From the admin invite only standpoint, why not just put the sign up page behind admin access requirements? If an admin fills in the details and email address then the user can get the registration link to continue the process from there.
That part should be pretty simple to solve regardless of solution.
Mostly because, as much as I worked with Elixir so far (soon 2 years), it hasn’t been with Phoenix at all. I was working on API gateways behind Guardian (and one of the customers already had a dedicated auth server). I also worked on various data crawlers and a lot of background tasks gated behind pools. So my exposure to this topic in Elixir land has been extremely limited. And when I found myself in a need of a quick solution, I have to fight an uphill battle to (a) inform myself of all the alternatives in a short time frame and (b) still work extra to custom-tailor them to my needs.
It’s hard to complain – at least there is a choice and all the libraries seem really well-made. But now I have to evaluate several other solutions with a time I don’t have (so I am using part of my otherwise free time). As much as I hate Rails, libraries like Devise can and do save time when you are building MVPs / prototypes / alpha versions.
Things are moving too fast for me to give you a good breakdown (because half my complaints I don’t even remember now), but in a nutshell: I have to go my non-web and web app directories and execute commands there separately. My chief complaint was that I could do everything in myapp but when I wanted to get the generated controllers I had to go to myapp_web. And then they went into the wrong directory myapp_web/lib/_web for some reason (the generator didn’t detect the myapp part).
I would very much appreciate if community-made Phoenix generators – not only Coherence – allow the user to specify the app they want to inject the code into and to auto-detect the web app (scanning dependencies to look for phoenix, looking for MyApp.Web module, looking where router.ex is). It’s not a big deal per se but requires extra attention and it’s good that your mix tasks give proper informative output (kudos for that!) otherwise I’d be very quickly lost.
Do you mind repeating here on how I can do that? I looked at the docs and the way it was described there was the first thing I tried but it didn’t work for me. One of the things I also tried was fiddle with the functions in the schemas.ex – doing Repo.preload there worked immediately. I eventually settled for the generated controllers and overriding their private current_user function. I am looking at something as simple as updating the user and their attached belongs_to object (only when needed).
See, this is what only working with the domain / business logic code nets you. I keep forgetting about the beauties of Plug. Thanks for giving me a reality check!
That’s what I thought as well but haven’t tried it yet. Thanks for confirming. 
Do you have a recommendation on how can I update my already generated controllers? Or is it just mix coh.install --reinstall and git diff after?
BTW, Coherence is still at 0.5.2 for me and Hex claims there’s no newer version. Should I be using the git master version to get the latest changes or are you releasing a new version soon?
Thanks a lot for being responsive!
I am not sure I remember well but weren’t JWT tokens all based off of the same secret? In a few other auth frameworks (not only in Elixir) every user has their own signing salt / secret which I feel is more secure.
Also, how does it deal with token revocation?
Your library looks promising. A few questions:
poison with jason as others did (including the core team)?schemas.ex file for you and you can just fetch users and other related data from practically anywhere if you change the functions. Enforcing such an external module via a behaviour would be even better.I have to say that I read your README in GitHub and your linked article. I love your approach and was gravitating to something very similar myself. It’s just that the added views from other libraries are quite tempting and I am not sure I wanna reinvent them (but it might turn out easy).
I’ll keep this thread updated on what I choose and why. Haven’t made the choice yet, still making test apps and trying to evaluate objectively.
I totally get that. I will most likely replace poison with jason in a coming version as to not add another dependency to new Phoenix applications. As for working with any schema it is a top priority in the rewrite currently going on as I realize my opinionated approach is a clear turnoff to some applications. Keep a look out and best of luck with what you chose!
Check Entrance 
https://github.com/henriquefernandez/entrance
Modules and functions to make authentication with Plug / Phoenix and Ecto easy without tons of configuration or boxing users into rigid framework.
The primary goal of Entrance is to build an opinionated interface and easy to use API on top of flexible modules that can also be used directly.
Will do, thank you.
Although I’d be more charitable if I were you. Immediately dissing your competitor libraries as “rigid and bloated” is not competing in good faith.