/* Styling for the controls static/js/password.js injects.
 *
 * Standalone rather than part of app.css, because these appear in two places
 * with nothing else in common: the app shell, and the Django admin's add-user
 * form where staff accounts are actually created. The admin cannot load
 * app.css -- Tailwind's preflight would reset the admin's own styling out from
 * under it -- so this file carries everything the controls need.
 *
 * Every colour is `var(--token, fallback)`. Inside the shell the tokens resolve
 * to the design system and the controls follow light/dark with everything else;
 * in the admin the tokens are undefined and the fallbacks -- which are the
 * light theme's values -- apply.
 */

.password-wrap {
  position: relative;
  display: block;
}

/* Room for the reveal button, so a long password does not run under it. */
.password-input {
  padding-right: 2.75rem !important;
  width: 100%;
}

.password-reveal {
  position: absolute;
  top: 0;
  right: 0;
  height: 100%;
  width: 2.75rem;
  display: grid;
  place-items: center;
  background: none;
  border: 0;
  padding: 0;
  cursor: pointer;
  border-radius: var(--radius-md, 8px);
  color: var(--color-ink-400, #8290a8);
  transition: color 160ms ease;
}

.password-reveal:hover {
  color: var(--color-ink-700, #435065);
}

.password-reveal:focus-visible {
  outline: 2px solid var(--color-brand-500, #3566b3);
  outline-offset: -2px;
}

/* --- Generate ------------------------------------------------------------ */

.password-generate {
  display: inline-flex;
  align-items: center;
  gap: 0.5rem;
  margin-top: 0.625rem;
  /* The 44px WCAG 2.5.5 target, matched to the app's .btn. */
  min-height: 2.75rem;
  padding: 0 1rem;
  border-radius: var(--radius-md, 8px);
  border: 1px solid var(--color-ink-200, #dfe4ed);
  background-color: var(--color-surface, #ffffff);
  color: var(--color-brand-800, #1a3563);
  font: inherit;
  font-size: 0.875rem;
  font-weight: 500;
  line-height: 1;
  cursor: pointer;
  transition: background-color 160ms ease, border-color 160ms ease,
              transform 160ms ease;
}

.password-generate:hover:not(:disabled) {
  background-color: var(--color-ink-50, #f6f8fb);
  border-color: var(--color-ink-300, #c3cbd9);
}

.password-generate:active:not(:disabled) {
  transform: translateY(1px);
}

.password-generate:disabled {
  opacity: 0.5;
  cursor: default;
}

.password-generate:focus-visible {
  outline: 2px solid var(--color-brand-500, #3566b3);
  outline-offset: 2px;
}

.password-generate-status:empty {
  display: none;
}

.password-generate-status {
  margin: 0.5rem 0 0;
  font-size: 0.75rem;
  color: var(--color-ink-500, #626e88);
}

.password-generate-status.is-error {
  color: var(--color-overdue-strong, #8a1a1a);
}

/* --- Checklist ----------------------------------------------------------- */

.password-checklist {
  list-style: none;
  margin: 0.75rem 0 0;
  padding: 0;
  display: grid;
  gap: 0.25rem;
}

.password-rule {
  display: flex;
  align-items: center;
  gap: 0.4rem;
  font-size: 0.75rem;
  color: var(--color-ink-500, #626e88);
  transition: color 160ms ease;
}

.password-rule-icon {
  width: 0.875rem;
  height: 0.875rem;
  flex-shrink: 0;
  opacity: 0.35;
  transition: opacity 160ms ease, color 160ms ease, transform 220ms
              cubic-bezier(0.34, 1.42, 0.64, 1);
}

.password-rule.is-met {
  color: var(--color-paid-strong, #0a5c3e);
}

.password-rule.is-met .password-rule-icon {
  opacity: 1;
  transform: scale(1.15);
}

/* The line about the breach check. It has no tick because it is not something
   the browser can verify -- it states what the server will do on submit. */
.password-rule-note {
  padding-left: 1.275rem;
  font-style: italic;
  opacity: 0.85;
}

@media (prefers-reduced-motion: reduce) {
  .password-reveal,
  .password-generate,
  .password-rule,
  .password-rule-icon {
    transition: none;
  }
}