/* ---------------------------------------------------------------------------
   Two-factor authentication (TOTP) — Security page + enrollment / login modals.
   Reuses the app design tokens and shares the .settings-detail-card shell with
   the other settings pages. Epic #1861, stage 1 (#1862).
   --------------------------------------------------------------------------- */

#security-2fa {
  max-width: 760px;
}

.twofa-row {
  display: flex;
  align-items: center;
  justify-content: space-between;
  gap: 16px;
  flex-wrap: wrap;
}

.twofa-strong {
  font-weight: 700;
}

.twofa-muted {
  color: var(--clr-muted);
  font-size: 0.85rem;
}

.twofa-actions {
  display: flex;
  gap: 8px;
  flex-wrap: wrap;
}

/* Status pill */
.twofa-pill {
  display: inline-flex;
  align-items: center;
  gap: 6px;
  padding: 2px 10px;
  border-radius: 999px;
  font-size: 0.72rem;
  font-weight: 700;
  border: 1px solid var(--clr-border);
  vertical-align: middle;
}
.twofa-pill::before {
  content: "";
  width: 7px;
  height: 7px;
  border-radius: 50%;
  background: currentColor;
  display: inline-block;
}
.twofa-pill.on {
  background: var(--clr-success-bg);
  color: var(--clr-success-text);
  border-color: var(--clr-success-border);
}
.twofa-pill.off {
  background: var(--clr-surface);
  color: var(--clr-muted);
}

/* Inline banner */
.twofa-alert {
  border-radius: 10px;
  padding: 11px 14px;
  font-size: 0.85rem;
  margin-bottom: 14px;
  border: 1px solid transparent;
}
.twofa-alert.success {
  background: var(--clr-success-bg);
  color: var(--clr-success-text);
  border-color: var(--clr-success-border);
}
.twofa-alert.warn {
  background: var(--clr-warning-bg);
  color: var(--clr-warning-text);
  border-color: var(--clr-warning-border);
}

.twofa-device-row {
  display: flex;
  justify-content: space-between;
  gap: 12px;
  padding: 8px 0;
  border-bottom: 1px solid var(--clr-border);
  font-size: 0.85rem;
}
.twofa-device-row:last-of-type {
  border-bottom: none;
}

/* ---- Modals (share the app's overlay conventions) ---- */
.twofa-modal {
  position: fixed;
  inset: 0;
  z-index: 1280;
}
.twofa-modal.hidden {
  display: none;
}
.twofa-modal-backdrop {
  position: absolute;
  inset: 0;
  background: rgba(15, 23, 42, 0.5);
}
.twofa-modal-card {
  position: absolute;
  top: 50%;
  left: 50%;
  transform: translate(-50%, -50%);
  width: min(460px, calc(100vw - 2rem));
  max-height: calc(100vh - 2rem);
  overflow: auto;
  border: 1px solid var(--clr-border);
  border-radius: 12px;
  background: var(--clr-elevated);
  box-shadow: var(--clr-shadow);
  padding: 1.1rem 1.2rem 1.2rem;
}
.twofa-modal-card h2 {
  margin: 0 0 0.4rem;
  font-size: 1.1rem;
}
.twofa-modal-actions {
  margin-top: 1.1rem;
  display: flex;
  justify-content: flex-end;
  gap: 0.55rem;
}
.twofa-modal-error {
  margin: 0.5rem 0 0;
  font-size: 0.82rem;
  color: var(--clr-error-text);
}
.twofa-modal-error.hidden {
  display: none;
}

/* Stepper */
.twofa-steps {
  display: flex;
  gap: 6px;
  margin-bottom: 16px;
}
.twofa-steps span {
  flex: 1;
  height: 5px;
  border-radius: 999px;
  background: var(--clr-border);
}
.twofa-steps span.done {
  background: var(--clr-primary-fill);
}
.twofa-steps span.cur {
  background: var(--clr-primary-fill);
  opacity: 0.5;
}

/* QR + manual key */
.twofa-qr {
  display: flex;
  justify-content: center;
  margin: 4px auto 12px;
  min-height: 160px;
}
.twofa-qr svg,
.twofa-qr img {
  width: 168px;
  height: 168px;
  border: 1px solid var(--clr-border);
  border-radius: 10px;
  background: #fff;
}
.twofa-secret {
  font-family: ui-monospace, Consolas, monospace;
  background: var(--clr-surface-alt);
  border: 1px solid var(--clr-border);
  border-radius: 8px;
  padding: 8px 10px;
  text-align: center;
  letter-spacing: 0.12em;
  font-size: 0.9rem;
  word-break: break-all;
}

/* Code entry */
.twofa-code-input {
  width: 100%;
  text-align: center;
  letter-spacing: 0.4em;
  font-size: 1.5rem;
  font-weight: 700;
  padding: 0.6rem;
  border: 1px solid var(--clr-border);
  border-radius: 10px;
  background: var(--clr-input-bg);
  color: var(--clr-text);
}
.twofa-code-input:focus {
  outline: none;
  border-color: var(--clr-primary);
  box-shadow: 0 0 0 3px rgba(37, 99, 235, 0.15);
}

.twofa-field-label {
  display: block;
  font-size: 0.82rem;
  font-weight: 600;
  color: var(--clr-muted);
  margin: 0.7rem 0 0.3rem;
}
.twofa-text-input {
  width: 100%;
  padding: 0.5rem 0.65rem;
  border: 1px solid var(--clr-border);
  border-radius: var(--radius);
  background: var(--clr-input-bg);
  color: var(--clr-text);
  font-size: 0.9rem;
}

/* Recovery codes grid */
.twofa-codes {
  display: grid;
  grid-template-columns: 1fr 1fr;
  gap: 8px;
  font-family: ui-monospace, Consolas, monospace;
  font-size: 0.9rem;
  background: var(--clr-surface-alt);
  border: 1px solid var(--clr-border);
  border-radius: 10px;
  padding: 14px;
  margin: 12px 0;
}

.twofa-remember {
  display: flex;
  align-items: center;
  gap: 8px;
  margin-top: 0.9rem;
  font-size: 0.85rem;
  color: var(--clr-text);
  cursor: pointer;
}

.twofa-linkbtn {
  background: none;
  border: none;
  color: var(--clr-primary);
  cursor: pointer;
  font-size: 0.82rem;
  padding: 0;
  text-decoration: underline;
}

/* ---------------------------------------------------------------------------
 * Rules below replace style="" attributes that lived in index.php's 2FA modals
 * and partials/views/security-2fa.php (#2335).
 * ------------------------------------------------------------------------- */

/* Info variant, alongside .success/.warn above. No --clr-info-border token
   exists yet, so this uses the same var(--token, <literal>) fallback idiom as
   --clr-danger elsewhere; #2333 defines the token and this starts using it. */
.twofa-alert.info {
  background: var(--clr-info-bg);
  color: var(--clr-info-text);
  border-color: var(--clr-info-border, #bfdbfe);
}

/* The policy modal is wider than the default card — it holds a compliance list. */
.twofa-modal-card.wide {
  width: min(560px, calc(100vw - 2rem));
}

/* The login prompt puts "Use a recovery code" opposite the Cancel/Verify pair,
   rather than the default flex-end grouping. */
.twofa-modal-actions.split {
  justify-content: space-between;
  align-items: center;
}

/* Vertical rhythm within the org 2FA policy modal. */
.twofa-policy-toggle-row {
  margin-top: 10px;
}

.twofa-policy-note {
  margin-top: 12px;
}

.twofa-policy-compliance-title {
  margin-top: 14px;
}

/* Security > 2FA settings panel. */
#twofa-status-sub {
  margin-top: 4px;
}

#btn-twofa-revoke-devices {
  margin-top: 10px;
}