Oh that’s interesting. It’s not possible, but I like the idea!
I think it may become too complex to manage in a generalized way, as the user id field is used for more than just authentication. Also there may be some security issues I haven’t thought of.
It doesn’t require much effort to currently set up multiple user id field authentication though:
defmodule MyApp.Users do
alias MyApp.{Repo, Users.User}
import Ecto.Query, only: [from: 2]
use Pow.Ecto.Context,
repo: Repo,
user: User
def authenticate(params) do
user_id = params["user_id"]
password = params["password"]
user_id
|> get_by_user_id()
|> maybe_verify_password(password)
end
defp get_by_user_id(user_id) do
query =
from u in User,
where: u.email == ^user_id or u.pseudo == ^user_id or u.phone == ^pseudo
Repo.one(query)
end
defp maybe_verify_password(nil, _pasword), do: nil
defp maybe_verify_password(user, password) do
case User.verify_password(user, password) do
true -> user
false -> nil
end
end
end
I’m going to work on WebAuthn at some point which may make it possible to sign in without a user id. I’ve added this comment to the github issue to remind me when I’ll refactor the auth flow. Thanks for the suggestion!
Edit: Another option is instead to have something like :authentication_user_id_fields that’s used exclusively for authentication.
