From 66107f1b7adefadc735f98d5f90289ef4afcfc19 Mon Sep 17 00:00:00 2001
From: Shawn Jackson <shawn@resgrid.com>
Date: Sat, 31 Oct 2026 11:53:58 -0700
Subject: [PATCH 1/2] RD-T49 Login Fixes

---
 src/__tests__/app/login/index.web.test.tsx    |  47 ++++++-
 src/app/login/index.tsx                       |  20 ++-
 src/app/login/index.web.tsx                   |  27 +++-
 src/app/login/login-form.tsx                  |   6 +-
 .../__tests__/login-server-badge.test.tsx     |  56 ++++++++
 src/components/auth/login-server-badge.tsx    |  37 +++++
 src/hooks/use-login-server.ts                 |  22 +++
 src/lib/__tests__/login-server.test.ts        |  17 +++
 src/lib/auth/__tests__/login-errors.test.ts   | 132 ++++++++++++++++++
 src/lib/auth/api.tsx                          |  15 +-
 src/lib/auth/login-errors.ts                  | 109 +++++++++++++++
 src/lib/auth/types.tsx                        |   5 +
 src/lib/login-server.ts                       |  24 ++++
 src/stores/auth/store.tsx                     |  11 +-
 src/translations/ar.json                      |  68 ++++++++-
 src/translations/de.json                      |  68 ++++++++-
 src/translations/el.json                      |  68 ++++++++-
 src/translations/en.json                      |  68 ++++++++-
 src/translations/es.json                      |  68 ++++++++-
 src/translations/fr.json                      |  68 ++++++++-
 src/translations/it.json                      |  68 ++++++++-
 src/translations/pl.json                      |  68 ++++++++-
 src/translations/sv.json                      |  68 ++++++++-
 src/translations/uk.json                      |  68 ++++++++-
 24 files changed, 1177 insertions(+), 31 deletions(-)
 create mode 100644 src/components/auth/__tests__/login-server-badge.test.tsx
 create mode 100644 src/components/auth/login-server-badge.tsx
 create mode 100644 src/hooks/use-login-server.ts
 create mode 100644 src/lib/__tests__/login-server.test.ts
 create mode 100644 src/lib/auth/__tests__/login-errors.test.ts
 create mode 100644 src/lib/auth/login-errors.ts
 create mode 100644 src/lib/login-server.ts

diff --git a/src/__tests__/app/login/index.web.test.tsx b/src/__tests__/app/login/index.web.test.tsx
index ccadcde0..27b4c900 100644
--- a/src/__tests__/app/login/index.web.test.tsx
+++ b/src/__tests__/app/login/index.web.test.tsx
@@ -3,6 +3,7 @@ import { render, screen, fireEvent, waitFor } from '@testing-library/react-nativ
 
 import LoginWeb from '../../../app/login/index.web';
 import { useAuth } from '@/lib/auth';
+import useAuthStore from '@/stores/auth/store';
 
 // Mock hooks and dependencies
 const mockLogin = jest.fn();
@@ -28,8 +29,12 @@ jest.mock('expo-router', () => ({
 
 jest.mock('react-i18next', () => ({
   useTranslation: () => ({
-    t: (key: string, fallback?: string) => {
+    t: (key: string, fallbackOrOptions?: string | Record<string, unknown>) => {
       const translations: Record<string, string> = {
+        'login.server.label': 'Server:',
+        'login.server.custom_host': 'Custom ({{host}})',
+        'login.errors.account_locked_out.title': 'Account temporarily locked',
+        'login.errors.account_locked_out.message': 'Wait {{minutes}} min and try again.',
         'login.page_subtitle': 'Enter the information below to Sign in to the Resgrid Dispatch application.',
         'login.username_placeholder': 'Enter your username',
         'login.password_placeholder': 'Enter your password',
@@ -46,7 +51,11 @@ jest.mock('react-i18next', () => ({
         'common.save': 'Save',
         'sso.sso_button': 'SSO Login',
       };
-      return translations[key] || fallback || key;
+      if (translations[key]) {
+        const options = typeof fallbackOrOptions === 'object' ? fallbackOrOptions : {};
+        return translations[key].replace(/\{\{(\w+)\}\}/g, (_, name: string) => String(options[name]));
+      }
+      return (typeof fallbackOrOptions === 'string' && fallbackOrOptions) || key;
     },
   }),
 }));
@@ -86,12 +95,14 @@ jest.mock('@/lib/env', () => ({
   },
 }));
 
-jest.mock('@/stores/app/server-url-store', () => ({
-  useServerUrlStore: () => ({
+jest.mock('@/stores/app/server-url-store', () => {
+  const state = {
+    url: 'https://api.example.com/api/v4',
     setUrl: jest.fn(),
     getUrl: jest.fn().mockResolvedValue('https://api.example.com/api/v4'),
-  }),
-}));
+  };
+  return { useServerUrlStore: (selector?: (s: typeof state) => unknown) => (selector ? selector(state) : state) };
+});
 
 jest.mock('nativewind', () => ({
   styled: jest.fn((Component: any) => Component),
@@ -230,6 +241,30 @@ describe('LoginWeb', () => {
     });
   });
 
+  it('says which server the form signs in to, and opens the server selector from it', () => {
+    render(<LoginWeb />);
+    expect(screen.getByText('Custom (api.example.com)')).toBeTruthy();
+    fireEvent.press(screen.getByTestId('login-server-badge'));
+    expect(screen.getByText('Cancel')).toBeTruthy();
+  });
+
+  it('explains a known sign-in failure instead of the generic message', async () => {
+    useAuthStore.setState({ loginFailure: { code: 'account_locked_out', lockoutMinutes: 12 } });
+    (useAuth as jest.Mock).mockReturnValue({
+      login: mockLogin,
+      status: 'error',
+      error: 'account_locked_out',
+      isAuthenticated: false,
+    });
+    render(<LoginWeb />);
+    await waitFor(() => {
+      expect(screen.getByText('Account temporarily locked')).toBeTruthy();
+    });
+    expect(screen.getByTestId('login-error-message').props.children).toBe('Wait 12 min and try again.');
+    expect(screen.queryByText('Login Failed')).toBeNull();
+    useAuthStore.setState({ loginFailure: null });
+  });
+
   it('closes error modal when OK is pressed', async () => {
     (useAuth as jest.Mock).mockReturnValue({
       login: mockLogin,
diff --git a/src/app/login/index.tsx b/src/app/login/index.tsx
index 01aba86b..4a8d3f8b 100644
--- a/src/app/login/index.tsx
+++ b/src/app/login/index.tsx
@@ -11,7 +11,9 @@ import { Button, ButtonText } from '@/components/ui/button';
 import { Modal, ModalBackdrop, ModalBody, ModalContent, ModalFooter, ModalHeader } from '@/components/ui/modal';
 import { Text } from '@/components/ui/text';
 import { useAnalytics } from '@/hooks/use-analytics';
+import { useLoginServer } from '@/hooks/use-login-server';
 import { useAuth } from '@/lib/auth';
+import { describeLoginFailure, isLoginErrorCode } from '@/lib/auth/login-errors';
 import { logger } from '@/lib/logging';
 import { isMfaErrorCode, mfaErrorKey } from '@/lib/mfa/messages';
 import { useSharedInstallation } from '@/lib/mfa/shared-installation';
@@ -31,7 +33,11 @@ export default function Login() {
   const router = useRouter();
   const { login, status, error, isAuthenticated } = useAuth();
   const mfaChallenge = useAuthStore((s) => s.mfaChallenge);
+  const loginFailure = useAuthStore((s) => s.loginFailure);
   const installation = useSharedInstallation();
+  const { name: serverName } = useLoginServer();
+  // A failed password sign-in says why and what to do next.
+  const loginError = isLoginErrorCode(error) ? describeLoginFailure(t, loginFailure?.code === error ? loginFailure : { code: error }, serverName) : null;
   // A sign-in that ended (expired, too many attempts, policy changed) or a shared shift that ran out says why in the
   // member's language.
   const displayError = error === 'shift_ended' ? t('shared_session.shift_ended') : isMfaErrorCode(error) ? t(mfaErrorKey(error)) : error;
@@ -117,7 +123,7 @@ export default function Login() {
       <LoginForm
         onSubmit={onSubmit}
         isLoading={status === 'loading'}
-        error={displayError ?? undefined}
+        error={loginError?.message ?? displayError ?? undefined}
         onServerUrlPress={() => setShowServerUrl(true)}
         onSsoPress={() => router.push('/login/sso' as any)}
         onSharedDevicePress={() => router.push('/login/shared-device' as unknown as Href)}
@@ -135,11 +141,17 @@ export default function Login() {
         <ModalBackdrop />
         <ModalContent className="m-4 w-full max-w-3xl rounded-2xl">
           <ModalHeader>
-            <Text className="text-xl font-semibold">{t('login.errorModal.title')}</Text>
+            <Text className="text-xl font-semibold">{loginError?.title ?? t('login.errorModal.title')}</Text>
           </ModalHeader>
           <ModalBody>
-            <Text>{t('login.errorModal.message')}</Text>
-            {displayError ? <Text className="mt-2 text-sm text-gray-500">{displayError}</Text> : null}
+            {loginError ? (
+              <Text testID="login-error-message">{loginError.message}</Text>
+            ) : (
+              <>
+                <Text>{t('login.errorModal.message')}</Text>
+                {displayError ? <Text className="mt-2 text-sm text-gray-500">{displayError}</Text> : null}
+              </>
+            )}
           </ModalBody>
           <ModalFooter>
             <Button
diff --git a/src/app/login/index.web.tsx b/src/app/login/index.web.tsx
index dbb0baf1..0f050a2e 100644
--- a/src/app/login/index.web.tsx
+++ b/src/app/login/index.web.tsx
@@ -11,9 +11,12 @@ import * as z from 'zod';
 
 import { LoginMfaSheet } from '@/components/auth/login-mfa-sheet';
 import { LoginOtpModal } from '@/components/auth/login-otp-modal';
+import { LoginServerBadge } from '@/components/auth/login-server-badge';
 import { Text } from '@/components/ui/text';
 import { useAnalytics } from '@/hooks/use-analytics';
+import { useLoginServer } from '@/hooks/use-login-server';
 import { useAuth } from '@/lib/auth';
+import { describeLoginFailure, isLoginErrorCode } from '@/lib/auth/login-errors';
 import { logger } from '@/lib/logging';
 import { isMfaErrorCode, mfaErrorKey } from '@/lib/mfa/messages';
 import { useSharedInstallation } from '@/lib/mfa/shared-installation';
@@ -137,7 +140,11 @@ export default function LoginWeb() {
   const router = useRouter();
   const { login, status, error, isAuthenticated } = useAuth();
   const mfaChallenge = useAuthStore((s) => s.mfaChallenge);
+  const loginFailure = useAuthStore((s) => s.loginFailure);
   const installation = useSharedInstallation();
+  const { name: serverName } = useLoginServer();
+  // A failed password sign-in says why and what to do next.
+  const loginError = isLoginErrorCode(error) ? describeLoginFailure(t, loginFailure?.code === error ? loginFailure : { code: error }, serverName) : null;
   // Held only to resubmit with the code when an older server answers mfa_required without a login transaction;
   // memory-only, dropped on success, dismissal or unmount. Never logged.
   const [pendingCredentials, setPendingCredentials] = useState<{ username: string; password: string } | null>(null);
@@ -428,6 +435,9 @@ export default function LoginWeb() {
             <Animated.View entering={FadeInDown.delay(200).duration(500)} style={styles.loginHeader}>
               <Text style={StyleSheet.flatten([styles.loginTitle, isDark ? styles.loginTitleDark : styles.loginTitleLight])}>{t('login.welcome_title', 'Welcome Back')}</Text>
               <Text style={StyleSheet.flatten([styles.loginSubtitle, isDark ? styles.loginSubtitleDark : styles.loginSubtitleLight])}>{t('login.page_subtitle')}</Text>
+              <View style={styles.serverBadgeContainer}>
+                <LoginServerBadge onPress={() => setShowServerUrlModal(true)} />
+              </View>
             </Animated.View>
 
             {/* Login Form */}
@@ -552,9 +562,17 @@ export default function LoginWeb() {
             <View style={styles.modalIconContainer}>
               <AlertCircle size={48} color="#ef4444" />
             </View>
-            <Text style={StyleSheet.flatten([styles.modalTitle, isDark ? styles.modalTitleDark : styles.modalTitleLight])}>{t('login.errorModal.title')}</Text>
-            <Text style={StyleSheet.flatten([styles.modalMessage, isDark ? styles.modalMessageDark : styles.modalMessageLight])}>{t('login.errorModal.message')}</Text>
-            {displayError ? <Text style={StyleSheet.flatten([styles.modalMessage, isDark ? styles.modalMessageDark : styles.modalMessageLight])}>{displayError}</Text> : null}
+            <Text style={StyleSheet.flatten([styles.modalTitle, isDark ? styles.modalTitleDark : styles.modalTitleLight])}>{loginError?.title ?? t('login.errorModal.title')}</Text>
+            {loginError ? (
+              <Text style={StyleSheet.flatten([styles.modalMessage, isDark ? styles.modalMessageDark : styles.modalMessageLight])} testID="login-error-message">
+                {loginError.message}
+              </Text>
+            ) : (
+              <>
+                <Text style={StyleSheet.flatten([styles.modalMessage, isDark ? styles.modalMessageDark : styles.modalMessageLight])}>{t('login.errorModal.message')}</Text>
+                {displayError ? <Text style={StyleSheet.flatten([styles.modalMessage, isDark ? styles.modalMessageDark : styles.modalMessageLight])}>{displayError}</Text> : null}
+              </>
+            )}
             <Pressable style={styles.modalButton} onPress={() => setShowErrorModal(false)}>
               <Text style={styles.modalButtonText}>{t('login.errorModal.confirmButton')}</Text>
             </Pressable>
@@ -977,6 +995,9 @@ const styles = StyleSheet.create({
   loginSubtitleLight: {
     color: '#6b7280',
   },
+  serverBadgeContainer: {
+    marginTop: 12,
+  },
   formContainer: {
     gap: 12,
   },
diff --git a/src/app/login/login-form.tsx b/src/app/login/login-form.tsx
index 4c2fd9d3..545b491d 100644
--- a/src/app/login/login-form.tsx
+++ b/src/app/login/login-form.tsx
@@ -9,6 +9,7 @@ import { Image, Keyboard } from 'react-native';
 import { KeyboardAvoidingView } from 'react-native-keyboard-controller';
 import * as z from 'zod';
 
+import { LoginServerBadge } from '@/components/auth/login-server-badge';
 import { View } from '@/components/ui';
 import { Button, ButtonSpinner, ButtonText } from '@/components/ui/button';
 import { FormControl, FormControlError, FormControlErrorIcon, FormControlErrorText, FormControlLabel, FormControlLabelText } from '@/components/ui/form-control';
@@ -82,7 +83,10 @@ export const LoginForm = ({ onSubmit = () => {}, isLoading = false, error = unde
           <Image style={{ width: '96%' }} source={colorScheme === 'dark' ? require('@assets/images/Resgrid_JustText_White.png') : require('@assets/images/Resgrid_JustText.png')} resizeMode="contain" />
           <Text className="pb-2 text-center text-4xl font-bold">{t('login.page_title')}</Text>
 
-          <Text className="mb-6 max-w-xl text-center text-gray-500 dark:text-gray-400">{t('login.page_subtitle')}</Text>
+          <Text className="mb-4 max-w-xl text-center text-gray-500 dark:text-gray-400">{t('login.page_subtitle')}</Text>
+        </View>
+        <View className="mb-6">
+          <LoginServerBadge onPress={onServerUrlPress} />
         </View>
         <FormControl isInvalid={!!errors?.username || !validated.usernameValid} className="w-full">
           <FormControlLabel>
diff --git a/src/components/auth/__tests__/login-server-badge.test.tsx b/src/components/auth/__tests__/login-server-badge.test.tsx
new file mode 100644
index 00000000..0e62d96e
--- /dev/null
+++ b/src/components/auth/__tests__/login-server-badge.test.tsx
@@ -0,0 +1,56 @@
+import { act, fireEvent, render, screen } from '@testing-library/react-native';
+import React from 'react';
+
+import { useServerUrlStore } from '@/stores/app/server-url-store';
+
+import { LoginServerBadge } from '../login-server-badge';
+
+jest.mock('react-i18next', () => ({
+  useTranslation: () => ({
+    t: (key: string, options?: Record<string, string>) =>
+      ({
+        'login.server.label': 'Server:',
+        'login.server.us_west': 'US West',
+        'login.server.eu_central': 'EU Central',
+      })[key] ?? (key === 'login.server.custom_host' ? `Custom (${options?.host})` : key),
+  }),
+}));
+
+jest.mock('nativewind', () => ({ useColorScheme: () => ({ colorScheme: 'light' }) }));
+jest.mock('@/api/config', () => ({ getSystemConfig: jest.fn() }));
+jest.mock('@/lib/mapbox-token', () => ({ clearMapboxToken: jest.fn() }));
+jest.mock('@/lib/storage/app', () => ({
+  getBaseApiUrl: jest.fn(() => 'https://api.resgrid.com/api/v4'),
+  setBaseApiUrl: jest.fn(),
+}));
+
+describe('LoginServerBadge', () => {
+  beforeEach(() => {
+    useServerUrlStore.setState({ url: '' });
+  });
+
+  it('names the stored server before anything changes it', () => {
+    render(<LoginServerBadge />);
+    expect(screen.getByText('US West')).toBeTruthy();
+  });
+
+  it('follows a server change', async () => {
+    render(<LoginServerBadge />);
+    await act(async () => {
+      await useServerUrlStore.getState().setUrl('https://api-eu-central.resgrid.com/api/v4');
+    });
+    expect(screen.getByText('EU Central')).toBeTruthy();
+
+    await act(async () => {
+      await useServerUrlStore.getState().setUrl('https://rg.example.org/api/v4');
+    });
+    expect(screen.getByText('Custom (rg.example.org)')).toBeTruthy();
+  });
+
+  it('opens the server selector when pressed', () => {
+    const onPress = jest.fn();
+    render(<LoginServerBadge onPress={onPress} />);
+    fireEvent.press(screen.getByTestId('login-server-badge'));
+    expect(onPress).toHaveBeenCalled();
+  });
+});
diff --git a/src/components/auth/login-server-badge.tsx b/src/components/auth/login-server-badge.tsx
new file mode 100644
index 00000000..f03db758
--- /dev/null
+++ b/src/components/auth/login-server-badge.tsx
@@ -0,0 +1,37 @@
+import { Server } from 'lucide-react-native';
+import { useColorScheme } from 'nativewind';
+import React from 'react';
+import { useTranslation } from 'react-i18next';
+import { Pressable } from 'react-native';
+
+import { Text } from '@/components/ui/text';
+import { useLoginServer } from '@/hooks/use-login-server';
+
+interface LoginServerBadgeProps {
+  /** Opens the server selector; without it the badge is a plain label. */
+  onPress?: () => void;
+}
+
+/** Names the server the login form signs in to (US West, EU Central or Custom), so a wrong server is spotted before signing in. */
+export const LoginServerBadge = ({ onPress }: LoginServerBadgeProps) => {
+  const { t } = useTranslation();
+  const { colorScheme } = useColorScheme();
+  const { name } = useLoginServer();
+
+  return (
+    <Pressable
+      onPress={onPress}
+      disabled={!onPress}
+      accessibilityRole={onPress ? 'button' : 'text'}
+      accessibilityLabel={t('login.server.signing_in_to', { server: name })}
+      accessibilityHint={onPress ? t('login.server.change_hint') : undefined}
+      testID="login-server-badge"
+      className="flex-row items-center self-center rounded-full border border-gray-300 px-3 py-1.5 dark:border-gray-700"
+    >
+      <Server size={14} color={colorScheme === 'dark' ? '#9ca3af' : '#6b7280'} />
+      <Text className="ml-1.5 text-sm text-gray-600 dark:text-gray-300">
+        {t('login.server.label')} <Text className="text-sm font-semibold text-gray-900 dark:text-white">{name}</Text>
+      </Text>
+    </Pressable>
+  );
+};
diff --git a/src/hooks/use-login-server.ts b/src/hooks/use-login-server.ts
new file mode 100644
index 00000000..528f0bf2
--- /dev/null
+++ b/src/hooks/use-login-server.ts
@@ -0,0 +1,22 @@
+import { useMemo } from 'react';
+import { useTranslation } from 'react-i18next';
+
+import { describeLoginServer, type LoginServer } from '@/lib/login-server';
+import { getBaseApiUrl } from '@/lib/storage/app';
+import { useServerUrlStore } from '@/stores/app/server-url-store';
+
+/**
+ * The server this device signs in to, and its display name ("US West", "EU Central" or "Custom (host)"). Follows a
+ * server change made from the login screen, since saving one updates the server URL store.
+ */
+export const useLoginServer = (): LoginServer & { name: string } => {
+  const { t } = useTranslation();
+  const storeUrl = useServerUrlStore((state) => state.url);
+  const apiUrl = storeUrl || getBaseApiUrl();
+
+  return useMemo(() => {
+    const server = describeLoginServer(apiUrl);
+    const name = server.kind === 'custom' ? t('login.server.custom_host', { host: server.host }) : t(`login.server.${server.kind}`);
+    return { ...server, name };
+  }, [apiUrl, t]);
+};
diff --git a/src/lib/__tests__/login-server.test.ts b/src/lib/__tests__/login-server.test.ts
new file mode 100644
index 00000000..abd96ffa
--- /dev/null
+++ b/src/lib/__tests__/login-server.test.ts
@@ -0,0 +1,17 @@
+import { describeLoginServer } from '../login-server';
+
+jest.mock('@/api/config', () => ({ getSystemConfig: jest.fn() }));
+
+describe('describeLoginServer', () => {
+  it('names the Resgrid hosted servers with or without the API suffix', () => {
+    expect(describeLoginServer('https://api.resgrid.com/api/v4')).toEqual({ kind: 'us_west', host: 'api.resgrid.com' });
+    expect(describeLoginServer('https://API.resgrid.com/')).toEqual({ kind: 'us_west', host: 'api.resgrid.com' });
+    expect(describeLoginServer('https://api-eu-central.resgrid.com/api/v4')).toEqual({ kind: 'eu_central', host: 'api-eu-central.resgrid.com' });
+  });
+
+  it('labels any other server custom, with its host', () => {
+    expect(describeLoginServer('https://qaapi.resgrid.dev/api/v4')).toEqual({ kind: 'custom', host: 'qaapi.resgrid.dev' });
+    expect(describeLoginServer('http://localhost:5000/api/v4')).toEqual({ kind: 'custom', host: 'localhost:5000' });
+    expect(describeLoginServer('https://resgrid.example.org/rg/api/v4')).toEqual({ kind: 'custom', host: 'resgrid.example.org' });
+  });
+});
diff --git a/src/lib/auth/__tests__/login-errors.test.ts b/src/lib/auth/__tests__/login-errors.test.ts
new file mode 100644
index 00000000..16f4573c
--- /dev/null
+++ b/src/lib/auth/__tests__/login-errors.test.ts
@@ -0,0 +1,132 @@
+import type { TFunction } from 'i18next';
+
+import ar from '@/translations/ar.json';
+import de from '@/translations/de.json';
+import el from '@/translations/el.json';
+import en from '@/translations/en.json';
+import es from '@/translations/es.json';
+import fr from '@/translations/fr.json';
+import itLang from '@/translations/it.json';
+import pl from '@/translations/pl.json';
+import sv from '@/translations/sv.json';
+import uk from '@/translations/uk.json';
+
+import { classifyLoginFailure, describeLoginFailure, isLoginErrorCode, type LoginErrorCode } from '../login-errors';
+
+const axiosError = (status?: number, data?: unknown) => ({
+  isAxiosError: true,
+  message: status ? `Request failed with status code ${status}` : 'Network Error',
+  response: status ? { status, data } : undefined,
+});
+
+const ALL_CODES: LoginErrorCode[] = [
+  'invalid_credentials',
+  'account_locked_out',
+  'account_disabled',
+  'account_not_activated',
+  'no_department',
+  'sso_required',
+  'maximum_sessions',
+  'department_access_denied',
+  'server_unreachable',
+  'server_not_resgrid',
+  'rate_limited',
+  'server_error',
+  'login_failed',
+];
+
+describe('classifyLoginFailure', () => {
+  it('reads the reason the server sends in login_error', () => {
+    for (const reason of ['invalid_credentials', 'account_disabled', 'account_not_activated', 'no_department', 'sso_required', 'maximum_sessions', 'department_access_denied']) {
+      expect(classifyLoginFailure(axiosError(400, { error: 'invalid_grant', login_error: reason }))).toEqual({ code: reason });
+    }
+  });
+
+  it('keeps the minutes left on a temporary lockout', () => {
+    expect(classifyLoginFailure(axiosError(400, { error: 'invalid_grant', login_error: 'account_locked_out', lockout_minutes_remaining: 12 }))).toEqual({ code: 'account_locked_out', lockoutMinutes: 12 });
+  });
+
+  it('leaves the minutes out of a lockout with no end', () => {
+    expect(classifyLoginFailure(axiosError(400, { error: 'invalid_grant', login_error: 'account_locked_out' }))).toEqual({ code: 'account_locked_out' });
+    expect(classifyLoginFailure(axiosError(400, { error: 'invalid_grant', login_error: 'account_locked_out', lockout_minutes_remaining: 'soon' }))).toEqual({ code: 'account_locked_out' });
+  });
+
+  it('ignores a login_error it does not know', () => {
+    expect(classifyLoginFailure(axiosError(400, { error: 'invalid_grant', login_error: 'something_new' }))).toEqual({ code: 'invalid_credentials' });
+  });
+
+  it('treats a bare invalid_grant from an older server as wrong credentials', () => {
+    expect(classifyLoginFailure(axiosError(400, { error: 'invalid_grant', error_description: 'The username or password is invalid.' }))).toEqual({ code: 'invalid_credentials' });
+  });
+
+  it("recognizes an older server's session refusals by their descriptions", () => {
+    expect(classifyLoginFailure(axiosError(400, { error: 'invalid_grant', error_description: "The department's maximum number of active sessions has been reached." }))).toEqual({ code: 'maximum_sessions' });
+    expect(classifyLoginFailure(axiosError(400, { error: 'invalid_grant', error_description: 'The user is no longer allowed to sign in to this department.' }))).toEqual({ code: 'department_access_denied' });
+  });
+
+  it('reports a request that never got a response as an unreachable server', () => {
+    expect(classifyLoginFailure(axiosError())).toEqual({ code: 'server_unreachable' });
+  });
+
+  it('reports throttling, server failures and non-Resgrid servers', () => {
+    expect(classifyLoginFailure(axiosError(429, ''))).toEqual({ code: 'rate_limited' });
+    expect(classifyLoginFailure(axiosError(500, {}))).toEqual({ code: 'server_error' });
+    expect(classifyLoginFailure(axiosError(503, '<html>'))).toEqual({ code: 'server_error' });
+    expect(classifyLoginFailure(axiosError(400, { error: 'temporarily_unavailable' }))).toEqual({ code: 'server_error' });
+    expect(classifyLoginFailure(axiosError(404, '<html>Not found</html>'))).toEqual({ code: 'server_not_resgrid' });
+    expect(classifyLoginFailure(axiosError(200, '<html>'))).toEqual({ code: 'server_not_resgrid' });
+  });
+
+  it('falls back to a general failure for anything else', () => {
+    expect(classifyLoginFailure(axiosError(400, { error: 'invalid_client' }))).toEqual({ code: 'login_failed' });
+    expect(classifyLoginFailure(new Error('boom'))).toEqual({ code: 'login_failed' });
+    expect(classifyLoginFailure(null)).toEqual({ code: 'login_failed' });
+  });
+});
+
+describe('isLoginErrorCode', () => {
+  it('accepts only login failure codes', () => {
+    for (const code of ALL_CODES) {
+      expect(isLoginErrorCode(code)).toBe(true);
+    }
+    expect(isLoginErrorCode('invalid_totp')).toBe(false);
+    expect(isLoginErrorCode('Request failed with status code 400')).toBe(false);
+    expect(isLoginErrorCode(null)).toBe(false);
+  });
+});
+
+describe('describeLoginFailure', () => {
+  const t = jest.fn((key: string, options?: Record<string, unknown>) => `${key}${options ? JSON.stringify(options) : ''}`) as unknown as TFunction;
+
+  it('passes the lockout minutes and server name to the guidance', () => {
+    const result = describeLoginFailure(t, { code: 'account_locked_out', lockoutMinutes: 7 }, 'US West');
+    expect(result.title).toBe('login.errors.account_locked_out.title');
+    expect(result.message).toBe('login.errors.account_locked_out.message{"minutes":7,"server":"US West"}');
+  });
+
+  it('sends a lockout with no end to the administrator instead of a wait', () => {
+    expect(describeLoginFailure(t, { code: 'account_locked_out' }, 'US West').title).toBe('login.errors.account_locked.title');
+  });
+});
+
+describe('login error translations', () => {
+  const languages = { ar, de, el, en, es, fr, it: itLang, pl, sv, uk } as Record<string, any>;
+
+  it.each(Object.keys(languages))('%s has a title and message for every failure', (language) => {
+    const errors = languages[language].login.errors;
+    for (const key of [...ALL_CODES, 'account_locked']) {
+      expect(errors[key]?.title).toEqual(expect.any(String));
+      expect(errors[key]?.message).toEqual(expect.any(String));
+    }
+    expect(errors.account_locked_out.message).toContain('{{minutes}}');
+    expect(errors.server_unreachable.message).toContain('{{server}}');
+  });
+
+  it.each(Object.keys(languages))('%s names every login server', (language) => {
+    const server = languages[language].login.server;
+    for (const key of ['label', 'us_west', 'eu_central', 'custom_host', 'signing_in_to', 'change_hint']) {
+      expect(server[key]).toEqual(expect.any(String));
+    }
+    expect(server.custom_host).toContain('{{host}}');
+  });
+});
diff --git a/src/lib/auth/api.tsx b/src/lib/auth/api.tsx
index ab8585a4..553a91f9 100644
--- a/src/lib/auth/api.tsx
+++ b/src/lib/auth/api.tsx
@@ -9,6 +9,7 @@ import { type MfaChallenge, parseMethods } from '@/lib/mfa/types';
 
 import { getItem, removeItem, setItem } from '../storage';
 import { getBaseApiUrl } from '../storage/app';
+import { classifyLoginFailure } from './login-errors';
 import type { AuthResponse, LoginCredentials, LoginResponse } from './types';
 
 // Strip any query string from a URL so tokens/credentials in params are never logged.
@@ -29,6 +30,8 @@ const sanitizeAuthError = (error: unknown): Record<string, unknown> => {
       'The user is no longer allowed to sign in.': 'user_sign_in_not_allowed',
     };
     const rejectionReason = typeof data?.error_description === 'string' && Object.hasOwn(knownDescriptions, data.error_description) ? knownDescriptions[data.error_description] : undefined;
+    // The server's login_error is a fixed set of reason codes, never free text.
+    const loginError = typeof data?.login_error === 'string' && /^[a-z_]{1,40}$/.test(data.login_error) ? data.login_error : undefined;
     return {
       message: error.message,
       status: error.response?.status,
@@ -36,6 +39,7 @@ const sanitizeAuthError = (error: unknown): Record<string, unknown> => {
       ...(oauthError ? { oauthError } : {}),
       ...(oauthErrorId ? { oauthErrorId } : {}),
       ...(rejectionReason ? { rejectionReason } : {}),
+      ...(loginError ? { loginError } : {}),
     };
   }
   return { message: error instanceof Error ? error.message : String(error) };
@@ -209,8 +213,9 @@ export const loginRequest = async (credentials: LoginCredentials): Promise<Login
 
       return {
         successful: false,
-        message: 'Login failed',
+        message: 'login_failed',
         authResponse: null,
+        failure: { code: 'login_failed' },
       };
     }
   } catch (error) {
@@ -245,16 +250,18 @@ export const loginRequest = async (credentials: LoginCredentials): Promise<Login
       };
     }
 
+    const failure = classifyLoginFailure(error);
     logger.error({
       message: 'Login API call failed with exception',
-      context: { ...sanitizeAuthError(error), username: credentials.username },
+      context: { ...sanitizeAuthError(error), loginFailure: failure.code, username: credentials.username },
     });
 
-    // Return a failed response instead of throwing
+    // Return a failed response instead of throwing; the code carries the reason the login screen explains.
     return {
       successful: false,
-      message: error instanceof Error ? error.message : 'Login failed',
+      message: failure.code,
       authResponse: null,
+      failure,
     };
   }
 };
diff --git a/src/lib/auth/login-errors.ts b/src/lib/auth/login-errors.ts
new file mode 100644
index 00000000..90b05f47
--- /dev/null
+++ b/src/lib/auth/login-errors.ts
@@ -0,0 +1,109 @@
+import type { TFunction } from 'i18next';
+
+/**
+ * Why a password sign-in failed, as the login screen explains it: the reasons the server reports in `login_error`
+ * beside `invalid_grant`, plus what the app can tell on its own (the server could not be reached, is not a Resgrid
+ * server, is throttling, or failed).
+ */
+export type LoginErrorCode =
+  | 'invalid_credentials'
+  | 'account_locked_out'
+  | 'account_disabled'
+  | 'account_not_activated'
+  | 'no_department'
+  | 'sso_required'
+  | 'maximum_sessions'
+  | 'department_access_denied'
+  | 'server_unreachable'
+  | 'server_not_resgrid'
+  | 'rate_limited'
+  | 'server_error'
+  | 'login_failed';
+
+export interface LoginFailure {
+  code: LoginErrorCode;
+  /** Minutes left on a temporary lockout, when the server says; absent for a lockout only an administrator can lift. */
+  lockoutMinutes?: number;
+}
+
+// The reasons a server that knows login_error can send.
+const SERVER_REASONS = new Set<string>(['invalid_credentials', 'account_locked_out', 'account_disabled', 'account_not_activated', 'no_department', 'sso_required', 'maximum_sessions', 'department_access_denied']);
+
+const LOGIN_ERROR_CODES = new Set<string>([...SERVER_REASONS, 'server_unreachable', 'server_not_resgrid', 'rate_limited', 'server_error', 'login_failed']);
+
+/** Whether an auth-store error is one of these codes (shown with its guidance) rather than a code or text from elsewhere. */
+export const isLoginErrorCode = (value: string | null | undefined): value is LoginErrorCode => !!value && LOGIN_ERROR_CODES.has(value);
+
+interface TokenErrorBody {
+  error?: unknown;
+  error_description?: unknown;
+  login_error?: unknown;
+  lockout_minutes_remaining?: unknown;
+}
+
+/**
+ * Classifies a failed token request. A server older than login_error answers every refused password sign-in with the
+ * same invalid_grant; only its session-limit refusals have their own descriptions.
+ */
+export const classifyLoginFailure = (error: unknown): LoginFailure => {
+  const candidate = error as { isAxiosError?: boolean; response?: { status?: number; data?: unknown } } | null;
+  if (!candidate?.isAxiosError) {
+    return { code: 'login_failed' };
+  }
+
+  // No response at all: offline, DNS, TLS, CORS, a timeout, or a server address that is not listening.
+  const response = candidate.response;
+  if (!response) {
+    return { code: 'server_unreachable' };
+  }
+
+  const status = response.status ?? 0;
+  const body: TokenErrorBody | null = typeof response.data === 'object' && response.data !== null ? (response.data as TokenErrorBody) : null;
+
+  if (body && typeof body.login_error === 'string' && SERVER_REASONS.has(body.login_error)) {
+    const minutes = body.lockout_minutes_remaining;
+    return {
+      code: body.login_error as LoginErrorCode,
+      ...(typeof minutes === 'number' && Number.isFinite(minutes) && minutes > 0 ? { lockoutMinutes: Math.ceil(minutes) } : {}),
+    };
+  }
+
+  if (status === 429) {
+    return { code: 'rate_limited' };
+  }
+
+  if (body?.error === 'invalid_grant') {
+    const description = typeof body.error_description === 'string' ? body.error_description : '';
+    if (description.includes('maximum number of active sessions')) {
+      return { code: 'maximum_sessions' };
+    }
+    if (description.includes('no longer allowed to sign in to this department')) {
+      return { code: 'department_access_denied' };
+    }
+    return { code: 'invalid_credentials' };
+  }
+
+  if (body?.error === 'temporarily_unavailable' || status >= 500) {
+    return { code: 'server_error' };
+  }
+
+  // A web page or a 404 where the token endpoint should be: the address points at something other than a Resgrid API.
+  if (!body || status === 404 || status === 405) {
+    return { code: 'server_not_resgrid' };
+  }
+
+  return { code: 'login_failed' };
+};
+
+/**
+ * The title and guidance for a failed sign-in. `server` is the name of the server the member is signing in to (as the
+ * login form shows it), so a connection problem says which server could not be reached.
+ */
+export const describeLoginFailure = (t: TFunction, failure: LoginFailure, server: string): { title: string; message: string } => {
+  // A lockout with no end is an administrator's to lift; waiting will not help.
+  const key = failure.code === 'account_locked_out' && failure.lockoutMinutes == null ? 'account_locked' : failure.code;
+  return {
+    title: t(`login.errors.${key}.title`),
+    message: t(`login.errors.${key}.message`, { minutes: failure.lockoutMinutes, server }),
+  };
+};
diff --git a/src/lib/auth/types.tsx b/src/lib/auth/types.tsx
index cec9e7b9..5935054d 100644
--- a/src/lib/auth/types.tsx
+++ b/src/lib/auth/types.tsx
@@ -1,3 +1,4 @@
+import type { LoginFailure } from '@/lib/auth/login-errors';
 import type { ApprovalWaitResult } from '@/lib/mfa/approval-wait';
 import type { ApprovalRequestData, MfaChallenge, TotpSetupData } from '@/lib/mfa/types';
 import type { BrokeredSsoResult, LoginMfaResult, LoginMfaStep, RecoveryStart, SsoDepartment } from '@/stores/auth/login-mfa';
@@ -38,6 +39,8 @@ export interface LoginResponse {
   mfaTransaction?: { secret: string; challenge: MfaChallenge };
   /** The department requires MFA the account does not have, and this server cannot set it up in the app. */
   enrollmentRequired?: boolean;
+  /** Why an unsuccessful sign-in failed, for the login screen's guidance. */
+  failure?: LoginFailure;
 }
 export interface ProfileModel {
   sub: string;
@@ -84,6 +87,8 @@ export interface AuthState {
   refreshTokenExpiresOn: string | null;
   status: AuthStatus;
   error: string | null;
+  /** The last failed password sign-in, with what the guidance needs beyond its code (a lockout's minutes). Never persisted. */
+  loginFailure: LoginFailure | null;
   profile: ProfileModel | null;
   userId: string | null;
   /**
diff --git a/src/lib/login-server.ts b/src/lib/login-server.ts
new file mode 100644
index 00000000..301e503a
--- /dev/null
+++ b/src/lib/login-server.ts
@@ -0,0 +1,24 @@
+import { isSameServerUrl, RESGRID_HOSTED_LOCATIONS } from '@/lib/server-url';
+
+/** Which server a sign-in goes to, as the login form labels it. */
+export type LoginServerKind = 'us_west' | 'eu_central' | 'custom';
+
+export interface LoginServer {
+  kind: LoginServerKind;
+  /** The server's host name, shown beside "Custom" so a self-hosted or test server is recognizable. */
+  host: string;
+}
+
+const HOSTED_KINDS: Record<string, LoginServerKind> = {
+  'US-West': 'us_west',
+  'EU-Central': 'eu_central',
+};
+
+// RN's URL polyfill does not implement hostname, so the host is read from the address directly.
+const hostOf = (url: string) => /^[a-z][a-z\d+.-]*:\/\/([^/?#]+)/i.exec(url.trim())?.[1]?.toLowerCase() ?? url.trim();
+
+/** Names the server behind an API URL (with or without the /api/vX suffix): a Resgrid hosted site, or a custom one. */
+export const describeLoginServer = (apiUrl: string): LoginServer => {
+  const hosted = RESGRID_HOSTED_LOCATIONS.find((location) => isSameServerUrl(location.ApiUrl, apiUrl));
+  return { kind: (hosted && HOSTED_KINDS[hosted.Name]) || 'custom', host: hostOf(apiUrl) };
+};
diff --git a/src/stores/auth/store.tsx b/src/stores/auth/store.tsx
index caac5234..3f567dbc 100644
--- a/src/stores/auth/store.tsx
+++ b/src/stores/auth/store.tsx
@@ -116,6 +116,7 @@ const useAuthStore = create<AuthState>()(
       refreshTokenExpiresOn: null,
       status: 'idle',
       error: null,
+      loginFailure: null,
       profile: null,
       userId: null,
       isFirstTime: true,
@@ -124,7 +125,7 @@ const useAuthStore = create<AuthState>()(
       login: async (credentials: LoginCredentials) => {
         try {
           pendingPasswordVerification = null;
-          set({ status: 'loading', error: null });
+          set({ status: 'loading', error: null, loginFailure: null });
           logger.info({
             message: 'Login: Calling loginRequest API',
             context: { username: credentials.username, platform: Platform.OS },
@@ -221,9 +222,11 @@ const useAuthStore = create<AuthState>()(
               message: 'Login: API returned unsuccessful response',
               context: { message: response.message },
             });
+            const failure = response.failure ?? { code: 'login_failed' };
             set({
               status: 'error',
-              error: response.message || 'Login failed',
+              error: failure.code,
+              loginFailure: failure,
             });
           }
         } catch (error) {
@@ -231,9 +234,11 @@ const useAuthStore = create<AuthState>()(
             message: 'Login: Exception caught',
             context: { error: error instanceof Error ? error.message : String(error) },
           });
+          // An unreadable token response is the server's fault, not the member's; the detail stays in the log.
           set({
             status: 'error',
-            error: error instanceof Error ? error.message : 'Login failed',
+            error: 'login_failed',
+            loginFailure: { code: 'login_failed' },
           });
         }
       },
diff --git a/src/translations/ar.json b/src/translations/ar.json
index a293d68c..30363c05 100644
--- a/src/translations/ar.json
+++ b/src/translations/ar.json
@@ -1154,7 +1154,73 @@
     "title": "تسجيل الدخول",
     "username": "اسم المستخدم",
     "username_placeholder": "أدخل اسم المستخدم الخاص بك",
-    "welcome_title": "مرحباً بعودتك"
+    "welcome_title": "مرحباً بعودتك",
+    "server": {
+      "label": "الخادم:",
+      "us_west": "غرب الولايات المتحدة",
+      "eu_central": "وسط الاتحاد الأوروبي",
+      "custom_host": "مخصص ({{host}})",
+      "signing_in_to": "تسجيل الدخول إلى {{server}}",
+      "change_hint": "يفتح اختيار الخادم"
+    },
+    "errors": {
+      "invalid_credentials": {
+        "title": "اسم المستخدم أو كلمة المرور غير صحيحة",
+        "message": "اسم المستخدم أو كلمة المرور التي أدخلتها غير صحيحة. كلمات المرور حساسة لحالة الأحرف، لذا تأكد من إيقاف Caps Lock. إذا نسيت كلمة المرور، فأعد تعيينها من موقع Resgrid. ستؤدي المحاولات الفاشلة الكثيرة إلى قفل حسابك مؤقتًا."
+      },
+      "account_locked_out": {
+        "title": "الحساب مقفل مؤقتًا",
+        "message": "تم قفل حسابك بعد محاولات تسجيل دخول فاشلة كثيرة. انتظر {{minutes}} دقيقة ثم حاول مرة أخرى. إذا نسيت كلمة المرور، فأعد تعيينها من موقع Resgrid قبل المحاولة مرة أخرى."
+      },
+      "account_locked": {
+        "title": "الحساب مقفل",
+        "message": "حسابك مقفل. تواصل مع مسؤول إدارتك لإلغاء قفله."
+      },
+      "account_disabled": {
+        "title": "الحساب معطل",
+        "message": "قامت إدارتك بتعطيل حسابك. تواصل مع مسؤول إدارتك لإعادة تفعيله."
+      },
+      "account_not_activated": {
+        "title": "الحساب غير مفعّل",
+        "message": "لم يتم تفعيل حسابك بعد. استخدم رسالة الدعوة من إدارتك لإكمال إعداده، أو اطلب من مسؤول إدارتك إرسال دعوة جديدة."
+      },
+      "no_department": {
+        "title": "لا توجد إدارة نشطة",
+        "message": "حسابك ليس عضوًا في أي إدارة نشطة. اطلب من مسؤول إدارتك إضافتك، ثم حاول مرة أخرى."
+      },
+      "sso_required": {
+        "title": "تسجيل الدخول الموحد مطلوب",
+        "message": "تتطلب إدارتك تسجيل الدخول الموحد. استخدم زر SSO لتسجيل الدخول بحساب مؤسستك بدلًا من كلمة المرور."
+      },
+      "maximum_sessions": {
+        "title": "عدد كبير من الجلسات النشطة",
+        "message": "وصلت إدارتك إلى الحد الأقصى للجلسات المسجلة. سجّل الخروج من جهاز آخر، أو اطلب من مسؤول إدارتك إنهاء جلسة غير مستخدمة، ثم حاول مرة أخرى."
+      },
+      "department_access_denied": {
+        "title": "تسجيل الدخول غير مسموح",
+        "message": "لم يعد مسموحًا لحسابك بتسجيل الدخول إلى هذه الإدارة. تواصل مع مسؤول إدارتك."
+      },
+      "server_unreachable": {
+        "title": "تعذر الوصول إلى الخادم",
+        "message": "تعذر الاتصال بـ {{server}}. تحقق من اتصالك بالإنترنت ومن اختيار الخادم الصحيح، ثم حاول مرة أخرى."
+      },
+      "server_not_resgrid": {
+        "title": "لم يتم التعرف على الخادم",
+        "message": "لم يستجب {{server}} كخادم Resgrid. تحقق من عنوان الخادم وحاول مرة أخرى."
+      },
+      "rate_limited": {
+        "title": "محاولات كثيرة جدًا",
+        "message": "تمت محاولات تسجيل دخول كثيرة في وقت قصير. انتظر دقيقة ثم حاول مرة أخرى."
+      },
+      "server_error": {
+        "title": "مشكلة في الخادم",
+        "message": "تعذر على {{server}} إكمال تسجيل الدخول الآن. انتظر بضع دقائق ثم حاول مرة أخرى. إذا استمرت المشكلة، فتواصل مع دعم Resgrid أو مسؤول الخادم."
+      },
+      "login_failed": {
+        "title": "فشل تسجيل الدخول",
+        "message": "حدث خطأ أثناء تسجيل الدخول. حاول مرة أخرى. إذا استمرت المشكلة، فتواصل مع مسؤول إدارتك أو دعم Resgrid."
+      }
+    }
   },
   "maintenance": {
     "downtime_message": "نحن نعمل بجد لإكمال الصيانة في أسرع وقت ممكن. يرجى التحقق مرة أخرى قريبا.",
diff --git a/src/translations/de.json b/src/translations/de.json
index 9a3d6a55..94ec0b29 100644
--- a/src/translations/de.json
+++ b/src/translations/de.json
@@ -1154,7 +1154,73 @@
     "title": "Anmeldung",
     "username": "Benutzername",
     "username_placeholder": "Benutzernamen eingeben",
-    "welcome_title": "Willkommen zurück"
+    "welcome_title": "Willkommen zurück",
+    "server": {
+      "label": "Server:",
+      "us_west": "USA West",
+      "eu_central": "EU Zentral",
+      "custom_host": "Benutzerdefiniert ({{host}})",
+      "signing_in_to": "Anmeldung bei {{server}}",
+      "change_hint": "Öffnet die Serverauswahl"
+    },
+    "errors": {
+      "invalid_credentials": {
+        "title": "Falscher Benutzername oder falsches Passwort",
+        "message": "Der eingegebene Benutzername oder das Passwort ist falsch. Bei Passwörtern wird zwischen Groß- und Kleinschreibung unterschieden, prüfen Sie daher, ob die Feststelltaste deaktiviert ist. Wenn Sie Ihr Passwort vergessen haben, setzen Sie es auf der Resgrid-Website zurück. Nach zu vielen Fehlversuchen wird Ihr Konto vorübergehend gesperrt."
+      },
+      "account_locked_out": {
+        "title": "Konto vorübergehend gesperrt",
+        "message": "Ihr Konto wurde nach zu vielen fehlgeschlagenen Anmeldeversuchen gesperrt. Warten Sie {{minutes}} Min. und versuchen Sie es erneut. Wenn Sie Ihr Passwort vergessen haben, setzen Sie es vorher auf der Resgrid-Website zurück."
+      },
+      "account_locked": {
+        "title": "Konto gesperrt",
+        "message": "Ihr Konto ist gesperrt. Wenden Sie sich an den Administrator Ihrer Organisation, um es entsperren zu lassen."
+      },
+      "account_disabled": {
+        "title": "Konto deaktiviert",
+        "message": "Ihr Konto wurde von Ihrer Organisation deaktiviert. Wenden Sie sich an den Administrator Ihrer Organisation, um es wieder aktivieren zu lassen."
+      },
+      "account_not_activated": {
+        "title": "Konto nicht aktiviert",
+        "message": "Ihr Konto wurde noch nicht aktiviert. Verwenden Sie die Einladungs-E-Mail Ihrer Organisation, um die Einrichtung abzuschließen, oder bitten Sie den Administrator Ihrer Organisation um eine neue Einladung."
+      },
+      "no_department": {
+        "title": "Keine aktive Organisation",
+        "message": "Ihr Konto ist kein Mitglied einer aktiven Organisation. Bitten Sie den Administrator Ihrer Organisation, Sie hinzuzufügen, und versuchen Sie es dann erneut."
+      },
+      "sso_required": {
+        "title": "Single Sign-On erforderlich",
+        "message": "Ihre Organisation verlangt Single Sign-On. Verwenden Sie die SSO-Schaltfläche, um sich mit dem Konto Ihrer Organisation statt mit einem Passwort anzumelden."
+      },
+      "maximum_sessions": {
+        "title": "Zu viele aktive Sitzungen",
+        "message": "Ihre Organisation hat die maximale Anzahl angemeldeter Sitzungen erreicht. Melden Sie sich auf einem anderen Gerät ab oder bitten Sie den Administrator Ihrer Organisation, eine ungenutzte Sitzung zu beenden, und versuchen Sie es dann erneut."
+      },
+      "department_access_denied": {
+        "title": "Anmeldung nicht erlaubt",
+        "message": "Ihr Konto darf sich nicht mehr bei dieser Organisation anmelden. Wenden Sie sich an den Administrator Ihrer Organisation."
+      },
+      "server_unreachable": {
+        "title": "Server nicht erreichbar",
+        "message": "Keine Verbindung zu {{server}} möglich. Prüfen Sie Ihre Internetverbindung und ob der richtige Server ausgewählt ist, und versuchen Sie es dann erneut."
+      },
+      "server_not_resgrid": {
+        "title": "Server nicht erkannt",
+        "message": "{{server}} hat nicht wie ein Resgrid-Server geantwortet. Prüfen Sie die Serveradresse und versuchen Sie es erneut."
+      },
+      "rate_limited": {
+        "title": "Zu viele Versuche",
+        "message": "In kurzer Zeit wurden zu viele Anmeldeversuche unternommen. Warten Sie eine Minute und versuchen Sie es erneut."
+      },
+      "server_error": {
+        "title": "Serverproblem",
+        "message": "{{server}} konnte die Anmeldung gerade nicht abschließen. Warten Sie einige Minuten und versuchen Sie es erneut. Wenn das Problem weiterhin besteht, wenden Sie sich an den Resgrid-Support oder Ihren Serveradministrator."
+      },
+      "login_failed": {
+        "title": "Anmeldung fehlgeschlagen",
+        "message": "Bei der Anmeldung ist ein Fehler aufgetreten. Versuchen Sie es erneut. Wenn das Problem weiterhin besteht, wenden Sie sich an den Administrator Ihrer Organisation oder den Resgrid-Support."
+      }
+    }
   },
   "maintenance": {
     "downtime_message": "Wir arbeiten daran, die Wartung so schnell wie möglich abzuschließen. Bitte schauen Sie bald wieder vorbei.",
diff --git a/src/translations/el.json b/src/translations/el.json
index 74f72751..4572618e 100644
--- a/src/translations/el.json
+++ b/src/translations/el.json
@@ -1154,7 +1154,73 @@
     "title": "Σύνδεση",
     "username": "Όνομα Χρήστη",
     "username_placeholder": "Εισαγάγετε το όνομα χρήστη σας",
-    "welcome_title": "Καλώς Ήρθατε Ξανά"
+    "welcome_title": "Καλώς Ήρθατε Ξανά",
+    "server": {
+      "label": "Διακομιστής:",
+      "us_west": "ΗΠΑ Δύση",
+      "eu_central": "ΕΕ Κεντρική",
+      "custom_host": "Προσαρμοσμένος ({{host}})",
+      "signing_in_to": "Σύνδεση στο {{server}}",
+      "change_hint": "Ανοίγει την επιλογή διακομιστή"
+    },
+    "errors": {
+      "invalid_credentials": {
+        "title": "Λανθασμένο όνομα χρήστη ή κωδικός πρόσβασης",
+        "message": "Το όνομα χρήστη ή ο κωδικός πρόσβασης που εισαγάγατε είναι λανθασμένα. Οι κωδικοί πρόσβασης κάνουν διάκριση πεζών-κεφαλαίων, οπότε βεβαιωθείτε ότι το Caps Lock είναι απενεργοποιημένο. Αν ξεχάσατε τον κωδικό σας, επαναφέρετέ τον από τον ιστότοπο του Resgrid. Πολλές αποτυχημένες προσπάθειες θα κλειδώσουν προσωρινά τον λογαριασμό σας."
+      },
+      "account_locked_out": {
+        "title": "Ο λογαριασμός κλειδώθηκε προσωρινά",
+        "message": "Ο λογαριασμός σας κλειδώθηκε μετά από πολλές αποτυχημένες προσπάθειες σύνδεσης. Περιμένετε {{minutes}} λεπτά και δοκιμάστε ξανά. Αν ξεχάσατε τον κωδικό σας, επαναφέρετέ τον από τον ιστότοπο του Resgrid πριν δοκιμάσετε ξανά."
+      },
+      "account_locked": {
+        "title": "Ο λογαριασμός είναι κλειδωμένος",
+        "message": "Ο λογαριασμός σας είναι κλειδωμένος. Επικοινωνήστε με τον διαχειριστή της υπηρεσίας σας για να τον ξεκλειδώσει."
+      },
+      "account_disabled": {
+        "title": "Ο λογαριασμός είναι απενεργοποιημένος",
+        "message": "Ο λογαριασμός σας απενεργοποιήθηκε από την υπηρεσία σας. Επικοινωνήστε με τον διαχειριστή της υπηρεσίας σας για να τον ενεργοποιήσει ξανά."
+      },
+      "account_not_activated": {
+        "title": "Ο λογαριασμός δεν έχει ενεργοποιηθεί",
+        "message": "Ο λογαριασμός σας δεν έχει ενεργοποιηθεί ακόμη. Χρησιμοποιήστε το email πρόσκλησης της υπηρεσίας σας για να ολοκληρώσετε τη ρύθμισή του ή ζητήστε από τον διαχειριστή της υπηρεσίας σας να στείλει νέα πρόσκληση."
+      },
+      "no_department": {
+        "title": "Καμία ενεργή υπηρεσία",
+        "message": "Ο λογαριασμός σας δεν είναι μέλος καμίας ενεργής υπηρεσίας. Ζητήστε από τον διαχειριστή της υπηρεσίας σας να σας προσθέσει και δοκιμάστε ξανά."
+      },
+      "sso_required": {
+        "title": "Απαιτείται ενιαία σύνδεση",
+        "message": "Η υπηρεσία σας απαιτεί ενιαία σύνδεση (SSO). Χρησιμοποιήστε το κουμπί SSO για να συνδεθείτε με τον λογαριασμό του οργανισμού σας αντί για κωδικό πρόσβασης."
+      },
+      "maximum_sessions": {
+        "title": "Πάρα πολλές ενεργές συνεδρίες",
+        "message": "Η υπηρεσία σας έφτασε το όριο συνδεδεμένων συνεδριών. Αποσυνδεθείτε από άλλη συσκευή ή ζητήστε από τον διαχειριστή της υπηρεσίας σας να τερματίσει μια αχρησιμοποίητη συνεδρία και δοκιμάστε ξανά."
+      },
+      "department_access_denied": {
+        "title": "Η σύνδεση δεν επιτρέπεται",
+        "message": "Ο λογαριασμός σας δεν επιτρέπεται πλέον να συνδέεται σε αυτή την υπηρεσία. Επικοινωνήστε με τον διαχειριστή της υπηρεσίας σας."
+      },
+      "server_unreachable": {
+        "title": "Ο διακομιστής δεν είναι προσβάσιμος",
+        "message": "Δεν ήταν δυνατή η σύνδεση στο {{server}}. Ελέγξτε τη σύνδεσή σας στο διαδίκτυο και ότι έχει επιλεγεί ο σωστός διακομιστής και δοκιμάστε ξανά."
+      },
+      "server_not_resgrid": {
+        "title": "Ο διακομιστής δεν αναγνωρίστηκε",
+        "message": "Το {{server}} δεν απάντησε ως διακομιστής Resgrid. Ελέγξτε τη διεύθυνση του διακομιστή και δοκιμάστε ξανά."
+      },
+      "rate_limited": {
+        "title": "Πάρα πολλές προσπάθειες",
+        "message": "Έγιναν πάρα πολλές προσπάθειες σύνδεσης σε σύντομο χρόνο. Περιμένετε ένα λεπτό και δοκιμάστε ξανά."
+      },
+      "server_error": {
+        "title": "Πρόβλημα διακομιστή",
+        "message": "Το {{server}} δεν μπόρεσε να ολοκληρώσει τη σύνδεση αυτή τη στιγμή. Περιμένετε λίγα λεπτά και δοκιμάστε ξανά. Αν συνεχίσει, επικοινωνήστε με την υποστήριξη του Resgrid ή τον διαχειριστή του διακομιστή σας."
+      },
+      "login_failed": {
+        "title": "Η σύνδεση απέτυχε",
+        "message": "Κάτι πήγε στραβά κατά τη σύνδεση. Δοκιμάστε ξανά. Αν συνεχίσει, επικοινωνήστε με τον διαχειριστή της υπηρεσίας σας ή την υποστήριξη του Resgrid."
+      }
+    }
   },
   "maintenance": {
     "downtime_message": "Εργαζόμαστε εντατικά για να ολοκληρώσουμε τη συντήρηση όσο το δυνατόν γρηγορότερα. Ελέγξτε ξανά σύντομα.",
diff --git a/src/translations/en.json b/src/translations/en.json
index dc351fe4..b70bd739 100644
--- a/src/translations/en.json
+++ b/src/translations/en.json
@@ -1154,7 +1154,73 @@
     "title": "Login",
     "username": "Username",
     "username_placeholder": "Enter your username",
-    "welcome_title": "Welcome Back"
+    "welcome_title": "Welcome Back",
+    "server": {
+      "label": "Server:",
+      "us_west": "US West",
+      "eu_central": "EU Central",
+      "custom_host": "Custom ({{host}})",
+      "signing_in_to": "Signing in to {{server}}",
+      "change_hint": "Opens the server selection"
+    },
+    "errors": {
+      "invalid_credentials": {
+        "title": "Incorrect username or password",
+        "message": "The username or password you entered is incorrect. Passwords are case-sensitive, so check that Caps Lock is off. If you forgot your password, reset it from the Resgrid website. Too many failed attempts will temporarily lock your account."
+      },
+      "account_locked_out": {
+        "title": "Account temporarily locked",
+        "message": "Your account was locked after too many failed sign-in attempts. Wait {{minutes}} min and try again. If you forgot your password, reset it from the Resgrid website before trying again."
+      },
+      "account_locked": {
+        "title": "Account locked",
+        "message": "Your account is locked. Contact your department administrator to have it unlocked."
+      },
+      "account_disabled": {
+        "title": "Account disabled",
+        "message": "Your account has been disabled by your department. Contact your department administrator to have it re-enabled."
+      },
+      "account_not_activated": {
+        "title": "Account not activated",
+        "message": "Your account hasn't been activated yet. Use the invitation email from your department to finish setting it up, or ask your department administrator to send a new invitation."
+      },
+      "no_department": {
+        "title": "No active department",
+        "message": "Your account isn't a member of an active department. Ask your department administrator to add you, then try again."
+      },
+      "sso_required": {
+        "title": "Single sign-on required",
+        "message": "Your department requires single sign-on. Use the SSO button to sign in with your organization's account instead of a password."
+      },
+      "maximum_sessions": {
+        "title": "Too many active sessions",
+        "message": "Your department has reached its limit of signed-in sessions. Sign out on another device, or ask your department administrator to end an unused session, then try again."
+      },
+      "department_access_denied": {
+        "title": "Sign-in not allowed",
+        "message": "Your account is no longer allowed to sign in to this department. Contact your department administrator."
+      },
+      "server_unreachable": {
+        "title": "Can't reach the server",
+        "message": "Couldn't connect to {{server}}. Check your internet connection and that the right server is selected, then try again."
+      },
+      "server_not_resgrid": {
+        "title": "Server not recognized",
+        "message": "{{server}} didn't respond like a Resgrid server. Check the server address and try again."
+      },
+      "rate_limited": {
+        "title": "Too many attempts",
+        "message": "Too many sign-in attempts were made in a short time. Wait a minute and try again."
+      },
+      "server_error": {
+        "title": "Server problem",
+        "message": "{{server}} couldn't complete the sign-in right now. Wait a few minutes and try again. If it keeps happening, contact Resgrid support or your server administrator."
+      },
+      "login_failed": {
+        "title": "Sign-in failed",
+        "message": "Something went wrong while signing in. Try again. If it keeps happening, contact your department administrator or Resgrid support."
+      }
+    }
   },
   "maintenance": {
     "downtime_message": "We are working hard to complete the maintenance as quickly as possible. Please check back soon.",
diff --git a/src/translations/es.json b/src/translations/es.json
index 89a26ed5..7af2ecd2 100644
--- a/src/translations/es.json
+++ b/src/translations/es.json
@@ -1154,7 +1154,73 @@
     "title": "Iniciar sesión",
     "username": "Nombre de usuario",
     "username_placeholder": "Introduce tu nombre de usuario",
-    "welcome_title": "Bienvenido de Nuevo"
+    "welcome_title": "Bienvenido de Nuevo",
+    "server": {
+      "label": "Servidor:",
+      "us_west": "EE. UU. Oeste",
+      "eu_central": "UE Central",
+      "custom_host": "Personalizado ({{host}})",
+      "signing_in_to": "Iniciando sesión en {{server}}",
+      "change_hint": "Abre la selección de servidor"
+    },
+    "errors": {
+      "invalid_credentials": {
+        "title": "Usuario o contraseña incorrectos",
+        "message": "El usuario o la contraseña que introdujo no son correctos. Las contraseñas distinguen entre mayúsculas y minúsculas, así que compruebe que Bloq Mayús esté desactivado. Si olvidó su contraseña, restablézcala desde el sitio web de Resgrid. Demasiados intentos fallidos bloquearán su cuenta temporalmente."
+      },
+      "account_locked_out": {
+        "title": "Cuenta bloqueada temporalmente",
+        "message": "Su cuenta se bloqueó tras demasiados intentos de inicio de sesión fallidos. Espere {{minutes}} min y vuelva a intentarlo. Si olvidó su contraseña, restablézcala desde el sitio web de Resgrid antes de volver a intentarlo."
+      },
+      "account_locked": {
+        "title": "Cuenta bloqueada",
+        "message": "Su cuenta está bloqueada. Contacte con el administrador de su departamento para que la desbloquee."
+      },
+      "account_disabled": {
+        "title": "Cuenta deshabilitada",
+        "message": "Su departamento ha deshabilitado su cuenta. Contacte con el administrador de su departamento para que la vuelva a habilitar."
+      },
+      "account_not_activated": {
+        "title": "Cuenta no activada",
+        "message": "Su cuenta aún no se ha activado. Use el correo de invitación de su departamento para terminar de configurarla, o pida al administrador de su departamento que le envíe una nueva invitación."
+      },
+      "no_department": {
+        "title": "Sin departamento activo",
+        "message": "Su cuenta no pertenece a ningún departamento activo. Pida al administrador de su departamento que le añada y vuelva a intentarlo."
+      },
+      "sso_required": {
+        "title": "Se requiere inicio de sesión único",
+        "message": "Su departamento requiere inicio de sesión único. Use el botón SSO para iniciar sesión con la cuenta de su organización en lugar de una contraseña."
+      },
+      "maximum_sessions": {
+        "title": "Demasiadas sesiones activas",
+        "message": "Su departamento ha alcanzado su límite de sesiones iniciadas. Cierre sesión en otro dispositivo, o pida al administrador de su departamento que finalice una sesión sin uso, y vuelva a intentarlo."
+      },
+      "department_access_denied": {
+        "title": "Inicio de sesión no permitido",
+        "message": "Su cuenta ya no puede iniciar sesión en este departamento. Contacte con el administrador de su departamento."
+      },
+      "server_unreachable": {
+        "title": "No se puede contactar con el servidor",
+        "message": "No se pudo conectar con {{server}}. Compruebe su conexión a internet y que esté seleccionado el servidor correcto, y vuelva a intentarlo."
+      },
+      "server_not_resgrid": {
+        "title": "Servidor no reconocido",
+        "message": "{{server}} no respondió como un servidor de Resgrid. Compruebe la dirección del servidor y vuelva a intentarlo."
+      },
+      "rate_limited": {
+        "title": "Demasiados intentos",
+        "message": "Se hicieron demasiados intentos de inicio de sesión en poco tiempo. Espere un minuto y vuelva a intentarlo."
+      },
+      "server_error": {
+        "title": "Problema del servidor",
+        "message": "{{server}} no pudo completar el inicio de sesión en este momento. Espere unos minutos y vuelva a intentarlo. Si sigue ocurriendo, contacte con el soporte de Resgrid o con el administrador de su servidor."
+      },
+      "login_failed": {
+        "title": "Error al iniciar sesión",
+        "message": "Algo salió mal al iniciar sesión. Vuelva a intentarlo. Si sigue ocurriendo, contacte con el administrador de su departamento o con el soporte de Resgrid."
+      }
+    }
   },
   "maintenance": {
     "downtime_message": "Estamos trabajando arduamente para completar el mantenimiento lo antes posible. Por favor, vuelva pronto.",
diff --git a/src/translations/fr.json b/src/translations/fr.json
index b3bf97f5..c3c6bea4 100644
--- a/src/translations/fr.json
+++ b/src/translations/fr.json
@@ -1154,7 +1154,73 @@
     "title": "Connexion",
     "username": "Nom d'utilisateur",
     "username_placeholder": "Saisissez votre nom d'utilisateur",
-    "welcome_title": "Bon retour"
+    "welcome_title": "Bon retour",
+    "server": {
+      "label": "Serveur :",
+      "us_west": "États-Unis Ouest",
+      "eu_central": "UE Centre",
+      "custom_host": "Personnalisé ({{host}})",
+      "signing_in_to": "Connexion à {{server}}",
+      "change_hint": "Ouvre la sélection du serveur"
+    },
+    "errors": {
+      "invalid_credentials": {
+        "title": "Nom d'utilisateur ou mot de passe incorrect",
+        "message": "Le nom d'utilisateur ou le mot de passe saisi est incorrect. Les mots de passe sont sensibles à la casse : vérifiez que le verrouillage des majuscules est désactivé. Si vous avez oublié votre mot de passe, réinitialisez-le depuis le site web de Resgrid. Trop de tentatives échouées verrouilleront temporairement votre compte."
+      },
+      "account_locked_out": {
+        "title": "Compte temporairement verrouillé",
+        "message": "Votre compte a été verrouillé après trop de tentatives de connexion échouées. Patientez {{minutes}} min puis réessayez. Si vous avez oublié votre mot de passe, réinitialisez-le depuis le site web de Resgrid avant de réessayer."
+      },
+      "account_locked": {
+        "title": "Compte verrouillé",
+        "message": "Votre compte est verrouillé. Contactez l'administrateur de votre service pour le faire déverrouiller."
+      },
+      "account_disabled": {
+        "title": "Compte désactivé",
+        "message": "Votre compte a été désactivé par votre service. Contactez l'administrateur de votre service pour le faire réactiver."
+      },
+      "account_not_activated": {
+        "title": "Compte non activé",
+        "message": "Votre compte n'a pas encore été activé. Utilisez l'e-mail d'invitation de votre service pour terminer sa configuration, ou demandez à l'administrateur de votre service de vous envoyer une nouvelle invitation."
+      },
+      "no_department": {
+        "title": "Aucun service actif",
+        "message": "Votre compte n'est membre d'aucun service actif. Demandez à l'administrateur de votre service de vous ajouter, puis réessayez."
+      },
+      "sso_required": {
+        "title": "Authentification unique requise",
+        "message": "Votre service exige l'authentification unique. Utilisez le bouton SSO pour vous connecter avec le compte de votre organisation au lieu d'un mot de passe."
+      },
+      "maximum_sessions": {
+        "title": "Trop de sessions actives",
+        "message": "Votre service a atteint sa limite de sessions connectées. Déconnectez-vous sur un autre appareil, ou demandez à l'administrateur de votre service de fermer une session inutilisée, puis réessayez."
+      },
+      "department_access_denied": {
+        "title": "Connexion non autorisée",
+        "message": "Votre compte n'est plus autorisé à se connecter à ce service. Contactez l'administrateur de votre service."
+      },
+      "server_unreachable": {
+        "title": "Serveur injoignable",
+        "message": "Impossible de se connecter à {{server}}. Vérifiez votre connexion internet et que le bon serveur est sélectionné, puis réessayez."
+      },
+      "server_not_resgrid": {
+        "title": "Serveur non reconnu",
+        "message": "{{server}} n'a pas répondu comme un serveur Resgrid. Vérifiez l'adresse du serveur et réessayez."
+      },
+      "rate_limited": {
+        "title": "Trop de tentatives",
+        "message": "Trop de tentatives de connexion ont été faites en peu de temps. Patientez une minute et réessayez."
+      },
+      "server_error": {
+        "title": "Problème de serveur",
+        "message": "{{server}} n'a pas pu terminer la connexion pour le moment. Patientez quelques minutes et réessayez. Si le problème persiste, contactez le support Resgrid ou l'administrateur de votre serveur."
+      },
+      "login_failed": {
+        "title": "Échec de la connexion",
+        "message": "Un problème est survenu lors de la connexion. Réessayez. Si le problème persiste, contactez l'administrateur de votre service ou le support Resgrid."
+      }
+    }
   },
   "maintenance": {
     "downtime_message": "Nous travaillons activement pour terminer la maintenance le plus rapidement possible. Veuillez revenir bientôt.",
diff --git a/src/translations/it.json b/src/translations/it.json
index 19b16732..a6d53a74 100644
--- a/src/translations/it.json
+++ b/src/translations/it.json
@@ -1154,7 +1154,73 @@
     "title": "Accesso",
     "username": "Nome utente",
     "username_placeholder": "Inserisci il tuo nome utente",
-    "welcome_title": "Bentornato"
+    "welcome_title": "Bentornato",
+    "server": {
+      "label": "Server:",
+      "us_west": "USA Ovest",
+      "eu_central": "UE Centrale",
+      "custom_host": "Personalizzato ({{host}})",
+      "signing_in_to": "Accesso a {{server}}",
+      "change_hint": "Apre la selezione del server"
+    },
+    "errors": {
+      "invalid_credentials": {
+        "title": "Nome utente o password errati",
+        "message": "Il nome utente o la password inseriti non sono corretti. Le password distinguono tra maiuscole e minuscole, quindi verifica che il blocco maiuscole sia disattivato. Se hai dimenticato la password, reimpostala dal sito web di Resgrid. Troppi tentativi non riusciti bloccheranno temporaneamente l'account."
+      },
+      "account_locked_out": {
+        "title": "Account temporaneamente bloccato",
+        "message": "Il tuo account è stato bloccato dopo troppi tentativi di accesso non riusciti. Attendi {{minutes}} min e riprova. Se hai dimenticato la password, reimpostala dal sito web di Resgrid prima di riprovare."
+      },
+      "account_locked": {
+        "title": "Account bloccato",
+        "message": "Il tuo account è bloccato. Contatta l'amministratore del tuo dipartimento per farlo sbloccare."
+      },
+      "account_disabled": {
+        "title": "Account disattivato",
+        "message": "Il tuo account è stato disattivato dal tuo dipartimento. Contatta l'amministratore del tuo dipartimento per farlo riattivare."
+      },
+      "account_not_activated": {
+        "title": "Account non attivato",
+        "message": "Il tuo account non è ancora stato attivato. Usa l'email di invito del tuo dipartimento per completarne la configurazione, oppure chiedi all'amministratore del tuo dipartimento di inviarti un nuovo invito."
+      },
+      "no_department": {
+        "title": "Nessun dipartimento attivo",
+        "message": "Il tuo account non è membro di alcun dipartimento attivo. Chiedi all'amministratore del tuo dipartimento di aggiungerti, poi riprova."
+      },
+      "sso_required": {
+        "title": "Accesso Single Sign-On richiesto",
+        "message": "Il tuo dipartimento richiede il Single Sign-On. Usa il pulsante SSO per accedere con l'account della tua organizzazione invece che con una password."
+      },
+      "maximum_sessions": {
+        "title": "Troppe sessioni attive",
+        "message": "Il tuo dipartimento ha raggiunto il limite di sessioni connesse. Esci da un altro dispositivo, oppure chiedi all'amministratore del tuo dipartimento di chiudere una sessione inutilizzata, poi riprova."
+      },
+      "department_access_denied": {
+        "title": "Accesso non consentito",
+        "message": "Il tuo account non può più accedere a questo dipartimento. Contatta l'amministratore del tuo dipartimento."
+      },
+      "server_unreachable": {
+        "title": "Server non raggiungibile",
+        "message": "Impossibile connettersi a {{server}}. Verifica la connessione a internet e che sia selezionato il server corretto, poi riprova."
+      },
+      "server_not_resgrid": {
+        "title": "Server non riconosciuto",
+        "message": "{{server}} non ha risposto come un server Resgrid. Verifica l'indirizzo del server e riprova."
+      },
+      "rate_limited": {
+        "title": "Troppi tentativi",
+        "message": "Sono stati effettuati troppi tentativi di accesso in poco tempo. Attendi un minuto e riprova."
+      },
+      "server_error": {
+        "title": "Problema del server",
+        "message": "{{server}} non è riuscito a completare l'accesso in questo momento. Attendi qualche minuto e riprova. Se il problema persiste, contatta il supporto Resgrid o l'amministratore del server."
+      },
+      "login_failed": {
+        "title": "Accesso non riuscito",
+        "message": "Si è verificato un problema durante l'accesso. Riprova. Se il problema persiste, contatta l'amministratore del tuo dipartimento o il supporto Resgrid."
+      }
+    }
   },
   "maintenance": {
     "downtime_message": "Stiamo lavorando per completare la manutenzione il prima possibile. Ricontrolla presto.",
diff --git a/src/translations/pl.json b/src/translations/pl.json
index 5aa7de85..1773d2e0 100644
--- a/src/translations/pl.json
+++ b/src/translations/pl.json
@@ -1154,7 +1154,73 @@
     "title": "Logowanie",
     "username": "Nazwa użytkownika",
     "username_placeholder": "Wprowadź swoją nazwę użytkownika",
-    "welcome_title": "Witaj ponownie"
+    "welcome_title": "Witaj ponownie",
+    "server": {
+      "label": "Serwer:",
+      "us_west": "USA Zachód",
+      "eu_central": "UE Centrum",
+      "custom_host": "Niestandardowy ({{host}})",
+      "signing_in_to": "Logowanie do {{server}}",
+      "change_hint": "Otwiera wybór serwera"
+    },
+    "errors": {
+      "invalid_credentials": {
+        "title": "Nieprawidłowa nazwa użytkownika lub hasło",
+        "message": "Wprowadzona nazwa użytkownika lub hasło są nieprawidłowe. W hasłach rozróżniana jest wielkość liter, więc sprawdź, czy Caps Lock jest wyłączony. Jeśli nie pamiętasz hasła, zresetuj je na stronie Resgrid. Zbyt wiele nieudanych prób tymczasowo zablokuje konto."
+      },
+      "account_locked_out": {
+        "title": "Konto tymczasowo zablokowane",
+        "message": "Twoje konto zostało zablokowane po zbyt wielu nieudanych próbach logowania. Odczekaj {{minutes}} min i spróbuj ponownie. Jeśli nie pamiętasz hasła, zresetuj je na stronie Resgrid przed kolejną próbą."
+      },
+      "account_locked": {
+        "title": "Konto zablokowane",
+        "message": "Twoje konto jest zablokowane. Skontaktuj się z administratorem swojej jednostki, aby je odblokować."
+      },
+      "account_disabled": {
+        "title": "Konto wyłączone",
+        "message": "Twoje konto zostało wyłączone przez Twoją jednostkę. Skontaktuj się z administratorem swojej jednostki, aby je ponownie włączyć."
+      },
+      "account_not_activated": {
+        "title": "Konto nieaktywowane",
+        "message": "Twoje konto nie zostało jeszcze aktywowane. Użyj e-maila z zaproszeniem od swojej jednostki, aby dokończyć konfigurację, lub poproś administratora jednostki o wysłanie nowego zaproszenia."
+      },
+      "no_department": {
+        "title": "Brak aktywnej jednostki",
+        "message": "Twoje konto nie należy do żadnej aktywnej jednostki. Poproś administratora swojej jednostki o dodanie Cię, a następnie spróbuj ponownie."
+      },
+      "sso_required": {
+        "title": "Wymagane logowanie jednokrotne",
+        "message": "Twoja jednostka wymaga logowania jednokrotnego. Użyj przycisku SSO, aby zalogować się kontem swojej organizacji zamiast hasłem."
+      },
+      "maximum_sessions": {
+        "title": "Zbyt wiele aktywnych sesji",
+        "message": "Twoja jednostka osiągnęła limit zalogowanych sesji. Wyloguj się na innym urządzeniu lub poproś administratora jednostki o zakończenie nieużywanej sesji, a następnie spróbuj ponownie."
+      },
+      "department_access_denied": {
+        "title": "Logowanie niedozwolone",
+        "message": "Twoje konto nie może już logować się do tej jednostki. Skontaktuj się z administratorem swojej jednostki."
+      },
+      "server_unreachable": {
+        "title": "Brak połączenia z serwerem",
+        "message": "Nie można połączyć się z {{server}}. Sprawdź połączenie z internetem i czy wybrano właściwy serwer, a następnie spróbuj ponownie."
+      },
+      "server_not_resgrid": {
+        "title": "Nierozpoznany serwer",
+        "message": "{{server}} nie odpowiedział jak serwer Resgrid. Sprawdź adres serwera i spróbuj ponownie."
+      },
+      "rate_limited": {
+        "title": "Zbyt wiele prób",
+        "message": "W krótkim czasie podjęto zbyt wiele prób logowania. Odczekaj minutę i spróbuj ponownie."
+      },
+      "server_error": {
+        "title": "Problem z serwerem",
+        "message": "{{server}} nie mógł teraz dokończyć logowania. Odczekaj kilka minut i spróbuj ponownie. Jeśli problem się powtarza, skontaktuj się z pomocą techniczną Resgrid lub administratorem serwera."
+      },
+      "login_failed": {
+        "title": "Logowanie nie powiodło się",
+        "message": "Podczas logowania wystąpił błąd. Spróbuj ponownie. Jeśli problem się powtarza, skontaktuj się z administratorem swojej jednostki lub pomocą techniczną Resgrid."
+      }
+    }
   },
   "maintenance": {
     "downtime_message": "Pracujemy nad jak najszybszym zakończeniem konserwacji. Proszę sprawdzić ponownie wkrótce.",
diff --git a/src/translations/sv.json b/src/translations/sv.json
index dbb5b878..ccadc90e 100644
--- a/src/translations/sv.json
+++ b/src/translations/sv.json
@@ -1154,7 +1154,73 @@
     "title": "Logga in",
     "username": "Användarnamn",
     "username_placeholder": "Ange ditt användarnamn",
-    "welcome_title": "Välkommen tillbaka"
+    "welcome_title": "Välkommen tillbaka",
+    "server": {
+      "label": "Server:",
+      "us_west": "USA Väst",
+      "eu_central": "EU Central",
+      "custom_host": "Anpassad ({{host}})",
+      "signing_in_to": "Loggar in på {{server}}",
+      "change_hint": "Öppnar serverval"
+    },
+    "errors": {
+      "invalid_credentials": {
+        "title": "Fel användarnamn eller lösenord",
+        "message": "Användarnamnet eller lösenordet du angav är fel. Lösenord är skiftlägeskänsliga, så kontrollera att Caps Lock är avstängt. Om du har glömt ditt lösenord kan du återställa det på Resgrids webbplats. För många misslyckade försök låser ditt konto tillfälligt."
+      },
+      "account_locked_out": {
+        "title": "Kontot är tillfälligt låst",
+        "message": "Ditt konto låstes efter för många misslyckade inloggningsförsök. Vänta {{minutes}} min och försök igen. Om du har glömt ditt lösenord, återställ det på Resgrids webbplats innan du försöker igen."
+      },
+      "account_locked": {
+        "title": "Kontot är låst",
+        "message": "Ditt konto är låst. Kontakta din organisations administratör för att få det upplåst."
+      },
+      "account_disabled": {
+        "title": "Kontot är inaktiverat",
+        "message": "Ditt konto har inaktiverats av din organisation. Kontakta din organisations administratör för att få det aktiverat igen."
+      },
+      "account_not_activated": {
+        "title": "Kontot är inte aktiverat",
+        "message": "Ditt konto har inte aktiverats än. Använd inbjudningsmejlet från din organisation för att slutföra konfigurationen, eller be din organisations administratör att skicka en ny inbjudan."
+      },
+      "no_department": {
+        "title": "Ingen aktiv organisation",
+        "message": "Ditt konto är inte medlem i någon aktiv organisation. Be din organisations administratör att lägga till dig och försök sedan igen."
+      },
+      "sso_required": {
+        "title": "Enkel inloggning krävs",
+        "message": "Din organisation kräver enkel inloggning. Använd SSO-knappen för att logga in med din organisations konto i stället för ett lösenord."
+      },
+      "maximum_sessions": {
+        "title": "För många aktiva sessioner",
+        "message": "Din organisation har nått sin gräns för inloggade sessioner. Logga ut på en annan enhet, eller be din organisations administratör att avsluta en oanvänd session, och försök sedan igen."
+      },
+      "department_access_denied": {
+        "title": "Inloggning inte tillåten",
+        "message": "Ditt konto får inte längre logga in i den här organisationen. Kontakta din organisations administratör."
+      },
+      "server_unreachable": {
+        "title": "Servern kan inte nås",
+        "message": "Det gick inte att ansluta till {{server}}. Kontrollera din internetanslutning och att rätt server är vald, och försök sedan igen."
+      },
+      "server_not_resgrid": {
+        "title": "Servern känns inte igen",
+        "message": "{{server}} svarade inte som en Resgrid-server. Kontrollera serveradressen och försök igen."
+      },
+      "rate_limited": {
+        "title": "För många försök",
+        "message": "För många inloggningsförsök gjordes på kort tid. Vänta en minut och försök igen."
+      },
+      "server_error": {
+        "title": "Serverproblem",
+        "message": "{{server}} kunde inte slutföra inloggningen just nu. Vänta några minuter och försök igen. Om det fortsätter, kontakta Resgrids support eller din serveradministratör."
+      },
+      "login_failed": {
+        "title": "Inloggningen misslyckades",
+        "message": "Något gick fel vid inloggningen. Försök igen. Om det fortsätter, kontakta din organisations administratör eller Resgrids support."
+      }
+    }
   },
   "maintenance": {
     "downtime_message": "Vi arbetar hårt för att slutföra underhållet så snabbt som möjligt. Vänligen kontrollera igen snart.",
diff --git a/src/translations/uk.json b/src/translations/uk.json
index ba198628..9948b6b5 100644
--- a/src/translations/uk.json
+++ b/src/translations/uk.json
@@ -1154,7 +1154,73 @@
     "title": "Вхід",
     "username": "Ім'я користувача",
     "username_placeholder": "Введіть ваше ім'я користувача",
-    "welcome_title": "З поверненням"
+    "welcome_title": "З поверненням",
+    "server": {
+      "label": "Сервер:",
+      "us_west": "США Захід",
+      "eu_central": "ЄС Центр",
+      "custom_host": "Власний ({{host}})",
+      "signing_in_to": "Вхід на {{server}}",
+      "change_hint": "Відкриває вибір сервера"
+    },
+    "errors": {
+      "invalid_credentials": {
+        "title": "Неправильне ім'я користувача або пароль",
+        "message": "Введене ім'я користувача або пароль неправильні. Паролі чутливі до регістру, тож перевірте, чи вимкнено Caps Lock. Якщо ви забули пароль, скиньте його на вебсайті Resgrid. Забагато невдалих спроб тимчасово заблокує ваш обліковий запис."
+      },
+      "account_locked_out": {
+        "title": "Обліковий запис тимчасово заблоковано",
+        "message": "Ваш обліковий запис заблоковано після забагатьох невдалих спроб входу. Зачекайте {{minutes}} хв і спробуйте знову. Якщо ви забули пароль, скиньте його на вебсайті Resgrid перед наступною спробою."
+      },
+      "account_locked": {
+        "title": "Обліковий запис заблоковано",
+        "message": "Ваш обліковий запис заблоковано. Зверніться до адміністратора вашого підрозділу, щоб його розблокувати."
+      },
+      "account_disabled": {
+        "title": "Обліковий запис вимкнено",
+        "message": "Ваш підрозділ вимкнув ваш обліковий запис. Зверніться до адміністратора вашого підрозділу, щоб його знову ввімкнути."
+      },
+      "account_not_activated": {
+        "title": "Обліковий запис не активовано",
+        "message": "Ваш обліковий запис ще не активовано. Скористайтеся листом-запрошенням від вашого підрозділу, щоб завершити налаштування, або попросіть адміністратора підрозділу надіслати нове запрошення."
+      },
+      "no_department": {
+        "title": "Немає активного підрозділу",
+        "message": "Ваш обліковий запис не входить до жодного активного підрозділу. Попросіть адміністратора вашого підрозділу додати вас і спробуйте знову."
+      },
+      "sso_required": {
+        "title": "Потрібен єдиний вхід",
+        "message": "Ваш підрозділ вимагає єдиного входу. Скористайтеся кнопкою SSO, щоб увійти обліковим записом вашої організації замість пароля."
+      },
+      "maximum_sessions": {
+        "title": "Забагато активних сеансів",
+        "message": "Ваш підрозділ досяг ліміту активних сеансів. Вийдіть на іншому пристрої або попросіть адміністратора підрозділу завершити невикористаний сеанс і спробуйте знову."
+      },
+      "department_access_denied": {
+        "title": "Вхід заборонено",
+        "message": "Вашому обліковому запису більше не дозволено входити до цього підрозділу. Зверніться до адміністратора вашого підрозділу."
+      },
+      "server_unreachable": {
+        "title": "Сервер недоступний",
+        "message": "Не вдалося підключитися до {{server}}. Перевірте підключення до інтернету та чи вибрано правильний сервер, і спробуйте знову."
+      },
+      "server_not_resgrid": {
+        "title": "Сервер не розпізнано",
+        "message": "{{server}} відповів не як сервер Resgrid. Перевірте адресу сервера і спробуйте знову."
+      },
+      "rate_limited": {
+        "title": "Забагато спроб",
+        "message": "За короткий час зроблено забагато спроб входу. Зачекайте хвилину і спробуйте знову."
+      },
+      "server_error": {
+        "title": "Проблема на сервері",
+        "message": "{{server}} не зміг зараз завершити вхід. Зачекайте кілька хвилин і спробуйте знову. Якщо проблема повторюється, зверніться до підтримки Resgrid або адміністратора вашого сервера."
+      },
+      "login_failed": {
+        "title": "Не вдалося увійти",
+        "message": "Під час входу сталася помилка. Спробуйте знову. Якщо проблема повторюється, зверніться до адміністратора вашого підрозділу або підтримки Resgrid."
+      }
+    }
   },
   "maintenance": {
     "downtime_message": "Ми працюємо над якнайшвидшим завершенням технічних робіт. Будь ласка, перевірте пізніше.",

From b2bf2e34dc834fe9af3278c5e0c35758640f1dae Mon Sep 17 00:00:00 2001
From: Shawn Jackson <shawn@resgrid.com>
Date: Sat, 31 Oct 2026 12:32:13 -0700
Subject: [PATCH 2/2] RD-T49 PR #155 Fixes

---
 .../__tests__/login-server-badge.test.tsx     |  9 ++++++
 src/components/auth/login-server-badge.tsx    | 32 ++++++++++++-------
 src/lib/auth/__tests__/login-errors.test.ts   | 20 +++++++++++-
 src/lib/auth/api.tsx                          |  6 ++--
 src/lib/auth/login-errors.ts                  | 17 ++++++----
 src/stores/auth/__tests__/store-mfa.test.ts   | 14 ++++++++
 src/stores/auth/store.tsx                     |  6 ++--
 7 files changed, 81 insertions(+), 23 deletions(-)

diff --git a/src/components/auth/__tests__/login-server-badge.test.tsx b/src/components/auth/__tests__/login-server-badge.test.tsx
index 0e62d96e..91ab5b92 100644
--- a/src/components/auth/__tests__/login-server-badge.test.tsx
+++ b/src/components/auth/__tests__/login-server-badge.test.tsx
@@ -53,4 +53,13 @@ describe('LoginServerBadge', () => {
     fireEvent.press(screen.getByTestId('login-server-badge'));
     expect(onPress).toHaveBeenCalled();
   });
+
+  it('is a button only when it opens something', () => {
+    const { rerender } = render(<LoginServerBadge onPress={jest.fn()} />);
+    expect(screen.getByTestId('login-server-badge').props.accessibilityRole).toBe('button');
+
+    rerender(<LoginServerBadge />);
+    expect(screen.getByTestId('login-server-badge').props.accessibilityRole).toBeUndefined();
+    expect(screen.queryByRole('button')).toBeNull();
+  });
 });
diff --git a/src/components/auth/login-server-badge.tsx b/src/components/auth/login-server-badge.tsx
index f03db758..b90fe244 100644
--- a/src/components/auth/login-server-badge.tsx
+++ b/src/components/auth/login-server-badge.tsx
@@ -2,7 +2,7 @@ import { Server } from 'lucide-react-native';
 import { useColorScheme } from 'nativewind';
 import React from 'react';
 import { useTranslation } from 'react-i18next';
-import { Pressable } from 'react-native';
+import { Pressable, View } from 'react-native';
 
 import { Text } from '@/components/ui/text';
 import { useLoginServer } from '@/hooks/use-login-server';
@@ -12,26 +12,36 @@ interface LoginServerBadgeProps {
   onPress?: () => void;
 }
 
+const BADGE_CLASS = 'flex-row items-center self-center rounded-full border border-gray-300 px-3 py-1.5 dark:border-gray-700';
+
 /** Names the server the login form signs in to (US West, EU Central or Custom), so a wrong server is spotted before signing in. */
 export const LoginServerBadge = ({ onPress }: LoginServerBadgeProps) => {
   const { t } = useTranslation();
   const { colorScheme } = useColorScheme();
   const { name } = useLoginServer();
+  const label = t('login.server.signing_in_to', { server: name });
 
-  return (
-    <Pressable
-      onPress={onPress}
-      disabled={!onPress}
-      accessibilityRole={onPress ? 'button' : 'text'}
-      accessibilityLabel={t('login.server.signing_in_to', { server: name })}
-      accessibilityHint={onPress ? t('login.server.change_hint') : undefined}
-      testID="login-server-badge"
-      className="flex-row items-center self-center rounded-full border border-gray-300 px-3 py-1.5 dark:border-gray-700"
-    >
+  const content = (
+    <>
       <Server size={14} color={colorScheme === 'dark' ? '#9ca3af' : '#6b7280'} />
       <Text className="ml-1.5 text-sm text-gray-600 dark:text-gray-300">
         {t('login.server.label')} <Text className="text-sm font-semibold text-gray-900 dark:text-white">{name}</Text>
       </Text>
+    </>
+  );
+
+  // Only a badge that does something is a button; a label stays a label for assistive technologies.
+  if (!onPress) {
+    return (
+      <View accessible accessibilityLabel={label} testID="login-server-badge" className={BADGE_CLASS}>
+        {content}
+      </View>
+    );
+  }
+
+  return (
+    <Pressable onPress={onPress} accessibilityRole="button" accessibilityLabel={label} accessibilityHint={t('login.server.change_hint')} testID="login-server-badge" className={BADGE_CLASS}>
+      {content}
     </Pressable>
   );
 };
diff --git a/src/lib/auth/__tests__/login-errors.test.ts b/src/lib/auth/__tests__/login-errors.test.ts
index 16f4573c..6f8d262b 100644
--- a/src/lib/auth/__tests__/login-errors.test.ts
+++ b/src/lib/auth/__tests__/login-errors.test.ts
@@ -11,7 +11,7 @@ import pl from '@/translations/pl.json';
 import sv from '@/translations/sv.json';
 import uk from '@/translations/uk.json';
 
-import { classifyLoginFailure, describeLoginFailure, isLoginErrorCode, type LoginErrorCode } from '../login-errors';
+import { classifyLoginFailure, describeLoginFailure, isLoginErrorCode, isServerLoginReason, type LoginErrorCode } from '../login-errors';
 
 const axiosError = (status?: number, data?: unknown) => ({
   isAxiosError: true,
@@ -55,6 +55,15 @@ describe('classifyLoginFailure', () => {
     expect(classifyLoginFailure(axiosError(400, { error: 'invalid_grant', login_error: 'something_new' }))).toEqual({ code: 'invalid_credentials' });
   });
 
+  it('reads login_error only beside invalid_grant', () => {
+    expect(classifyLoginFailure(axiosError(400, { error: 'invalid_client', login_error: 'account_disabled' }))).toEqual({ code: 'login_failed' });
+    expect(classifyLoginFailure(axiosError(500, { login_error: 'account_disabled' }))).toEqual({ code: 'server_error' });
+  });
+
+  it('tells a throttled member to wait whatever reason the body gives', () => {
+    expect(classifyLoginFailure(axiosError(429, { error: 'invalid_grant', login_error: 'account_locked_out', lockout_minutes_remaining: 5 }))).toEqual({ code: 'rate_limited' });
+  });
+
   it('treats a bare invalid_grant from an older server as wrong credentials', () => {
     expect(classifyLoginFailure(axiosError(400, { error: 'invalid_grant', error_description: 'The username or password is invalid.' }))).toEqual({ code: 'invalid_credentials' });
   });
@@ -95,6 +104,15 @@ describe('isLoginErrorCode', () => {
   });
 });
 
+describe('isServerLoginReason', () => {
+  it('accepts only the reasons a server sends', () => {
+    expect(isServerLoginReason('account_locked_out')).toBe(true);
+    expect(isServerLoginReason('server_unreachable')).toBe(false);
+    expect(isServerLoginReason('mysecretpassword')).toBe(false);
+    expect(isServerLoginReason(42)).toBe(false);
+  });
+});
+
 describe('describeLoginFailure', () => {
   const t = jest.fn((key: string, options?: Record<string, unknown>) => `${key}${options ? JSON.stringify(options) : ''}`) as unknown as TFunction;
 
diff --git a/src/lib/auth/api.tsx b/src/lib/auth/api.tsx
index 553a91f9..2542e2ef 100644
--- a/src/lib/auth/api.tsx
+++ b/src/lib/auth/api.tsx
@@ -9,7 +9,7 @@ import { type MfaChallenge, parseMethods } from '@/lib/mfa/types';
 
 import { getItem, removeItem, setItem } from '../storage';
 import { getBaseApiUrl } from '../storage/app';
-import { classifyLoginFailure } from './login-errors';
+import { classifyLoginFailure, isServerLoginReason } from './login-errors';
 import type { AuthResponse, LoginCredentials, LoginResponse } from './types';
 
 // Strip any query string from a URL so tokens/credentials in params are never logged.
@@ -30,8 +30,8 @@ const sanitizeAuthError = (error: unknown): Record<string, unknown> => {
       'The user is no longer allowed to sign in.': 'user_sign_in_not_allowed',
     };
     const rejectionReason = typeof data?.error_description === 'string' && Object.hasOwn(knownDescriptions, data.error_description) ? knownDescriptions[data.error_description] : undefined;
-    // The server's login_error is a fixed set of reason codes, never free text.
-    const loginError = typeof data?.login_error === 'string' && /^[a-z_]{1,40}$/.test(data.login_error) ? data.login_error : undefined;
+    // Only a login_error the server is known to send; anything else is response text and is never logged.
+    const loginError = isServerLoginReason(data?.login_error) ? data.login_error : undefined;
     return {
       message: error.message,
       status: error.response?.status,
diff --git a/src/lib/auth/login-errors.ts b/src/lib/auth/login-errors.ts
index 90b05f47..f74f9e3d 100644
--- a/src/lib/auth/login-errors.ts
+++ b/src/lib/auth/login-errors.ts
@@ -34,6 +34,9 @@ const LOGIN_ERROR_CODES = new Set<string>([...SERVER_REASONS, 'server_unreachabl
 /** Whether an auth-store error is one of these codes (shown with its guidance) rather than a code or text from elsewhere. */
 export const isLoginErrorCode = (value: string | null | undefined): value is LoginErrorCode => !!value && LOGIN_ERROR_CODES.has(value);
 
+/** Whether a response's login_error is one of the reasons the server sends; anything else is response text, never logged. */
+export const isServerLoginReason = (value: unknown): value is LoginErrorCode => typeof value === 'string' && SERVER_REASONS.has(value);
+
 interface TokenErrorBody {
   error?: unknown;
   error_description?: unknown;
@@ -60,18 +63,20 @@ export const classifyLoginFailure = (error: unknown): LoginFailure => {
   const status = response.status ?? 0;
   const body: TokenErrorBody | null = typeof response.data === 'object' && response.data !== null ? (response.data as TokenErrorBody) : null;
 
-  if (body && typeof body.login_error === 'string' && SERVER_REASONS.has(body.login_error)) {
+  // Throttling comes first: whatever else the body says, waiting is what helps.
+  if (status === 429) {
+    return { code: 'rate_limited' };
+  }
+
+  // The server sends its reason only beside invalid_grant.
+  if (body?.error === 'invalid_grant' && isServerLoginReason(body.login_error)) {
     const minutes = body.lockout_minutes_remaining;
     return {
-      code: body.login_error as LoginErrorCode,
+      code: body.login_error,
       ...(typeof minutes === 'number' && Number.isFinite(minutes) && minutes > 0 ? { lockoutMinutes: Math.ceil(minutes) } : {}),
     };
   }
 
-  if (status === 429) {
-    return { code: 'rate_limited' };
-  }
-
   if (body?.error === 'invalid_grant') {
     const description = typeof body.error_description === 'string' ? body.error_description : '';
     if (description.includes('maximum number of active sessions')) {
diff --git a/src/stores/auth/__tests__/store-mfa.test.ts b/src/stores/auth/__tests__/store-mfa.test.ts
index d968296c..1f8dd9e0 100644
--- a/src/stores/auth/__tests__/store-mfa.test.ts
+++ b/src/stores/auth/__tests__/store-mfa.test.ts
@@ -189,6 +189,20 @@ describe('Dispatch auth store: login transaction and shared workstations', () =>
     expect(saved.accessToken).toBe('a');
   });
 
+  it('never restores a failed sign-in, whose reason is not kept', () => {
+    useAuthStore.setState({ status: 'error', error: 'account_locked_out', loginFailure: { code: 'account_locked_out', lockoutMinutes: 9 } });
+    const saved = useAuthStore.persist.getOptions().partialize!(useAuthStore.getState()) as Record<string, unknown>;
+    expect(saved.status).toBe('signedOut');
+    expect(saved).not.toHaveProperty('error');
+    expect(saved).not.toHaveProperty('loginFailure');
+  });
+
+  it('drops the last failed sign-in on sign-out', async () => {
+    useAuthStore.setState({ loginFailure: { code: 'account_locked_out', lockoutMinutes: 9 } });
+    await useAuthStore.getState().logout();
+    expect(useAuthStore.getState().loginFailure).toBeNull();
+  });
+
   it('conceals a session restored on a shared installation before the server is asked, and not on a personal one', async () => {
     const stored = { state: { status: 'signedIn', accessToken: 'a', refreshToken: 'r', refreshTokenExpiresOn: String(Date.now() + 3600000) }, version: 0 };
     const storage = new MMKV({ id: 'auth-storage' });
diff --git a/src/stores/auth/store.tsx b/src/stores/auth/store.tsx
index 3f567dbc..78cbaf54 100644
--- a/src/stores/auth/store.tsx
+++ b/src/stores/auth/store.tsx
@@ -290,6 +290,7 @@ const useAuthStore = create<AuthState>()(
           status: 'signedOut',
           // Why the session ended, when the screen should say (a shared shift that ran out); otherwise nothing.
           error: typeof reason === 'string' ? reason : null,
+          loginFailure: null,
           profile: null,
           userId: null,
           isFirstTime: true,
@@ -414,8 +415,9 @@ const useAuthStore = create<AuthState>()(
         refreshTokenExpiresOn: state.refreshTokenExpiresOn,
         profile: state.profile,
         userId: state.userId,
-        // A pending second factor dies with the process (its secret lives in memory only), so it restarts signed out.
-        status: state.status === 'mfaRequired' ? 'signedOut' : state.status,
+        // A pending second factor dies with the process (its secret lives in memory only), so it restarts signed out. So
+        // does a failed sign-in: its reason is not kept, and a restart must not reopen the failure with nothing to explain.
+        status: state.status === 'mfaRequired' || state.status === 'error' ? 'signedOut' : state.status,
         isFirstTime: state.isFirstTime,
       }),
     }