I followed the tutorial to setup Ash Authentication.

I have the following:

router.ex

...
  scope "/", WfdBaseWeb do
    pipe_through :browser

    get "/", PageController, :home

    sign_in_route(on_mount: [{WfdBaseWeb.LiveUserAuth, :live_no_user}])
    sign_out_route AuthController

    auth_routes_for WfdBase.Accounts.User, to: AuthController
    reset_route []

    ash_authentication_live_session :authentication_optional,
      on_mount: {WfdBaseWeb.LiveUserAuth, :live_user_optional} do
      live "/app", App
    end
...
  end

The helper for liveview:

defmodule WfdBaseWeb.LiveUserAuth do
  @moduledoc """
  Helpers for authenticating users in LiveViews.
  """

  import Phoenix.Component
  use WfdBaseWeb, :verified_routes

  def on_mount(:live_user_optional, _params, _session, socket) do
    if socket.assigns[:current_user] do
      {:cont, socket}
    else
      {:cont, assign(socket, :current_user, nil)}
    end
  end

  def on_mount(:live_user_required, _params, _session, socket) do
    if socket.assigns[:current_user] do
      {:cont, socket}
    else
      {:halt, Phoenix.LiveView.redirect(socket, to: ~p"/sign-in")}
    end
  end

  def on_mount(:live_no_user, _params, _session, socket) do
    if socket.assigns[:current_user] do
      {:halt, Phoenix.LiveView.redirect(socket, to: ~p"/")}
    else
      {:cont, assign(socket, :current_user, nil)}
    end
  end
end

My controller:

defmodule WfdBaseWeb.AuthController do
  use WfdBaseWeb, :controller
  use AshAuthentication.Phoenix.Controller

  def success(conn, _activity, user, _token) do
    return_to = get_session(conn, :return_to) || ~p"/app"

    conn
    |> delete_session(:return_to)
    |> store_in_session(user)
    |> assign(:current_user, user)
    |> redirect(to: return_to)
  end

  def failure(conn, _activity, _reason) do
    conn
    |> put_status(401)
    |> render("failure.html")
  end

  def sign_out(conn, _params) do
    return_to = get_session(conn, :return_to) || ~p"/"

    conn
    |> clear_session()
    |> redirect(to: return_to)
  end
end

And my failure markup file at lib/wfd_base_web/controllers/auth_html/failure.html.heex

Signing in with a existing user and correct credentials works fine and redirects to /app as I expect.

The problem is that when I submit wrong credentials, I still get redirected to /app, which is not right, I expect a redirect to failure.html

Looking at /routes, there is no route for the failure page, is that expected ? how is this usually handled ?

Is there documentation on how to do this ?