You can easily change the user id field like this:
defmodule MyApp.Users.User do
use Ecto.Schema
use Pow.Ecto.Schema, user_id_field: :username
# ...
end
Only caveat is that the user id field should always be unique, since it’s used to sign in.
Well I would like to sign in with email. Just have temporary (thowaway) accounts without email (but a unique ID). At the end of a game a user could provide them email to turn the account into a real one, or the account will be deleted by a scheduled task. There would be no sign in with such an account.
what I usually do in that case is to have the system generate random_id@anon_user.mydomain.com - and then the client/frontend handles not showing that it technically is an email.. and being able to login with random_id/password etc etc.
I’d love to see this too - I converted from coherence and was using their database session storage solution since I’m on Heroku. Right now I’m bypassing the session store altogether by using a custom authorization plug.
For an ecto based cache store, you could leverage foreign keys. I would probably have namespace, key, value, user_id (optional), and expiration columns, and set up invalidator job to clean out expired keys periodically. But be warned, the stores are built to be simple key-value store, so SQL DB isn’t really the right tool.
As an example, when a new session is created, two keys are created/updated, one for the session id, and one for the user. The session id key just contains the key for the user. The user key contains the cached user data and list of session id’s. When a session id is fetched, the user will be fetched from the user key. Could maybe be handled with some pattern matching (e.g. using the namespace value to differentiate) so foreign key can be leveraged.
Changelog: Github
Hex: https://hex.pm/packages/pow/1.0.12
The Mnesia cache backend can now auto join clusters, and Pow.Store.Backend.MnesiaCache.Unsplit can be used to automatically self-heal if network splits occurs.
Read more in the docs:
https://hexdocs.pm/pow/1.0.12/Pow.Store.Backend.MnesiaCache.html
https://hexdocs.pm/pow/1.0.12/Pow.Store.Backend.MnesiaCache.Unsplit.html
Added a guide that explains how you can use Pow in an API: https://hexdocs.pm/pow/1.0.12/api.html
Happy coding 
Great to see that these issues are nicely handled as always. ^^
Now I notice we didn’t think about the problem in the other way. I mean what should happen when an user logged out then clicked on the browser back button ? How to prevent visitors from seeing a page that only authenticated users should see ?
Sorry for just pointing this out wth yet any solution in mind.
Oh now I see it works as expected for pages that require authentication…
The problem is only about pages that do not require authentication but I render a conditional login or logout link on them. Logout shows up on them even if the user logget out but clicked the back button.
So the solution would myabe to have two different pages for this case even if there are almost the same. The second will pass through Pow authentication_required plug.
But this means to duplicate more or less a lot of pages. If someone has a nicer solution, I’m all for. ^^
