/* os-decrypter admin UI.
 *
 * Every rule lives in this file rather than in a style attribute: the Content
 * Security Policy is `default-src 'none'` with no 'unsafe-inline', so an
 * inline style would simply not apply, and would be a silent visual bug rather
 * than a loud one. Keeping the policy strict is what makes an injected
 * <script> or style-based data exfiltration inert.
 */

:root {
  --bg: #12141a;
  --panel: #1a1d26;
  --panel-2: #222633;
  --line: #2f3545;
  --fg: #e7e9ef;
  --fg-dim: #9aa2b5;
  --accent: #6ea8fe;
  --ok: #4ec9a0;
  --warn: #e3b341;
  --bad: #f2777a;
  --mono: ui-monospace, SFMono-Regular, "SF Mono", Menlo, Consolas, monospace;
}

* { box-sizing: border-box; }

body {
  margin: 0;
  background: var(--bg);
  color: var(--fg);
  font: 15px/1.5 system-ui, -apple-system, "Segoe UI", Roboto, sans-serif;
}

a { color: var(--accent); }
a:hover { text-decoration: underline; }

header.topbar {
  display: flex;
  flex-wrap: wrap;
  align-items: center;
  gap: 18px;
  padding: 12px 20px;
  background: var(--panel);
  border-bottom: 1px solid var(--line);
}

header.topbar .brand {
  font-weight: 700;
  letter-spacing: 0.02em;
}

header.topbar nav { display: flex; flex-wrap: wrap; gap: 14px; }
header.topbar nav a { color: var(--fg-dim); text-decoration: none; }
header.topbar nav a:hover, header.topbar nav a.active { color: var(--fg); }
header.topbar .spacer { flex: 1 1 auto; }
header.topbar .who { color: var(--fg-dim); font-size: 13px; }
header.topbar form { margin: 0; }

main { padding: 20px; max-width: 1200px; }

h1 { font-size: 20px; margin: 0 0 16px; }
h2 { font-size: 16px; margin: 24px 0 10px; }

.panel {
  background: var(--panel);
  border: 1px solid var(--line);
  border-radius: 6px;
  padding: 16px;
  margin-bottom: 18px;
}

.panel.narrow { max-width: 460px; }

table { border-collapse: collapse; width: 100%; font-size: 14px; }
th, td { text-align: left; padding: 7px 10px; border-bottom: 1px solid var(--line); vertical-align: top; }
th { color: var(--fg-dim); font-weight: 600; font-size: 12px; text-transform: uppercase; letter-spacing: 0.04em; }
tbody tr:hover { background: var(--panel-2); }

.mono, code, pre { font-family: var(--mono); font-size: 13px; }
pre { overflow-x: auto; background: var(--panel-2); padding: 12px; border-radius: 4px; }

.badge {
  display: inline-block;
  padding: 1px 8px;
  border-radius: 10px;
  font-size: 12px;
  border: 1px solid var(--line);
  color: var(--fg-dim);
}
.badge.ok { color: var(--ok); border-color: var(--ok); }
.badge.warn { color: var(--warn); border-color: var(--warn); }
.badge.bad { color: var(--bad); border-color: var(--bad); }

label { display: block; margin: 12px 0 4px; color: var(--fg-dim); font-size: 13px; }
input[type=text], input[type=email], input[type=password], input[type=number], input[type=datetime-local], textarea, select {
  width: 100%;
  padding: 8px 10px;
  background: var(--panel-2);
  color: var(--fg);
  border: 1px solid var(--line);
  border-radius: 4px;
  font: inherit;
}
textarea { min-height: 70px; }
.hint { color: var(--fg-dim); font-size: 12px; margin-top: 4px; }

button, .button {
  display: inline-block;
  padding: 8px 14px;
  margin-top: 14px;
  background: var(--accent);
  color: #0d1017;
  border: 0;
  border-radius: 4px;
  font: inherit;
  font-weight: 600;
  cursor: pointer;
  text-decoration: none;
}
button.secondary, .button.secondary { background: var(--panel-2); color: var(--fg); border: 1px solid var(--line); }
button.danger, .button.danger { background: var(--bad); color: #1a0d0e; }

.error {
  border: 1px solid var(--bad);
  color: var(--bad);
  background: rgba(242, 119, 122, 0.08);
  padding: 10px 12px;
  border-radius: 4px;
  margin-bottom: 14px;
}
.notice {
  border: 1px solid var(--accent);
  background: rgba(110, 168, 254, 0.08);
  padding: 10px 12px;
  border-radius: 4px;
  margin-bottom: 14px;
}

.token-warning {
  border: 2px solid var(--warn);
  background: rgba(227, 179, 65, 0.1);
  padding: 14px;
  border-radius: 6px;
  margin-bottom: 16px;
}
.token-warning strong { color: var(--warn); }
.token-box {
  font-family: var(--mono);
  font-size: 15px;
  word-break: break-all;
  background: #0d1017;
  border: 1px solid var(--warn);
  padding: 14px;
  border-radius: 4px;
  user-select: all;
}

.filters { display: flex; flex-wrap: wrap; gap: 12px; align-items: flex-end; }
.filters > div { flex: 0 1 190px; }
.filters label { margin-top: 0; }
.filters button { margin-top: 0; }

.pager { display: flex; gap: 12px; align-items: center; margin-top: 14px; color: var(--fg-dim); font-size: 13px; }

.kv { display: grid; grid-template-columns: 200px 1fr; gap: 6px 16px; font-size: 14px; }
.kv dt { color: var(--fg-dim); }
.kv dd { margin: 0; }

.copy-status { margin-left: 10px; color: var(--ok); font-size: 13px; }

footer.foot { padding: 16px 20px; color: var(--fg-dim); font-size: 12px; }

@media (max-width: 700px) {
  .kv { grid-template-columns: 1fr; }
  main { padding: 14px; }
}

/* --- administrator management ------------------------------------------
   Dangerous actions are visually distinct from routine ones. The disable,
   withdraw, reset-second-factor and sign-out-everywhere paths all carry
   either .danger (a button) or .danger-link (a list action), and their
   confirmation pages carry .danger-panel, so the page an operator lands on
   before an irreversible action does not look like the page they land on
   before a harmless one. There is no inline style anywhere: the CSP is
   style-src 'self' with no 'unsafe-inline'. */
a.danger-link,
a.danger-link:visited {
  color: #b3261e;
  font-weight: 600;
}
a.danger-link:hover {
  text-decoration: underline;
}
.danger-panel {
  border-left: 4px solid #b3261e;
  background: #fff6f5;
}
.danger-panel h1,
.danger-panel h2 {
  color: #8c1d18;
}
.subject {
  font-size: 1.05rem;
  font-weight: 600;
  margin: 0 0 0.75rem;
}