AshAuthentication password_reset_with_password fails when called by AshGraphQL

Thanks! That worked great!

Okay, gotcha, so, set identity :unique_email (or whatever the identity is that users use to log in).

Yes, by default it does support the id input, but I disable it with the identity false option.

It is as you said, you shouldn’t need to have to fetch the user to run this action since the whole point is to actually reset the password of an account that you don’t currently have access to.

In any case, here is the action schema

image599×596 49.2 KB

Ah, sorry I’m looking for the graphql schema. Like if you load up the explorer or something like that, I was looking for whether or not it supports an id input, because it should, I think.

EDIT: actually, thinking about this, that doesn’t make sense. It would need to look up a user by email. Might need a consult from @jimsynz on this one.

Just for completness, before what I did to fix this was to create the graphql mutation by hand like this:

    field :password_reset_with_password, type: :logged_user_output do
      arg :input, non_null(:password_reset_with_password_input)

      resolve fn _, %{input: args}, _ ->
        strategy = AshAuthentication.Info.strategy!(User, :password)
        args = args |> Enum.map(fn {k, v} -> {Atom.to_string(k), v} end) |> Enum.into(%{})

        case AshAuthentication.Strategy.Password.Actions.reset(strategy, args, []) do
          {:ok, user} ->
            {:ok, %{user: user, token: user.__metadata__.token}}

          {:error, %{errors: errors}} ->
            errors = Enum.map(errors, &AshGraphql.Error.to_error/1)

            {:ok, %{errors: errors}}

          {:error, %AshAuthentication.Errors.InvalidToken{}} ->
            {:ok, %{errors: [%{code: "invalid_token"}]}}
        end
      end
    end

In this case I’m using AshAuthentication.Strategy.Password.Actions.reset instead of the password_reset_with_password action. But I want to remove this code and just use AshGraphql + AshAuthentication directly in my resource.

It is just the default action AshAuthentication creates when we use the password strategy, here is the generated schema:

%Ash.Resource.Actions.Update{
  name: :password_reset_with_password,
  primary?: false,
  description: nil,
  error_handler: nil,
  accept: [],
  manual: nil,
  manual?: false,
  atomics: [],
  require_attributes: [],
  delay_global_validations?: false,
  skip_global_validations?: false,
  arguments: [
    %Ash.Resource.Actions.Argument{
      allow_nil?: true,
      type: Ash.Type.String,
      name: :reset_token,
      default: nil,
      private?: false,
      sensitive?: true,
      description: nil,
      constraints: [allow_empty?: false, trim?: true]
    },
    %Ash.Resource.Actions.Argument{
      allow_nil?: false,
      type: Ash.Type.String,
      name: :password,
      default: nil,
      private?: false,
      sensitive?: true,
      description: nil,
      constraints: [allow_empty?: false, trim?: true, min_length: 8]
    },
    %Ash.Resource.Actions.Argument{
      allow_nil?: false,
      type: Ash.Type.String,
      name: :password_confirmation,
      default: nil,
      private?: false,
      sensitive?: true,
      description: nil,
      constraints: [allow_empty?: false, trim?: true, min_length: 8]
    }
  ],
  changes: [
    %Ash.Resource.Validation{
      validation: {AshAuthentication.Strategy.Password.ResetTokenValidation,
        []},
      module: AshAuthentication.Strategy.Password.ResetTokenValidation,
      opts: [],
      only_when_valid?: false,
      description: nil,
      message: nil,
      before_action?: false,
      where: [],
      on: []
    },
    %Ash.Resource.Validation{
      validation: {AshAuthentication.Strategy.Password.PasswordConfirmationValidation,
        []},
      module: AshAuthentication.Strategy.Password.PasswordConfirmationValidation,
      opts: [],
      only_when_valid?: false,
      description: nil,
      message: nil,
      before_action?: false,
      where: [],
      on: []
    },
    %Ash.Resource.Change{
      change: {AshAuthentication.Strategy.Password.HashPasswordChange, []},
      on: nil,
      only_when_valid?: false,
      description: nil,
      where: []
    },
    %Ash.Resource.Change{
      change: {AshAuthentication.GenerateTokenChange, []},
      on: nil,
      only_when_valid?: false,
      description: nil,
      where: []
    }
  ],
  reject: [],
  metadata: [
    %Ash.Resource.Actions.Metadata{
      allow_nil?: false,
      type: Ash.Type.String,
      name: :token,
      default: nil,
      description: nil,
      constraints: [allow_empty?: false, trim?: true]
    }
  ],
  transaction?: true,
  touches_resources: [],
  type: :update
}

The only difference from the original is that I added these two changes to it:

change Actions.PasswordResetWithPassword.Changes.RemoveAllTokens,
    where: [action_is(:password_reset_with_password)]

change Actions.PasswordResetWithPassword.Changes.SendEmail,
    where: [action_is(:password_reset_with_password)]

But these, I believe, should not change anything regarding the error I’m getting.

This is pretty strange. With that default setup it should be requiring an id input…what does the generated schema for that action look like?