danschultzer
None of the current solutions worked well for me, so I went ahead and built a user management system from scratch.
This project took far longer than I initially thought, and I would love to get some help to iron out everything. So please try it out and let me know what you think!
https://github.com/danschultzer/pow
https://hexdocs.pm/pow/
The latest release is a pre release version, but it is running in a production environment (we went away from a Coherence setup).
So what does Pow do (differently)?
Functional configuration
A huge issue with most libraries is the dependency on a global environment configuration. It becomes especially messy when dealing with umbrella apps. Pow handles configuration by passing it as an argument to all method calls (and with plug it’s passed in a private key). There’s also fallback to app-specific environment configuration by using :otp_app like Ecto/Phoenix.
Plug n’ play
Pow exposes only necessary files. It means that even views and templates for Phoenix aren’t generated unless required for customization.
Modular
Pow has been build with clear separation between Ecto, Plug, and Phoenix modules, so if/when deep customization is necessary, you can pull out any part and work with it.
Extendable
Out of the box, Pow does basic user and session management. But Pow has been made to be easy to extend. A reset password, email confirmation and remember me extension ships with it! Extensions are built as a separate system to keep the core of Pow lean and easy to understand.
Security
When working with user authentication, there can be many pitfalls. That’s why your user authentication library should do as much of the work as possible, so you don’t have to think about it. Pow is built with care for recommended best practice, and detailed in the readme.
Transparent
Pow attempts to give the developer full control and understanding of the API for Pow. For example, when you install pow, you’ll have to enable extension support yourself, so you understand the working parts. This it to remove as much “magic” as possible.
And a whole lot more
- Mnesia cache for distributed systems (and in general for production run)
- Near zero dependencies (
:ecto,:phoenixand:phoenix_htmlare currently required to compile, but I plan to make them optional) - Simple migration from Coherence
- Multi provider support with GitHub - pow-auth/pow_assent: Multi-provider authentication for your Pow enabled app · GitHub
- Alright! Go read the documentation already: Pow v1.0.39 — Documentation
Trending in Announcing
Other Trending Topics
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #library
- #deployment
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #elixirconf
- #channels
- #exunit
- #discussion
- #code-sync
- #podcasts
- #javascript
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ai
- #ecto-query
- #elixirconf-us
- #blog-post
- #elixir-ls
- #phoenix_html
- #iex
- #graphql
- #genstage
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #elixirconf-eu
- #api
- #forms
- #security
- #metaprogramming










Showing Posts 241 to 232- Show Best Posts
- Show All (oldest first)
- Show All (newest first)
spurgus
Hi, first of all, thanks for creating this auth library.
Is it still maintained? I’ve seen there hasn’t been a release for more than a year ago and it’s no longer compatible with the latest Phoenix versions. There are PRs for that but seem abandoned.
Thanks!
Kurisu
Hello @danschultzer,
The guide on user roles and authorization through a Plug is great for keeping users from accessing restricted pages but sometimes we would want more radical methods. For example in an umbrella project, I don’t want
front_appusers to be authenticated when trying to login through theadmin_apppage.So I added a custom
authenticatemethod to the admin users context:Maybe there is a better/recommended way to achieve this?
Kurisu
Fortunately erasing the
.elixir_lsfolder and let it be rebuilt made the warning gone. Thanks.NobbZ
The LS uses a bundled/vendored version of dialyxir, just to translate errors that have been found by dialyzer into elixir syntax.
If you want to run dialyzer from the terminal on your own, you will need to add the
dialyxirpackage as a:devdependency to your project.A “has no local return” is often hard to debug and can require knowledge of the full program context and its libraries. More than often, this errors origin was in a library that had some types of its own wrong, or a NIF-stub was not set up correctly.
Kurisu
Thank you all for your replies and for your time.
I think the issue has nothing to do with
Pow. I just replaced theLoadProfilePlugwith another Plug code that does not show any warning in its original context, and the warning remains in theLoadPlugProfile. That is to say no matter the code I put in it, the warning remains. The issue comes probably from the outside of the Plug, maybe because of how I call it? I will be checking that.I feel really sorry for wasting you some time on this.
Thanks
Kurisu
I’m using the vscode extension and it’s marked ElixirLS v0.5.0.
I’m working in an umbrella project and running
mix dyalizerat the root of the umbrealla or in its child app shows:Should I add any dependency?
My initial warning message
Function call/2 has no local return.ElixirLS Dialyzeris shown only in
vscodeeditor. When compiling the project in terminal and runningPhoenix serverI don’t see any warning. I have to say also that I just installed the ElixirLs vscode plugin but didn’t add any configuration.danschultzer
What version of ElixirLS are you using? I just tested with the plug and it doesn’t print any dialyzer warning for me (I also ran
mix dialyzerjust to be sure.). Using ElixirLS 0.2.25.NobbZ
no_returnmeans, this function will never return.Never returning means, it will recurse infinitely.
Raising is always allowed, you do not need to annotate it, we are not doing Java here.
Dialyzer will never complain about a
raisehere or there, as long as it can proove you will return a value of the correct type at least sometimes.It will complain though, if it does not find a way to properly return a value of the correct type, it will tell you something like “function foo does not have a local return”.
Just adding
no_returnas one of the possible return types, tells dialyzer “ignore everything else, this function does not return ever”.So instead of just adding
no_returnyou should think about if that is right, and why dialyzer might think it is that way and then fix the code.Schultzer
I’m not an expert on dialyzer at all, but in the past when I had dialyzer warnings with any function that could raise then ‘no_return()’ has always worked.
But there might be a specific type that encapsule a function that would raise on error or return a value?
I’m intrested in hearing how you have solved these dialyzer warnings on function no_return?
NobbZ
no_return | …doesn’t make sense.Either a function is
no_returnor it is not. But it can’t be both.