Magic Link with a Mobile application (universal links, jwt)

I am trying to authenticate my users in a mobile app via email-based Magic Link provided by Ash. The idea is to use Universal Links/AppLinks. The user taps their email like in a web version of the magic link, he receives an email, click on va magic link and with Universal/App links, the application is opened instead of the browser. The mobile application receive the “magic link token”, and then I can ask for an exchange with a JWT token. I also would like to keep the magic link behavior for the web part and creating the user if he does not exist.

What I have done:

• I generated a fresh Ash project with MagicLink authentication (no password strategy)
• Universal/App links work
• I created a new endpoint under the apipipeline to disable the CSRF for that endpoint and request a magic login link: /mobile/auth/magic-link/request. It works, but I am not sure I do it the Ash way.
• Same for login with mobile magic link.

Here is my controller:

  def request_mobile_magic_link(conn, %{"email" => email}) when is_binary(email) do
    input =
      User
      |> Ash.ActionInput.for_action(:request_magic_link, %{email: email})
      |> Ash.ActionInput.set_context(%{private: %{ash_authentication?: true}})

    case Ash.run_action(input) do
      :ok ->
        send_resp(conn, :ok, "")

      {:error, error} ->
        Logger.warning("request_magic_link error: #{Exception.message(error)}")
        send_resp(conn, :ok, "")
    end
  end

  def sign_in_with_mobile_magic_link(conn, %{"token" => _token} = params) do
    User
    |> Ash.Changeset.for_create(:sign_in_with_magic_link, params)
    |> Ash.Changeset.set_context(%{private: %{ash_authentication?: true}})
    |> Ash.create()
    |> case do
          {:ok, record} ->
            {:ok, token, _claims} = AshAuthentication.Jwt.token_for_user(record, %{})

            conn
            |> put_resp_header("content-type", "application/json")
            |> send_resp(:ok, JSON.encode!(%{token: token}))

          {:error, error} ->
            {:error,
             AshAuthentication.Errors.AuthenticationFailed.exception(
               strategy: AshAuthentication.Strategy.MagicLink,
               caused_by: error
             )}
        end
  end

I add to set the context with %{private: %{ash_authentication?: true}}in both methods otherwise I received a forbidden error due to the forbid_if always()policy, except for the bypass ash_authentication/lib/ash_authentication/checks/ash_authentication_interaction.ex at main · team-alembic/ash_authentication · GitHub

I created another endpoint to login from mobile, as I want to keep the magic login link from web, and I want to return a JWT token on success.

Should I create another bypass, or is it fine to set a private key?

I need two different emails depending if the user is requesting a magic link from the mobile app or from the web app. I would like to pass a mobile?: trueoption to the third argument of the sendmethod but I do not find how to achieve that? I tried to add it to the context.

Here is the action on the User resource (generated by Ash):

    create :sign_in_with_magic_link do
      description "Sign in or register a user with magic link."

      argument :token, :string do
        description "The token from the magic link that was sent to the user"
        allow_nil? false
      end

      upsert? true
      upsert_identity :unique_email
      upsert_fields [:email]

      # Uses the information from the token to create or sign in the user
      change AshAuthentication.Strategy.MagicLink.SignInChange

      metadata :token, :string do
        allow_nil? false
      end
    end

I do not understand the purpose of “metadata :token, :string …” and I didn’t find doc about this. Could someone explain me or point me to a doc/blog post?

It also seems that the AshAuthentication.Strategy.MagicLink.SignInChange, put a JWT token under the metadata of the resource but I am not able to retrieve it with resource.__meta__.token. This is the reason why I generated one in the controller.

Finally, I would like to know if this is the correct Ash way to do things or if I miss something more obvious.

I’m new to Ash, so I admit I’m still struggling with some concepts. Feel free to redirect me to the right documentation resource.