From c5d132d6a0ccd486bc25cd08c6459bd936526c80 Mon Sep 17 00:00:00 2001
From: Shawn Jackson <shawn@resgrid.com>
Date: Sat, 31 Oct 2026 11:51:53 -0700
Subject: [PATCH 1/2] RC-T48 Login Fixes

---
 src/app/login/__tests__/index.test.tsx        |  31 ++++
 src/app/login/index.tsx                       |  20 ++-
 src/app/login/login-form.tsx                  |   6 +-
 .../__tests__/login-server-badge.test.tsx     |  54 +++++++
 src/components/auth/login-server-badge.tsx    |  37 +++++
 src/hooks/use-login-server.ts                 |  22 +++
 src/lib/__tests__/login-server.test.ts        |  15 ++
 src/lib/auth/__tests__/api-logging.test.ts    |  17 ++-
 src/lib/auth/__tests__/login-errors.test.ts   | 132 ++++++++++++++++++
 src/lib/auth/api.tsx                          |  16 ++-
 src/lib/auth/login-errors.ts                  | 109 +++++++++++++++
 src/lib/auth/types.tsx                        |   5 +
 src/lib/login-server.ts                       |  33 +++++
 src/stores/auth/__tests__/store-mfa.test.ts   |  35 +++++
 src/stores/auth/store.tsx                     |  23 ++-
 src/translations/ar.json                      |  66 +++++++++
 src/translations/de.json                      |  66 +++++++++
 src/translations/el.json                      |  66 +++++++++
 src/translations/en.json                      |  66 +++++++++
 src/translations/es.json                      |  66 +++++++++
 src/translations/fr.json                      |  66 +++++++++
 src/translations/it.json                      |  66 +++++++++
 src/translations/pl.json                      |  66 +++++++++
 src/translations/sv.json                      |  66 +++++++++
 src/translations/uk.json                      |  66 +++++++++
 25 files changed, 1198 insertions(+), 17 deletions(-)
 create mode 100644 src/components/auth/__tests__/login-server-badge.test.tsx
 create mode 100644 src/components/auth/login-server-badge.tsx
 create mode 100644 src/hooks/use-login-server.ts
 create mode 100644 src/lib/__tests__/login-server.test.ts
 create mode 100644 src/lib/auth/__tests__/login-errors.test.ts
 create mode 100644 src/lib/auth/login-errors.ts
 create mode 100644 src/lib/login-server.ts

diff --git a/src/app/login/__tests__/index.test.tsx b/src/app/login/__tests__/index.test.tsx
index e6879a0..a2c116c 100644
--- a/src/app/login/__tests__/index.test.tsx
+++ b/src/app/login/__tests__/index.test.tsx
@@ -239,6 +239,37 @@ describe('Login', () => {
     expect(screen.getByText('Login failed')).toBeTruthy();
   });
 
+  describe('a refused password sign-in', () => {
+    const { default: useAuthStore } = jest.requireActual('@/stores/auth/store') as typeof import('@/stores/auth/store');
+    afterEach(() => useAuthStore.setState({ loginFailure: null }));
+
+    it('says why and what to do next, in the modal and on the form, never as the raw code', () => {
+      useAuthStore.setState({ loginFailure: { code: 'invalid_credentials' } });
+      mockUseAuth.mockReturnValue({ login: jest.fn(), ssoLogin: jest.fn(), status: 'error', error: 'invalid_credentials', isAuthenticated: false });
+
+      render(<Login />);
+
+      expect(screen.getByText('login.errors.invalid_credentials.title')).toBeTruthy();
+      // Once in the modal and once on the form under the sign-in button.
+      expect(screen.getAllByText('login.errors.invalid_credentials.message')).toHaveLength(2);
+      expect(screen.queryByText('invalid_credentials')).toBeNull();
+      expect(screen.queryByText('Login failed')).toBeNull();
+    });
+
+    it('tells a temporary lockout from one only an administrator can lift', () => {
+      mockUseAuth.mockReturnValue({ login: jest.fn(), ssoLogin: jest.fn(), status: 'error', error: 'account_locked_out', isAuthenticated: false });
+
+      useAuthStore.setState({ loginFailure: { code: 'account_locked_out', lockoutMinutes: 5 } });
+      const { unmount } = render(<Login />);
+      expect(screen.getByText('login.errors.account_locked_out.title')).toBeTruthy();
+      unmount();
+
+      useAuthStore.setState({ loginFailure: null });
+      render(<Login />);
+      expect(screen.getByText('login.errors.account_locked.title')).toBeTruthy();
+    });
+  });
+
   it('redirects to app when authenticated', async () => {
     mockUseAuth.mockReturnValue({
       login: jest.fn(),
diff --git a/src/app/login/index.tsx b/src/app/login/index.tsx
index ec99851..c179823 100644
--- a/src/app/login/index.tsx
+++ b/src/app/login/index.tsx
@@ -11,7 +11,9 @@ import { Button, ButtonText } from '@/components/ui/button';
 import { Modal, ModalBackdrop, ModalBody, ModalContent, ModalFooter, ModalHeader } from '@/components/ui/modal';
 import { Text } from '@/components/ui/text';
 import { useAnalytics } from '@/hooks/use-analytics';
+import { useLoginServer } from '@/hooks/use-login-server';
 import { useAuth } from '@/lib/auth';
+import { describeLoginFailure, isLoginErrorCode } from '@/lib/auth/login-errors';
 import { logger } from '@/lib/logging';
 import { isMfaErrorCode, mfaErrorKey } from '@/lib/mfa/messages';
 import { useSharedInstallation } from '@/lib/mfa/shared-installation';
@@ -32,7 +34,11 @@ export default function Login() {
   const router = useRouter();
   const { login, status, error, isAuthenticated } = useAuth();
   const mfaChallenge = useAuthStore((s) => s.mfaChallenge);
+  const loginFailure = useAuthStore((s) => s.loginFailure);
   const installation = useSharedInstallation();
+  const { name: serverName } = useLoginServer();
+  // A failed password sign-in says why and what to do next.
+  const loginError = isLoginErrorCode(error) ? describeLoginFailure(t, loginFailure?.code === error ? loginFailure : { code: error }, serverName) : null;
   // A sign-in that ended (expired, too many attempts, policy changed) or a shared shift that ran out says why in the
   // member's language.
   const displayError = error === 'shift_ended' ? t('shared_session.shift_ended') : isMfaErrorCode(error) ? t(mfaErrorKey(error)) : error;
@@ -80,7 +86,7 @@ export default function Login() {
       <LoginForm
         onSubmit={onSubmit}
         isLoading={status === 'loading'}
-        error={displayError ?? undefined}
+        error={loginError?.message ?? displayError ?? undefined}
         onServerUrlPress={() => setShowServerUrl(true)}
         onSsoPress={() => router.push('/login/sso')}
         onSharedDevicePress={() => router.push('/login/shared-device' as unknown as Href)}
@@ -98,11 +104,17 @@ export default function Login() {
         <ModalBackdrop />
         <ModalContent className="m-4 w-full max-w-3xl rounded-2xl">
           <ModalHeader>
-            <Text className="text-xl font-semibold">{t('login.errorModal.title')}</Text>
+            <Text className="text-xl font-semibold">{loginError?.title ?? t('login.errorModal.title')}</Text>
           </ModalHeader>
           <ModalBody>
-            <Text>{t('login.errorModal.message')}</Text>
-            {displayError ? <Text className="mt-2 text-sm text-gray-500">{displayError}</Text> : null}
+            {loginError ? (
+              <Text testID="login-error-message">{loginError.message}</Text>
+            ) : (
+              <>
+                <Text>{t('login.errorModal.message')}</Text>
+                {displayError ? <Text className="mt-2 text-sm text-gray-500">{displayError}</Text> : null}
+              </>
+            )}
           </ModalBody>
           <ModalFooter>
             <Button
diff --git a/src/app/login/login-form.tsx b/src/app/login/login-form.tsx
index 8c5df22..aac531a 100644
--- a/src/app/login/login-form.tsx
+++ b/src/app/login/login-form.tsx
@@ -8,6 +8,7 @@ import { Image, Keyboard } from 'react-native';
 import { KeyboardAvoidingView } from 'react-native-keyboard-controller';
 import * as z from 'zod';
 
+import { LoginServerBadge } from '@/components/auth/login-server-badge';
 import { View } from '@/components/ui';
 import { Button, ButtonSpinner, ButtonText } from '@/components/ui/button';
 import { FormControl, FormControlError, FormControlErrorIcon, FormControlErrorText, FormControlLabel, FormControlLabelText } from '@/components/ui/form-control';
@@ -102,7 +103,10 @@ export const LoginForm = ({ onSubmit = () => {}, isLoading = false, error = unde
         <View className="items-center justify-center">
           <Image style={{ width: '96%' }} source={colorScheme === 'dark' ? require('@assets/images/Resgrid_JustText_White.png') : require('@assets/images/Resgrid_JustText.png')} resizeMode="contain" />
           <Text className="pb-6 text-center text-4xl font-bold">{t('login.title')}</Text>
-          <Text className="mb-6 max-w-xl text-center text-gray-500">{t('login.subtitle')}</Text>
+          <Text className="mb-4 max-w-xl text-center text-gray-500">{t('login.subtitle')}</Text>
+        </View>
+        <View className="mb-6">
+          <LoginServerBadge onPress={onServerUrlPress} />
         </View>
 
         {/* Username */}
diff --git a/src/components/auth/__tests__/login-server-badge.test.tsx b/src/components/auth/__tests__/login-server-badge.test.tsx
new file mode 100644
index 0000000..c0163ce
--- /dev/null
+++ b/src/components/auth/__tests__/login-server-badge.test.tsx
@@ -0,0 +1,54 @@
+import { act, fireEvent, render, screen } from '@testing-library/react-native';
+import React from 'react';
+
+import { useServerUrlStore } from '@/stores/app/server-url-store';
+
+import { LoginServerBadge } from '../login-server-badge';
+
+jest.mock('react-i18next', () => ({
+  useTranslation: () => ({
+    t: (key: string, options?: Record<string, string>) =>
+      ({
+        'login.server.label': 'Server:',
+        'login.server.us_west': 'US West',
+        'login.server.eu_central': 'EU Central',
+      })[key] ?? (key === 'login.server.custom_host' ? `Custom (${options?.host})` : key),
+  }),
+}));
+
+jest.mock('nativewind', () => ({ useColorScheme: () => ({ colorScheme: 'light' }) }));
+jest.mock('@/lib/storage/app', () => ({
+  getBaseApiUrl: jest.fn(() => 'https://api.resgrid.com/api/v4'),
+  setBaseApiUrl: jest.fn(),
+}));
+
+describe('LoginServerBadge', () => {
+  beforeEach(() => {
+    useServerUrlStore.setState({ url: '' });
+  });
+
+  it('names the stored server before anything changes it', () => {
+    render(<LoginServerBadge />);
+    expect(screen.getByText('US West')).toBeTruthy();
+  });
+
+  it('follows a server change', async () => {
+    render(<LoginServerBadge />);
+    await act(async () => {
+      await useServerUrlStore.getState().setUrl('https://api-eu-central.resgrid.com/api/v4');
+    });
+    expect(screen.getByText('EU Central')).toBeTruthy();
+
+    await act(async () => {
+      await useServerUrlStore.getState().setUrl('https://rg.example.org/api/v4');
+    });
+    expect(screen.getByText('Custom (rg.example.org)')).toBeTruthy();
+  });
+
+  it('opens the server selector when pressed', () => {
+    const onPress = jest.fn();
+    render(<LoginServerBadge onPress={onPress} />);
+    fireEvent.press(screen.getByTestId('login-server-badge'));
+    expect(onPress).toHaveBeenCalled();
+  });
+});
diff --git a/src/components/auth/login-server-badge.tsx b/src/components/auth/login-server-badge.tsx
new file mode 100644
index 0000000..f03db75
--- /dev/null
+++ b/src/components/auth/login-server-badge.tsx
@@ -0,0 +1,37 @@
+import { Server } from 'lucide-react-native';
+import { useColorScheme } from 'nativewind';
+import React from 'react';
+import { useTranslation } from 'react-i18next';
+import { Pressable } from 'react-native';
+
+import { Text } from '@/components/ui/text';
+import { useLoginServer } from '@/hooks/use-login-server';
+
+interface LoginServerBadgeProps {
+  /** Opens the server selector; without it the badge is a plain label. */
+  onPress?: () => void;
+}
+
+/** Names the server the login form signs in to (US West, EU Central or Custom), so a wrong server is spotted before signing in. */
+export const LoginServerBadge = ({ onPress }: LoginServerBadgeProps) => {
+  const { t } = useTranslation();
+  const { colorScheme } = useColorScheme();
+  const { name } = useLoginServer();
+
+  return (
+    <Pressable
+      onPress={onPress}
+      disabled={!onPress}
+      accessibilityRole={onPress ? 'button' : 'text'}
+      accessibilityLabel={t('login.server.signing_in_to', { server: name })}
+      accessibilityHint={onPress ? t('login.server.change_hint') : undefined}
+      testID="login-server-badge"
+      className="flex-row items-center self-center rounded-full border border-gray-300 px-3 py-1.5 dark:border-gray-700"
+    >
+      <Server size={14} color={colorScheme === 'dark' ? '#9ca3af' : '#6b7280'} />
+      <Text className="ml-1.5 text-sm text-gray-600 dark:text-gray-300">
+        {t('login.server.label')} <Text className="text-sm font-semibold text-gray-900 dark:text-white">{name}</Text>
+      </Text>
+    </Pressable>
+  );
+};
diff --git a/src/hooks/use-login-server.ts b/src/hooks/use-login-server.ts
new file mode 100644
index 0000000..528f0bf
--- /dev/null
+++ b/src/hooks/use-login-server.ts
@@ -0,0 +1,22 @@
+import { useMemo } from 'react';
+import { useTranslation } from 'react-i18next';
+
+import { describeLoginServer, type LoginServer } from '@/lib/login-server';
+import { getBaseApiUrl } from '@/lib/storage/app';
+import { useServerUrlStore } from '@/stores/app/server-url-store';
+
+/**
+ * The server this device signs in to, and its display name ("US West", "EU Central" or "Custom (host)"). Follows a
+ * server change made from the login screen, since saving one updates the server URL store.
+ */
+export const useLoginServer = (): LoginServer & { name: string } => {
+  const { t } = useTranslation();
+  const storeUrl = useServerUrlStore((state) => state.url);
+  const apiUrl = storeUrl || getBaseApiUrl();
+
+  return useMemo(() => {
+    const server = describeLoginServer(apiUrl);
+    const name = server.kind === 'custom' ? t('login.server.custom_host', { host: server.host }) : t(`login.server.${server.kind}`);
+    return { ...server, name };
+  }, [apiUrl, t]);
+};
diff --git a/src/lib/__tests__/login-server.test.ts b/src/lib/__tests__/login-server.test.ts
new file mode 100644
index 0000000..689bdee
--- /dev/null
+++ b/src/lib/__tests__/login-server.test.ts
@@ -0,0 +1,15 @@
+import { describeLoginServer } from '../login-server';
+
+describe('describeLoginServer', () => {
+  it('names the Resgrid hosted servers with or without the API suffix', () => {
+    expect(describeLoginServer('https://api.resgrid.com/api/v4')).toEqual({ kind: 'us_west', host: 'api.resgrid.com' });
+    expect(describeLoginServer('https://API.resgrid.com/')).toEqual({ kind: 'us_west', host: 'api.resgrid.com' });
+    expect(describeLoginServer('https://api-eu-central.resgrid.com/api/v4')).toEqual({ kind: 'eu_central', host: 'api-eu-central.resgrid.com' });
+  });
+
+  it('labels any other server custom, with its host', () => {
+    expect(describeLoginServer('https://qaapi.resgrid.dev/api/v4')).toEqual({ kind: 'custom', host: 'qaapi.resgrid.dev' });
+    expect(describeLoginServer('http://localhost:5000/api/v4')).toEqual({ kind: 'custom', host: 'localhost:5000' });
+    expect(describeLoginServer('https://resgrid.example.org/rg/api/v4')).toEqual({ kind: 'custom', host: 'resgrid.example.org' });
+  });
+});
diff --git a/src/lib/auth/__tests__/api-logging.test.ts b/src/lib/auth/__tests__/api-logging.test.ts
index 4efc94e..c63fcdc 100644
--- a/src/lib/auth/__tests__/api-logging.test.ts
+++ b/src/lib/auth/__tests__/api-logging.test.ts
@@ -39,16 +39,27 @@ describe('sign-in logging', () => {
     expect(logged()).not.toContain(USERNAME);
   });
 
-  it('logs a failed request without the username', async () => {
+  it('logs a failed request without the username, and answers with the reason instead of throwing', async () => {
     const failure = Object.assign(new Error('Network Error'), { isAxiosError: true, config: { data: requestBody } });
     mockPost.mockRejectedValue(failure);
 
-    await expect(loginRequest({ username: USERNAME, password: PASSWORD })).rejects.toBe(failure);
+    await expect(loginRequest({ username: USERNAME, password: PASSWORD })).resolves.toMatchObject({ successful: false, message: 'server_unreachable', failure: { code: 'server_unreachable' } });
 
-    expect(mockLogger.error).toHaveBeenCalledWith({ message: 'Login failed', context: { error: failure } });
+    expect(mockLogger.error).toHaveBeenCalledWith({ message: 'Login failed', context: { error: failure, loginFailure: 'server_unreachable' } });
     expect(mockLogger.error.mock.calls[0][0].context).not.toHaveProperty('username');
   });
 
+  it("passes on the server's reason for refusing the password", async () => {
+    mockPost.mockRejectedValue({
+      isAxiosError: true,
+      message: 'Request failed with status code 400',
+      response: { status: 400, data: { error: 'invalid_grant', error_description: 'The account is locked out.', login_error: 'account_locked_out', lockout_minutes_remaining: 14.2 } },
+    });
+
+    await expect(loginRequest({ username: USERNAME, password: PASSWORD })).resolves.toMatchObject({ successful: false, failure: { code: 'account_locked_out', lockoutMinutes: 15 } });
+    expect(mockLogger.error.mock.calls[0][0].context).toMatchObject({ loginFailure: 'account_locked_out' });
+  });
+
   it('logs the SSO exchange with the provider, never the username', async () => {
     mockPost.mockResolvedValueOnce({ status: 200, data: { access_token: 'a' } }).mockResolvedValueOnce({ status: 204, data: null });
     await ssoExternalTokenRequest({ provider: 'oidc', externalToken: 'id-token', username: USERNAME });
diff --git a/src/lib/auth/__tests__/login-errors.test.ts b/src/lib/auth/__tests__/login-errors.test.ts
new file mode 100644
index 0000000..16f4573
--- /dev/null
+++ b/src/lib/auth/__tests__/login-errors.test.ts
@@ -0,0 +1,132 @@
+import type { TFunction } from 'i18next';
+
+import ar from '@/translations/ar.json';
+import de from '@/translations/de.json';
+import el from '@/translations/el.json';
+import en from '@/translations/en.json';
+import es from '@/translations/es.json';
+import fr from '@/translations/fr.json';
+import itLang from '@/translations/it.json';
+import pl from '@/translations/pl.json';
+import sv from '@/translations/sv.json';
+import uk from '@/translations/uk.json';
+
+import { classifyLoginFailure, describeLoginFailure, isLoginErrorCode, type LoginErrorCode } from '../login-errors';
+
+const axiosError = (status?: number, data?: unknown) => ({
+  isAxiosError: true,
+  message: status ? `Request failed with status code ${status}` : 'Network Error',
+  response: status ? { status, data } : undefined,
+});
+
+const ALL_CODES: LoginErrorCode[] = [
+  'invalid_credentials',
+  'account_locked_out',
+  'account_disabled',
+  'account_not_activated',
+  'no_department',
+  'sso_required',
+  'maximum_sessions',
+  'department_access_denied',
+  'server_unreachable',
+  'server_not_resgrid',
+  'rate_limited',
+  'server_error',
+  'login_failed',
+];
+
+describe('classifyLoginFailure', () => {
+  it('reads the reason the server sends in login_error', () => {
+    for (const reason of ['invalid_credentials', 'account_disabled', 'account_not_activated', 'no_department', 'sso_required', 'maximum_sessions', 'department_access_denied']) {
+      expect(classifyLoginFailure(axiosError(400, { error: 'invalid_grant', login_error: reason }))).toEqual({ code: reason });
+    }
+  });
+
+  it('keeps the minutes left on a temporary lockout', () => {
+    expect(classifyLoginFailure(axiosError(400, { error: 'invalid_grant', login_error: 'account_locked_out', lockout_minutes_remaining: 12 }))).toEqual({ code: 'account_locked_out', lockoutMinutes: 12 });
+  });
+
+  it('leaves the minutes out of a lockout with no end', () => {
+    expect(classifyLoginFailure(axiosError(400, { error: 'invalid_grant', login_error: 'account_locked_out' }))).toEqual({ code: 'account_locked_out' });
+    expect(classifyLoginFailure(axiosError(400, { error: 'invalid_grant', login_error: 'account_locked_out', lockout_minutes_remaining: 'soon' }))).toEqual({ code: 'account_locked_out' });
+  });
+
+  it('ignores a login_error it does not know', () => {
+    expect(classifyLoginFailure(axiosError(400, { error: 'invalid_grant', login_error: 'something_new' }))).toEqual({ code: 'invalid_credentials' });
+  });
+
+  it('treats a bare invalid_grant from an older server as wrong credentials', () => {
+    expect(classifyLoginFailure(axiosError(400, { error: 'invalid_grant', error_description: 'The username or password is invalid.' }))).toEqual({ code: 'invalid_credentials' });
+  });
+
+  it("recognizes an older server's session refusals by their descriptions", () => {
+    expect(classifyLoginFailure(axiosError(400, { error: 'invalid_grant', error_description: "The department's maximum number of active sessions has been reached." }))).toEqual({ code: 'maximum_sessions' });
+    expect(classifyLoginFailure(axiosError(400, { error: 'invalid_grant', error_description: 'The user is no longer allowed to sign in to this department.' }))).toEqual({ code: 'department_access_denied' });
+  });
+
+  it('reports a request that never got a response as an unreachable server', () => {
+    expect(classifyLoginFailure(axiosError())).toEqual({ code: 'server_unreachable' });
+  });
+
+  it('reports throttling, server failures and non-Resgrid servers', () => {
+    expect(classifyLoginFailure(axiosError(429, ''))).toEqual({ code: 'rate_limited' });
+    expect(classifyLoginFailure(axiosError(500, {}))).toEqual({ code: 'server_error' });
+    expect(classifyLoginFailure(axiosError(503, '<html>'))).toEqual({ code: 'server_error' });
+    expect(classifyLoginFailure(axiosError(400, { error: 'temporarily_unavailable' }))).toEqual({ code: 'server_error' });
+    expect(classifyLoginFailure(axiosError(404, '<html>Not found</html>'))).toEqual({ code: 'server_not_resgrid' });
+    expect(classifyLoginFailure(axiosError(200, '<html>'))).toEqual({ code: 'server_not_resgrid' });
+  });
+
+  it('falls back to a general failure for anything else', () => {
+    expect(classifyLoginFailure(axiosError(400, { error: 'invalid_client' }))).toEqual({ code: 'login_failed' });
+    expect(classifyLoginFailure(new Error('boom'))).toEqual({ code: 'login_failed' });
+    expect(classifyLoginFailure(null)).toEqual({ code: 'login_failed' });
+  });
+});
+
+describe('isLoginErrorCode', () => {
+  it('accepts only login failure codes', () => {
+    for (const code of ALL_CODES) {
+      expect(isLoginErrorCode(code)).toBe(true);
+    }
+    expect(isLoginErrorCode('invalid_totp')).toBe(false);
+    expect(isLoginErrorCode('Request failed with status code 400')).toBe(false);
+    expect(isLoginErrorCode(null)).toBe(false);
+  });
+});
+
+describe('describeLoginFailure', () => {
+  const t = jest.fn((key: string, options?: Record<string, unknown>) => `${key}${options ? JSON.stringify(options) : ''}`) as unknown as TFunction;
+
+  it('passes the lockout minutes and server name to the guidance', () => {
+    const result = describeLoginFailure(t, { code: 'account_locked_out', lockoutMinutes: 7 }, 'US West');
+    expect(result.title).toBe('login.errors.account_locked_out.title');
+    expect(result.message).toBe('login.errors.account_locked_out.message{"minutes":7,"server":"US West"}');
+  });
+
+  it('sends a lockout with no end to the administrator instead of a wait', () => {
+    expect(describeLoginFailure(t, { code: 'account_locked_out' }, 'US West').title).toBe('login.errors.account_locked.title');
+  });
+});
+
+describe('login error translations', () => {
+  const languages = { ar, de, el, en, es, fr, it: itLang, pl, sv, uk } as Record<string, any>;
+
+  it.each(Object.keys(languages))('%s has a title and message for every failure', (language) => {
+    const errors = languages[language].login.errors;
+    for (const key of [...ALL_CODES, 'account_locked']) {
+      expect(errors[key]?.title).toEqual(expect.any(String));
+      expect(errors[key]?.message).toEqual(expect.any(String));
+    }
+    expect(errors.account_locked_out.message).toContain('{{minutes}}');
+    expect(errors.server_unreachable.message).toContain('{{server}}');
+  });
+
+  it.each(Object.keys(languages))('%s names every login server', (language) => {
+    const server = languages[language].login.server;
+    for (const key of ['label', 'us_west', 'eu_central', 'custom_host', 'signing_in_to', 'change_hint']) {
+      expect(server[key]).toEqual(expect.any(String));
+    }
+    expect(server.custom_host).toContain('{{host}}');
+  });
+});
diff --git a/src/lib/auth/api.tsx b/src/lib/auth/api.tsx
index 59d31ae..1361576 100644
--- a/src/lib/auth/api.tsx
+++ b/src/lib/auth/api.tsx
@@ -7,6 +7,7 @@ import { applyClientHeaders } from '@/lib/mfa/client-app';
 import { type MfaChallenge, parseMethods } from '@/lib/mfa/types';
 
 import { getBaseApiUrl } from '../storage/app';
+import { classifyLoginFailure } from './login-errors';
 import type { AuthResponse, LoginCredentials, LoginResponse, SsoLoginCredentials } from './types';
 
 const authApi = axios.create({
@@ -91,8 +92,9 @@ export const loginRequest = async (credentials: LoginCredentials): Promise<Login
 
       return {
         successful: false,
-        message: 'Login failed',
+        message: 'login_failed',
         authResponse: null,
+        failure: { code: 'login_failed' },
       };
     }
   } catch (error) {
@@ -129,11 +131,19 @@ export const loginRequest = async (credentials: LoginCredentials): Promise<Login
 
     // The sanitizer reduces axios errors to safe summaries (no request bodies).
     // Never include the username here — it is frequently an email address.
+    const failure = classifyLoginFailure(error);
     logger.error({
       message: 'Login failed',
-      context: { error },
+      context: { error, loginFailure: failure.code },
     });
-    throw error;
+
+    // Return a failed response instead of throwing; the code carries the reason the login screen explains.
+    return {
+      successful: false,
+      message: failure.code,
+      authResponse: null,
+      failure,
+    };
   }
 };
 
diff --git a/src/lib/auth/login-errors.ts b/src/lib/auth/login-errors.ts
new file mode 100644
index 0000000..90b05f4
--- /dev/null
+++ b/src/lib/auth/login-errors.ts
@@ -0,0 +1,109 @@
+import type { TFunction } from 'i18next';
+
+/**
+ * Why a password sign-in failed, as the login screen explains it: the reasons the server reports in `login_error`
+ * beside `invalid_grant`, plus what the app can tell on its own (the server could not be reached, is not a Resgrid
+ * server, is throttling, or failed).
+ */
+export type LoginErrorCode =
+  | 'invalid_credentials'
+  | 'account_locked_out'
+  | 'account_disabled'
+  | 'account_not_activated'
+  | 'no_department'
+  | 'sso_required'
+  | 'maximum_sessions'
+  | 'department_access_denied'
+  | 'server_unreachable'
+  | 'server_not_resgrid'
+  | 'rate_limited'
+  | 'server_error'
+  | 'login_failed';
+
+export interface LoginFailure {
+  code: LoginErrorCode;
+  /** Minutes left on a temporary lockout, when the server says; absent for a lockout only an administrator can lift. */
+  lockoutMinutes?: number;
+}
+
+// The reasons a server that knows login_error can send.
+const SERVER_REASONS = new Set<string>(['invalid_credentials', 'account_locked_out', 'account_disabled', 'account_not_activated', 'no_department', 'sso_required', 'maximum_sessions', 'department_access_denied']);
+
+const LOGIN_ERROR_CODES = new Set<string>([...SERVER_REASONS, 'server_unreachable', 'server_not_resgrid', 'rate_limited', 'server_error', 'login_failed']);
+
+/** Whether an auth-store error is one of these codes (shown with its guidance) rather than a code or text from elsewhere. */
+export const isLoginErrorCode = (value: string | null | undefined): value is LoginErrorCode => !!value && LOGIN_ERROR_CODES.has(value);
+
+interface TokenErrorBody {
+  error?: unknown;
+  error_description?: unknown;
+  login_error?: unknown;
+  lockout_minutes_remaining?: unknown;
+}
+
+/**
+ * Classifies a failed token request. A server older than login_error answers every refused password sign-in with the
+ * same invalid_grant; only its session-limit refusals have their own descriptions.
+ */
+export const classifyLoginFailure = (error: unknown): LoginFailure => {
+  const candidate = error as { isAxiosError?: boolean; response?: { status?: number; data?: unknown } } | null;
+  if (!candidate?.isAxiosError) {
+    return { code: 'login_failed' };
+  }
+
+  // No response at all: offline, DNS, TLS, CORS, a timeout, or a server address that is not listening.
+  const response = candidate.response;
+  if (!response) {
+    return { code: 'server_unreachable' };
+  }
+
+  const status = response.status ?? 0;
+  const body: TokenErrorBody | null = typeof response.data === 'object' && response.data !== null ? (response.data as TokenErrorBody) : null;
+
+  if (body && typeof body.login_error === 'string' && SERVER_REASONS.has(body.login_error)) {
+    const minutes = body.lockout_minutes_remaining;
+    return {
+      code: body.login_error as LoginErrorCode,
+      ...(typeof minutes === 'number' && Number.isFinite(minutes) && minutes > 0 ? { lockoutMinutes: Math.ceil(minutes) } : {}),
+    };
+  }
+
+  if (status === 429) {
+    return { code: 'rate_limited' };
+  }
+
+  if (body?.error === 'invalid_grant') {
+    const description = typeof body.error_description === 'string' ? body.error_description : '';
+    if (description.includes('maximum number of active sessions')) {
+      return { code: 'maximum_sessions' };
+    }
+    if (description.includes('no longer allowed to sign in to this department')) {
+      return { code: 'department_access_denied' };
+    }
+    return { code: 'invalid_credentials' };
+  }
+
+  if (body?.error === 'temporarily_unavailable' || status >= 500) {
+    return { code: 'server_error' };
+  }
+
+  // A web page or a 404 where the token endpoint should be: the address points at something other than a Resgrid API.
+  if (!body || status === 404 || status === 405) {
+    return { code: 'server_not_resgrid' };
+  }
+
+  return { code: 'login_failed' };
+};
+
+/**
+ * The title and guidance for a failed sign-in. `server` is the name of the server the member is signing in to (as the
+ * login form shows it), so a connection problem says which server could not be reached.
+ */
+export const describeLoginFailure = (t: TFunction, failure: LoginFailure, server: string): { title: string; message: string } => {
+  // A lockout with no end is an administrator's to lift; waiting will not help.
+  const key = failure.code === 'account_locked_out' && failure.lockoutMinutes == null ? 'account_locked' : failure.code;
+  return {
+    title: t(`login.errors.${key}.title`),
+    message: t(`login.errors.${key}.message`, { minutes: failure.lockoutMinutes, server }),
+  };
+};
diff --git a/src/lib/auth/types.tsx b/src/lib/auth/types.tsx
index a7fdc48..a1002e4 100644
--- a/src/lib/auth/types.tsx
+++ b/src/lib/auth/types.tsx
@@ -1,3 +1,4 @@
+import type { LoginFailure } from '@/lib/auth/login-errors';
 import type { ApprovalWaitResult } from '@/lib/mfa/approval-wait';
 import type { ApprovalRequestData, MfaChallenge, TotpSetupData } from '@/lib/mfa/types';
 import type { BrokeredSsoResult, LoginMfaResult, LoginMfaStep, RecoveryStart, SsoDepartment } from '@/stores/auth/login-mfa';
@@ -52,6 +53,8 @@ export interface LoginResponse {
   mfaTransaction?: { secret: string; challenge: MfaChallenge };
   /** The department requires MFA the account does not have, and this server cannot set it up in the app. */
   enrollmentRequired?: boolean;
+  /** Why an unsuccessful sign-in failed, for the login screen's guidance. */
+  failure?: LoginFailure;
 }
 export interface ProfileModel {
   sub: string;
@@ -75,6 +78,8 @@ export interface AuthState {
   refreshTokenExpiresOn: string | null;
   status: AuthStatus;
   error: string | null;
+  /** The last failed password sign-in, with what the guidance needs beyond its code (a lockout's minutes). Never persisted. */
+  loginFailure: LoginFailure | null;
   profile: ProfileModel | null;
   userId: string | null;
   refreshTimeoutId: ReturnType<typeof setTimeout> | null;
diff --git a/src/lib/login-server.ts b/src/lib/login-server.ts
new file mode 100644
index 0000000..6418e28
--- /dev/null
+++ b/src/lib/login-server.ts
@@ -0,0 +1,33 @@
+/** Which server a sign-in goes to, as the login form labels it. */
+export type LoginServerKind = 'us_west' | 'eu_central' | 'custom';
+
+export interface LoginServer {
+  kind: LoginServerKind;
+  /** The server's host name, shown beside "Custom" so a self-hosted or test server is recognizable. */
+  host: string;
+}
+
+// The Resgrid hosted sites, by their base URL (no /api/vX suffix).
+const HOSTED_SERVERS: readonly { apiUrl: string; kind: LoginServerKind }[] = [
+  { apiUrl: 'https://api.resgrid.com', kind: 'us_west' },
+  { apiUrl: 'https://api-eu-central.resgrid.com', kind: 'eu_central' },
+];
+
+// Reduce a URL to its bare base (no trailing slash, no /api/vX suffix) so a stored API URL and a hosted base compare
+// equal; host names are case-insensitive, so the comparison is too.
+const toComparableUrl = (url: string) =>
+  url
+    .trim()
+    .replace(/\/+$/, '')
+    .replace(/\/api\/v\d+$/i, '')
+    .toLowerCase();
+
+// RN's URL polyfill does not implement hostname, so the host is read from the address directly.
+const hostOf = (url: string) => /^[a-z][a-z\d+.-]*:\/\/([^/?#]+)/i.exec(url.trim())?.[1]?.toLowerCase() ?? url.trim();
+
+/** Names the server behind an API URL (with or without the /api/vX suffix): a Resgrid hosted site, or a custom one. */
+export const describeLoginServer = (apiUrl: string): LoginServer => {
+  const base = toComparableUrl(apiUrl);
+  const hosted = HOSTED_SERVERS.find((server) => toComparableUrl(server.apiUrl) === base);
+  return { kind: hosted?.kind ?? 'custom', host: hostOf(apiUrl) };
+};
diff --git a/src/stores/auth/__tests__/store-mfa.test.ts b/src/stores/auth/__tests__/store-mfa.test.ts
index 14f453e..d717257 100644
--- a/src/stores/auth/__tests__/store-mfa.test.ts
+++ b/src/stores/auth/__tests__/store-mfa.test.ts
@@ -163,3 +163,38 @@ describe('auth store: login transaction and shared sessions', () => {
     expect(saved.accessToken).toBe('a');
   });
 });
+
+describe('auth store: a refused password sign-in', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    useAuthStore.setState({ status: 'signedOut', error: null, loginFailure: null, mfaChallenge: null });
+  });
+
+  it('keeps the reason and the lockout minutes for the login screen, never in storage', async () => {
+    mockLoginRequest.mockResolvedValue({ successful: false, message: 'account_locked_out', authResponse: null, failure: { code: 'account_locked_out', lockoutMinutes: 9 } });
+
+    await useAuthStore.getState().login({ username: 'pat', password: 'pw' });
+
+    expect(useAuthStore.getState()).toMatchObject({ status: 'error', error: 'account_locked_out', loginFailure: { code: 'account_locked_out', lockoutMinutes: 9 } });
+    const persist = (useAuthStore as unknown as { persist: { getOptions: () => { partialize: (s: unknown) => Record<string, unknown> } } }).persist;
+    expect(persist.getOptions().partialize(useAuthStore.getState())).not.toHaveProperty('loginFailure');
+  });
+
+  it('forgets the last reason when the next sign-in starts', async () => {
+    useAuthStore.setState({ status: 'error', error: 'invalid_credentials', loginFailure: { code: 'invalid_credentials' } });
+    mockLoginRequest.mockResolvedValue({ successful: false, message: '', authResponse: null, mfaRequired: true, mfaTransaction: { secret: 'txn-secret', challenge } });
+
+    await useAuthStore.getState().login({ username: 'pat', password: 'pw' });
+
+    expect(useAuthStore.getState()).toMatchObject({ status: 'mfaRequired', error: null, loginFailure: null });
+    useAuthStore.getState().cancelLoginMfa();
+  });
+
+  it('reports a sign-in it could not finish as a general failure, not the exception text', async () => {
+    mockLoginRequest.mockResolvedValue({ successful: true, message: 'Login successful', authResponse: { ...tokens, id_token: 'not-a-jwt' } });
+
+    await useAuthStore.getState().login({ username: 'pat', password: 'pw' });
+
+    expect(useAuthStore.getState()).toMatchObject({ status: 'error', error: 'login_failed', loginFailure: { code: 'login_failed' } });
+  });
+});
diff --git a/src/stores/auth/store.tsx b/src/stores/auth/store.tsx
index 660a196..476c3c4 100644
--- a/src/stores/auth/store.tsx
+++ b/src/stores/auth/store.tsx
@@ -10,6 +10,7 @@ import { clearCacheScope, getCacheScope, setCacheScope } from '@/lib/cache/cache
 import { logger } from '@/lib/logging';
 
 import { loginRequest, refreshTokenSingleFlight, ssoExternalTokenRequest } from '../../lib/auth/api';
+import { isLoginErrorCode } from '../../lib/auth/login-errors';
 import { isSharedSessionLockedRefresh } from '../../lib/auth/token-refresh';
 import type { AuthResponse, AuthState, LoginCredentials, SsoLoginCredentials } from '../../lib/auth/types';
 import { type ProfileModel } from '../../lib/auth/types';
@@ -110,6 +111,7 @@ const useAuthStore = create<AuthState>()(
       refreshTokenExpiresOn: null,
       status: 'idle',
       error: null,
+      loginFailure: null,
       profile: null,
       userId: null,
       isFirstTime: true,
@@ -119,7 +121,8 @@ const useAuthStore = create<AuthState>()(
       pendingRecoveryCodes: null,
       login: async (credentials: LoginCredentials) => {
         try {
-          set({ status: 'loading' });
+          // A previous password failure's reason goes with it; an MFA code (invalid_totp) stays until the retry answers.
+          set({ status: 'loading', loginFailure: null, ...(isLoginErrorCode(get().error) ? { error: null } : {}) });
           const response = await loginRequest(credentials);
 
           if (response.successful) {
@@ -186,15 +189,23 @@ const useAuthStore = create<AuthState>()(
               mfaChallenge: { kind: 'legacy', methods: ['totp'], enrolled: ['totp'], preferred: 'totp', expiresAt: null, source: 'password' },
             });
           } else {
+            const failure = response.failure ?? { code: 'login_failed' };
             set({
               status: 'error',
-              error: response.message,
+              error: failure.code,
+              loginFailure: failure,
             });
           }
         } catch (error) {
+          // An unreadable token response is the server's fault, not the member's; the detail stays in the log.
+          logger.error({
+            message: 'Login: Exception caught',
+            context: { error: error instanceof Error ? error.message : String(error) },
+          });
           set({
             status: 'error',
-            error: error instanceof Error ? error.message : 'Login failed',
+            error: 'login_failed',
+            loginFailure: { code: 'login_failed' },
           });
         }
       },
@@ -528,9 +539,9 @@ const useAuthStore = create<AuthState>()(
     {
       name: 'auth-storage',
       storage: createJSONStorage(() => zustandStorage),
-      // A pending sign-in and recovery codes shown once are never written to storage, and neither is the refresh timer
-      // (a handle that means nothing after a restart).
-      partialize: ({ mfaChallenge: _mfaChallenge, pendingRecoveryCodes: _pendingRecoveryCodes, refreshTimeoutId: _refreshTimeoutId, ...persisted }) => persisted,
+      // A pending sign-in, recovery codes shown once and the last failed sign-in are never written to storage, and neither
+      // is the refresh timer (a handle that means nothing after a restart).
+      partialize: ({ mfaChallenge: _mfaChallenge, pendingRecoveryCodes: _pendingRecoveryCodes, loginFailure: _loginFailure, refreshTimeoutId: _refreshTimeoutId, ...persisted }) => persisted,
       // The pending SSO exchange and the login transaction live in module memory and die with the process, so a
       // rehydrated pending state would open a prompt with nothing to finish. Force them back.
       merge: (persisted, current) => ({ ...current, ...(persisted as Partial<AuthState>), isSsoMfaPending: false, mfaChallenge: null, pendingRecoveryCodes: null }),
diff --git a/src/translations/ar.json b/src/translations/ar.json
index 34b49b3..d57218a 100644
--- a/src/translations/ar.json
+++ b/src/translations/ar.json
@@ -1325,6 +1325,64 @@
       "message": "يرجى التحقق من اسم المستخدم وكلمة المرور والمحاولة مرة أخرى.",
       "title": "فشل تسجيل الدخول"
     },
+    "errors": {
+      "account_disabled": {
+        "message": "قامت إدارتك بتعطيل حسابك. تواصل مع مسؤول إدارتك لإعادة تفعيله.",
+        "title": "الحساب معطل"
+      },
+      "account_locked": {
+        "message": "حسابك مقفل. تواصل مع مسؤول إدارتك لإلغاء قفله.",
+        "title": "الحساب مقفل"
+      },
+      "account_locked_out": {
+        "message": "تم قفل حسابك بعد محاولات تسجيل دخول فاشلة كثيرة. انتظر {{minutes}} دقيقة ثم حاول مرة أخرى. إذا نسيت كلمة المرور، فأعد تعيينها من موقع Resgrid قبل المحاولة مرة أخرى.",
+        "title": "الحساب مقفل مؤقتًا"
+      },
+      "account_not_activated": {
+        "message": "لم يتم تفعيل حسابك بعد. استخدم رسالة الدعوة من إدارتك لإكمال إعداده، أو اطلب من مسؤول إدارتك إرسال دعوة جديدة.",
+        "title": "الحساب غير مفعّل"
+      },
+      "department_access_denied": {
+        "message": "لم يعد مسموحًا لحسابك بتسجيل الدخول إلى هذه الإدارة. تواصل مع مسؤول إدارتك.",
+        "title": "تسجيل الدخول غير مسموح"
+      },
+      "invalid_credentials": {
+        "message": "اسم المستخدم أو كلمة المرور التي أدخلتها غير صحيحة. كلمات المرور حساسة لحالة الأحرف، لذا تأكد من إيقاف Caps Lock. إذا نسيت كلمة المرور، فأعد تعيينها من موقع Resgrid. ستؤدي المحاولات الفاشلة الكثيرة إلى قفل حسابك مؤقتًا.",
+        "title": "اسم المستخدم أو كلمة المرور غير صحيحة"
+      },
+      "login_failed": {
+        "message": "حدث خطأ أثناء تسجيل الدخول. حاول مرة أخرى. إذا استمرت المشكلة، فتواصل مع مسؤول إدارتك أو دعم Resgrid.",
+        "title": "فشل تسجيل الدخول"
+      },
+      "maximum_sessions": {
+        "message": "وصلت إدارتك إلى الحد الأقصى للجلسات المسجلة. سجّل الخروج من جهاز آخر، أو اطلب من مسؤول إدارتك إنهاء جلسة غير مستخدمة، ثم حاول مرة أخرى.",
+        "title": "عدد كبير من الجلسات النشطة"
+      },
+      "no_department": {
+        "message": "حسابك ليس عضوًا في أي إدارة نشطة. اطلب من مسؤول إدارتك إضافتك، ثم حاول مرة أخرى.",
+        "title": "لا توجد إدارة نشطة"
+      },
+      "rate_limited": {
+        "message": "تمت محاولات تسجيل دخول كثيرة في وقت قصير. انتظر دقيقة ثم حاول مرة أخرى.",
+        "title": "محاولات كثيرة جدًا"
+      },
+      "server_error": {
+        "message": "تعذر على {{server}} إكمال تسجيل الدخول الآن. انتظر بضع دقائق ثم حاول مرة أخرى. إذا استمرت المشكلة، فتواصل مع دعم Resgrid أو مسؤول الخادم.",
+        "title": "مشكلة في الخادم"
+      },
+      "server_not_resgrid": {
+        "message": "لم يستجب {{server}} كخادم Resgrid. تحقق من عنوان الخادم وحاول مرة أخرى.",
+        "title": "لم يتم التعرف على الخادم"
+      },
+      "server_unreachable": {
+        "message": "تعذر الاتصال بـ {{server}}. تحقق من اتصالك بالإنترنت ومن اختيار الخادم الصحيح، ثم حاول مرة أخرى.",
+        "title": "تعذر الوصول إلى الخادم"
+      },
+      "sso_required": {
+        "message": "تتطلب إدارتك تسجيل الدخول الموحد. استخدم زر SSO لتسجيل الدخول بحساب مؤسستك بدلًا من كلمة المرور.",
+        "title": "تسجيل الدخول الموحد مطلوب"
+      }
+    },
     "login": "تسجيل الدخول",
     "login_button": "تسجيل الدخول",
     "login_button_description": "قم بتسجيل الدخول إلى حسابك للمتابعة",
@@ -1340,6 +1398,14 @@
     "password": "كلمة المرور",
     "password_incorrect": "كانت كلمة المرور غير صحيحة",
     "password_placeholder": "أدخل كلمة المرور الخاصة بك",
+    "server": {
+      "change_hint": "يفتح اختيار الخادم",
+      "custom_host": "مخصص ({{host}})",
+      "eu_central": "وسط الاتحاد الأوروبي",
+      "label": "الخادم:",
+      "signing_in_to": "تسجيل الدخول إلى {{server}}",
+      "us_west": "غرب الولايات المتحدة"
+    },
     "sso_button": "تسجيل الدخول عبر SSO",
     "sso_department": "SSO مقدم من {{name}}",
     "sso_department_id": "معرف القسم (اختياري)",
diff --git a/src/translations/de.json b/src/translations/de.json
index 0f31031..9682b3d 100644
--- a/src/translations/de.json
+++ b/src/translations/de.json
@@ -1325,6 +1325,64 @@
       "message": "Bitte Benutzername und Passwort überprüfen und erneut versuchen.",
       "title": "Anmeldung fehlgeschlagen"
     },
+    "errors": {
+      "account_disabled": {
+        "message": "Ihr Konto wurde von Ihrer Organisation deaktiviert. Wenden Sie sich an den Administrator Ihrer Organisation, um es wieder aktivieren zu lassen.",
+        "title": "Konto deaktiviert"
+      },
+      "account_locked": {
+        "message": "Ihr Konto ist gesperrt. Wenden Sie sich an den Administrator Ihrer Organisation, um es entsperren zu lassen.",
+        "title": "Konto gesperrt"
+      },
+      "account_locked_out": {
+        "message": "Ihr Konto wurde nach zu vielen fehlgeschlagenen Anmeldeversuchen gesperrt. Warten Sie {{minutes}} Min. und versuchen Sie es erneut. Wenn Sie Ihr Passwort vergessen haben, setzen Sie es vorher auf der Resgrid-Website zurück.",
+        "title": "Konto vorübergehend gesperrt"
+      },
+      "account_not_activated": {
+        "message": "Ihr Konto wurde noch nicht aktiviert. Verwenden Sie die Einladungs-E-Mail Ihrer Organisation, um die Einrichtung abzuschließen, oder bitten Sie den Administrator Ihrer Organisation um eine neue Einladung.",
+        "title": "Konto nicht aktiviert"
+      },
+      "department_access_denied": {
+        "message": "Ihr Konto darf sich nicht mehr bei dieser Organisation anmelden. Wenden Sie sich an den Administrator Ihrer Organisation.",
+        "title": "Anmeldung nicht erlaubt"
+      },
+      "invalid_credentials": {
+        "message": "Der eingegebene Benutzername oder das Passwort ist falsch. Bei Passwörtern wird zwischen Groß- und Kleinschreibung unterschieden, prüfen Sie daher, ob die Feststelltaste deaktiviert ist. Wenn Sie Ihr Passwort vergessen haben, setzen Sie es auf der Resgrid-Website zurück. Nach zu vielen Fehlversuchen wird Ihr Konto vorübergehend gesperrt.",
+        "title": "Falscher Benutzername oder falsches Passwort"
+      },
+      "login_failed": {
+        "message": "Bei der Anmeldung ist ein Fehler aufgetreten. Versuchen Sie es erneut. Wenn das Problem weiterhin besteht, wenden Sie sich an den Administrator Ihrer Organisation oder den Resgrid-Support.",
+        "title": "Anmeldung fehlgeschlagen"
+      },
+      "maximum_sessions": {
+        "message": "Ihre Organisation hat die maximale Anzahl angemeldeter Sitzungen erreicht. Melden Sie sich auf einem anderen Gerät ab oder bitten Sie den Administrator Ihrer Organisation, eine ungenutzte Sitzung zu beenden, und versuchen Sie es dann erneut.",
+        "title": "Zu viele aktive Sitzungen"
+      },
+      "no_department": {
+        "message": "Ihr Konto ist kein Mitglied einer aktiven Organisation. Bitten Sie den Administrator Ihrer Organisation, Sie hinzuzufügen, und versuchen Sie es dann erneut.",
+        "title": "Keine aktive Organisation"
+      },
+      "rate_limited": {
+        "message": "In kurzer Zeit wurden zu viele Anmeldeversuche unternommen. Warten Sie eine Minute und versuchen Sie es erneut.",
+        "title": "Zu viele Versuche"
+      },
+      "server_error": {
+        "message": "{{server}} konnte die Anmeldung gerade nicht abschließen. Warten Sie einige Minuten und versuchen Sie es erneut. Wenn das Problem weiterhin besteht, wenden Sie sich an den Resgrid-Support oder Ihren Serveradministrator.",
+        "title": "Serverproblem"
+      },
+      "server_not_resgrid": {
+        "message": "{{server}} hat nicht wie ein Resgrid-Server geantwortet. Prüfen Sie die Serveradresse und versuchen Sie es erneut.",
+        "title": "Server nicht erkannt"
+      },
+      "server_unreachable": {
+        "message": "Keine Verbindung zu {{server}} möglich. Prüfen Sie Ihre Internetverbindung und ob der richtige Server ausgewählt ist, und versuchen Sie es dann erneut.",
+        "title": "Server nicht erreichbar"
+      },
+      "sso_required": {
+        "message": "Ihre Organisation verlangt Single Sign-On. Verwenden Sie die SSO-Schaltfläche, um sich mit dem Konto Ihrer Organisation statt mit einem Passwort anzumelden.",
+        "title": "Single Sign-On erforderlich"
+      }
+    },
     "login": "Anmelden",
     "login_button": "Anmelden",
     "login_button_description": "Bei Ihrem Konto anmelden, um fortzufahren",
@@ -1340,6 +1398,14 @@
     "password": "Passwort",
     "password_incorrect": "Passwort war falsch",
     "password_placeholder": "Passwort eingeben",
+    "server": {
+      "change_hint": "Öffnet die Serverauswahl",
+      "custom_host": "Benutzerdefiniert ({{host}})",
+      "eu_central": "EU Zentral",
+      "label": "Server:",
+      "signing_in_to": "Anmeldung bei {{server}}",
+      "us_west": "USA West"
+    },
     "sso_button": "Mit SSO anmelden",
     "sso_department": "SSO bereitgestellt von {{name}}",
     "sso_department_id": "Abteilungs-ID (optional)",
diff --git a/src/translations/el.json b/src/translations/el.json
index 08157b4..133478a 100644
--- a/src/translations/el.json
+++ b/src/translations/el.json
@@ -1325,6 +1325,64 @@
       "message": "Ελέγξτε το όνομα χρήστη και τον κωδικό πρόσβασής σας και δοκιμάστε ξανά.",
       "title": "Η Σύνδεση Απέτυχε"
     },
+    "errors": {
+      "account_disabled": {
+        "message": "Ο λογαριασμός σας απενεργοποιήθηκε από την υπηρεσία σας. Επικοινωνήστε με τον διαχειριστή της υπηρεσίας σας για να τον ενεργοποιήσει ξανά.",
+        "title": "Ο λογαριασμός είναι απενεργοποιημένος"
+      },
+      "account_locked": {
+        "message": "Ο λογαριασμός σας είναι κλειδωμένος. Επικοινωνήστε με τον διαχειριστή της υπηρεσίας σας για να τον ξεκλειδώσει.",
+        "title": "Ο λογαριασμός είναι κλειδωμένος"
+      },
+      "account_locked_out": {
+        "message": "Ο λογαριασμός σας κλειδώθηκε μετά από πολλές αποτυχημένες προσπάθειες σύνδεσης. Περιμένετε {{minutes}} λεπτά και δοκιμάστε ξανά. Αν ξεχάσατε τον κωδικό σας, επαναφέρετέ τον από τον ιστότοπο του Resgrid πριν δοκιμάσετε ξανά.",
+        "title": "Ο λογαριασμός κλειδώθηκε προσωρινά"
+      },
+      "account_not_activated": {
+        "message": "Ο λογαριασμός σας δεν έχει ενεργοποιηθεί ακόμη. Χρησιμοποιήστε το email πρόσκλησης της υπηρεσίας σας για να ολοκληρώσετε τη ρύθμισή του ή ζητήστε από τον διαχειριστή της υπηρεσίας σας να στείλει νέα πρόσκληση.",
+        "title": "Ο λογαριασμός δεν έχει ενεργοποιηθεί"
+      },
+      "department_access_denied": {
+        "message": "Ο λογαριασμός σας δεν επιτρέπεται πλέον να συνδέεται σε αυτή την υπηρεσία. Επικοινωνήστε με τον διαχειριστή της υπηρεσίας σας.",
+        "title": "Η σύνδεση δεν επιτρέπεται"
+      },
+      "invalid_credentials": {
+        "message": "Το όνομα χρήστη ή ο κωδικός πρόσβασης που εισαγάγατε είναι λανθασμένα. Οι κωδικοί πρόσβασης κάνουν διάκριση πεζών-κεφαλαίων, οπότε βεβαιωθείτε ότι το Caps Lock είναι απενεργοποιημένο. Αν ξεχάσατε τον κωδικό σας, επαναφέρετέ τον από τον ιστότοπο του Resgrid. Πολλές αποτυχημένες προσπάθειες θα κλειδώσουν προσωρινά τον λογαριασμό σας.",
+        "title": "Λανθασμένο όνομα χρήστη ή κωδικός πρόσβασης"
+      },
+      "login_failed": {
+        "message": "Κάτι πήγε στραβά κατά τη σύνδεση. Δοκιμάστε ξανά. Αν συνεχίσει, επικοινωνήστε με τον διαχειριστή της υπηρεσίας σας ή την υποστήριξη του Resgrid.",
+        "title": "Η σύνδεση απέτυχε"
+      },
+      "maximum_sessions": {
+        "message": "Η υπηρεσία σας έφτασε το όριο συνδεδεμένων συνεδριών. Αποσυνδεθείτε από άλλη συσκευή ή ζητήστε από τον διαχειριστή της υπηρεσίας σας να τερματίσει μια αχρησιμοποίητη συνεδρία και δοκιμάστε ξανά.",
+        "title": "Πάρα πολλές ενεργές συνεδρίες"
+      },
+      "no_department": {
+        "message": "Ο λογαριασμός σας δεν είναι μέλος καμίας ενεργής υπηρεσίας. Ζητήστε από τον διαχειριστή της υπηρεσίας σας να σας προσθέσει και δοκιμάστε ξανά.",
+        "title": "Καμία ενεργή υπηρεσία"
+      },
+      "rate_limited": {
+        "message": "Έγιναν πάρα πολλές προσπάθειες σύνδεσης σε σύντομο χρόνο. Περιμένετε ένα λεπτό και δοκιμάστε ξανά.",
+        "title": "Πάρα πολλές προσπάθειες"
+      },
+      "server_error": {
+        "message": "Το {{server}} δεν μπόρεσε να ολοκληρώσει τη σύνδεση αυτή τη στιγμή. Περιμένετε λίγα λεπτά και δοκιμάστε ξανά. Αν συνεχίσει, επικοινωνήστε με την υποστήριξη του Resgrid ή τον διαχειριστή του διακομιστή σας.",
+        "title": "Πρόβλημα διακομιστή"
+      },
+      "server_not_resgrid": {
+        "message": "Το {{server}} δεν απάντησε ως διακομιστής Resgrid. Ελέγξτε τη διεύθυνση του διακομιστή και δοκιμάστε ξανά.",
+        "title": "Ο διακομιστής δεν αναγνωρίστηκε"
+      },
+      "server_unreachable": {
+        "message": "Δεν ήταν δυνατή η σύνδεση στο {{server}}. Ελέγξτε τη σύνδεσή σας στο διαδίκτυο και ότι έχει επιλεγεί ο σωστός διακομιστής και δοκιμάστε ξανά.",
+        "title": "Ο διακομιστής δεν είναι προσβάσιμος"
+      },
+      "sso_required": {
+        "message": "Η υπηρεσία σας απαιτεί ενιαία σύνδεση (SSO). Χρησιμοποιήστε το κουμπί SSO για να συνδεθείτε με τον λογαριασμό του οργανισμού σας αντί για κωδικό πρόσβασης.",
+        "title": "Απαιτείται ενιαία σύνδεση"
+      }
+    },
     "login": "Σύνδεση",
     "login_button": "Σύνδεση",
     "login_button_description": "Συνδεθείτε στον λογαριασμό σας για να συνεχίσετε",
@@ -1340,6 +1398,14 @@
     "password": "Κωδικός Πρόσβασης",
     "password_incorrect": "Ο κωδικός πρόσβασης ήταν λανθασμένος",
     "password_placeholder": "Εισαγάγετε τον κωδικό πρόσβασής σας",
+    "server": {
+      "change_hint": "Ανοίγει την επιλογή διακομιστή",
+      "custom_host": "Προσαρμοσμένος ({{host}})",
+      "eu_central": "ΕΕ Κεντρική",
+      "label": "Διακομιστής:",
+      "signing_in_to": "Σύνδεση στο {{server}}",
+      "us_west": "ΗΠΑ Δύση"
+    },
     "sso_button": "Συνδεθείτε με SSO",
     "sso_department": "Το SSO παρέχεται από {{name}}",
     "sso_department_id": "Αναγνωριστικό Τμήματος (προαιρετικό)",
diff --git a/src/translations/en.json b/src/translations/en.json
index ac9d372..894b945 100644
--- a/src/translations/en.json
+++ b/src/translations/en.json
@@ -1325,6 +1325,64 @@
       "message": "Please check your username and password and try again.",
       "title": "Login Failed"
     },
+    "errors": {
+      "account_disabled": {
+        "message": "Your account has been disabled by your department. Contact your department administrator to have it re-enabled.",
+        "title": "Account disabled"
+      },
+      "account_locked": {
+        "message": "Your account is locked. Contact your department administrator to have it unlocked.",
+        "title": "Account locked"
+      },
+      "account_locked_out": {
+        "message": "Your account was locked after too many failed sign-in attempts. Wait {{minutes}} min and try again. If you forgot your password, reset it from the Resgrid website before trying again.",
+        "title": "Account temporarily locked"
+      },
+      "account_not_activated": {
+        "message": "Your account hasn't been activated yet. Use the invitation email from your department to finish setting it up, or ask your department administrator to send a new invitation.",
+        "title": "Account not activated"
+      },
+      "department_access_denied": {
+        "message": "Your account is no longer allowed to sign in to this department. Contact your department administrator.",
+        "title": "Sign-in not allowed"
+      },
+      "invalid_credentials": {
+        "message": "The username or password you entered is incorrect. Passwords are case-sensitive, so check that Caps Lock is off. If you forgot your password, reset it from the Resgrid website. Too many failed attempts will temporarily lock your account.",
+        "title": "Incorrect username or password"
+      },
+      "login_failed": {
+        "message": "Something went wrong while signing in. Try again. If it keeps happening, contact your department administrator or Resgrid support.",
+        "title": "Sign-in failed"
+      },
+      "maximum_sessions": {
+        "message": "Your department has reached its limit of signed-in sessions. Sign out on another device, or ask your department administrator to end an unused session, then try again.",
+        "title": "Too many active sessions"
+      },
+      "no_department": {
+        "message": "Your account isn't a member of an active department. Ask your department administrator to add you, then try again.",
+        "title": "No active department"
+      },
+      "rate_limited": {
+        "message": "Too many sign-in attempts were made in a short time. Wait a minute and try again.",
+        "title": "Too many attempts"
+      },
+      "server_error": {
+        "message": "{{server}} couldn't complete the sign-in right now. Wait a few minutes and try again. If it keeps happening, contact Resgrid support or your server administrator.",
+        "title": "Server problem"
+      },
+      "server_not_resgrid": {
+        "message": "{{server}} didn't respond like a Resgrid server. Check the server address and try again.",
+        "title": "Server not recognized"
+      },
+      "server_unreachable": {
+        "message": "Couldn't connect to {{server}}. Check your internet connection and that the right server is selected, then try again.",
+        "title": "Can't reach the server"
+      },
+      "sso_required": {
+        "message": "Your department requires single sign-on. Use the SSO button to sign in with your organization's account instead of a password.",
+        "title": "Single sign-on required"
+      }
+    },
     "login": "Login",
     "login_button": "Sign In",
     "login_button_description": "Login to your account to continue",
@@ -1340,6 +1398,14 @@
     "password": "Password",
     "password_incorrect": "Password was incorrect",
     "password_placeholder": "Enter your password",
+    "server": {
+      "change_hint": "Opens the server selection",
+      "custom_host": "Custom ({{host}})",
+      "eu_central": "EU Central",
+      "label": "Server:",
+      "signing_in_to": "Signing in to {{server}}",
+      "us_west": "US West"
+    },
     "sso_button": "Sign in with SSO",
     "sso_department": "SSO provided by {{name}}",
     "sso_department_id": "Department ID (optional)",
diff --git a/src/translations/es.json b/src/translations/es.json
index 528eb6b..6876dfa 100644
--- a/src/translations/es.json
+++ b/src/translations/es.json
@@ -1325,6 +1325,64 @@
       "message": "Por favor, comprueba tu nombre de usuario y contraseña e inténtalo de nuevo.",
       "title": "Inicio de sesión fallido"
     },
+    "errors": {
+      "account_disabled": {
+        "message": "Su departamento ha deshabilitado su cuenta. Contacte con el administrador de su departamento para que la vuelva a habilitar.",
+        "title": "Cuenta deshabilitada"
+      },
+      "account_locked": {
+        "message": "Su cuenta está bloqueada. Contacte con el administrador de su departamento para que la desbloquee.",
+        "title": "Cuenta bloqueada"
+      },
+      "account_locked_out": {
+        "message": "Su cuenta se bloqueó tras demasiados intentos de inicio de sesión fallidos. Espere {{minutes}} min y vuelva a intentarlo. Si olvidó su contraseña, restablézcala desde el sitio web de Resgrid antes de volver a intentarlo.",
+        "title": "Cuenta bloqueada temporalmente"
+      },
+      "account_not_activated": {
+        "message": "Su cuenta aún no se ha activado. Use el correo de invitación de su departamento para terminar de configurarla, o pida al administrador de su departamento que le envíe una nueva invitación.",
+        "title": "Cuenta no activada"
+      },
+      "department_access_denied": {
+        "message": "Su cuenta ya no puede iniciar sesión en este departamento. Contacte con el administrador de su departamento.",
+        "title": "Inicio de sesión no permitido"
+      },
+      "invalid_credentials": {
+        "message": "El usuario o la contraseña que introdujo no son correctos. Las contraseñas distinguen entre mayúsculas y minúsculas, así que compruebe que Bloq Mayús esté desactivado. Si olvidó su contraseña, restablézcala desde el sitio web de Resgrid. Demasiados intentos fallidos bloquearán su cuenta temporalmente.",
+        "title": "Usuario o contraseña incorrectos"
+      },
+      "login_failed": {
+        "message": "Algo salió mal al iniciar sesión. Vuelva a intentarlo. Si sigue ocurriendo, contacte con el administrador de su departamento o con el soporte de Resgrid.",
+        "title": "Error al iniciar sesión"
+      },
+      "maximum_sessions": {
+        "message": "Su departamento ha alcanzado su límite de sesiones iniciadas. Cierre sesión en otro dispositivo, o pida al administrador de su departamento que finalice una sesión sin uso, y vuelva a intentarlo.",
+        "title": "Demasiadas sesiones activas"
+      },
+      "no_department": {
+        "message": "Su cuenta no pertenece a ningún departamento activo. Pida al administrador de su departamento que le añada y vuelva a intentarlo.",
+        "title": "Sin departamento activo"
+      },
+      "rate_limited": {
+        "message": "Se hicieron demasiados intentos de inicio de sesión en poco tiempo. Espere un minuto y vuelva a intentarlo.",
+        "title": "Demasiados intentos"
+      },
+      "server_error": {
+        "message": "{{server}} no pudo completar el inicio de sesión en este momento. Espere unos minutos y vuelva a intentarlo. Si sigue ocurriendo, contacte con el soporte de Resgrid o con el administrador de su servidor.",
+        "title": "Problema del servidor"
+      },
+      "server_not_resgrid": {
+        "message": "{{server}} no respondió como un servidor de Resgrid. Compruebe la dirección del servidor y vuelva a intentarlo.",
+        "title": "Servidor no reconocido"
+      },
+      "server_unreachable": {
+        "message": "No se pudo conectar con {{server}}. Compruebe su conexión a internet y que esté seleccionado el servidor correcto, y vuelva a intentarlo.",
+        "title": "No se puede contactar con el servidor"
+      },
+      "sso_required": {
+        "message": "Su departamento requiere inicio de sesión único. Use el botón SSO para iniciar sesión con la cuenta de su organización en lugar de una contraseña.",
+        "title": "Se requiere inicio de sesión único"
+      }
+    },
     "login": "Iniciar sesión",
     "login_button": "Iniciar sesión",
     "login_button_description": "Inicia sesión en tu cuenta para continuar",
@@ -1340,6 +1398,14 @@
     "password": "Contraseña",
     "password_incorrect": "La contraseña era incorrecta",
     "password_placeholder": "Introduce tu contraseña",
+    "server": {
+      "change_hint": "Abre la selección de servidor",
+      "custom_host": "Personalizado ({{host}})",
+      "eu_central": "UE Central",
+      "label": "Servidor:",
+      "signing_in_to": "Iniciando sesión en {{server}}",
+      "us_west": "EE. UU. Oeste"
+    },
     "sso_button": "Iniciar sesión con SSO",
     "sso_department": "SSO proporcionado por {{name}}",
     "sso_department_id": "ID de departamento (opcional)",
diff --git a/src/translations/fr.json b/src/translations/fr.json
index 6ce0c00..4b9e51d 100644
--- a/src/translations/fr.json
+++ b/src/translations/fr.json
@@ -1325,6 +1325,64 @@
       "message": "Veuillez vérifier votre nom d'utilisateur et votre mot de passe et réessayer.",
       "title": "Échec de la connexion"
     },
+    "errors": {
+      "account_disabled": {
+        "message": "Votre compte a été désactivé par votre service. Contactez l'administrateur de votre service pour le faire réactiver.",
+        "title": "Compte désactivé"
+      },
+      "account_locked": {
+        "message": "Votre compte est verrouillé. Contactez l'administrateur de votre service pour le faire déverrouiller.",
+        "title": "Compte verrouillé"
+      },
+      "account_locked_out": {
+        "message": "Votre compte a été verrouillé après trop de tentatives de connexion échouées. Patientez {{minutes}} min puis réessayez. Si vous avez oublié votre mot de passe, réinitialisez-le depuis le site web de Resgrid avant de réessayer.",
+        "title": "Compte temporairement verrouillé"
+      },
+      "account_not_activated": {
+        "message": "Votre compte n'a pas encore été activé. Utilisez l'e-mail d'invitation de votre service pour terminer sa configuration, ou demandez à l'administrateur de votre service de vous envoyer une nouvelle invitation.",
+        "title": "Compte non activé"
+      },
+      "department_access_denied": {
+        "message": "Votre compte n'est plus autorisé à se connecter à ce service. Contactez l'administrateur de votre service.",
+        "title": "Connexion non autorisée"
+      },
+      "invalid_credentials": {
+        "message": "Le nom d'utilisateur ou le mot de passe saisi est incorrect. Les mots de passe sont sensibles à la casse : vérifiez que le verrouillage des majuscules est désactivé. Si vous avez oublié votre mot de passe, réinitialisez-le depuis le site web de Resgrid. Trop de tentatives échouées verrouilleront temporairement votre compte.",
+        "title": "Nom d'utilisateur ou mot de passe incorrect"
+      },
+      "login_failed": {
+        "message": "Un problème est survenu lors de la connexion. Réessayez. Si le problème persiste, contactez l'administrateur de votre service ou le support Resgrid.",
+        "title": "Échec de la connexion"
+      },
+      "maximum_sessions": {
+        "message": "Votre service a atteint sa limite de sessions connectées. Déconnectez-vous sur un autre appareil, ou demandez à l'administrateur de votre service de fermer une session inutilisée, puis réessayez.",
+        "title": "Trop de sessions actives"
+      },
+      "no_department": {
+        "message": "Votre compte n'est membre d'aucun service actif. Demandez à l'administrateur de votre service de vous ajouter, puis réessayez.",
+        "title": "Aucun service actif"
+      },
+      "rate_limited": {
+        "message": "Trop de tentatives de connexion ont été faites en peu de temps. Patientez une minute et réessayez.",
+        "title": "Trop de tentatives"
+      },
+      "server_error": {
+        "message": "{{server}} n'a pas pu terminer la connexion pour le moment. Patientez quelques minutes et réessayez. Si le problème persiste, contactez le support Resgrid ou l'administrateur de votre serveur.",
+        "title": "Problème de serveur"
+      },
+      "server_not_resgrid": {
+        "message": "{{server}} n'a pas répondu comme un serveur Resgrid. Vérifiez l'adresse du serveur et réessayez.",
+        "title": "Serveur non reconnu"
+      },
+      "server_unreachable": {
+        "message": "Impossible de se connecter à {{server}}. Vérifiez votre connexion internet et que le bon serveur est sélectionné, puis réessayez.",
+        "title": "Serveur injoignable"
+      },
+      "sso_required": {
+        "message": "Votre service exige l'authentification unique. Utilisez le bouton SSO pour vous connecter avec le compte de votre organisation au lieu d'un mot de passe.",
+        "title": "Authentification unique requise"
+      }
+    },
     "login": "Connexion",
     "login_button": "Se connecter",
     "login_button_description": "Connectez-vous à votre compte pour continuer",
@@ -1340,6 +1398,14 @@
     "password": "Mot de passe",
     "password_incorrect": "Le mot de passe était incorrect",
     "password_placeholder": "Saisir votre mot de passe",
+    "server": {
+      "change_hint": "Ouvre la sélection du serveur",
+      "custom_host": "Personnalisé ({{host}})",
+      "eu_central": "UE Centre",
+      "label": "Serveur :",
+      "signing_in_to": "Connexion à {{server}}",
+      "us_west": "États-Unis Ouest"
+    },
     "sso_button": "Se connecter avec SSO",
     "sso_department": "SSO fourni par {{name}}",
     "sso_department_id": "ID du département (optionnel)",
diff --git a/src/translations/it.json b/src/translations/it.json
index be65dd5..93279f9 100644
--- a/src/translations/it.json
+++ b/src/translations/it.json
@@ -1325,6 +1325,64 @@
       "message": "Verificare nome utente e password e riprovare.",
       "title": "Accesso fallito"
     },
+    "errors": {
+      "account_disabled": {
+        "message": "Il tuo account è stato disattivato dal tuo dipartimento. Contatta l'amministratore del tuo dipartimento per farlo riattivare.",
+        "title": "Account disattivato"
+      },
+      "account_locked": {
+        "message": "Il tuo account è bloccato. Contatta l'amministratore del tuo dipartimento per farlo sbloccare.",
+        "title": "Account bloccato"
+      },
+      "account_locked_out": {
+        "message": "Il tuo account è stato bloccato dopo troppi tentativi di accesso non riusciti. Attendi {{minutes}} min e riprova. Se hai dimenticato la password, reimpostala dal sito web di Resgrid prima di riprovare.",
+        "title": "Account temporaneamente bloccato"
+      },
+      "account_not_activated": {
+        "message": "Il tuo account non è ancora stato attivato. Usa l'email di invito del tuo dipartimento per completarne la configurazione, oppure chiedi all'amministratore del tuo dipartimento di inviarti un nuovo invito.",
+        "title": "Account non attivato"
+      },
+      "department_access_denied": {
+        "message": "Il tuo account non può più accedere a questo dipartimento. Contatta l'amministratore del tuo dipartimento.",
+        "title": "Accesso non consentito"
+      },
+      "invalid_credentials": {
+        "message": "Il nome utente o la password inseriti non sono corretti. Le password distinguono tra maiuscole e minuscole, quindi verifica che il blocco maiuscole sia disattivato. Se hai dimenticato la password, reimpostala dal sito web di Resgrid. Troppi tentativi non riusciti bloccheranno temporaneamente l'account.",
+        "title": "Nome utente o password errati"
+      },
+      "login_failed": {
+        "message": "Si è verificato un problema durante l'accesso. Riprova. Se il problema persiste, contatta l'amministratore del tuo dipartimento o il supporto Resgrid.",
+        "title": "Accesso non riuscito"
+      },
+      "maximum_sessions": {
+        "message": "Il tuo dipartimento ha raggiunto il limite di sessioni connesse. Esci da un altro dispositivo, oppure chiedi all'amministratore del tuo dipartimento di chiudere una sessione inutilizzata, poi riprova.",
+        "title": "Troppe sessioni attive"
+      },
+      "no_department": {
+        "message": "Il tuo account non è membro di alcun dipartimento attivo. Chiedi all'amministratore del tuo dipartimento di aggiungerti, poi riprova.",
+        "title": "Nessun dipartimento attivo"
+      },
+      "rate_limited": {
+        "message": "Sono stati effettuati troppi tentativi di accesso in poco tempo. Attendi un minuto e riprova.",
+        "title": "Troppi tentativi"
+      },
+      "server_error": {
+        "message": "{{server}} non è riuscito a completare l'accesso in questo momento. Attendi qualche minuto e riprova. Se il problema persiste, contatta il supporto Resgrid o l'amministratore del server.",
+        "title": "Problema del server"
+      },
+      "server_not_resgrid": {
+        "message": "{{server}} non ha risposto come un server Resgrid. Verifica l'indirizzo del server e riprova.",
+        "title": "Server non riconosciuto"
+      },
+      "server_unreachable": {
+        "message": "Impossibile connettersi a {{server}}. Verifica la connessione a internet e che sia selezionato il server corretto, poi riprova.",
+        "title": "Server non raggiungibile"
+      },
+      "sso_required": {
+        "message": "Il tuo dipartimento richiede il Single Sign-On. Usa il pulsante SSO per accedere con l'account della tua organizzazione invece che con una password.",
+        "title": "Accesso Single Sign-On richiesto"
+      }
+    },
     "login": "Accedi",
     "login_button": "Accedi",
     "login_button_description": "Accedi al tuo account per continuare",
@@ -1340,6 +1398,14 @@
     "password": "Password",
     "password_incorrect": "La password non è corretta",
     "password_placeholder": "Inserisci la tua password",
+    "server": {
+      "change_hint": "Apre la selezione del server",
+      "custom_host": "Personalizzato ({{host}})",
+      "eu_central": "UE Centrale",
+      "label": "Server:",
+      "signing_in_to": "Accesso a {{server}}",
+      "us_west": "USA Ovest"
+    },
     "sso_button": "Accedi con SSO",
     "sso_department": "SSO fornito da {{name}}",
     "sso_department_id": "ID dipartimento (opzionale)",
diff --git a/src/translations/pl.json b/src/translations/pl.json
index c3c3350..6f0c7ae 100644
--- a/src/translations/pl.json
+++ b/src/translations/pl.json
@@ -1325,6 +1325,64 @@
       "message": "Sprawdź nazwę użytkownika i hasło i spróbuj ponownie.",
       "title": "Logowanie nieudane"
     },
+    "errors": {
+      "account_disabled": {
+        "message": "Twoje konto zostało wyłączone przez Twoją jednostkę. Skontaktuj się z administratorem swojej jednostki, aby je ponownie włączyć.",
+        "title": "Konto wyłączone"
+      },
+      "account_locked": {
+        "message": "Twoje konto jest zablokowane. Skontaktuj się z administratorem swojej jednostki, aby je odblokować.",
+        "title": "Konto zablokowane"
+      },
+      "account_locked_out": {
+        "message": "Twoje konto zostało zablokowane po zbyt wielu nieudanych próbach logowania. Odczekaj {{minutes}} min i spróbuj ponownie. Jeśli nie pamiętasz hasła, zresetuj je na stronie Resgrid przed kolejną próbą.",
+        "title": "Konto tymczasowo zablokowane"
+      },
+      "account_not_activated": {
+        "message": "Twoje konto nie zostało jeszcze aktywowane. Użyj e-maila z zaproszeniem od swojej jednostki, aby dokończyć konfigurację, lub poproś administratora jednostki o wysłanie nowego zaproszenia.",
+        "title": "Konto nieaktywowane"
+      },
+      "department_access_denied": {
+        "message": "Twoje konto nie może już logować się do tej jednostki. Skontaktuj się z administratorem swojej jednostki.",
+        "title": "Logowanie niedozwolone"
+      },
+      "invalid_credentials": {
+        "message": "Wprowadzona nazwa użytkownika lub hasło są nieprawidłowe. W hasłach rozróżniana jest wielkość liter, więc sprawdź, czy Caps Lock jest wyłączony. Jeśli nie pamiętasz hasła, zresetuj je na stronie Resgrid. Zbyt wiele nieudanych prób tymczasowo zablokuje konto.",
+        "title": "Nieprawidłowa nazwa użytkownika lub hasło"
+      },
+      "login_failed": {
+        "message": "Podczas logowania wystąpił błąd. Spróbuj ponownie. Jeśli problem się powtarza, skontaktuj się z administratorem swojej jednostki lub pomocą techniczną Resgrid.",
+        "title": "Logowanie nie powiodło się"
+      },
+      "maximum_sessions": {
+        "message": "Twoja jednostka osiągnęła limit zalogowanych sesji. Wyloguj się na innym urządzeniu lub poproś administratora jednostki o zakończenie nieużywanej sesji, a następnie spróbuj ponownie.",
+        "title": "Zbyt wiele aktywnych sesji"
+      },
+      "no_department": {
+        "message": "Twoje konto nie należy do żadnej aktywnej jednostki. Poproś administratora swojej jednostki o dodanie Cię, a następnie spróbuj ponownie.",
+        "title": "Brak aktywnej jednostki"
+      },
+      "rate_limited": {
+        "message": "W krótkim czasie podjęto zbyt wiele prób logowania. Odczekaj minutę i spróbuj ponownie.",
+        "title": "Zbyt wiele prób"
+      },
+      "server_error": {
+        "message": "{{server}} nie mógł teraz dokończyć logowania. Odczekaj kilka minut i spróbuj ponownie. Jeśli problem się powtarza, skontaktuj się z pomocą techniczną Resgrid lub administratorem serwera.",
+        "title": "Problem z serwerem"
+      },
+      "server_not_resgrid": {
+        "message": "{{server}} nie odpowiedział jak serwer Resgrid. Sprawdź adres serwera i spróbuj ponownie.",
+        "title": "Nierozpoznany serwer"
+      },
+      "server_unreachable": {
+        "message": "Nie można połączyć się z {{server}}. Sprawdź połączenie z internetem i czy wybrano właściwy serwer, a następnie spróbuj ponownie.",
+        "title": "Brak połączenia z serwerem"
+      },
+      "sso_required": {
+        "message": "Twoja jednostka wymaga logowania jednokrotnego. Użyj przycisku SSO, aby zalogować się kontem swojej organizacji zamiast hasłem.",
+        "title": "Wymagane logowanie jednokrotne"
+      }
+    },
     "login": "Zaloguj się",
     "login_button": "Zaloguj się",
     "login_button_description": "Zaloguj się do swojego konta, aby kontynuować",
@@ -1340,6 +1398,14 @@
     "password": "Hasło",
     "password_incorrect": "Hasło jest nieprawidłowe",
     "password_placeholder": "Wpisz hasło",
+    "server": {
+      "change_hint": "Otwiera wybór serwera",
+      "custom_host": "Niestandardowy ({{host}})",
+      "eu_central": "UE Centrum",
+      "label": "Serwer:",
+      "signing_in_to": "Logowanie do {{server}}",
+      "us_west": "USA Zachód"
+    },
     "sso_button": "Zaloguj się przez SSO",
     "sso_department": "SSO zapewnione przez {{name}}",
     "sso_department_id": "ID działu (opcjonalnie)",
diff --git a/src/translations/sv.json b/src/translations/sv.json
index f897061..488214c 100644
--- a/src/translations/sv.json
+++ b/src/translations/sv.json
@@ -1325,6 +1325,64 @@
       "message": "Kontrollera ditt användarnamn och lösenord och försök igen.",
       "title": "Inloggningen misslyckades"
     },
+    "errors": {
+      "account_disabled": {
+        "message": "Ditt konto har inaktiverats av din organisation. Kontakta din organisations administratör för att få det aktiverat igen.",
+        "title": "Kontot är inaktiverat"
+      },
+      "account_locked": {
+        "message": "Ditt konto är låst. Kontakta din organisations administratör för att få det upplåst.",
+        "title": "Kontot är låst"
+      },
+      "account_locked_out": {
+        "message": "Ditt konto låstes efter för många misslyckade inloggningsförsök. Vänta {{minutes}} min och försök igen. Om du har glömt ditt lösenord, återställ det på Resgrids webbplats innan du försöker igen.",
+        "title": "Kontot är tillfälligt låst"
+      },
+      "account_not_activated": {
+        "message": "Ditt konto har inte aktiverats än. Använd inbjudningsmejlet från din organisation för att slutföra konfigurationen, eller be din organisations administratör att skicka en ny inbjudan.",
+        "title": "Kontot är inte aktiverat"
+      },
+      "department_access_denied": {
+        "message": "Ditt konto får inte längre logga in i den här organisationen. Kontakta din organisations administratör.",
+        "title": "Inloggning inte tillåten"
+      },
+      "invalid_credentials": {
+        "message": "Användarnamnet eller lösenordet du angav är fel. Lösenord är skiftlägeskänsliga, så kontrollera att Caps Lock är avstängt. Om du har glömt ditt lösenord kan du återställa det på Resgrids webbplats. För många misslyckade försök låser ditt konto tillfälligt.",
+        "title": "Fel användarnamn eller lösenord"
+      },
+      "login_failed": {
+        "message": "Något gick fel vid inloggningen. Försök igen. Om det fortsätter, kontakta din organisations administratör eller Resgrids support.",
+        "title": "Inloggningen misslyckades"
+      },
+      "maximum_sessions": {
+        "message": "Din organisation har nått sin gräns för inloggade sessioner. Logga ut på en annan enhet, eller be din organisations administratör att avsluta en oanvänd session, och försök sedan igen.",
+        "title": "För många aktiva sessioner"
+      },
+      "no_department": {
+        "message": "Ditt konto är inte medlem i någon aktiv organisation. Be din organisations administratör att lägga till dig och försök sedan igen.",
+        "title": "Ingen aktiv organisation"
+      },
+      "rate_limited": {
+        "message": "För många inloggningsförsök gjordes på kort tid. Vänta en minut och försök igen.",
+        "title": "För många försök"
+      },
+      "server_error": {
+        "message": "{{server}} kunde inte slutföra inloggningen just nu. Vänta några minuter och försök igen. Om det fortsätter, kontakta Resgrids support eller din serveradministratör.",
+        "title": "Serverproblem"
+      },
+      "server_not_resgrid": {
+        "message": "{{server}} svarade inte som en Resgrid-server. Kontrollera serveradressen och försök igen.",
+        "title": "Servern känns inte igen"
+      },
+      "server_unreachable": {
+        "message": "Det gick inte att ansluta till {{server}}. Kontrollera din internetanslutning och att rätt server är vald, och försök sedan igen.",
+        "title": "Servern kan inte nås"
+      },
+      "sso_required": {
+        "message": "Din organisation kräver enkel inloggning. Använd SSO-knappen för att logga in med din organisations konto i stället för ett lösenord.",
+        "title": "Enkel inloggning krävs"
+      }
+    },
     "login": "Logga in",
     "login_button": "Logga in",
     "login_button_description": "Logga in på ditt konto för att fortsätta",
@@ -1340,6 +1398,14 @@
     "password": "Lösenord",
     "password_incorrect": "Lösenordet var felaktigt",
     "password_placeholder": "Ange ditt lösenord",
+    "server": {
+      "change_hint": "Öppnar serverval",
+      "custom_host": "Anpassad ({{host}})",
+      "eu_central": "EU Central",
+      "label": "Server:",
+      "signing_in_to": "Loggar in på {{server}}",
+      "us_west": "USA Väst"
+    },
     "sso_button": "Logga in med SSO",
     "sso_department": "SSO tillhandahållet av {{name}}",
     "sso_department_id": "Avdelnings-ID (valfritt)",
diff --git a/src/translations/uk.json b/src/translations/uk.json
index b1ce3f9..d97e7a9 100644
--- a/src/translations/uk.json
+++ b/src/translations/uk.json
@@ -1325,6 +1325,64 @@
       "message": "Перевірте ім'я користувача та пароль і спробуйте ще раз.",
       "title": "Помилка входу"
     },
+    "errors": {
+      "account_disabled": {
+        "message": "Ваш підрозділ вимкнув ваш обліковий запис. Зверніться до адміністратора вашого підрозділу, щоб його знову ввімкнути.",
+        "title": "Обліковий запис вимкнено"
+      },
+      "account_locked": {
+        "message": "Ваш обліковий запис заблоковано. Зверніться до адміністратора вашого підрозділу, щоб його розблокувати.",
+        "title": "Обліковий запис заблоковано"
+      },
+      "account_locked_out": {
+        "message": "Ваш обліковий запис заблоковано після забагатьох невдалих спроб входу. Зачекайте {{minutes}} хв і спробуйте знову. Якщо ви забули пароль, скиньте його на вебсайті Resgrid перед наступною спробою.",
+        "title": "Обліковий запис тимчасово заблоковано"
+      },
+      "account_not_activated": {
+        "message": "Ваш обліковий запис ще не активовано. Скористайтеся листом-запрошенням від вашого підрозділу, щоб завершити налаштування, або попросіть адміністратора підрозділу надіслати нове запрошення.",
+        "title": "Обліковий запис не активовано"
+      },
+      "department_access_denied": {
+        "message": "Вашому обліковому запису більше не дозволено входити до цього підрозділу. Зверніться до адміністратора вашого підрозділу.",
+        "title": "Вхід заборонено"
+      },
+      "invalid_credentials": {
+        "message": "Введене ім'я користувача або пароль неправильні. Паролі чутливі до регістру, тож перевірте, чи вимкнено Caps Lock. Якщо ви забули пароль, скиньте його на вебсайті Resgrid. Забагато невдалих спроб тимчасово заблокує ваш обліковий запис.",
+        "title": "Неправильне ім'я користувача або пароль"
+      },
+      "login_failed": {
+        "message": "Під час входу сталася помилка. Спробуйте знову. Якщо проблема повторюється, зверніться до адміністратора вашого підрозділу або підтримки Resgrid.",
+        "title": "Не вдалося увійти"
+      },
+      "maximum_sessions": {
+        "message": "Ваш підрозділ досяг ліміту активних сеансів. Вийдіть на іншому пристрої або попросіть адміністратора підрозділу завершити невикористаний сеанс і спробуйте знову.",
+        "title": "Забагато активних сеансів"
+      },
+      "no_department": {
+        "message": "Ваш обліковий запис не входить до жодного активного підрозділу. Попросіть адміністратора вашого підрозділу додати вас і спробуйте знову.",
+        "title": "Немає активного підрозділу"
+      },
+      "rate_limited": {
+        "message": "За короткий час зроблено забагато спроб входу. Зачекайте хвилину і спробуйте знову.",
+        "title": "Забагато спроб"
+      },
+      "server_error": {
+        "message": "{{server}} не зміг зараз завершити вхід. Зачекайте кілька хвилин і спробуйте знову. Якщо проблема повторюється, зверніться до підтримки Resgrid або адміністратора вашого сервера.",
+        "title": "Проблема на сервері"
+      },
+      "server_not_resgrid": {
+        "message": "{{server}} відповів не як сервер Resgrid. Перевірте адресу сервера і спробуйте знову.",
+        "title": "Сервер не розпізнано"
+      },
+      "server_unreachable": {
+        "message": "Не вдалося підключитися до {{server}}. Перевірте підключення до інтернету та чи вибрано правильний сервер, і спробуйте знову.",
+        "title": "Сервер недоступний"
+      },
+      "sso_required": {
+        "message": "Ваш підрозділ вимагає єдиного входу. Скористайтеся кнопкою SSO, щоб увійти обліковим записом вашої організації замість пароля.",
+        "title": "Потрібен єдиний вхід"
+      }
+    },
     "login": "Увійти",
     "login_button": "Увійти",
     "login_button_description": "Увійдіть до свого облікового запису для продовження",
@@ -1340,6 +1398,14 @@
     "password": "Пароль",
     "password_incorrect": "Пароль невірний",
     "password_placeholder": "Введіть пароль",
+    "server": {
+      "change_hint": "Відкриває вибір сервера",
+      "custom_host": "Власний ({{host}})",
+      "eu_central": "ЄС Центр",
+      "label": "Сервер:",
+      "signing_in_to": "Вхід на {{server}}",
+      "us_west": "США Захід"
+    },
     "sso_button": "Увійти через SSO",
     "sso_department": "SSO надано {{name}}",
     "sso_department_id": "ID підрозділу (необов'язково)",

From 32601b3765da3c38208b59cf7f7459bf18bf6758 Mon Sep 17 00:00:00 2001
From: Shawn Jackson <shawn@resgrid.com>
Date: Sat, 31 Oct 2026 12:31:54 -0700
Subject: [PATCH 2/2] RC-T48 PR #80 Fixes

---
 .../__tests__/login-server-badge.test.tsx     |  8 +++++
 src/components/auth/login-server-badge.tsx    | 32 ++++++++++++-------
 src/lib/auth/__tests__/login-errors.test.ts   | 20 +++++++++++-
 src/lib/auth/login-errors.ts                  | 17 ++++++----
 src/stores/auth/__tests__/store-mfa.test.ts   | 15 +++++++++
 src/stores/auth/store.tsx                     | 10 ++++--
 6 files changed, 82 insertions(+), 20 deletions(-)

diff --git a/src/components/auth/__tests__/login-server-badge.test.tsx b/src/components/auth/__tests__/login-server-badge.test.tsx
index c0163ce..b951ea8 100644
--- a/src/components/auth/__tests__/login-server-badge.test.tsx
+++ b/src/components/auth/__tests__/login-server-badge.test.tsx
@@ -51,4 +51,12 @@ describe('LoginServerBadge', () => {
     fireEvent.press(screen.getByTestId('login-server-badge'));
     expect(onPress).toHaveBeenCalled();
   });
+  it('is a button only when it opens something', () => {
+    const { rerender } = render(<LoginServerBadge onPress={jest.fn()} />);
+    expect(screen.getByTestId('login-server-badge').props.accessibilityRole).toBe('button');
+
+    rerender(<LoginServerBadge />);
+    expect(screen.getByTestId('login-server-badge').props.accessibilityRole).toBeUndefined();
+    expect(screen.queryByRole('button')).toBeNull();
+  });
 });
diff --git a/src/components/auth/login-server-badge.tsx b/src/components/auth/login-server-badge.tsx
index f03db75..b90fe24 100644
--- a/src/components/auth/login-server-badge.tsx
+++ b/src/components/auth/login-server-badge.tsx
@@ -2,7 +2,7 @@ import { Server } from 'lucide-react-native';
 import { useColorScheme } from 'nativewind';
 import React from 'react';
 import { useTranslation } from 'react-i18next';
-import { Pressable } from 'react-native';
+import { Pressable, View } from 'react-native';
 
 import { Text } from '@/components/ui/text';
 import { useLoginServer } from '@/hooks/use-login-server';
@@ -12,26 +12,36 @@ interface LoginServerBadgeProps {
   onPress?: () => void;
 }
 
+const BADGE_CLASS = 'flex-row items-center self-center rounded-full border border-gray-300 px-3 py-1.5 dark:border-gray-700';
+
 /** Names the server the login form signs in to (US West, EU Central or Custom), so a wrong server is spotted before signing in. */
 export const LoginServerBadge = ({ onPress }: LoginServerBadgeProps) => {
   const { t } = useTranslation();
   const { colorScheme } = useColorScheme();
   const { name } = useLoginServer();
+  const label = t('login.server.signing_in_to', { server: name });
 
-  return (
-    <Pressable
-      onPress={onPress}
-      disabled={!onPress}
-      accessibilityRole={onPress ? 'button' : 'text'}
-      accessibilityLabel={t('login.server.signing_in_to', { server: name })}
-      accessibilityHint={onPress ? t('login.server.change_hint') : undefined}
-      testID="login-server-badge"
-      className="flex-row items-center self-center rounded-full border border-gray-300 px-3 py-1.5 dark:border-gray-700"
-    >
+  const content = (
+    <>
       <Server size={14} color={colorScheme === 'dark' ? '#9ca3af' : '#6b7280'} />
       <Text className="ml-1.5 text-sm text-gray-600 dark:text-gray-300">
         {t('login.server.label')} <Text className="text-sm font-semibold text-gray-900 dark:text-white">{name}</Text>
       </Text>
+    </>
+  );
+
+  // Only a badge that does something is a button; a label stays a label for assistive technologies.
+  if (!onPress) {
+    return (
+      <View accessible accessibilityLabel={label} testID="login-server-badge" className={BADGE_CLASS}>
+        {content}
+      </View>
+    );
+  }
+
+  return (
+    <Pressable onPress={onPress} accessibilityRole="button" accessibilityLabel={label} accessibilityHint={t('login.server.change_hint')} testID="login-server-badge" className={BADGE_CLASS}>
+      {content}
     </Pressable>
   );
 };
diff --git a/src/lib/auth/__tests__/login-errors.test.ts b/src/lib/auth/__tests__/login-errors.test.ts
index 16f4573..6f8d262 100644
--- a/src/lib/auth/__tests__/login-errors.test.ts
+++ b/src/lib/auth/__tests__/login-errors.test.ts
@@ -11,7 +11,7 @@ import pl from '@/translations/pl.json';
 import sv from '@/translations/sv.json';
 import uk from '@/translations/uk.json';
 
-import { classifyLoginFailure, describeLoginFailure, isLoginErrorCode, type LoginErrorCode } from '../login-errors';
+import { classifyLoginFailure, describeLoginFailure, isLoginErrorCode, isServerLoginReason, type LoginErrorCode } from '../login-errors';
 
 const axiosError = (status?: number, data?: unknown) => ({
   isAxiosError: true,
@@ -55,6 +55,15 @@ describe('classifyLoginFailure', () => {
     expect(classifyLoginFailure(axiosError(400, { error: 'invalid_grant', login_error: 'something_new' }))).toEqual({ code: 'invalid_credentials' });
   });
 
+  it('reads login_error only beside invalid_grant', () => {
+    expect(classifyLoginFailure(axiosError(400, { error: 'invalid_client', login_error: 'account_disabled' }))).toEqual({ code: 'login_failed' });
+    expect(classifyLoginFailure(axiosError(500, { login_error: 'account_disabled' }))).toEqual({ code: 'server_error' });
+  });
+
+  it('tells a throttled member to wait whatever reason the body gives', () => {
+    expect(classifyLoginFailure(axiosError(429, { error: 'invalid_grant', login_error: 'account_locked_out', lockout_minutes_remaining: 5 }))).toEqual({ code: 'rate_limited' });
+  });
+
   it('treats a bare invalid_grant from an older server as wrong credentials', () => {
     expect(classifyLoginFailure(axiosError(400, { error: 'invalid_grant', error_description: 'The username or password is invalid.' }))).toEqual({ code: 'invalid_credentials' });
   });
@@ -95,6 +104,15 @@ describe('isLoginErrorCode', () => {
   });
 });
 
+describe('isServerLoginReason', () => {
+  it('accepts only the reasons a server sends', () => {
+    expect(isServerLoginReason('account_locked_out')).toBe(true);
+    expect(isServerLoginReason('server_unreachable')).toBe(false);
+    expect(isServerLoginReason('mysecretpassword')).toBe(false);
+    expect(isServerLoginReason(42)).toBe(false);
+  });
+});
+
 describe('describeLoginFailure', () => {
   const t = jest.fn((key: string, options?: Record<string, unknown>) => `${key}${options ? JSON.stringify(options) : ''}`) as unknown as TFunction;
 
diff --git a/src/lib/auth/login-errors.ts b/src/lib/auth/login-errors.ts
index 90b05f4..f74f9e3 100644
--- a/src/lib/auth/login-errors.ts
+++ b/src/lib/auth/login-errors.ts
@@ -34,6 +34,9 @@ const LOGIN_ERROR_CODES = new Set<string>([...SERVER_REASONS, 'server_unreachabl
 /** Whether an auth-store error is one of these codes (shown with its guidance) rather than a code or text from elsewhere. */
 export const isLoginErrorCode = (value: string | null | undefined): value is LoginErrorCode => !!value && LOGIN_ERROR_CODES.has(value);
 
+/** Whether a response's login_error is one of the reasons the server sends; anything else is response text, never logged. */
+export const isServerLoginReason = (value: unknown): value is LoginErrorCode => typeof value === 'string' && SERVER_REASONS.has(value);
+
 interface TokenErrorBody {
   error?: unknown;
   error_description?: unknown;
@@ -60,18 +63,20 @@ export const classifyLoginFailure = (error: unknown): LoginFailure => {
   const status = response.status ?? 0;
   const body: TokenErrorBody | null = typeof response.data === 'object' && response.data !== null ? (response.data as TokenErrorBody) : null;
 
-  if (body && typeof body.login_error === 'string' && SERVER_REASONS.has(body.login_error)) {
+  // Throttling comes first: whatever else the body says, waiting is what helps.
+  if (status === 429) {
+    return { code: 'rate_limited' };
+  }
+
+  // The server sends its reason only beside invalid_grant.
+  if (body?.error === 'invalid_grant' && isServerLoginReason(body.login_error)) {
     const minutes = body.lockout_minutes_remaining;
     return {
-      code: body.login_error as LoginErrorCode,
+      code: body.login_error,
       ...(typeof minutes === 'number' && Number.isFinite(minutes) && minutes > 0 ? { lockoutMinutes: Math.ceil(minutes) } : {}),
     };
   }
 
-  if (status === 429) {
-    return { code: 'rate_limited' };
-  }
-
   if (body?.error === 'invalid_grant') {
     const description = typeof body.error_description === 'string' ? body.error_description : '';
     if (description.includes('maximum number of active sessions')) {
diff --git a/src/stores/auth/__tests__/store-mfa.test.ts b/src/stores/auth/__tests__/store-mfa.test.ts
index d717257..948a715 100644
--- a/src/stores/auth/__tests__/store-mfa.test.ts
+++ b/src/stores/auth/__tests__/store-mfa.test.ts
@@ -180,6 +180,21 @@ describe('auth store: a refused password sign-in', () => {
     expect(persist.getOptions().partialize(useAuthStore.getState())).not.toHaveProperty('loginFailure');
   });
 
+  it('restarts a failed sign-in signed out, without a reason it no longer has', () => {
+    const persist = (useAuthStore as unknown as { persist: { getOptions: () => { merge: (persisted: unknown, current: unknown) => Record<string, unknown> } } }).persist;
+
+    expect(persist.getOptions().merge({ status: 'error', error: 'account_locked_out', userId: 'u1' }, useAuthStore.getState())).toMatchObject({ status: 'signedOut', error: null, userId: 'u1' });
+    // Why a session ended is not a sign-in failure and still reaches the login screen after a restart.
+    expect(persist.getOptions().merge({ status: 'signedOut', error: 'shift_ended' }, useAuthStore.getState())).toMatchObject({ status: 'signedOut', error: 'shift_ended' });
+    expect(persist.getOptions().merge({ status: 'signedIn', error: null }, useAuthStore.getState())).toMatchObject({ status: 'signedIn' });
+  });
+
+  it('drops the last failed sign-in on sign-out', async () => {
+    useAuthStore.setState({ loginFailure: { code: 'account_locked_out', lockoutMinutes: 9 } });
+    await useAuthStore.getState().logout();
+    expect(useAuthStore.getState().loginFailure).toBeNull();
+  });
+
   it('forgets the last reason when the next sign-in starts', async () => {
     useAuthStore.setState({ status: 'error', error: 'invalid_credentials', loginFailure: { code: 'invalid_credentials' } });
     mockLoginRequest.mockResolvedValue({ successful: false, message: '', authResponse: null, mfaRequired: true, mfaTransaction: { secret: 'txn-secret', challenge } });
diff --git a/src/stores/auth/store.tsx b/src/stores/auth/store.tsx
index 476c3c4..b03c437 100644
--- a/src/stores/auth/store.tsx
+++ b/src/stores/auth/store.tsx
@@ -346,6 +346,7 @@ const useAuthStore = create<AuthState>()(
             status: 'signedOut',
             // Why the session ended, when the screen should say (a shared shift that ran out); otherwise nothing.
             error: typeof reason === 'string' ? reason : null,
+            loginFailure: null,
             profile: null,
             // Clearing the user id drops the API cache scope (see the subscription below); leaving it set
             // keeps this user's cache keys live for whoever signs in next on the same device.
@@ -543,8 +544,13 @@ const useAuthStore = create<AuthState>()(
       // is the refresh timer (a handle that means nothing after a restart).
       partialize: ({ mfaChallenge: _mfaChallenge, pendingRecoveryCodes: _pendingRecoveryCodes, loginFailure: _loginFailure, refreshTimeoutId: _refreshTimeoutId, ...persisted }) => persisted,
       // The pending SSO exchange and the login transaction live in module memory and die with the process, so a
-      // rehydrated pending state would open a prompt with nothing to finish. Force them back.
-      merge: (persisted, current) => ({ ...current, ...(persisted as Partial<AuthState>), isSsoMfaPending: false, mfaChallenge: null, pendingRecoveryCodes: null }),
+      // rehydrated pending state would open a prompt with nothing to finish. Force them back. A failed sign-in's reason is
+      // not stored either, so the failure restarts signed out rather than reopening with nothing to explain it.
+      merge: (persisted, current) => {
+        const restored = (persisted ?? {}) as Partial<AuthState>;
+        const failedSignIn = isLoginErrorCode(restored.error) ? { status: restored.status === 'error' ? ('signedOut' as const) : (restored.status ?? current.status), error: null } : {};
+        return { ...current, ...restored, ...failedSignIn, isSsoMfaPending: false, mfaChallenge: null, pendingRecoveryCodes: null };
+      },
       onRehydrateStorage: () => {
         return (state, error) => {
           if (error) {