04 — Information Architecture (Auth Module)

1. Two top-level zones
2. Route table (module-owned; extends 00-shared/05 §4)
3. Screen hierarchy (pre-auth)
4. Modal hierarchy (module)
5. Screen relationships
6. Nested nav
7. Quick actions / FAB / context menus
8. Deep links (proposed routing table)
9. Accessibility of IA
10. Peripheral: which nav elements are Auth-owned

Where Auth screens live in the shell (00-shared/05). Auth owns the pre-shell public stack (routes reachable while unauthenticated) and the Security section inside the authenticated app. Everything is derived from auth.controller.ts (routes) and the shared shell routing table.

1. Two top-level zones

App
 ├─ PRE-AUTH (no shell, no NavigationBar)          │  POST-AUTH (AppShell)
 │  ├─ /login                                      │  └─ /settings
 │  ├─ /login/2fa        (planned)                 │     └─ Security hub
 │  ├─ /register                                   │        ├─ /settings/security/2fa
 │  ├─ /verify-email                               │        ├─ /settings/security/devices
 │  ├─ /forgot-password                            │        └─ /settings/security/api-keys
 │  └─ /reset-password

Pre-auth zone: no bottom NavigationBar, no global AppBar chrome — single-column, brand-first layout, keyboard-friendly, minimal distraction.
Post-auth Security section lives under /settings (auth-gated by JwtAuthGuard).

2. Route table (module-owned; extends `00-shared/05 §4`)

Route	Screen	Auth	Source API
`/login`	Login	public	`POST /auth/login`
`/login/2fa`	2FA challenge	public, token-carrying `(planned)`	future challenge
`/register`	Tenant registration	public	`POST /auth/register`
`/verify-email`	Email verify (+result)	public	`POST /auth/verify-email`
`/forgot-password`	Forgot	public	`POST /auth/forgot-password`
`/reset-password`	Reset	public	`POST /auth/reset-password`
`/settings/security`	Security hub	JWT	—
`/settings/security/2fa`	2FA status + setup	JWT	`/auth/2fa/enable`,`/2fa/verify`,`/2fa/disable`
`/settings/security/devices`	Sessions/devices	JWT	`GET/DELETE /auth/sessions(/:id)`
`/settings/security/api-keys`	API key list	JWT	`GET/POST/DELETE /auth/api-keys(/:id)`
`/lock`	App lock screen (`(forward-looking)`)	device biometry	none

3. Screen hierarchy (pre-auth)

Login is the hub: → /forgot-password, → /register, → /login/2fa (after a login that signals challenge, planned), ← /reset-password (success → login), ← /verify-email (success → login).
Registration is a full-screen page (multi-field form > 3 fields → page, not dialog — 00-shared/05 §5).
Verify/reset are token-injection pages: they accept ?token= from deep link/email and can be re-invoked from banner buttons.

flowchart TD
    L[/login/] --> F[/forgot-password/]
    L --> R[/register/]
    L --> TOTP[/login/2fa/]
    F --> V[/reset-password/]
    R --> VE[/verify-email/]
    VE --> L
    V --> L
    subgraph authed security
      SEC[/settings/security/] --> FA[/settings/security/2fa/]
      SEC --> DEV[/settings/security/devices/]
      SEC --> AKEY[/settings/security/api-keys/]
    end

Following 00-shared/05 §5:

Snackbar/toast — "Password reset email sent", "Logged out", "Copy", "Key revoked".
Bottom sheet — API-key one-time reveal (needs full attention), session device detail.
Dialog — destructive confirms (revoke key, log out this device, disable 2FA), typed confirm only for irreversible (none in module — all revocable actions use plain confirm).
Full-screen page — register (5 fields), login, reset.
Loader — button spinner (submit), never full-screen dual column.

5. Screen relationships

Login → (success) → authenticated switch → shell home for role (00-shared/05 §2).
Security hub → subpages return with changed state (2FA now on; key created; count of sessions changed) — parent cubit refreshes on return.
Logout anywhere → global AuthCubit pivot → /login with reason.

6. Nested nav

Tablets/desktop: Security uses master-detail (/settings/security list left pane, details right); phone: push (module routes push like globals).
No StatefulShellBranch needed across zones; pre-auth stack is a simple Navigator.

7. Quick actions / FAB / context menus

No FAB in auth zone (forms are the surface). Security lists: row AppMenu (Device → Log out, Details; API key → Copy prefix, Revoke).
Keyboard: pre-auth Enter in password field submits login (08 §2); Esc clears errors/closes sheets; Ctrl+K search n/a pre-auth.

8. Deep links (proposed routing table)

Pattern	Target	Note
`studylyon://login`	Login	warm start
`studylyon://verify-email?token=…`	Verify email	token prefill
`studylyon://reset-password?token=…`	Reset	token prefill
`studylyon://settings/security`	Security hub	JWT required

9. Accessibility of IA

One headlineMedium per screen; pre-auth forms ordered email→password→CTA.
Focus begins at first input; back gesture = previous auth page (never shell home).

10. Peripheral: which nav elements are Auth-owned

Shell-owned cross-cutting screens (logout, account avatar) are preserved from 00-shared/05 §8; Auth adds only the Security hub under settings and the pre-auth gate zone. State of the gate (unauthenticated) hides all authenticated routes.

Keyboard shortcuts

StudyLyon — Design Docs