Ash Authentication – Generated UI and multiple auth Resources

BryanJBryce · January 15, 2025, 2:00am

I realize this is pushing the boundaries of tested space for this library, but I’ve got two Auth resources (Admin and User, one is global the other schema-based both with their own token tables) and I’m trying to figure out how to use the generate UI with them, but have them be separated. The default when you do that is this fun UI:

I tried this:

 scope "/admin", AppWeb do
    pipe_through :browser

    auth_routes AdminAuthController, App.Accounts.Admin,
      path: "/admin/auth",
      sign_in_path: "/admin/sign-in",
      register_path: nil,
      reset_path: "/admin/reset"
  end

  scope "/", AppWeb do
    pipe_through :browser

    # User authentication routes
    auth_routes AuthController, App.Accounts.User,
      path: "/auth",
      sign_in_path: "/sign-in",
      register_path: "/register",
      reset_path: "/reset"

No dice:

== Compilation error in file lib/app_web/router.ex ==
** (ArgumentError) AshAuthentication.Phoenix.StrategyRouter has already been forwarded to. A module can only be forwarded a single time
(phoenix 1.7.18) lib/phoenix/router/scope.ex:87: Phoenix.Router.Scope.register_forwards/3
(phoenix 1.7.18) lib/phoenix/router/scope.ex:58: Phoenix.Router.Scope.route/8
lib/app_web/router.ex:74: (module)

zachdaniel · January 15, 2025, 2:44am

A module can only be forwarded to a single time??? This is news to me

Looking into it there are certain kinds of workarounds that could be done:

github.com/graphql-elixir/plug_graphql

Workaround double `forward` error

opened 04:23PM - 16 Dec 15 UTC

joshprice

Phoenix errors when a second `forward` is declared to the same Plug. This can be… worked around by wrapping the `GraphQL.Plug.Endpoint` with configuration in a new module Plug. ``` elixir forward "/hello", GraphQL.Plug.Endpoint, schema: {GraphQL.Schema.HelloWorld, :schema} forward "/blog", GraphQL.Plug.Endpoint, schema: {GraphQL.Schema.SimpleBlog, :schema} ``` Gives this error: ``` elixir == Compilation error on file web/router.ex == ** (ArgumentError) `GraphQL.Plug.Endpoint` has already been forwarded to. A module can only be forwarded a single time. (phoenix) lib/phoenix/router/route.ex:171: Phoenix.Router.Route.forward_path_segments/3 web/router.ex:29: (module) (stdlib) erl_eval.erl:669: :erl_eval.do_apply/6 (elixir) lib/kernel/parallel_compiler.ex:100: anonymous fn/4 in Kernel.ParallelCompiler.spawn_compilers/8 ``` Arguably this may be a bug in Phoenix, as this seems like a reasonable thing to do... There are 2 workarounds: 1. The plug wrapper workaround (suggested by @chrismccord) which hides the identity of the underlying plug ``` elixir # Hello World wrapper defmodule HelloWorld do plug GraphQL.Plug.Endpoint, schema: {GraphQL.Schema.HelloWorld, :schema} end # Simple Blog wrapper defmodule SimpleBlog do plug GraphQL.Plug.Endpoint, schema: {GraphQL.Schema.SimpleBlog, :schema} end forward "/hello", HelloWorld forward "/blog", SimpleBlog ``` 2. This is the `get`/`post` workaround which avoids `forward` altogether, losing ability to handle other HTTP verbs. ``` elixir # Hello World example get "/hello", GraphQL.Plug.Endpoint, schema: {GraphQL.Schema.HelloWorld, :schema} post "/hello", GraphQL.Plug.Endpoint, schema: {GraphQL.Schema.HelloWorld, :schema} # Simple Blog example get "/blog", GraphQL.Plug.Endpoint, schema: {GraphQL.Schema.SimpleBlog, :schema} post "/blog", GraphQL.Plug.Endpoint, schema: {GraphQL.Schema.SimpleBlog, :schema} ``` The error is fired here and perhaps could account for differing configuration? https://github.com/phoenixframework/phoenix/blob/master/lib/phoenix/router/route.ex#L170-L172

but honestly nothing I can think of that is something that you could apply yourself in this situation. I would first really like to understand why you can’t forward to the same plug multiple times from different routes??

BryanJBryce · January 15, 2025, 2:47am

Right?!

jimsynz · January 15, 2025, 2:48am

that is so goddamn weird.

zachdaniel · January 15, 2025, 2:54am

I’ve pushed something up to main that you can try.

First define a plug that wraps AshAuthentication.Phoenix.StrategyRouter like so:

defmodule MyPlugThatShouldNotBeNecessary do
  defdelegate init(opts), to: AshAuthentication.Phoenix.StrategyRouter
  defdelegate call(conn, opts), to: AshAuthentication.Phoenix.StrategyRouter
end

then in your second call to auth_routes add strategy_router_plug: MyPlugThatShouldNotBeNecessary

This seems like a very strange limitation, but this should get you around it. If you wouldn’t mind, a PR with docs for this or an issue reminding us to add some docs around it would be great.

BryanJBryce · January 15, 2025, 2:55am

I’ll get that done