334A853' d='M24 48c6.48 0 11.93-2.13 15.89-5.81l-7.73-6c-2.15 1.45-4.92 2.3-8.16 2.3-6.26 0-11.57-4.22-13.47-9.91l-7.98 6.19C6.51 42.62 14.62 48 24 48z'/%3E%3C/svg%3E") center / contain no-repeat;
}

/* ------------------------------------------------------------ alerts -- */

.alert,
.pf-c-alert,
.pf-v5-c-alert {
  border-radius: 6px;
  font-size: .875rem;
}

.alert-error,
.pf-m-danger {
  color: var(--error-color);
}

#kc-info-message,
#kc-form-options,
.login-pf-page .kc-feedback-text,
.instruction {
  font-size: .85rem;
  color: var(--ink-muted);
}

/* §149: ERRORS MUST LOOK LIKE ERRORS. Keycloak puts `kc-feedback-text` on its
   error messages too — the field ones ("Email already exists", #input-error-*)
   and the text inside the danger alert ("Invalid username or password") — so
   the muted rule above painted them as grey hints. A customer whose address was
   taken saw the form "just reload". These come after it and win. */
.login-pf-page .pf-m-error,
.login-pf-page [id^="input-error"],
.login-pf-page .alert-error .kc-feedback-text,
.login-pf-page .pf-m-danger .kc-feedback-text {
  color: var(--error-color);
  font-weight: 600;
}
.login-pf-page input[aria-invalid="true"] {
  border-color: var(--error-color) !important;
}

/* ------------------------------------------------------------- misc --- */

#kc-registration,
#kc-registration-container {
  font-size: .85rem;
  text-align: center;
}

/* Arabic (§30f): Keycloak sets dir=rtl for the ar locale. */
html[dir="rtl"] #kc-social-providers a[id^="social-"],
html[dir="rtl"] #kc-form-login label,
html[dir="rtl"] #kc-register-form label {
  text-align: right;
}

/* §149: on the register form the label's COLUMN is what carries PatternFly's
   text-align:left, so aligning the label alone left the Arabic labels on the
   wrong side. */
html[dir="rtl"] #kc-register-form .form-group > div {
  text-align: right;
}

@media (max-width: 480px) {
  .login-pf-page .card-pf {
    margin: 0 .75rem;
    padding: 1.25rem 1.1rem;
  }

  #kc-header-wrapper::before {
    width: 160px;
    height: 46px;
  }
}