Module-specific interactions precise for pre-auth forms and security screens, layered on
shared 00-shared/08 . Covers every input modality on phone/tablet/desktop.
Gesture Behaviour Where
Tap submit, reveal password, copy, open/close sheets all inputs Tap on CTA submitting-aware disabled re-tap login/register/reset/enable Long-press AppMenu on session/api-key rowssessions, api keys Double-tap none (no media in auth) — Swipe left no destructive swipe (revoke is destructive) — keep confirm — Pull down refresh sessions/api-keys lists only Pinch/drag none (no media) — Hardware back pre-auth: pop to previous auth step; never back into shell; on root → exit all Edge swipe drawer (authed shell) — n/a pre-auth —
Input Behaviour
Tab email → password → CTA → secondary links; focus ring primary Enter submits the visible form (login/register/reset/forgot/2fa) Esc clears inline error / closes sheet / cancels dialog → returns focus to trigger Ctrl/Cmd+K n/a pre-auth (focus first field instead) recommended Ctrl/Cmd+Enter submit from form (same as Enter) Arrows navigate chips in API-key scopes (input) Right-click context menu (same as long-press: session revoke, key revoke) Hover tooltip after 500 ms; CTA elevation hinted Focus visible ring on every control; logical order
Event Haptic Ref
Wrong TOTP mediumImpact— Login success lightImpact— Copy key selectionClick— Enable 2FA lightImpact— Destroy confirm (revoke) heavyImpact— Rule disabled when system haptics off; none on desktop 08 §3
Transition Duration/curve Used by
Route push (pre-auth) m-base slidelogin→forgot→register Success→home m-base fade-upany unauthenticated success Sheet (key reveal) m-base bottom slideapi-key Totp box error shake AnimatedSwitcher (reduced-motion = none) 2fa Badge change (2FA on) scale pop m-fast security hub
Reduced-motion: only fades + instant; no shake.
Interaction Detail
Submit pressed button loading-state swap in m-base, double-tap locked Key copied snackbar "Copied" + toast, tooltip Password reveal icon toggles, focus stays, no screen shift TOTP auto-advance AnimatedContainer; paste-tolerant; on 401: red + shake + focus box Device revoked row fade-out m-base, list re-animates m-entrance stagger Refresh sessions RefreshIndicator completes with lightImpact
All presses respond < 100 ms with m-fast ripple.
Every network action shows pending state.
Submit buttons disabled while pending — no double-auth.
Rate-limit → never auto-retry; always surface countdown.
Errors never flash; persist until corrected or dismissed (persistent banner).
studylyon://verify-email?token= / reset-password?token= → fills hidden field; auto-submit.Manual code-paste → AppTotpInput accepts paste.
Copy key → share sheet on tablet/desktop (AppMenu?) — desktop: Ctrl+C on SelectableText.
Interaction spec never contradicts server: e.g. prevents re-enable 2fa vs server 400;
api-key reveal only once → widget caches nothing ; reset kills sessions → client force-logout
banner; unexpected-community → "password changed elsewhere".