Cannot get Ash authentication to work with the JSON API

lcabrini

I have a user resource that looks more or less like that one in the Ash Authentication getting started doc, with one added field: role. Role can be one of admin, merchant, client. Only admins should be able to log in via the web frontend, merchants and clients should only be able to register and “sign in” (that is, receive a token) only via a JSON API.

At this time, I’m only interested in the password strategy.

On the web side, everything works well (registration is disabled, I seed an initial admin, who can log in and create more admins, if needed).

However, I cannot get authentication to work with the JSON API. I have followed the documentation for ash-authentication and ash-json-api as well as peeked at this: Ash authentication on mobile - #11 by lud which is the closest I have found to what I’m looking to do.

Right now I’m not sure if I have completely missunderstood everything or if I’m just missing out on some little part. I was expecting registration to be fairly straight-forward, but not even that seems to be working.

I have created a router as per the getting started guide for ash-json-api. Do I need a controller as well? The documentation says the router partly plays the role of a controller, the forum post above says to add a controller. I’m a bit lost here.

Could somebody explain the steps required to get authentication working together with JSON API? Or even better, if you are working on a project that does this and is open source, I unfortunately seem to be better at reading code than explanations, or so it would seem.

5 comments

/ash #ash-authentication #ash-json-api

0 741 5

2024-04-26 12:37:01 UTC

Showing Posts 1 to 5

Show Best Posts
Show All (oldest first)
Show All (newest first)

zachdaniel

Creator of Ash

This is definitely an area we intend to improve at some point. The tools are all there, it’s just a matter of providing the guidance of how to use them. I will let @jimsynz answer because he is much more familiar with AshAuthentication’s internals than I.

Post #1

lcabrini

Yeah, I’ve noticed that Ash can really do a lot, but that the documentation, especially when it’s outside of the default use cases can be a bit lacking at times. I guess that’s normal for projects that move relatively fast. I’d be happy to help out in any way to rectify that situation.

Post #2

jimsynz

Ash Core Team

Hi there.

Ash Authentication’s dev/test setup includes an example of using JSON:API for password registration. Can you give us more information about what’s not working?

Post #3

lcabrini

Hi. Thanks for the pointer to the dev/test code. I’m looking through to see what I can figure out. To start off I’m trying to get registration to work. This is what I’m currently getting and I’m a little bit stumped, because I think if followed the documentation properly.

$ curl -X POST --data-raw '{"data": {"email": "foo@bar.bim", "password": "f00#b4Rb1mBAzzZ"}}' --header 'Accept: application/vnd.api+json' --header 'Content-Type: application/vnd.api+json' http://localhost:4000/api/accounts/users
{"errors":[{"code":"InvalidBody","id":"6f4fa33a-82ab-4840-a766-34fd349a0b19","status":"400","title":"Invalid Body","source":{"pointer":"data/email"},"detail":"Expected only defined properties, got key [\"data\", \"email\"]."},{"code":"InvalidBody","id":"b9be9233-73fa-4e1a-9188-5ae6d3735ed7","status":"400","title":"Invalid Body","source":{"pointer":"data/password"},"detail":"Expected only defined properties, got key [\"data\", \"password\"]."}],"jsonapi":{"version":"1.0"}}

Clearly I’m missing something or I’ve done something wrong. I just don’t really know what and I’m just running around in a circle at this point.

Post #4

zachdaniel

Creator of Ash

Have you followed the set up for the ash json api open api features? I’d suggest doing that and then you can look at your own api docs to see how it works