Redbaritone
An email shouldn't have to change to be valid
In the current Auth code, the email must change to be valid. This may be true for the two situations the author has in mind: Registering a user and changing one’s email address. But if you change a user one little bit, let’s say you want to add a username field, that code doesn’t work any more. You’re forced to change the email address even if you just want to change your username. Logically, an email address shouldn’t have to change to be valid. Also, the email validations should happen on the field itself, not the whole form. This way, more of the existing code won’t have to change if a user adds other fields.
In my situation, I’m creating a user system where only an administrator can add users. They can’t self-register. This Auth code is making me rewrite code that I don’t feel comfortable rewriting. I know that it could blow up some security concerns the original author had in mind.
Most Liked
steffend
Indeed, those are the only use cases we had in mind for that changeset. For any other cases where you want to change other fields of a user, a separate changeset is the way to go! That’s also why there are separate changesets for confirmation and password change. For an admin interface, you definitely want a custom changeset ![]()
rhcarvalho
I understand it’s normal and expected to have multiple “changeset” helper functions for the different use cases you might have.
Validation is encapsulated in those helpers. If you need to share validations across multiple changeset helpers, create reusable defp validate_foo(changeset, ...) functions (they might group together the validations for one or more fields.
For example, imagine that when an admin creates a user they can set all 10 fields, but if an admin wants to edit a user they are limited to changing 2 fields. The users themselves can edit 6 fields of their accounts, but can never register themselves. This situation I described calls for 3 separate changeset helpers:
create_changesetadmin_edit_changesetself_edit_changeset
Within each, you only cast and validate the fields that are allowed to change in those specific situations.
FlyingNoodle
Any code that is generated is your code.
Feel free to add new changesets etc.
If you don’t feel comfortable writing this code use an existing library instead.
Popular in Proposals: Ideas
Other popular topics
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #deployment
- #library
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #channels
- #elixirconf
- #exunit
- #discussion
- #code-sync
- #javascript
- #podcasts
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #elixir-ls
- #phoenix_html
- #iex
- #blog-post
- #graphql
- #genstage
- #ai
- #websockets
- #supervisor
- #elixirconf-us
- #advent-of-code
- #distillery
- #processes
- #forms
- #api
- #metaprogramming
- #security
- #hex









