Blocks
Auth
The screens every account needs: sign in, sign up, forgot and reset password, and a code check. Each takes your own async function, shows every state (checking, mistakes in the form, a refusal from your server, success) and works with password managers.
Examples
Sign in
The demo password is astrolabe; any other is refused, to show the message. The provider button and links are placeholders.
Sign in
Welcome back to Bayt al-Hikma.
<script lang="ts">
import { GoogleIcon } from '@hugeicons/core-free-icons';
import SignIn from '#lib/blocks/auth/SignIn.svelte';
import { toast } from '#lib/ui/toast/index.js';
// Stands in for your API. The demo password is "astrolabe"; anything else is refused with a code.
async function signIn({ password }: { email: string; password: string; remember: boolean }) {
await new Promise((r) => setTimeout(r, 800));
if (password !== 'astrolabe') throw Object.assign(new Error(), { code: 'invalid_credentials' });
}
</script>
<SignIn
onsubmit={signIn}
providers={[{ id: 'google', label: 'Google', icon: GoogleIcon }]}
onprovider={(id) => toast(`This would go to ${id} to sign in.`)}
forgotHref="#forgot"
signUpHref="#sign-up"
description="Welcome back to Bayt al-Hikma."
/>Sign up
The password shows its strength as you type. ibnsina@baytalhikma.org is taken, to show a refusal from the server under its field.
Create an account
A reader’s card for the House of Wisdom.
<script lang="ts">
import SignUp from '#lib/blocks/auth/SignUp.svelte';
// Stands in for your API: one address is already taken, to show the message.
async function signUp({ email }: { name: string; email: string; password: string }) {
await new Promise((r) => setTimeout(r, 900));
if (email.toLowerCase() === 'ibnsina@baytalhikma.org')
throw Object.assign(new Error(), { code: 'email_taken' });
}
</script>
<SignUp
onsubmit={signUp}
termsHref="#sign-up"
signInHref="#sign-in"
description="A reader’s card for the House of Wisdom."
/>Forgot password
Send the link, then it says where it went. Sending again waits out a short countdown.
Reset your password
We’ll email you a link to choose a new one.
<script lang="ts">
import ForgotPassword from '#lib/blocks/auth/ForgotPassword.svelte';
// Stands in for your API.
const send = () => new Promise((r) => setTimeout(r, 800));
</script>
<ForgotPassword onsubmit={send} signInHref="#sign-in" cooldown={30} />Reset password
Type the new password twice; they must match.
Choose a new password
You’ll use it to sign in from now on.
<script lang="ts">
import ResetPassword from '#lib/blocks/auth/ResetPassword.svelte';
// Stands in for your API, which also checks the reset token from the link.
const save = () => new Promise((r) => setTimeout(r, 900));
</script>
<ResetPassword onsubmit={save} signInHref="#sign-in" />Verification code
The demo code is 314159. It checks itself once the last digit is in; a wrong code is cleared, ready to try again.
Enter the code
We sent a 6-digit code to maryam@baytalhikma.org.
<script lang="ts">
import VerifyCode from '#lib/blocks/auth/VerifyCode.svelte';
// Stands in for your API. The demo code is 314159; any other is refused with a code.
async function check(code: string) {
await new Promise((r) => setTimeout(r, 700));
if (code !== '314159') throw Object.assign(new Error(), { code: 'invalid_code' });
}
const resend = () => new Promise((r) => setTimeout(r, 600));
</script>
<VerifyCode onsubmit={check} onresend={resend} sentTo="maryam@baytalhikma.org" cooldown={30} />Installation
npx sinaui add blocks/authCopy src/lib/blocks/auth/, with Alert, Button, Checkbox, Icon, Input, OtpInput, PasswordInput, RollingNumber, Separator, form.svelte.ts, announce.ts and tokens.css. No
dependencies.
Errors from your server
Throw an Error with a code from any callback and the block shows it in
plain words, under the field it's about when there is one. Unknown codes show “Something went
wrong. Try again.”, never the raw error. The wording lives in errors.ts.
| Code | Shown |
|---|---|
invalid_credentials | Above the form |
email_taken | Under the email |
weak_password | Under the password |
invalid_code, code_expired | Under the code |
link_expired, too_many_attempts | Above the form |
Props
SignIn
| Prop | Type | Default |
|---|---|---|
onsubmit | ({ email, password, remember }) => Promise (required) | |
providers | { id, label, icon? }[] | [] |
onprovider | (id) => void | |
forgotHref, signUpHref | string | |
title, description | string | 'Sign in', 'Welcome back.' |
SignUp
| Prop | Type | Default |
|---|---|---|
onsubmit | ({ name, email, password }) => Promise (required) | |
termsHref | string: adds a terms box to tick | |
minLength | number | 10 |
providers, onprovider, signInHref | as SignIn |
ForgotPassword
| Prop | Type | Default |
|---|---|---|
onsubmit | (email) => Promise (required) | |
cooldown | number: seconds before sending again | 60 |
signInHref | string |
ResetPassword
| Prop | Type | Default |
|---|---|---|
onsubmit | (password) => Promise (required) | |
minLength | number | 10 |
signInHref | string |
VerifyCode
| Prop | Type | Default |
|---|---|---|
onsubmit | (code) => Promise (required) | |
onresend | () => Promise | |
sentTo | string: where the code went | |
length, cooldown | number | 6, 60 |
Accessibility
- Real forms with the right autocomplete on every field, so password managers fill them and SMS codes autofill.
- Mistakes are joined to their field and read out; the first one gets focus on submit.
- Refusals and success are announced; after a success, focus moves to the message.
- Forgot password never says whether an account exists, so the form can't be used to find out.
- The resend countdown is read as seconds, not a ticking clock.
- With reduced motion, the confirmations appear without rising in.