Auth framework: need advice based on a list of prerequisites

Just a sidenote: Pow installer can be used easily in umbrella setups. You have to run mix pow.ecto.install -r MyApp.Repo in your ecto app and mix pow.phoenix.install -r MyApp.Repo in your phoenix app.

It’s impossible to know what kind of umbrella setup a project is, so this can’t be done automatically. However I think it would be useful to show a notice about how to do this when running pow.install in the umbrella app root.

I almost exclusively work with umbrella apps myself

Great tidbits! I will try those.

As for an installer, I would think something like mix pow.install --umbrella --new_app pow_auth could be enough? I don’t mean that your installer has to parse the structure of the umbrella app, no – I mean that with some more CLI options as you showed above, the Pow installer can just create an entirely separate app inside the umbrella that’s exclusively used for authentication with Pow?

Sorry if I am misunderstanding.

EDIT: I keep forgetting that eventually you do have to edit your web app’s router.ex file though.

Unfortunately that would require that Pow also creates a Phoenix app which is outside the scope of the Pow mix tasks. Most of the time you would want to have you sign in and registration views the same place as your default Phoenix app.

I understand. But as an unfortunate side effect any auth library one picks up becomes a strongly entrenched dependency inside your web app’s files which you cannot easily replace if something else is serving you better down the line.

True. It’s been something I’ve experienced with other authentication libraries for Elixir/Phoenix, so I’ve tried to make a very transparent API for Pow that makes it easier to replace if something fits better down the line. The goal has been to have as few files as possible generated or modified, and make any developer understand how Pow works by taking it step by step to e.g. enable extensions, or modify templates.

With umbrella apps it’s possible to limit this, but you’ll have to work with multiple Phoenix apps, endpoints, cross check sessions, etc, and at that point a detached authentication server may make more sense.

Outside of Pow and Guardian, the other authentication library/framework I’ve liked in this space is Phauxth. There’s been some recent updates, and the code is easy to read and well documented, so at least worth reading through if you’re planning on spinning your own authentication solution.

I’ve got a greenfield application scoped out that will need similar admin-invite capabilities, so I’m interested to see what solution you work out.

If you’re willing to accept a token-based approach, I created Authex. It has support for authentication + authorization, is pretty minimal in its approach, and is umbrella friendly. It may work depending on your needs.

https://github.com/nsweeting/authex

I’m really interested in what you don’t like? Are you not using the standard web structure?

Yes that is the downside of caching the user data. I’ve never come across the issue of a stale belongs_to, but completely understand the issue. The choices are either fetch the preloaded user schema on each request, or calling the API to update the cache.

BTW, if you want to fetch the user on each request, you could to that with a plug pretty easy. No changes to Coherence.

# lib/my_app_web/router.ex
def reload_user_data(%{assigns: %{current_user: %{id: id}}} = conn, _) do
    user = MyApp.Repo.get(id, preload: [...])
    assign(conn, :current_user, user)
end

def reload_user_data(conn, _) do
  conn
end

and then put that plug after the coherence plugs in each of your pipelines

Yes it is. Just don’t install the registerable option. This way, new accounts are either created somewhere in your app, or by sending them an invitation.

BTW, I have just overhauled custom controllers. The generated controllers are now < 10 lines long, with all the supporting actions and helpers overridable.

Thanks for sharing your experience with Coherence.

Apologies to everyone for the silence, I will respond properly when I get some free time somewhere in the next 24h.

https://github.com/AppDoctorIo/accesspass

My library should be able to cover all your use cases as it offers a vast amount of customization via a behavior. There are still some github issues I want to get to in the future that would make it an even better fit but it absolutely can do everything your looking for now in a fairly easy way. I should note that it is for api authentication and would still need a ui built around it. I made it for my project https://appdoctor.io . I currently only allow new accounts with a provided beta code. You can do much the same thing via your email strategy mentioned.

Here is a post I did a while back going into more detail on why I made it:

https://medium.com/appdoctor/accesspass-yet-another-elixir-authentication-library-7ea59734a49

and any pull requests/contribution is VERY welcome!

A big plus at least for me is ease of use in a new project. It provides a drop in plug and macro to handle everything in 3 lines of code for auth.

Also mind you this solution was originally not made to be open sourced so a lot of the current github issues deal with braking away from what I had as original defaults.