/* Risks page — issue cards, the issue table, and the attack path.
 *
 * The previous version of this file was authored LIGHT-THEME-ONLY (#eef2f6
 * chips, a #fafbfc chart canvas, #333/#666 ink) while the rest of the app was
 * dark, then patched token-by-token after the rebrand painted its pale greys
 * gold. Meanwhile risks.js still carried a hardcoded hex palette in JS
 * (TIER_COLOR / NODE_COLOR, `style="color:#d83d3d"`), which the contrast gate
 * cannot see at all — inline styles are invisible to
 * scripts/ci/check_contrast.py. Both are gone: every color on this page now
 * comes from a token, so the gate actually governs it.
 *
 * Severity is expressed with the ONE severity ramp (--sev-*), reusing the
 * shared `.badge.sev-*` pill from table.css rather than a parallel set of
 * pills — a "critical" here has to read identically to a critical on
 * Compliance, Alerts and VA, or the word stops meaning anything. */

#view-risks #risks-controls {
  display: flex;
  align-items: center;
  gap: 0.75rem;
}

/* ── Issue-type cards ────────────────────────────────────────────────
 *
 * The primary filter. Severity lives in a left border + the label, never in
 * the card's background — a grid of saturated fills is a heat map, and a heat
 * map of four items reads as an emergency regardless of what it says. */

/* L6 — the "never scanned" banner.
 *
 * Deliberately NEUTRAL, not a severity color. It is not an issue: we have an
 * absence of evidence, not evidence of a gap. Painting it --danger or --warn
 * would make "we haven't looked" read as "we found something", which is the
 * exact false alarm the severity model is built to avoid. It gets --info's
 * accent stripe (a statement of fact) and a plain --panel-2 surface. */
.risks-coverage {
  margin: 1rem 0;
  padding: 0.75rem 1rem;
  background: var(--panel-2);
  border: 1px solid var(--border);
  border-left: 3px solid var(--info);
  border-radius: 6px;
}

.risks-coverage-head {
  display: flex;
  align-items: baseline;
  gap: 0.75rem;
  flex-wrap: wrap;
}

.risks-coverage-sub {
  margin: 0.35rem 0 0;
  font-size: 0.9em;
}

.risks-coverage-list {
  display: flex;
  flex-wrap: wrap;
  align-items: center;
  gap: 0.4rem;
  margin-top: 0.6rem;
}

/* Each unscanned database is a button, not a label: it deep-links into the
 * Inventory drawer where the scan actually lives. --muted on --border is the
 * chip pairing the contrast gate already verifies (invariant: --muted must
 * stay legible on a --border fill). */
.risk-unscanned-chip {
  font: inherit;
  font-size: 0.85em;
  color: var(--muted);
  background: var(--border);
  border: 1px solid transparent;
  border-radius: 999px;
  padding: 0.15rem 0.6rem;
  cursor: pointer;
}

.risk-unscanned-chip:hover {
  color: var(--text);
  border-color: var(--info);
}

.risks-cards {
  display: grid;
  grid-template-columns: repeat(auto-fill, minmax(220px, 1fr));
  gap: 0.75rem;
  margin: 1rem 0;
}

.risk-card {
  display: grid;
  grid-template-areas:
    "count title"
    "count sev";
  grid-template-columns: auto 1fr;
  column-gap: 0.75rem;
  align-items: center;
  text-align: left;
  padding: 0.75rem 0.9rem;
  background: var(--panel);
  border: 1px solid var(--border);
  border-left-width: 3px;
  border-radius: 6px;
  cursor: pointer;
  font: inherit;
  transition: background 0.12s ease, border-color 0.12s ease;
}
.risk-card:hover { background: var(--lift); }

/* Selected state is a fill + a stronger edge, NOT a color change — the card's
   severity hue has to stay readable while it's active, so the selection has to
   be signalled with a different channel. `aria-pressed` carries it for
   assistive tech; this is the visual half. */
.risk-card.is-active {
  background: var(--lift-2);
  border-color: var(--accent);
  border-left-color: var(--accent);
}

.risk-card-count {
  grid-area: count;
  font-size: 1.65rem;
  font-weight: 700;
  line-height: 1;
  color: var(--text);
}
.risk-card-title {
  grid-area: title;
  font-size: 0.86rem;
  font-weight: 600;
  color: var(--text);
  line-height: 1.25;
}
.risk-card-sev {
  grid-area: sev;
  font-size: 0.72rem;
  text-transform: uppercase;
  letter-spacing: 0.05em;
  font-weight: 600;
  margin-top: 2px;
}

.risk-card-critical { border-left-color: var(--sev-critical); }
.risk-card-high     { border-left-color: var(--sev-high); }
.risk-card-medium   { border-left-color: var(--sev-medium); }
.risk-card-low      { border-left-color: var(--sev-low); }

.risk-card-critical .risk-card-sev { color: var(--sev-critical); }
.risk-card-high     .risk-card-sev { color: var(--sev-high); }
.risk-card-medium   .risk-card-sev { color: var(--sev-medium); }
.risk-card-low      .risk-card-sev { color: var(--sev-low); }

/* ── Toolbar + filter bar ────────────────────────────────────────────
 * Same shape as the Alerts page, on purpose: two tables that filter the same
 * way should look the same way. */

.risks-toolbar {
  display: flex;
  align-items: center;
  gap: 1rem;
  margin: 0.75rem 0 0.5rem;
}
.risks-search {
  flex: 0 1 320px;
  padding: 0.35rem 0.6rem;
  font-size: 0.85rem;
}
.risks-count {
  font-size: 0.85rem;
  color: var(--muted);
  white-space: nowrap;
}

.risks-active-filters {
  font-size: 0.8rem;
  color: var(--muted);
  padding: 0.35rem 0.6rem;
  margin-bottom: 0.5rem;
  background: var(--panel-2);
  border: 1px solid var(--border);
  border-radius: 4px;
}
.risks-active-filters-label {
  text-transform: uppercase;
  font-size: 0.7rem;
  letter-spacing: 0.05em;
  color: var(--dim);
  margin-right: 0.35rem;
}
.risks-clear-filters {
  margin-left: 0.5rem;
  font-size: 0.75rem;
  padding: 1px 8px;
  cursor: pointer;
}

.risks-truncated {
  font-size: 0.8rem;
  color: var(--warn);
  background: var(--warn-bg);
  border: 1px solid var(--warn-border);
  border-radius: 4px;
  padding: 0.35rem 0.6rem;
  margin-bottom: 0.5rem;
}

.risks-no-match {
  text-align: center;
  color: var(--muted);
  padding: 2rem 1rem;
}

/* ── Issue rows ──────────────────────────────────────────────────────── */

#risks-table tbody tr.risk-row { cursor: pointer; }
#risks-table tbody tr.risk-row:hover { background: var(--lift); }

.risk-issue-cell { max-width: 30rem; }

.risk-issue-headline { display: flex; align-items: baseline; gap: 0.4rem; }
.risk-issue-link {
  font-weight: 600;
  color: var(--text);
  text-decoration: none;
}
.risk-row:hover .risk-issue-link { text-decoration: underline; }

/* The "why" — the evaluator's own reason string, or the CVE rollup. Clamped to
   two lines: it is a scannable hint, not the evidence itself (the drawer has
   the evidence), and a row that grows to five lines destroys the table. */
.risk-issue-why {
  font-size: 0.8rem;
  color: var(--muted);
  margin-top: 2px;
  display: -webkit-box;
  -webkit-line-clamp: 2;
  -webkit-box-orient: vertical;
  line-clamp: 2;
  overflow: hidden;
}

.risk-resource {
  font-family: monospace;
  font-size: 0.8rem;
}

/* A named Presidio entity — US_SSN, CREDIT_CARD. Deliberately NOT severity-
   tinted: the entity is evidence, and colouring it by severity would double-
   count the severity the row already states. */
.entity-pill {
  display: inline-block;
  padding: 1px 6px;
  border-radius: 3px;
  background: var(--panel-2);
  border: 1px solid var(--border);
  color: var(--text);
  font-size: 0.7rem;
  font-family: monospace;
  white-space: nowrap;
}
.entity-more {
  font-size: 0.72rem;
  color: var(--dim);
  cursor: help;
}
.risk-data-cell { line-height: 1.9; }

/* ── Grouped issue rows (Wiz-style roll-up) ──────────────────────────────
 *
 * Like issues collapse into ONE parent row + a drill-down. The parent is a
 * summary (worst severity, N databases, the union of data types); the children
 * are the individual databases, in a recessed lane so the drill-down reads as
 * "inside" the parent rather than as more top-level rows. A single-database
 * issue stays a plain .risk-row. */

#risks-table tbody tr.risk-group-row { cursor: pointer; }
#risks-table tbody tr.risk-group-row:hover { background: var(--lift); }

.risk-expander {
  flex: 0 0 auto;
  width: 1em;
  color: var(--muted);
  font-size: 0.8rem;
  line-height: 1;
}
.risk-group-title { font-weight: 600; color: var(--text); }

/* How many databases this one row stands in for. --muted on a --border fill is
   the sanctioned count-chip pairing check_contrast.py validates. */
.risk-group-count {
  align-self: center;
  min-width: 1.4em;
  padding: 0 6px;
  border-radius: 9px;
  background: var(--border);
  color: var(--muted);
  font-size: 0.72rem;
  font-weight: 700;
  text-align: center;
}

#risks-table tbody tr.risk-child-row { cursor: pointer; background: var(--inset); }
#risks-table tbody tr.risk-child-row:hover { background: var(--lift); }

/* The indent + inset hairline is the "child of the row above" signal. A
   box-shadow rail (not border-left) keeps it off the table's cell borders. */
.risk-child-cell {
  padding-left: 2.4rem;
  box-shadow: inset 2px 0 0 var(--border);
}
.risk-child-why { font-size: 0.82rem; color: var(--muted); }

/* A compliance citation on a toxic child (e.g. PCI-DSS 3.3.1) — the evidence
   for a rule that fired. --muted on a --border fill is the gate-checked chip
   pairing (same as .risk-group-count). */
.risk-cite-pill {
  display: inline-block;
  padding: 1px 6px;
  border-radius: 3px;
  background: var(--border);
  color: var(--muted);
  font-family: monospace;
  font-size: 0.72rem;
  white-space: nowrap;
}

/* ── Detail modal ────────────────────────────────────────────────────── */

.risk-modal { max-width: 880px; }

.risk-modal-head {
  display: flex;
  align-items: center;
  gap: 0.6rem;
  margin-bottom: 0.35rem;
}
.risk-modal-head h3 { margin: 0; }

.risk-modal-resource {
  font-size: 0.8rem;
  margin-bottom: 1.25rem;
  display: flex;
  gap: 0.6rem;
  align-items: baseline;
  flex-wrap: wrap;
}
.risk-modal-resource code {
  word-break: break-all;
  background: var(--inset);
  padding: 1px 5px;
  border-radius: 3px;
}

.risk-modal h4 {
  margin: 1.5rem 0 0.6rem;
  font-size: 0.78rem;
  font-weight: 600;
  color: var(--muted);
  text-transform: uppercase;
  letter-spacing: 0.05em;
}

.risk-findings { list-style: none; padding: 0; margin: 0; }
.risk-findings li {
  padding: 0.5rem 0.7rem;
  margin-bottom: 0.4rem;
  background: var(--panel-2);
  border: 1px solid var(--border);
  border-radius: 4px;
}
.risk-finding-head {
  display: flex;
  align-items: baseline;
  gap: 0.45rem;
  flex-wrap: wrap;
}
.risk-finding-title  { font-size: 0.85rem; font-weight: 600; }
.risk-finding-reason { font-size: 0.82rem; color: var(--muted); margin-top: 2px; }
.risk-finding-id     { font-size: 0.7rem; color: var(--dim); }

/* The verdict, stated. A control's title is the REQUIREMENT ("Automated backups
   enabled") — without this pill the evidence for "no backups" reads as though
   backups are on. `failed` and `unverified` are different claims and are
   coloured differently: one is broken, the other is unknown. */
.risk-finding-status {
  flex: 0 0 auto;
  padding: 1px 7px;
  border-radius: 3px;
  font-size: 0.68rem;
  font-weight: 700;
  text-transform: uppercase;
  letter-spacing: 0.05em;
}
.risk-finding-failed {
  background: var(--danger-bg);
  border: 1px solid var(--danger-border);
  color: var(--danger);
}
.risk-finding-unverified {
  background: var(--warn-bg);
  border: 1px solid var(--warn-border);
  color: var(--warn);
}

.risk-data-summary,
.risk-entities,
.risk-citations,
.risk-vulns,
.risk-upgrade,
.risk-cves,
.risk-remediation { font-size: 0.85rem; margin-bottom: 0.5rem; line-height: 1.9; }

.risk-cve {
  font-size: 0.75rem;
  background: var(--inset);
  padding: 1px 5px;
  border-radius: 3px;
}

/* Known-exploited: CISA says this one is being used in the wild right now.
   That is the strongest signal on the page and it gets the strongest chip. */
.risk-kev {
  display: inline-block;
  padding: 1px 7px;
  border-radius: 3px;
  background: var(--sev-critical-bg);
  border: 1px solid var(--sev-critical-border);
  color: var(--sev-critical);
  font-size: 0.72rem;
  font-weight: 600;
  text-transform: uppercase;
  letter-spacing: 0.04em;
}

.risk-remediation {
  background: var(--panel-2);
  border: 1px solid var(--border);
  border-left: 3px solid var(--ok);
  border-radius: 4px;
  padding: 0.6rem 0.8rem;
  line-height: 1.5;
}

/* ── Attack path ─────────────────────────────────────────────────────
 *
 * Left-to-right lane of icon boxes: how an attacker gets from the outside to
 * the data. See components/attack-path.js for why this is HTML+SVG-icons and
 * not a hand-laid-out SVG scene. */

.attack-path {
  display: flex;
  align-items: stretch;
  gap: 0.5rem;
  list-style: none;
  padding: 0.9rem;
  margin: 0;
  background: var(--panel-2);
  border: 1px solid var(--border);
  border-radius: 6px;
  overflow-x: auto;   /* narrow viewports scroll the lane, never wrap it — a
                         wrapped attack path stops reading as a sequence */
}

.ap-stage {
  flex: 1 1 0;
  min-width: 150px;
  display: flex;
  flex-direction: column;
  align-items: center;
  text-align: center;
  gap: 0.3rem;
  padding: 0.8rem 0.6rem;
  background: var(--panel);
  border: 1px solid var(--border);
  border-radius: 6px;
}

.ap-icon-wrap {
  display: flex;
  align-items: center;
  justify-content: center;
  width: 42px;
  height: 42px;
  border-radius: 50%;
  background: var(--lift);
  color: var(--muted);
}
.ap-icon { width: 22px; height: 22px; }

.ap-label  { font-size: 0.85rem; font-weight: 600; color: var(--text); }
.ap-detail {
  font-size: 0.74rem;
  color: var(--muted);
  word-break: break-word;
  font-family: monospace;
}
.ap-classes { display: flex; gap: 0.25rem; flex-wrap: wrap; justify-content: center; }

/* An UNPROVEN stage is stated, not omitted — "we checked, there is no route in
   from the internet" is information. It stays visually quiet so it can't be
   mistaken for part of the attack. */
.ap-stage:not(.ap-proven) .ap-icon-wrap { color: var(--dim); }
.ap-stage:not(.ap-proven) .ap-label     { color: var(--muted); font-weight: 500; }

/* Reached-from-the-internet is the one stage that earns alarm. */
.ap-internet.ap-proven { border-color: var(--sev-critical-border); }
.ap-internet.ap-proven .ap-icon-wrap {
  background: var(--sev-critical-bg);
  color: var(--sev-critical);
}
.ap-internet.ap-proven .ap-label { color: var(--sev-critical); }

.ap-data { border-color: var(--warn-border); }
.ap-data .ap-icon-wrap { background: var(--warn-bg); color: var(--warn); }

.ap-database .ap-icon-wrap { background: var(--info-bg); color: var(--info); }

/* The gaps, drawn ON the database node — that is where they live. Hanging them
   off as separate hops would imply an ordering between them that doesn't
   exist. */
.ap-badges {
  list-style: none;
  padding: 0;
  margin: 0.35rem 0 0;
  display: flex;
  flex-direction: column;
  gap: 0.2rem;
  width: 100%;
}
.ap-badge {
  font-size: 0.7rem;
  padding: 2px 6px;
  border-radius: 3px;
  background: var(--danger-bg);
  border: 1px solid var(--danger-border);
  color: var(--danger);
  line-height: 1.3;
}

.ap-arrow {
  flex: 0 0 auto;
  display: flex;
  align-items: center;
  color: var(--dim);
}
.ap-arrow-icon { width: 20px; height: 20px; }

/* ── Home band ───────────────────────────────────────────────────────
 *
 * The same issue-type cards, miniaturized. Kept in THIS file rather than
 * home.css so the two card treatments can never drift: they are the same
 * control showing the same number, and a Home card that looks like a different
 * thing from the Risks card it links to is a card people don't click. */

.home-risk-cards {
  display: grid;
  grid-template-columns: repeat(auto-fill, minmax(190px, 1fr));
  gap: 0.6rem;
  margin-bottom: 0.6rem;
}

.home-risk-card {
  display: grid;
  grid-template-areas:
    "count title"
    "count sev";
  grid-template-columns: auto 1fr;
  column-gap: 0.6rem;
  align-items: center;
  text-align: left;
  padding: 0.6rem 0.75rem;
  background: var(--panel);
  border: 1px solid var(--border);
  border-left-width: 3px;
  border-radius: 6px;
  cursor: pointer;
  font: inherit;
  transition: background 0.12s ease, border-color 0.12s ease;
}
.home-risk-card:hover {
  background: var(--lift);
  border-color: var(--border-mid);
}

.home-risk-count {
  grid-area: count;
  font-size: 1.4rem;
  font-weight: 700;
  line-height: 1;
  color: var(--text);
}
.home-risk-title {
  grid-area: title;
  font-size: 0.78rem;
  font-weight: 600;
  color: var(--text);
  line-height: 1.25;
}
.home-risk-sev {
  grid-area: sev;
  font-size: 0.66rem;
  text-transform: uppercase;
  letter-spacing: 0.05em;
  font-weight: 600;
  margin-top: 1px;
}

.home-risk-card-critical { border-left-color: var(--sev-critical); }
.home-risk-card-high     { border-left-color: var(--sev-high); }
.home-risk-card-medium   { border-left-color: var(--sev-medium); }
.home-risk-card-low      { border-left-color: var(--sev-low); }

.home-risk-card-critical .home-risk-sev { color: var(--sev-critical); }
.home-risk-card-high     .home-risk-sev { color: var(--sev-high); }
.home-risk-card-medium   .home-risk-sev { color: var(--sev-medium); }
.home-risk-card-low      .home-risk-sev { color: var(--sev-low); }

/* Good news, stated plainly. A clean fleet gets a line, not a vanished
   section — a section that disappears reads as a broken feature. */
.home-risks-clear {
  display: flex;
  align-items: center;
  gap: 0.55rem;
  padding: 0.7rem 0.9rem;
  background: var(--ok-bg);
  border: 1px solid var(--ok-border);
  border-radius: 6px;
  color: var(--ok);
  font-size: 0.88rem;
}
.home-risks-clear svg { width: 18px; height: 18px; flex: 0 0 auto; }

/* ── Settings › severity tuning (lives on the Settings page) ─────────── */

#settings-severity-tuning { margin-top: 1.5rem; }

#settings-severity-tuning .settings-card-header {
  display: flex;
  justify-content: space-between;
  align-items: center;
}

#settings-severity-tuning .severity-tuning-row {
  display: grid;
  grid-template-columns: 1fr auto auto;
  align-items: center;
  gap: 0.5rem;
  padding: 0.4rem 0;
  border-bottom: 1px solid var(--border);
}

/* --warn is an OPAQUE amber fill; the row's text inherits --text, giving
   1.37:1 in dark mode. The translucent wash is the right token — and it is
   what the sibling .settings-sla-row.is-dirty in settings.css already uses. */
#settings-severity-tuning .severity-tuning-row.is-dirty { background: var(--warn-bg); }

#settings-severity-tuning .severity-tuning-row code { font-size: 0.85em; }
#settings-severity-tuning input[type="number"] { width: 80px; }
#settings-severity-tuning .reset-btn { font-size: 0.8em; padding: 2px 8px; }

/* Auto-remediation (#14) — Risks "Fix everywhere" bulk result. */
.rem-bulk-result { margin: 0.75rem 0 0; font-size: 0.8rem; }
.rem-bulk-list { margin: 0.3rem 0 0; padding-left: 1.1rem; max-height: 180px; overflow-y: auto; }
.rem-bulk-list li { margin: 0.1rem 0; }
.rem-bulk-btn { margin-right: auto; }