/*
 * Modul Identity – Rollenmatrix der Mitarbeitenden, Zwei-Faktor-Anmeldung (Einrichtung,
 * Wiederherstellungscodes, Code-Eingabe). Nur Tokens des Designsystems, keine eigenen Farben oder Schriften.
 */

/* ---- Rollenmatrix: Rolle × Standort ---------------------------------------- */

.role-matrix {
    padding: 0;
    border: 0;
}

.role-matrix > legend {
    margin-bottom: var(--space-1);
    padding: 0;
}

.role-matrix .table-wrap {
    margin-top: var(--space-2);
}

.role-matrix__table tbody th {
    min-width: 13rem;
}

.role-matrix__table tbody th > .role-matrix__summary {
    display: -webkit-box;
    max-width: 38ch;
    overflow: hidden;
    -webkit-line-clamp: 2;
    -webkit-box-orient: vertical;
}

.role-matrix__table .role-matrix__scope,
.role-matrix__table .role-matrix__cell {
    min-width: 6.5rem;
    text-align: center;
    white-space: normal;
}

.role-matrix__table .role-matrix__scope--all {
    background: var(--c-blue-tint);
}

.role-matrix__check {
    display: inline-grid;
    place-items: center;
    width: var(--target-min);
    height: var(--target-min);
    border-radius: var(--radius);
    cursor: pointer;
}

.role-matrix__check:hover {
    background: var(--c-row-hover);
}

.role-matrix__check input {
    width: 20px;
    height: 20px;
}

/* ---- Code-Eingabe (Anmeldung, Einrichtung) -------------------------------- */

.mfa-code-input {
    max-width: 12rem;
    font-size: var(--fs-h3);
    letter-spacing: 0.2em;
    font-variant-numeric: tabular-nums;
}

.mfa-code-input--recovery {
    max-width: 18rem;
    letter-spacing: 0.08em;
    text-transform: uppercase;
}

.mfa-switch {
    margin: var(--space-4) 0 0;
}

/* ---- Einrichtung: QR-Code und Schlüssel ----------------------------------- */

/* Schritte dürfen schmaler werden als ihr Inhalt (kein Querscrollen bei 390 px) */
.mfa-steps .steps__item {
    grid-template-columns: 2.25rem minmax(0, 1fr);
}

.mfa-steps .steps__item > * {
    min-width: 0;
}

.mfa-steps h3 {
    margin: 0 0 var(--space-1);
    font-size: var(--fs-base);
}

.mfa-setup {
    display: flex;
    flex-wrap: wrap;
    align-items: flex-start;
    gap: var(--space-5);
}

.mfa-qr {
    flex: 0 0 auto;
    width: 13rem;
    max-width: 100%;
    padding: var(--space-2);
    border: 1px solid var(--c-border);
    border-radius: var(--radius);
    background: var(--c-white);
}

.mfa-qr__image {
    display: block;
    width: 100%;
    height: auto;
}

.mfa-manual {
    flex: 1 1 18rem;
    min-width: 0;
}

.mfa-manual p {
    margin: 0 0 var(--space-3);
}

/* Angabenlisten der 2FA-Seiten: Werte dürfen umbrechen (lange Kontonamen, Status-Etikett) */
.mfa-facts {
    grid-template-columns: minmax(6rem, max-content) minmax(0, 1fr);
}

.mfa-facts dd {
    overflow-wrap: anywhere;
}

.mfa-facts .badge {
    white-space: normal;
}

.mfa-secret {
    display: inline-flex;
    flex-wrap: wrap;
    gap: var(--space-1) var(--space-2);
    padding: var(--space-2) var(--space-3);
    font-size: var(--fs-lead);
    letter-spacing: 0.06em;
    color: var(--c-text-strong);
    word-break: break-all;
}

.mfa-secret-hint {
    display: block;
    margin-top: var(--space-1);
    font-size: var(--fs-small);
}

.mfa-confirm .field {
    max-width: 20rem;
}

/* ---- Wiederherstellungscodes ------------------------------------------------ */

.mfa-codes h2 {
    margin: 0 0 var(--space-2);
    font-size: var(--fs-h3);
}

.mfa-codes__print-note {
    display: none;
}

.mfa-codes__list {
    display: grid;
    grid-template-columns: repeat(auto-fill, minmax(11rem, 1fr));
    gap: var(--space-2) var(--space-5);
    margin: 0;
    padding: var(--space-4) var(--space-4) var(--space-4) var(--space-7);
    border: 1px dashed var(--c-border);
    border-radius: var(--radius);
    background: var(--c-white);
}

.mfa-codes__list code {
    font-size: var(--fs-lead);
    letter-spacing: 0.08em;
    background: transparent;
    color: var(--c-text-strong);
}

@media print {
    .mfa-codes-panel .alert,
    .mfa-codes__actions,
    .page-header {
        display: none !important;
    }

    .mfa-codes-panel {
        border: 0;
        box-shadow: none;
    }

    .mfa-codes__print-note {
        display: block;
        margin: 0 0 var(--space-3);
    }

    .mfa-codes__list {
        grid-template-columns: repeat(2, minmax(0, 1fr));
        border-style: solid;
    }
}

/* ---- Rollen je Geltungsbereich (Mitarbeitende bearbeiten) ---------------------------------- */

.role-scope {
    border: 1px solid var(--c-line);
    border-radius: var(--radius);
    background: var(--c-white);
}

.role-scope + .role-scope {
    margin-top: var(--space-2);
}

.role-scope > summary {
    display: flex;
    flex-wrap: wrap;
    align-items: center;
    gap: var(--space-1) var(--space-2);
    min-height: var(--target-min);
    padding: var(--space-2) var(--space-3);
    cursor: pointer;
    list-style-position: inside;
}

.role-scope > summary strong {
    color: var(--c-text-strong);
}

.role-scope[open] > summary {
    border-bottom: 1px solid var(--c-line);
    background: var(--c-row-alt);
}

.role-scope__summary {
    flex-basis: 100%;
    font-size: var(--fs-small);
}

.role-scope__body {
    padding: var(--space-2) var(--space-3) var(--space-3);
}

.role-scope__group {
    margin: var(--space-3) 0 var(--space-1);
    color: var(--c-text-strong);
    font-size: var(--fs-small);
    font-weight: 700;
}

.role-scope__choices {
    display: grid;
    grid-template-columns: repeat(auto-fill, minmax(min(100%, 14rem), 1fr));
    gap: 2px var(--space-4);
}