Auth Pages

Accepted on LoginPage and RegisterPage only (the other six auth pages take no variant), but currently a no-op: both components destructure it as an intentionally-unused prop and never branch on it, so 'minimal' and 'split' render the identical default card layout — the layout-shape names are not yet implemented.

Branding slots. Login also takes loggedInTitle for the already-signed-in state (loggedInSubtitle is accepted by the LoginPage type but is currently a no-op — the signed-in subtitle is hard-coded to `Signed in as <email>`, mirroring the unwired variant prop above).

Toggle the built-in AbstractAnimatedBackground and add classes. showBackground / AbstractAnimatedBackground applies to the six card-style pages (Login, Register, Forgot/Reset/Set/ChangePassword) — VerifyEmailPage and MagicLinkVerifyPage declare no showBackground prop and render no background. Auth pages take no theme prop and export no per-page theme constant or extend<Page>Theme helper (MagicLinkVerifyPage's magicLinkVerifyPageTheme is the sole exception); deeper restyling is via className and your own CSS.

Lifecycle callbacks. The page does the API work and calls these so you own navigation. Link variants (forgotPasswordHref, signUpHref) are provided as an alternative to callbacks.

Required. payload is { email, password, rememberMe?, captchaId?, captchaAnswer? }; on success the cookies are set by the client and onSuccess fires.

Supply ME to let the page detect an existing session and show the logged-in panel; LOGOUT powers the sign-out button there.

Enables the Captcha challenge on the form. The page requests a challenge and submits captchaId/captchaAnswer with the login payload. (config.login — the LoginFeatureConfig — carries only captcha and redirectUrl; redirectUrl is accepted by the type but currently inert — no LoginPage component reads it, the page fires onSuccess and never navigates — mirroring the unwired variant / loggedInSubtitle props above.)

Toggle the secondary controls; pair with forgotPasswordHref / signUpHref or the onForgotPassword / onSignUp callbacks.

Required. payload is { email, password, firstName?, lastName?, createProfile? }.

Rules enforced live, with the strength meter. Note: on RegisterPage only minLength and the four require* flags actually take effect — maxLength, specialChars and showStrengthIndicator are accepted by the PasswordPolicyConfig type but are NOT wired on this page (there is no max-length check in the form's validation, the special-character set is a fixed regex in the store rather than driven by specialChars, and the strength meter always renders whenever a password has been typed). Those three ARE honored instead on ResetPasswordPage / SetPasswordPage, which use the separate PasswordPolicy type.

Feature toggles: showFirstName, showLastName, createProfileOnRegister, and termsUrl / privacyUrl for the consent links. (showTerms is a top-level RegisterPage prop — not a config.register field — and requires acceptance.)

Collects the email and triggers the reset mail. Steps: request → success. Pair with backToLoginHref.

The landing for the emailed reset token — takes a new password (policy-checked), submitted together with the token, and confirms. Steps: form → success. (Unlike SetPasswordPage/VerifyEmailPage there is no separate verifying/error step — the token isn't pre-validated.)

Dual-purpose: accepting an invite (isInvite) to set an initial password, or landing from a magic link. It verifies the token then sets the password. Takes the token as a prop and a passwordPolicy.

For an already-signed-in user — current + new + confirm, with a fixed 8-char minimum + strength check (no configurable passwordPolicy prop). No token needed.

The exported baseline used when you don't pass one: minLength 8, maxLength 128, upper+lower+number required, special optional, preventCommonPasswords and preventUserInfoInPassword on (but inert — no form enforces these two; any enforcement would be server-side), strength indicator shown.

Confirms a new account's email from the token, and offers a resend whenever verification fails (an expired or otherwise-invalid token — the resend lives in the generic error step). Steps: verifying → success → error, auto-redirecting on success after redirectDelay (default 3000ms) by firing onSuccess (falling back to onBackToLogin). The resend form is toggleable via showResendForm (defaults to true) and only renders when a resendVerificationAction is also supplied — the component guards on `showResendForm && resendVerificationAction`; an optional email prop prefills that resend field.

Completes a passwordless sign-in from a magic-link token, then hands off via onSuccess after redirectDelay (default 2000ms), while onError fires on any verification-failure path (empty/non-success response or a thrown error). By default it auto-verifies on mount (step machine verifying → success → error); set requireConfirmation (default false) to prepend a 'ready' step that gates verification behind a 'Verify & Sign In' button — handy to keep email-scanner prefetches from silently consuming the one-time token. A texts prop overrides every label (confirmTitle / confirmSubtitle / confirmButton, verifyingTitle / verifyingSubtitle, successTitle / successSubtitle, errorTitle, backToLogin). Exports the magicLinkVerifyPageTheme constant — the sole per-page theme export among the auth pages — though like every auth page it has no extend* helper (fe's extend<Page>Theme exports belong to non-auth pages such as AuthorizationPage / VerificationFlowPage).