I think the PITA here is that a successful auth/login and a failed one are going to look different based on the context of where the results are coming from — and you’d have to be comfortable saying a login did not occur because the “success” case is not present.