MMORPG Account
@rpgjs/account is an optional MMORPG-only module. It renders a replaceable
CanvasEngine account GUI before the first WebSocket connection. Your application
continues to own its HTTP API, database, password policy, and token format.
@rpgjs/ui-css/index.css for the default semantic styles. A custom
CanvasEngine or Vue GUI can replace the component through the component and
renderer options while reusing submitAccount(), accountSession,
accountPending, accountError, and signOut().
Tokens are stored in localStorage by default. This persists the account across
browser restarts but means an XSS vulnerability could read it. Use a strict CSP,
avoid unsafe script injection, and provide another storage implementation when
your security model requires one. Passwords are only passed to the configured
adapter and are never stored by the module.
The default registration form asks for a distinct username and email, plus a
password confirmation. Confirmation is checked client-side before signUp is
called. Username and email uniqueness must still be enforced by the account
endpoint; client validation is never authoritative.
After the server accepts the token, the account GUI closes and the normal RPGJS
flow continues. A server-provided title screen can then offer Start or Load;
authentication does not select or load a save slot.
Branding and sound
The built-in GUI acceptstitle, subtitle, backgroundImage (URL),
backgroundMusic (registered RPGJS sound ID), and
sounds: { open, navigate, confirm, error } (registered sound IDs). Missing
sound overrides use the engine’s configured UI cues. Register the assets using
the normal client sound configuration. Music uses the engine music controller
and is released when the account screen closes; browser autoplay restrictions
still apply until the first player interaction.
Password recovery
ProvidingforgotPassword enables the email request form. Providing
resetPassword enables the recovery-code/new-password form. Both adapters
return Promise<void>; recovery does not authenticate or open a WebSocket.
Pass an optional resetToken from your application’s email-link routing to open
the reset form directly, even when a session token is stored.
The server must issue expiring, single-use codes, enforce its password policy,
and return the same request response for known and unknown email addresses.
The old password is never retrieved or displayed. Successful reset returns the
player to sign-in. Adapter errors may throw { key, params } for localized
feedback. The generic fallback does not expose raw server errors.
Shared CSS primitives include rpg-ui-form-grid, rpg-ui-form-field,
rpg-ui-form-hint, rpg-ui-form-feedback (data-tone="error|success"),
rpg-ui-form-actions, and rpg-ui-text-button. Storybook’s
Compositions / Account covers login, registration, recovery, reset and feedback.
When a stored token exists, the account GUI remains hidden while the session is
restored. A successful restoration therefore opens the title screen directly,
without flashing the account form first.