Auth pages
pages/auth/**, modules/auth/pages/** — see the User Flow diagram for the full authorization mechanism these pages sit in.
Login — Live
Route: /auth/login
Username/password form → conditional 2FA modal.
| Control | Effect | Hook |
|---|---|---|
| Submit credentials | Logs in; if OTP disabled for the user, auto-verifies immediately | useLoginMutation |
| OTP modal: submit code | Verifies 2FA, sets auth cookie, full page reload | useLogin2FAMutation |
| OTP modal: resend | Requests a new code | useGenerateOtpMutation |
:::warning Dead code
Signup and Forgot Password UI components exist (signUpUI.tsx, ForgotPassword.tsx) but have no wired mutation/route — not reachable in the live app.
:::
Access Denied — Live, static
Route: /auth/access-denied
Shown when risk_dashboard_login capability is false.
| Control | Effect |
|---|---|
| "Back to login" link | Navigates to /auth/login |
No Sections Assigned — Live, static
Route: /dashboard/no-sections
Shown when a user has risk_dashboard_login but no section capability grants any route — rendered inside the normal DashboardWrapper chrome (sidebar visible, but nothing to click into).