[SantiSev]

Summary

Resolved this issue: FeedTheRealm-org/game#320

• Refactored the AuthFlow Manager
• Added a new Password reset handle

Related PRs

• US-101: Password Reset core-service#88
• US-101: Password Reset world-editor#121
• US-101: Password Reset game#334

AuthFlowManager — How it works

AuthFlowManager is the single coordinator for all authentication screens. It lives on a parent GameObject with each auth panel as a child GameObject.

Panel management

Each panel (Login, SignUp, VerifyNewAccount, AccountRecovery) is registered in a Dictionary<AuthPanel, GameObject> at startup. ShowPanel(AuthPanel) deactivates the current panel and activates the requested one — only one panel is ever active at a time.

Initialization

On Awake, all panels are disabled and each one's IAuth component is initialized via InitializeAuthComponent, which injects the shared dependencies (AuthService, Session, Logger, and the manager itself) into each controller. This means controllers never need to hold serialized references to services — they receive everything through IAuth.Initialize.

Flow completion

• AuthCompletion(message) — called when login or signup succeeds. Disables all panels and fires OnAuthComplete with a success message for external listeners (e.g. the main menu UI) to react to.
• PasswordResetCompletion(message) — called when account recovery completes. Fires OnPasswordResetComplete without closing the flow, allowing the UI to show a confirmation before returning to login.
• CancelAuth() — called when the user closes any panel. Disables everything and fires OnAuthCancelled.

AccountRecovery

The recovery flow (forgot password → verify code → new password) is handled entirely inside a single AccountRecoveryController with 3 internal steps shown/hidden by the controller itself. From AuthFlowManager's perspective it's just one panel — no extra states needed.

[Copilot]

Pull request overview

This PR refactors the authentication UI into a new AuthFlow prefab-based flow and adds password reset/account recovery support backed by new AuthService endpoints.

Changes:

• Replaces the old AuthMenu assets/controllers with a new AuthFlow structure, prefab, panel settings, and shared styles.
• Adds account recovery UI/controller flow for forgot password, reset-code verification, and new password submission.
• Extends auth API DTOs and AuthService with forgot-password, verify-reset-code, and reset-password methods.

Reviewed changes

Copilot reviewed 30 out of 47 changed files in this pull request and generated 9 comments.

Show a summary per file

File	Description
Runtime/UI/AuthMenu/Themes/VerifyCodeMenu.uxml	Removes old verify-code UXML.
Runtime/UI/AuthMenu/Themes/SignUpMenu.uxml	Removes old signup UXML.
Runtime/UI/AuthMenu/Themes/LoginMenu.uxml	Removes old login UXML.
Runtime/UI/AuthMenu/Themes/LoginBackground.uxml	Removes old login background UXML.
Runtime/UI/AuthMenu/Themes/AuthForm.uss	Removes old auth stylesheet.
Runtime/UI/AuthMenu/Themes/auth_bg.jpg.meta	Removes old auth background metadata.
Runtime/UI/AuthMenu/Scripts/VerifyCodeController.cs	Removes old verify-code controller.
Runtime/UI/AuthMenu/Scripts/IAuthUIController.cs	Removes old auth UI controller interface.
Runtime/UI/AuthMenu/Scripts/AuthFlowManager.cs	Removes old non-MonoBehaviour auth flow manager.
Runtime/UI/AuthFlow/Themes/VerifyCodeMenu.uxml.meta	Adds verify-code UXML metadata.
Runtime/UI/AuthFlow/Themes/VerifyCodeMenu.uxml	Adds new verify-code panel markup.
Runtime/UI/AuthFlow/Themes/SignUpMenu.uxml.meta	Adds signup UXML metadata.
Runtime/UI/AuthFlow/Themes/SignUpMenu.uxml	Adds new signup panel markup.
Runtime/UI/AuthFlow/Themes/Settings/SharedPackageDefaultTheme.tss.meta	Adds default theme metadata.
Runtime/UI/AuthFlow/Themes/Settings/SharedPackageDefaultTheme.tss	Adds default UI Toolkit theme import.
Runtime/UI/AuthFlow/Themes/Settings/AuthFlow.asset.meta	Adds panel settings metadata.
Runtime/UI/AuthFlow/Themes/Settings/AuthFlow.asset	Adds AuthFlow UI Toolkit panel settings.
Runtime/UI/AuthFlow/Themes/Settings.meta	Adds settings folder metadata.
Runtime/UI/AuthFlow/Themes/LoginMenu.uxml.meta	Adds login UXML metadata.
Runtime/UI/AuthFlow/Themes/LoginMenu.uxml	Adds new login panel markup with recovery link.
Runtime/UI/AuthFlow/Themes/AuthStyles.uss.meta	Adds shared auth stylesheet metadata.
Runtime/UI/AuthFlow/Themes/AuthStyles.uss	Adds shared AuthFlow styling.
Runtime/UI/AuthFlow/Themes/AccountRecovery.uxml.meta	Updates account recovery UXML metadata.
Runtime/UI/AuthFlow/Themes/AccountRecovery.uxml	Adds account recovery multi-step markup.
Runtime/UI/AuthFlow/Themes.meta	Adds themes folder metadata.
Runtime/UI/AuthFlow/Scripts/VerifyCodeController.cs.meta	Adds verify-code controller metadata.
Runtime/UI/AuthFlow/Scripts/VerifyCodeController.cs	Adds new initialized verify-code controller.
Runtime/UI/AuthFlow/Scripts/SignUpController.cs.meta	Adds signup controller metadata.
Runtime/UI/AuthFlow/Scripts/SignUpController.cs	Refactors signup controller for AuthFlowManager injection.
Runtime/UI/AuthFlow/Scripts/LoginController.cs.meta	Adds login controller metadata.
Runtime/UI/AuthFlow/Scripts/LoginController.cs	Refactors login controller and adds recovery navigation.
Runtime/UI/AuthFlow/Scripts/IAuth.cs.meta	Adds new auth interface metadata.
Runtime/UI/AuthFlow/Scripts/IAuth.cs	Adds shared initialization interface for auth panels.
Runtime/UI/AuthFlow/Scripts/AuthFlowManager.cs.meta	Updates AuthFlowManager metadata.
Runtime/UI/AuthFlow/Scripts/AuthFlowManager.cs	Adds MonoBehaviour auth panel coordinator.
Runtime/UI/AuthFlow/Scripts/AccountRecoveryController.cs.meta	Adds account recovery controller metadata.
Runtime/UI/AuthFlow/Scripts/AccountRecoveryController.cs	Adds forgot/reset password controller logic.
Runtime/UI/AuthFlow/Scripts.meta	Adds scripts folder metadata.
Runtime/UI/AuthFlow/AuthFlow.prefab.meta	Adds AuthFlow prefab metadata.
Runtime/UI/AuthFlow/AuthFlow.prefab	Adds prefab wiring panels, documents, and controllers.
Runtime/UI/AuthFlow.meta	Adds AuthFlow folder metadata.
Runtime/Data/Loggers/AuthLogger.asset.meta	Adds auth logger metadata.
Runtime/Data/Loggers/AuthLogger.asset	Adds auth-specific logger asset.
Runtime/Data/Loggers.meta	Adds loggers folder metadata.
Runtime/Core/Systems/API/DTOs/AuthDTOs.cs	Adds password reset request/response DTOs.
Runtime/Core/Systems/API/AuthService.cs	Adds password reset API calls.

Files not reviewed (5)

• Runtime/Data/Loggers.meta: Language not supported
• Runtime/Data/Loggers/AuthLogger.asset.meta: Language not supported
• Runtime/UI/AuthFlow/AuthFlow.prefab.meta: Language not supported
• Runtime/UI/AuthFlow/Scripts/AccountRecoveryController.cs.meta: Language not supported
• Runtime/UI/AuthFlow/Themes/Settings.meta: Language not supported

Comments suppressed due to low confidence (3)

Runtime/Core/Systems/API/AuthService.cs:470

• Passing a log prefix here makes BaseApiService log the raw reset payload, which includes both the reset token and the user's new password. Password reset requests should avoid raw body logging or redact these fields before logging.

            (string responseText, UnityWebRequest.Result result, long statusCode) =
                await SendRequestAsync(url, "POST", null, json, "ResetPassword");

Runtime/UI/AuthFlow/Scripts/AccountRecoveryController.cs:70

• This BackToLogin handler is registered every time the panel is enabled, but OnDisable never unregisters it. Reopening account recovery will accumulate duplicate callbacks on the button.

        _stepVerifyCode.Q<Button>("BackToLoginButton").clicked += OnBackToLogin;

Runtime/UI/AuthFlow/Scripts/AccountRecoveryController.cs:77

• This BackToLogin handler is registered every time the panel is enabled, but OnDisable never unregisters it. Reopening account recovery will accumulate duplicate callbacks on the button.

        _stepNewPassword.Q<Button>("BackToLoginButton").clicked += OnBackToLogin;

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.