SkillsLao TVET Back-office

• Screen: SCR-IDP.29 — Staff Login
• Use case: UC-IDP.07 — Login — Staff

Back-office portal login page for staff (Instructor, Program Administrator, Super Administrator) — displays email and password input fields as the primary credential, and a "Sign in with Google" button as an optional single sign-on channel. No verification code or PIN options because staff access only through a web browser (per FEAT-IDP.01), unlike the learner login page (SCR-IDP.07). When authentication fails, feedback is shown inline on the same page (no redirect): AF-3B (wrong password) — inline "Invalid email or password" message; AF-3C (5 failed attempts) — 15-minute countdown + Sign in button disabled; AF-3A (account not found) — directs to contact an Admin (staff cannot self-register); AF-3D (account suspended/revoked) — directs to contact the Super Administrator. Includes a "Forgot Password?" link for password reset (→ UC-IDP.22).

• email "Email" — text · required · always visible · validation: format:email, max_length:255
• password "Password" — password · (not persisted — compared against AuthIdentity.credential) · required · always visible · validation: min_length:8
• error_message "Error Message" — text · read-only · visible when auth_failed == true && lockout_active == false && account_not_found == false && account_suspended == false && account_revoked == false · fallback: "Invalid email or password"
• lockout_countdown "Lockout Countdown" — computed · read-only · visible when lockout_active == true · real-time MM:SS countdown (see additional req. 2)
• account_not_found_notice "Account Not Found" — text · read-only · visible when account_not_found == true · fallback: "Please contact your administrator to create an account for you."
• account_suspended_notice "Account Status" — computed · read-only · visible when account_suspended == true || account_revoked == true · fallback: "Your account cannot be accessed. Please contact your Super Administrator to restore access."

• sign_in "Sign in" — enabled when required_fields_valid && lockout_active == false · triggers UC-IDP.07-M-2 → /home/ (UC-IDP.26 — View Staff Portal Home)
• sign_in_google "Sign in with Google" — always enabled · triggers UC-IDP.07-A-2A-1 → SUC-IDP-03 (/authenticate-via-google-sso/)
• forgot_password "Forgot Password?" — always enabled · triggers UC-IDP.22-M-1 → /forgot-password/

1. Error messages (wrong password, suspended account, account not found, revoked account) must be displayed inline in the Login state feedback region — not as browser alert dialogs. [refs: NFR-11]
2. When an account is temporarily suspended (AF-3C, lockout_active == true): the "Sign in" button must be disabled and a real-time MM:SS countdown shown until the 15-minute lock expires. [refs: SS-IDP.13]
3. Keyboard focus order: Email → Password → "Sign in" → "Sign in with Google" → "Forgot Password?" — Tab/Shift+Tab must navigate in this order. [refs: NFR-11]
4. The "Sign in with Google" button must use the Google-branded button style (Google icon + "Sign in with Google" text) per Google Sign-In Branding Guidelines.
5. Error message for wrong password (AF-3B) must always read "Invalid email or password" regardless of whether the email or password is incorrect — to prevent account enumeration.