• Screen: SCR-IDP.22 — Login (Password + Google SSO)
• Use case: UC-IDP.02 — Login — Learner

Main login screen for learners — supports Password and Google SSO. Two inline error states: E1 — invalid credential (error_message visible when login_failed && !lockout_active); E2 — locked after 5 failed attempts (lockout_countdown visible, submit disabled). On success → SCR-LMS.01 (Browse Course Catalog). "Forgot Password?" → UC-IDP.22.
Learner Portal (web) note: AF-1A / AF-1A.1A (OS quick login, SUC-IDP-05) is a mobile-app-only capability per the requirements model's Sub-Use-Case invocation table — not rendered on this web prototype. See the Learner Mobile prototype for that scenario.

• login_identifier "Email / Mobile Number" — text · AuthIdentity.provider_uid · required · validation: one_of[email, phone], max_length:255 · always visible
• password "Password" — password · null (backend checks against AuthIdentity.credential hash) · required · validation: min_length:8 · always visible
• error_message "Error message" — text read-only · default "Invalid email or password" · visible when login_failed == true && lockout_active == false — prototype: scenario=AF-3A / AF-3B (same message renders for both, by design — prevents account enumeration)
• lockout_countdown "Lockout countdown" — computed from PasswordAttempt.lock_until · visible when lockout_active == true — prototype: scenario=AF-3C

• submit "Sign in" — enabled when required_fields_valid && lockout_active == false · triggers UC-IDP.02-M-2 · disabled in lockout / account-suspended states (AF-3C, AF-3D)
• google_sso "Sign in with Google" — enabled always · triggers UC-IDP.02-A-2A-1 → SUC-IDP-03
• forgot_password "Forgot Password?" — enabled always · triggers UC-IDP.02-A-3B-2 → UC-IDP.22
• sign_up "Sign up" — enabled always · triggers UC-IDP.01-M-1

1. Error message must always read "Invalid email or password" regardless of whether identifier or password is wrong — prevents account enumeration. This also covers AF-3A (account not found) — same generic message is shown, not a distinct "no account found" message. [refs: none]
2. During lockout (lockout_active == true): submit button disabled + real-time 15-minute countdown. [refs: SS-IDP.13]
3. Keyboard focus order: login_identifier → password → submit. Tab/Shift+Tab on both web and mobile browsers. [refs: NFR-09]