/* Generic single-product shell (see public/js/product-mode-shell.js).
   Generalises the mechanism whistleblowing-workspace.css introduced: one body
   class plus a marker class on the allowed nav links and settings tiles, and
   CSS hides the rest. Kept as CSS rather than inline style toggling so
   navigation.js's own re-renders cannot fight it back — the marker classes are
   re-applied on every page-load, and these rules then hold regardless.

   These selectors HIDE UI. They do not secure anything: every page and
   callable behind them keeps its own server-side check. */

.product-mode-only nav [data-page]:not(.product-mode-nav),
.product-mode-only nav .nav-group-trigger:not(.product-mode-nav),
.product-mode-only nav .nav-submenu:not(.product-mode-nav),
.product-mode-only nav .nav-section-caption,
.product-mode-only #settings-tile-list [data-group]:not(.product-mode-nav),
.product-mode-only .settings-tile-divider,
/* The command palette lists every HR page by name, which would advertise the
   whole suite to a tenant that bought one product. */
.product-mode-only #topbar-search,
.product-mode-only #eq-palette-overlay { display: none !important; }

/* The shell must never hide the app itself — the employee mobile view can mount
   before the mode resolves, and the sidebar/tabbar stay the way out of a page. */
.product-mode-only #app-content { display: block !important; }
.product-mode-only #sidebar { display: flex !important; }
.product-mode-only #mobile-tabbar { display: flex !important; }
@media (min-width: 901px) {
  .product-mode-only #mobile-tabbar { display: none !important; }
}

/* Branded login: the generic proof/marketing strip belongs to the full suite. */
.product-mode-login .login-brand .proof { display: none; }

/* Nav flags failsafe (public/js/feature-flags-boot.js). While getFeatureFlags'
   { flags, workspace } are still unknown — no cached copy for this org+user
   and the request pending or failed — the nav shows ONLY Startsida and
   Inställningar. Never the full app: a single-product (payEquity) tenant must
   not see the other products' groups before its workspace is known. Same
   CSS-over-inline approach as above, so navigation.js's re-renders can't
   fight it. Presentation only, like everything in this file. */
.nav-flags-pending nav [data-page]:not([data-page="startsida"]):not([data-page="settings"]),
.nav-flags-pending nav .nav-group-trigger,
.nav-flags-pending nav .nav-submenu,
.nav-flags-pending nav .nav-section-caption,
.nav-flags-pending #topbar-search,
.nav-flags-pending #eq-palette-overlay { display: none !important; }

/* The small, non-blocking "couldn't load every feature" notice. */
.nav-flags-notice {
  position: fixed;
  right: 16px;
  bottom: 16px;
  z-index: 9000;
  max-width: min(420px, calc(100vw - 32px));
  display: flex;
  align-items: center;
  gap: 8px;
  padding: 10px 8px 10px 16px;
  border-radius: 12px;
  border: 1px solid var(--border);
  background: var(--gold-soft);
  color: var(--ink);
  font-family: var(--font-ui);
  font-size: 14px;
}
@media (max-width: 900px) {
  .nav-flags-notice { bottom: 80px; left: 16px; right: 16px; max-width: none; }
}