/* mia-nube Vaultwarden brand override
 * Hides the Vaultwarden/Bitwarden footer disclaimer and applies the mia-nube accent.
 *
 * This file is served at a CONTENT-ADDRESSED url — /brand-override.css?v=<sha256
 * prefix of these bytes>, built in infra/modules/vaultwarden/main.tf. Editing
 * anything here, this comment included, changes that url, which is what stops a
 * returning browser replaying the copy it already holds: the response is
 * `public, immutable, max-age=604800` with no ETag, so at an unversioned url the
 * cache lifetime would be the staleness window and no deploy could shorten it.
 *
 * Target: Vaultwarden 1.37.0 (web-vault bundle 2026.6.0)
 * Verified against the rendered DOM on vault-test 2026-07-31 across ELEVEN
 *   pre-vault routes (#/login, #/sso, #/signup, #/hint, #/recover-2fa and the
 *   six that redirect to #/login), change repoint-vaultwarden-accent-to-rendered-dom.
 *   On every one of them: `footer` 1 node computing display:none, `a` computing
 *   rgb(184,121,74), and --color-bg-brand / --color-border-brand resolving to
 *   #B8794A. No visible "Vaultwarden"/"Bitwarden" text.
 *
 *   The bundle is ONE SPA document, so the override applies document-wide and a
 *   per-route difference in branding is not possible for these rules. What IS
 *   per-route is which ELEMENTS exist — which is why the illustration retint
 *   below was missed until a dialog that renders an illustration was inspected.
 *
 * CACHE WARNING, learned the hard way during that re-verification: the first
 * DOM measurement reported the button as #1252a3 (Bitwarden blue) and the
 * `:root` rule as absent. That was NOT a bundle regression — the browser was
 * replaying a STALE cached brand-override.css (served `immutable` with a long
 * max-age at an unversioned URL). Re-measuring after `fetch(url, {cache:
 * 'reload'})` showed the correct copper. This is exactly the failure the spec's
 * "SHALL defeat HTTP caching" clause exists for: an uncached read can report a
 * shipped change as failed. Always prime with a cache-busting fetch before
 * measuring, and never conclude "regression" from a first uncached read.
 *
 * Previous target: Vaultwarden 1.36.0 (web-vault bundle 2026.4.1), verified 2026-07-22.
 * Injection: ConfigMap mounted at /web-vault/brand-override.css, linked into
 *   index.html by the `inject-brand-css` init container.
 *
 * Twelve logo/footer/version selectors written against v1.35.3 were removed on
 * 2026-07-22 after each measured ZERO matches in the served DOM — they read as
 * branding coverage this file did not actually have. If you add a selector,
 * measure it against the served bundle first.
 *
 * The thirteenth such dead selector, `.new-logo-themed`, was also removed
 * (2026-07-23, change assert-vaultwarden-branding-on-the-rendered-dom) after it
 * measured ZERO rendered matches on #/login, #/vault and #/setup-extension. It had
 * been retained only to satisfy a text-grep in tests/vaultwarden/04-branding.sh;
 * that grep is gone, and the gate now asserts the rendered footer effect in
 * tests/vaultwarden-branding-dom/branding-dom.spec.js instead of the stylesheet's text.
 *
 * NOTE — the logo is NOT suppressed here, and does not need to be. The mia-nube
 * glyph is appended by home-link.js (which also hides the upstream wordmark), not
 * by hiding an upstream logo with CSS. The removal of the old .vaultwarden-logo /
 * .header-img / img[alt="Vaultwarden"] rules is therefore not a regression: they
 * matched nothing, and the element they were written to hide is not present in
 * this bundle.
 *
 * CORRECTION 2026-07-31 — that glyph did NOT render. home-link.js pointed its
 * <img src> at ${home_url}/static/logo-glyph.svg, a CROSS-ORIGIN host, and
 * Vaultwarden's own CSP is `img-src 'self' data: https://haveibeenpwned.com`.
 * Chromium blocked the request (requestfailed reason `csp`, naturalWidth 0) on
 * EVERY route, on BOTH clusters, so the header rendered the alt text "Mia Nube"
 * instead of the mark. The glyph is now mounted into the web vault itself and
 * served same-origin at /logo-glyph.svg. Nothing we serve may make a user's
 * browser contact a third party (CLAUDE.md, "No Third-Party Runtime Assets");
 * a cross-origin fetch of our own asset was the milder form of the same defect,
 * and the CSP happened to enforce the rule the code had broken.
 */

/* Footer carrying the Vaultwarden/Bitwarden disclaimer, product name and version.
 * The one selector of the original fourteen that matches (1 node, verified). */
footer {
  display: none !important;
}

/* Accent — terra/copper from design-system tokens.
 *
 * The 1.36.0 web vault is Tailwind-based and has no Bootstrap-era `.btn-primary`
 * class (measured: 0 matches). Its primary buttons carry `tw-bg-bg-brand` /
 * `tw-border-border-brand`, which resolve to the custom properties below, so we
 * retint the properties rather than chase utility class names. This also covers
 * the hover state (`hover:tw-bg-bg-brand-strong`) and any future element that
 * uses the brand tokens, instead of needing a new rule per component. */
:root {
  --color-bg-brand: #B8794A !important;
  --color-border-brand: #B8794A !important;
  --color-bg-brand-strong: #9A6538 !important;
  --color-border-brand-strong: #9A6538 !important;

  /* Illustration tokens — the SECOND family of brand colour in this bundle, and
   * the one the login page cannot reveal. The dialogs the SSO flow routes into
   * (set-initial-password, join-organization) render an inline SVG illustration
   * whose fills come from `tw-fill-illustration-*` utilities resolving to these
   * properties, NOT from the --color-bg-brand family above. Measured stock on
   * vault-test 2026-07-31: bg-primary `219 229 246`, bg-secondary `170 195 239`,
   * logo `23 93 220` (Bitwarden blue) and tertiary `255 191 0` (amber) — i.e. an
   * indigo/yellow padlock sitting inside an otherwise copper page.
   *
   * Retinted onto documented mia-nube palette entries only (design-system/tokens/
   * colors_and_type.css) — no colour is invented here. The bundle consumes these
   * as SPACE-SEPARATED rgb triplets inside rgb(var(--x) / <alpha>), so they must
   * be written as triplets, not as hex; a hex value here silently computes to
   * nothing. bg-tertiary is already #ffffff and is left alone. */
  --color-illustration-bg-primary: 236 227 211 !important;   /* sand-200  #ECE3D3 */
  --color-illustration-bg-secondary: 223 210 189 !important; /* sand-300  #DFD2BD */
  --color-illustration-logo: 184 121 74 !important;          /* terra-500 #B8794A */
  --color-illustration-outline: 46 41 32 !important;         /* cocoa-900 #2E2920 */
  --color-illustration-tertiary: 217 138 82 !important;      /* amber-500 #D98A52 */
}

a {
  color: #B8794A !important;
  background-color: transparent !important;
  border-color: transparent !important;
}