/*
 * The zeit-online realm authenticates exclusively through identity providers
 * (Azure AD and the zeit-online-ext realm), so its username/password form is
 * dead weight and gets hidden. zeit-online-ext shares this theme but IS the
 * password realm, so it must keep its form.
 *
 * The two are told apart by whether the page offers identity providers at all:
 * zeit-online has two brokers, zeit-online-ext has none. Keying on that keeps
 * one theme serving both realms.
 *
 * CAUTION: this couples "realm has identity providers" to "hide the password
 * form". If an identity provider is ever added to zeit-online-ext, its
 * password form disappears and password users are locked out of the UI. Should
 * that happen, split this rule out into a separate child theme rather than
 * loosening the selector.
 */
.pf-v5-c-login__main:has(#kc-social-providers) #kc-form-login {
    display: none;
}

/*
 * With no visible password form, the "or sign in with" band above the identity
 * providers has nothing to contrast against. keycloak.v2's social-providers.ftl
 * renders it as the sibling directly preceding #kc-social-providers.
 */
.pf-v5-c-login__main-footer-band:has(+ #kc-social-providers) {
    display: none;
}

/*
 * keycloak.v2 blanks the kcLogoIdP-* properties and picks a button icon from
 * the provider's providerId instead. Both of our brokers are plain "oidc", so
 * both end up with the same placeholder cube. Drop it rather than label two
 * different destinations with one meaningless glyph.
 */
#kc-social-providers a > svg {
    display: none;
}

/*
 * Staff sign in through Azure AD; the external-users realm is the exception.
 * Promote Azure to the primary action so the two paths are not weighted
 * equally. Borrow PatternFly's own primary-button tokens rather than hardcode
 * colours — they are already redefined under .pf-v5-theme-dark, so dark mode
 * follows automatically. ::after carries the secondary button's border.
 */
#social-microsoft {
    background-color: var(--pf-v5-c-button--m-primary--BackgroundColor);
    color: var(--pf-v5-c-button--m-primary--Color);
}

#social-microsoft:hover {
    background-color: var(--pf-v5-c-button--m-primary--hover--BackgroundColor);
    color: var(--pf-v5-c-button--m-primary--Color);
}

#social-microsoft::after {
    border: 0;
}

/*
 * The header carrying the realm display name is deliberately left alone: it
 * renders exactly as keycloak.v2 styles it. The one exception is the colour
 * fix below, which is required for legibility rather than for looks.
 */

/*
 * The v1 theme flattened the page background to a solid colour on small
 * screens; keycloak.v2 keeps the photographic background at every width.
 * Restore the flat background. The token flips under .pf-v5-theme-dark, so
 * this stays correct in dark mode.
 */
@media (max-width: 767px) {
    .login-pf body {
        background: var(--pf-v5-global--BackgroundColor--100);
    }

    /*
     * Colour only — the header is otherwise left as keycloak.v2 renders it.
     * Without this it is white on the flat white background above, i.e.
     * invisible: PatternFly re-scopes --pf-v5-global--Color--100 to white
     * inside .pf-v5-c-login__header because that text normally sits on the
     * dark photo. --pf-v5-global--Color--dark-100 is only ever defined on
     * :root (#151515) and .pf-v5-theme-dark (#e0e0e0), so it survives the
     * re-scope and still follows the colour scheme. The !important is needed
     * to beat keycloak.v2's own !important on the header colour.
     */
    #kc-header-wrapper {
        color: var(--pf-v5-global--Color--dark-100) !important;
    }

    /*
     * v1 also dropped the card frame at this width, so the form read as part
     * of the page rather than as a panel floating on it. keycloak.v2 already
     * lets the card run full bleed here, so only the shadow and the accent
     * border above the header need removing.
     */
    .pf-v5-c-login__main {
        box-shadow: none;
        /*
         * In light mode the card and the page are both white, so dropping the
         * shadow is enough. In dark mode the card sits on BackgroundColor--300
         * against a --100 page and stays visible as a lighter block, so let
         * the page show through instead.
         */
        background-color: transparent;
    }

    .pf-v5-c-login__main-header {
        border-top: 0;
    }
}