/* security.css — Integrations → "Additional security" card + the
   full-screen TOTP login gate (auth_gate.js).

   Visual language matches sections.css / modal.css so the new card and
   modals don't look like a foreign body in the rest of the panel. */

/* ── Card body ──────────────────────────────────────────────────────────── */

.security-list {
  display: flex;
  flex-direction: column;
  gap: 0.75rem;
}

.sec-row {
  border: 1px solid var(--border);
  border-radius: 12px;
  padding: 0.85rem 1rem;
  background: var(--security-row-bg);
  display: flex;
  flex-direction: column;
  gap: 0.4rem;
}

.sec-row-head {
  display: flex;
  align-items: center;
  justify-content: space-between;
  gap: 0.6rem;
}
.sec-row-title {
  display: inline-flex;
  align-items: center;
  gap: 0.5rem;
  font-size: 0.95rem;
}
.sec-emoji { font-size: 1.05rem; }
/* The Telegram login method: the official mark, a white plane on the
   Telegram-blue disc, sized to sit with the emoji of the other rows. */
.sec-emoji--tg {
  display: inline-grid;
  place-items: center;
  width: 1.2em;
  height: 1.2em;
  border-radius: 50%;
  background: #229ED9;
  color: #fff;
  vertical-align: -0.2em;
  flex: none;
}
.sec-emoji--tg svg { width: 0.78em; height: 0.78em; margin-left: -0.08em; }

.sec-status {
  font-size: 0.78rem;
  letter-spacing: 0.04em;
  text-transform: uppercase;
  padding: 2px 8px;
  border-radius: 999px;
}
.sec-status-on  { background: var(--security-on-bg); color: var(--security-on-text); }
.sec-status-off { background: var(--security-off-bg); color: var(--security-off-text); }

.sec-row-desc {
  margin: 0;
  font-size: 0.85rem;
  opacity: 0.85;
  line-height: 1.4;
}

.sec-row-actions {
  display: flex;
  gap: 0.5rem;
  margin-top: 0.25rem;
  flex-wrap: wrap;
}

.sec-backup-line { font-size: 0.8rem; opacity: 0.75; margin: 0; }

/* ── Login methods: one switch per way in ─────────────────────────────────── */

/* base.css styles every <input> as a full-width text field (width: 100%,
   padding, border); a checkbox must opt out of all of that, as .sec-keep-box
   does, or it fills the row and squeezes the text into a one-letter column. */
.sec-method { gap: 0.3rem; }
.sec-method-label {
  display: grid;
  grid-template-columns: auto minmax(0, 1fr);
  column-gap: 0.7rem;
  align-items: start;
  cursor: pointer;
}
.sec-method-box {
  width: auto;
  min-width: 0;
  height: auto;
  margin: 0.2rem 0 0 0;
  padding: 0;
  border: 0;
  border-radius: 0;
  background: none;
  box-shadow: none;
  accent-color: var(--accent);
}
.sec-method-box:focus { box-shadow: none; }
.sec-method-box:disabled { cursor: progress; }
.sec-method-text { display: flex; flex-direction: column; gap: 0.25rem; min-width: 0; }
.sec-method-desc { overflow-wrap: anywhere; }
.sec-method-note { margin: 0 0 0 calc(0.7rem + 13px); font-size: 0.8rem; }

/* ── Passkeys / security keys: the owner's credentials ───────────────────── */

.sec-credential-list { display: flex; flex-direction: column; }
.sec-credential {
  display: flex;
  align-items: center;
  gap: 0.75rem;
  padding: 0.55rem 0;
  border-top: 1px solid var(--border);
}
.sec-credential:first-child { border-top: 0; padding-top: 0; }
.sec-credential-body { flex: 1 1 12rem; min-width: 0; }
.sec-credential-name { font-weight: 600; overflow-wrap: anywhere; }

/* ── In-modal styling (setup / disable / regen) ─────────────────────────── */

.sec-step-intro {
  margin: 0 0 0.5rem 0;
  font-size: 0.9rem;
  line-height: 1.45;
}

.sec-qr-wrap {
  display: flex;
  justify-content: center;
  margin: 0.6rem 0 0.75rem 0;
}
.sec-qr {
  width: 200px;
  height: 200px;
  background: #fff;
  padding: 8px;
  border-radius: 10px;
}

.sec-secret {
  display: block;
  font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
  font-size: 0.95rem;
  letter-spacing: 0.05em;
  background: var(--surface-control);
  padding: 0.55rem 0.7rem;
  border-radius: 8px;
  margin: 0.25rem 0 0.85rem 0;
  user-select: all;
  word-break: break-all;
}

.sec-code-input {
  width: 100%;
  font-size: 1.4rem;
  letter-spacing: 0.18em;
  text-align: center;
  padding: 0.55rem 0.6rem;
  border-radius: 10px;
  border: 1px solid var(--border2, var(--border));
  background: var(--surface-control);
  color: inherit;
  font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
  margin: 0.4rem 0 0.5rem 0;
}
.sec-code-input:focus {
  outline: none;
  border-color: var(--accent);
}

.sec-error {
  color: var(--danger-action);
  font-size: 0.85rem;
  margin: 0 0 0.4rem 0;
}

.sec-warn {
  background: var(--byok-soft);
  color: var(--text);
  border-radius: 8px;
  padding: 0.5rem 0.7rem;
  font-size: 0.85rem;
  margin: 0.25rem 0 0.6rem 0;
}

.sec-modal-foot {
  display: flex;
  justify-content: flex-end;
  gap: 0.5rem;
  margin-top: 0.6rem;
}
.sec-modal-foot .danger {
  background: var(--err);
  color: var(--on-accent-solid);
  border: 1px solid var(--err);
}
.sec-modal-foot .danger:hover { background: var(--danger-action-hover); }
.sec-row-actions .danger {
  background: transparent;
  color: var(--danger-action);
  border: 1px solid color-mix(in srgb, var(--err) 55%, transparent);
}
.sec-row-actions .danger:hover { background: var(--err); color: var(--on-accent-solid); }

.sec-backup-list {
  display: grid;
  grid-template-columns: 1fr 1fr;
  gap: 0.35rem 1rem;
  margin: 0.4rem 0 0.6rem 0;
  padding-left: 1rem;
  list-style: none;
}
.sec-backup-list li {
  font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
  font-size: 0.95rem;
  letter-spacing: 0.06em;
}
.sec-backup-list code {
  background: transparent;
  padding: 0;
  font-size: inherit;
}

/* ── Full-screen auth gate (auth_gate.js) ───────────────────────────────── */

.auth-gate-overlay {
  position: fixed;
  inset: 0;
  z-index: 100000;            /* above modal-overlay (9999) */
  background: color-mix(in srgb, var(--bg) 92%, transparent);
  backdrop-filter: blur(8px);
  display: flex;
  align-items: center;
  justify-content: center;
  padding: 1rem;
}

.auth-gate-card {
  background: var(--card);
  border: 1px solid var(--border2);
  border-radius: 14px;
  padding: 1.25rem 1.4rem 1.4rem 1.4rem;
  width: min(420px, 100%);
  box-shadow: 0 18px 54px rgba(0, 0, 0, 0.55);
}

.auth-gate-head {
  display: flex;
  align-items: center;
  gap: 0.6rem;
  margin-bottom: 0.6rem;
}
.auth-gate-icon { font-size: 1.4rem; }
.auth-gate-title { font-size: 1.05rem; font-weight: 600; }

.auth-gate-intro {
  margin: 0 0 0.65rem 0;
  font-size: 0.9rem;
  line-height: 1.45;
  opacity: 0.85;
}

.auth-gate-input {
  width: 100%;
  font-size: 1.5rem;
  letter-spacing: 0.2em;
  text-align: center;
  padding: 0.55rem 0.6rem;
  border-radius: 10px;
  border: 1px solid var(--border2, var(--border));
  background: var(--surface-control);
  color: inherit;
  font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
}
.auth-gate-input:focus { outline: none; border-color: var(--accent); }

.auth-gate-error {
  color: var(--danger-action);
  font-size: 0.85rem;
  margin: 0.55rem 0 0 0;
}

/* One shape for every full-width action in a gate card, so the primary button
   and the Telegram one measure identically and read as one set. The Telegram
   action is an <a> and inherits NOTHING from base.css's `button` rule, so the
   geometry that rule would have supplied — font size, weight, line height — is
   spelled out here for both rather than left to differ by element name. */
.auth-gate-submit,
.auth-gate-telegram {
  display: flex;
  align-items: center;
  justify-content: center;
  gap: 0.5rem;
  width: 100%;
  margin-top: 0.7rem;
  padding: 0.6rem 0.8rem;
  border-radius: 10px;
  font-size: 0.82rem;
  font-weight: 600;
  line-height: 1.2;
  text-decoration: none;
  cursor: pointer;
}

.auth-gate-hint {
  margin: 0.85rem 0 0 0;
  font-size: 0.8rem;
  opacity: 0.7;
  text-align: center;
}

/* Telegram is the other half of the same invitation, not a footnote, so it
   gets a real button in Telegram's own blue. No rule separates the two: they
   are different destinations, not a second attempt at the first one, and a
   hairline between two adjacent buttons only adds a line to look at.
   The transparent border keeps this box exactly as tall as the primary
   button's bordered one. */
.auth-gate-telegram {
  border: 1px solid transparent;
  background: #229ed9;          /* Telegram brand blue */
  color: #fff;
  transition: background 0.15s ease;
}
.auth-gate-telegram:hover { background: #2aabee; color: #fff; }
.auth-gate-telegram:focus-visible {
  outline: 2px solid var(--accent);
  outline-offset: 2px;
}

.auth-gate-telegram-mark {
  width: 1.1rem;
  height: 1.1rem;
  flex: none;
  fill: currentColor;
}

/* The hint belongs to the button right above it, not to the card. */
.auth-gate-telegram + .auth-gate-hint { margin-top: 0.55rem; }

/* "Keep me signed in on this device": a checkbox row under the current
   device's line, its hint on a line of its own in the row's muted tone. */
.sec-keep {
  display: grid;
  grid-template-columns: auto 1fr;
  column-gap: 0.5rem;
  align-items: start;
  margin: 0.35rem 0 0.15rem 0;
  font-size: 0.85rem;
  cursor: pointer;
}
/* On its own card (Stay signed in) the switch reads like a method row. */
.sec-keep-row .sec-keep { margin: 0; font-size: 0.95rem; column-gap: 0.7rem; }
.sec-keep-row .sec-keep > span:not(.sec-keep-hint) { font-weight: 600; }
.sec-keep-row .sec-keep-hint { font-size: 0.85rem; opacity: 0.85; margin-top: 0.25rem; }
.sec-keep-box { margin: 0.15rem 0 0 0; }
.sec-keep-hint {
  grid-column: 2;
  font-size: 0.78rem;
  opacity: 0.7;
  line-height: 1.4;
}

/* ── Sessions & devices ─────────────────────────────────────────────────── */

/* Small pills: "This device", who holds a session, "Coming soon". */
.sec-badge {
  display: inline-flex;
  align-items: center;
  font-size: 0.72rem;
  font-weight: 500;
  line-height: 1.5;
  padding: 0 8px;
  border-radius: 999px;
  white-space: nowrap;
  background: var(--security-off-bg);
  color: var(--security-off-text);
}
.sec-badge-current { background: var(--accent-soft); color: var(--accent); }
.sec-badge-kept { background: var(--security-on-bg); color: var(--security-on-text); }
.sec-row-title .sec-badge { margin-left: 0.15rem; }

/* The idle-expiry picker: title left, picker right, hint underneath. */
.sec-expiry-label {
  display: flex;
  flex-wrap: wrap;
  align-items: center;
  justify-content: space-between;
  gap: 0.5rem 0.75rem;
}
.sec-expiry-label select { width: auto; flex: none; max-width: 100%; min-width: 9rem; }
.sec-expiry-label select:disabled { opacity: 0.6; cursor: not-allowed; }

.sec-count { text-transform: none; letter-spacing: 0; min-width: 1.6rem; text-align: center; }

/* One device per line: icon · name and pills over IP and last activity ·
   sign-out on the right. Lines are split by hairlines, not boxed, so a long
   list stays calm. */
.sec-session-list { display: flex; flex-direction: column; }
.sec-session {
  display: flex;
  flex-wrap: wrap;
  align-items: center;
  gap: 0.5rem 0.75rem;
  padding: 0.7rem 0;
  border-top: 1px solid var(--border);
}
.sec-session:first-child { border-top: 0; padding-top: 0.35rem; }
.sec-session-icon {
  flex: none;
  width: 2.3rem;
  height: 2.3rem;
  display: grid;
  place-items: center;
  border-radius: 10px;
  font-size: 1.1rem;
  background: var(--surface-hover-strong);
}
.sec-session.is-current .sec-session-icon {
  background: var(--accent-soft);
  box-shadow: inset 0 0 0 1px color-mix(in srgb, var(--accent) 35%, transparent);
}
.sec-session-body { flex: 1 1 12rem; min-width: 0; }
.sec-session-name {
  display: flex;
  flex-wrap: wrap;
  align-items: center;
  gap: 0.3rem 0.45rem;
  font-size: 0.9rem;
}
.sec-session-device {
  font-weight: 600;
  max-width: 100%;
  overflow: hidden;
  text-overflow: ellipsis;
  white-space: nowrap;
}
.sec-session-meta {
  margin: 0.2rem 0 0 0;
  font-size: 0.8rem;
  line-height: 1.4;
  color: var(--muted);
  overflow-wrap: anywhere;
}
.sec-session-meta [title] { cursor: help; }
.sec-session-revoke { flex: none; margin-left: auto; }

.sec-sessions-actions {
  border-top: 1px solid var(--border);
  padding-top: 0.75rem;
  margin-top: 0;
}

/* Two-tap confirm: the armed button turns red until it fires or times out. */
.sec-row button.is-armed {
  color: var(--danger-action);
  border-color: color-mix(in srgb, var(--err) 55%, transparent);
}

/* A line before each part of a card that has two (the idle limit, the devices). */
.sec-part-intro { margin: 0.2rem 0 0; }
.sec-part-intro + .sec-row { margin-top: 0.1rem; }