# Log in

- **Route:** `/login`
- **API:** GET /v1/auth/registration (pending) · POST /v1/auth/login
- **Visual reference:** `source/RenewCMS Screens Auth.dc.html`, group "Log in" (open it in a browser; each state is drawn at desktop and mobile, with a light/dark toggle).

After logging in, you go back to the page you originally asked for (?redirect=), or to /home. An unverified account goes to /register/pending. "Create the owner account" appears only when registration is open.

## States

### Default

**Trigger:** Registration is closed, which is the usual case.

- Heading: **Log in**
- Description: "Welcome back. Log in to manage your articles."
- Field `Username`: placeholder "Your username"
- Field `Password`: password with show/hide; link "Forgot password?"
- Submit button: "Log in"

### Fresh install

**Trigger:** GET /v1/auth/registration returns { open: true }.

- Relied on an API marked pending in the design; that API now exists.
- Heading: **Log in**
- Description: "Welcome back. Log in to manage your articles."
- Field `Username`: placeholder "Your username"
- Field `Password`: password with show/hide; link "Forgot password?"
- Submit button: "Log in"
- Footer: First time here? [Create the owner account]

### Validation errors

**Trigger:** Submit with a short username and an empty password. Nothing is sent.

- Heading: **Log in**
- Description: "Welcome back. Log in to manage your articles."
- Field `Username`: placeholder "Your username"; value "ma"; **error "Use at least 3 characters."**
- Field `Password`: password with show/hide; link "Forgot password?"; **error "Enter your password."**
- Submit button: "Log in"

### Submitting

**Trigger:** The request is in flight. Fields and button are disabled.

- Heading: **Log in**
- Description: "Welcome back. Log in to manage your articles."
- Field `Username`: placeholder "Your username"; value "marta"
- Field `Password`: value "limewash2026"; password with show/hide; link "Forgot password?"
- Submit button: "Logging in…", loading

### Wrong credentials (403)

**Trigger:** The API doesn't say which field is wrong, so neither does the message. The password is cleared and gets focus.

- Alert (error, circle-x): **That username and password don't match** "Check both and try again. Passwords are case-sensitive."
- Heading: **Log in**
- Description: "Welcome back. Log in to manage your articles."
- Field `Username`: placeholder "Your username"; value "marta"
- Field `Password`: password with show/hide; focused; link "Forgot password?"
- Submit button: "Log in"

### Too many attempts (429)

**Trigger:** Retry-After is counted down. The button re-enables at zero.

- Relied on an API marked pending in the design; that API now exists.
- Alert (info, timer): **Too many attempts** "For your security, wait a moment before trying again."
- Heading: **Log in**
- Description: "Welcome back. Log in to manage your articles."
- Field `Username`: placeholder "Your username"; value "marta"
- Field `Password`: value "limewash"; password with show/hide; link "Forgot password?"
- Submit button: "Try again in 0:42", disabled

### Session expired

**Trigger:** Redirected from a 401 with ?redirect=/article/12/edit&reason=expired. Unsaved edits are kept in the browser.

- Alert (info, clock): **Your session expired** "Log in again to pick up where you left off. Unsaved changes are kept on this device."
- Heading: **Log in**
- Description: "Welcome back. Log in to manage your articles."
- Field `Username`: placeholder "Your username"; value "marta"
- Field `Password`: password with show/hide; focused; link "Forgot password?"
- Submit button: "Log in"

### Password changed

**Trigger:** Arrived from a successful reset with ?reason=password-changed.

- Alert (success, circle-check): **Password changed** "Log in with your new password."
- Heading: **Log in**
- Description: "Welcome back. Log in to manage your articles."
- Field `Username`: placeholder "Your username"
- Field `Password`: password with show/hide; link "Forgot password?"
- Submit button: "Log in"

### Server or network error

**Trigger:** A 500 or no response. The fields keep their values.

- Alert (error, circle-x): **Couldn't reach RenewCMS** "Check your connection and try again."
- Heading: **Log in**
- Description: "Welcome back. Log in to manage your articles."
- Field `Username`: placeholder "Your username"; value "marta"
- Field `Password`: value "limewash2026"; password with show/hide; link "Forgot password?"
- Submit button: "Log in"