# UJ-101 Staff login with brute-force backoff

Audience: AI coding agents first.

- Actor + entry point: Staff operator; dashboard `/login` (`admin-panel/src/App.tsx:96-106`).
- Priority: MUST-HAVE.
- Preconditions: Create staff identity through staff identity-management API; clear session through logout API, never DB.
- Test layer: L3.

## Steps

1. Enter valid email/password and submit → login request succeeds; browser navigates to `/dashboard` (`admin-panel/src/pages/LoginPage.tsx:94-107`).
2. Reload `/dashboard` → authenticated shell remains visible.

## Failure branches

- Invalid credentials `401` → remain on `/login`; render invalid-credentials error (`admin-panel/src/pages/LoginPage.tsx:108-117`).
- Repeated failures `429` → render `Too many login attempts. Please try again later.`; further submit is denied until backoff expires (`admin-panel/src/pages/LoginPage.tsx:110-113`).
- Backend unreachable → render `An error occurred. Please try again.` (`admin-panel/src/pages/LoginPage.tsx:114-117`).

## Backend touchpoints

Staff login endpoint used by `useAuthStore.login`; authenticated session probe.