/*
|--------------------------------------------------------------------------
| DICE™ Enterprise Application Platform
| Authentication UI
|--------------------------------------------------------------------------
| Palette is intentionally NOT dice.css's platform navy (--primary in
| assets/css/dice.css). This page never loads dice.css - it is the one
| screen a tenant's own identity gets top billing on, before DICE's own
| chrome takes over for everything after login. Colors below are sampled
| from the deployment's own brand mark (license/images/*.jpg via
| DeploymentIdentity) rather than the platform's stock blue, so the door
| a cafe's staff walks through every shift looks like their cafe, not like
| a generic admin template. A future deployment with a different brand
| mark only needs these tokens revisited - the structure below is brand-
| agnostic.
|--------------------------------------------------------------------------
*/

:root{
    --accent:       #A15F27;
    --accent-dark:  #7A481D;
    --accent-soft:  rgba(161,95,39,.16);
    --ink:          #3B2A1C;
    --ink-soft:     #6B5744;
    --ink-faint:    #A4907A;
    --border:       #E6D7C2;
    --border-soft:  #F1E7D8;
    --bg-card:      #FFFEFC;
    --bg-page:      #FAF3E8;
}

*{
    margin:0;
    padding:0;
    box-sizing:border-box;
}

html,
body{
    width:100%;
    height:100%;
    font-family:"Segoe UI",Arial,sans-serif;
}

body{

    display:flex;

    justify-content:center;

    align-items:center;

    min-height:100vh;

    overflow:hidden;

    background:
        linear-gradient(rgba(255,255,255,.35) 1px,transparent 1px),
        linear-gradient(90deg,rgba(255,255,255,.35) 1px,transparent 1px),
        radial-gradient(circle at top left,#D9A15C 0%,transparent 38%),
        radial-gradient(circle at bottom right,#8A5A2E 0%,transparent 42%),
        var(--bg-page);

    background-size:
        40px 40px,
        40px 40px,
        auto,
        auto,
        auto;

}

.dice-login-page{

    width:100%;

    min-height:100vh;

    display:flex;

    justify-content:center;

    align-items:center;

    padding:40px;

}

.dice-login-card{

    position:relative;

    width:100%;

    max-width:480px;

    background:var(--bg-card);

    border-radius:24px;

    padding:50px;

    box-shadow:
        0 25px 70px rgba(84,54,22,.16);

    animation:fadeUp .35s ease;

    overflow:hidden;

}

/* A quiet brand cue at the top edge of the card - the one piece of color
   the sign-in screen commits to, so the page doesn't read as an unstyled
   form even before anything else loads. */
.dice-login-card::before{

    content:"";

    position:absolute;

    top:0;

    left:0;

    right:0;

    height:5px;

    background:linear-gradient(90deg,var(--accent-dark),var(--accent));

}

.login-logo{

    text-align:center;

    margin-bottom:36px;

}

/* Brand mark hover-spin - login.php's <img class="dice-logo-spin"> (see
   auth_header.php/login.php). This page uses its own auth.css, not
   assets/css/dice.css, which is why the identical rule already living
   in dice.css (for sidebar.php/about.php) never applied here - added
   here too so the login logo spins the same way. */
.dice-logo-spin {
    transition: transform .6s ease;
}
.dice-logo-spin:hover {
    transform: rotate(360deg);
}

/* No boxed background/border here on purpose: a tenant's own logo (e.g.
   license/images/tractor.jpg) usually already carries its own brand
   color and full-bleed art - wrapping it in an unrelated light-grey card
   fought the artwork instead of presenting it. A shadow and rounded
   corners are enough to read as "framed", whatever the image looks like. */
.brand-mark{

    width:112px;

    height:112px;

    margin:0 auto 20px;

    border-radius:22px;

    box-shadow:0 12px 26px rgba(84,54,22,.20);

    display:flex;

    justify-content:center;

    align-items:center;

    overflow:hidden;

}

.brand-mark-img{

    width:100%;

    height:100%;

    object-fit:cover;

}

/* A refined caption, not a second headline: a tenant's own logo (e.g.
   the cursive "Tractor Cafe" mark) usually already sets the name in its
   own type - repeating it in a large bold sans right underneath fought
   the logo's own lettering instead of confirming it. Small tracked caps
   read as an identity label under any logo, the platform's included. */
.login-logo h1{

    font-size:15px;

    font-weight:700;

    color:var(--ink);

    margin-bottom:6px;

    line-height:1.3;

    letter-spacing:.14em;

    text-transform:uppercase;

}

.login-logo p{

    color:var(--ink-soft);

    font-size:12.5px;

    letter-spacing:.03em;

}

.login-error{

    margin-bottom:24px;

    padding:14px 18px;

    border-radius:12px;

    background:#FBE7E4;

    color:#A83B22;

}

.form-group{

    margin-bottom:22px;

}

.form-group label{

    display:block;

    margin-bottom:8px;

    font-weight:600;

    color:var(--ink);

}

.form-group input{

    width:100%;

    height:52px;

    padding:0 18px 0 46px;

    border:1px solid var(--border);

    border-radius:12px;

    font-size:15px;

    color:var(--ink);

    background:#fff;

    transition:.20s;

}

.form-group input::placeholder{

    color:var(--ink-faint);

}

.form-group input:hover{

    border-color:#CBAE85;

}

.form-group input:focus{

    outline:none;

    border-color:var(--accent);

    box-shadow:0 0 0 4px var(--accent-soft);

}

.input-box{

    position:relative;

}

.input-icon{

    position:absolute;

    left:16px;

    top:50%;

    transform:translateY(-50%);

    color:var(--ink-faint);

    pointer-events:none;

}

.password-box input{

    padding-right:56px;

}

.password-toggle{

    position:absolute;

    right:14px;

    top:50%;

    transform:translateY(-50%);

    display:flex;

    align-items:center;

    justify-content:center;

    padding:4px;

    background:none;

    border:none;

    cursor:pointer;

    color:var(--ink-faint);

    transition:color .2s;

}

.password-toggle:hover{

    color:var(--accent);

}

.login-options{

    margin:22px 0 28px;

    display:flex;

    align-items:center;

    justify-content:space-between;

}

.login-options label{

    display:flex;

    align-items:center;

    gap:10px;

    cursor:pointer;

    color:var(--ink-soft);

    font-size:14.5px;

}

.forgot-link{

    font-size:13.5px;

    font-weight:600;

    color:var(--accent);

    text-decoration:none;

}

.forgot-link:hover{

    text-decoration:underline;

}

.login-options input[type="checkbox"]{

    width:17px;

    height:17px;

    accent-color:var(--accent);

    cursor:pointer;

}

.login-button{

    width:100%;

    height:56px;

    border:none;

    border-radius:12px;

    background:var(--accent);

    color:#FFF;

    font-size:17px;

    font-weight:700;

    cursor:pointer;

    transition:.20s;

}

.login-button:hover{

    background:var(--accent-dark);

    transform:translateY(-2px);

    box-shadow:0 10px 24px rgba(122,72,29,.30);

}

.login-button:active{

    transform:translateY(0);

}

.login-footer{

    margin-top:34px;

    padding-top:20px;

    border-top:1px solid var(--border-soft);

    text-align:center;

    color:var(--ink-faint);

    font-size:12px;

    line-height:1.8;

}

.system-signature{

    display:flex;

    flex-direction:column;

    justify-content:center;

    align-items:center;

    gap:6px;

    margin-bottom:10px;

}

.system-signature .powered-by-logo{

    margin-bottom:-10px;

    position:relative;

    top:5px;

}

.powered-by-logo{

    height:92px;

    width:auto;

    opacity:.85;

    flex-shrink:0;

}

.system-signature-text{

    display:flex;

    flex-direction:column;

    align-items:center;

    justify-content:center;

    line-height:1.5;

    white-space:nowrap;

}

.system-signature-text span{

    font-size:10.5px;

    color:var(--ink-faint);

    white-space:nowrap;

}

.system-signature-head{

    font-size:12.5px;

    font-weight:600;

    color:var(--ink-soft);

}

.version-tag{

    color:#D8C6AC;

}

@keyframes fadeUp{

    from{

        opacity:0;

        transform:translateY(24px);

    }

    to{

        opacity:1;

        transform:translateY(0);

    }

}

@media (max-width:640px){

    .dice-login-page{

        padding:24px;

    }

    .dice-login-card{

        padding:34px;

        border-radius:20px;

    }

    .login-logo h1{

        font-size:14px;

    }

}

/*==========================================================
 Error Pages (403 / 404 / 500)
==========================================================*/

.dice-error-page{

    max-width:480px;

    margin:80px auto;

    text-align:center;

    padding:20px;

}

.dice-error-code{

    font-size:72px;

    font-weight:800;

    color:var(--accent,#A15F27);

    line-height:1;

    margin-bottom:12px;

}

.dice-error-page h1{

    font-size:22px;

    margin-bottom:10px;

    color:var(--ink);

}

.dice-error-page p{

    color:var(--ink-soft);

    margin-bottom:24px;

}

.dice-error-page .btn-back{

    display:inline-block;

    padding:12px 28px;

    background:var(--accent,#A15F27);

    color:#fff;

    border-radius:8px;

    text-decoration:none;

    font-weight:600;

    transition:.2s;

}

.dice-error-page .btn-back:hover{

    opacity:.9;

}

@media (max-width:480px){

    .dice-error-page{

        margin:40px auto;

    }

    .dice-error-code{

        font-size:56px;

    }

}

/* ---------------------------------------------------------------------------
   DEPLOYMENT IDENTITY (config/deployment_identity.php) is now the PRIMARY
   hero above - .brand-mark / .login-logo h1 / .login-logo p render whatever
   DeploymentIdentity resolves, tenant-first. The platform's own DICE mark is
   demoted to a small credit line in .login-footer (.powered-by) instead of
   competing with it for top billing. See login.php for the fallback: a
   deployment with no identity configured still gets the DICE-branded hero,
   just without a "Powered by" line underneath it.
   --------------------------------------------------------------------------- */