ash-authentication

name	ash-authentication
description	AshAuthentication guidelines for implementing authentication in Ash Framework. Use when adding password, magic link, API key, or OAuth2 authentication strategies. Covers token configuration, UserIdentity resources, confirmation add-ons, and customizing authentication actions. Never hardcode credentials.

AshAuthentication Guidelines

Core Concepts

• Strategies: password, magic_link, api_key, OAuth2 (github, google, auth0, apple, oidc, slack)
• Tokens: JWT for stateless authentication
• UserIdentity: Links users to OAuth2 providers (optional, required for multiple providers per user)
• Add-ons: confirmation, logout-everywhere

Key Principles

• Never hardcode credentials - always use secrets management
• Enable tokens for magic_link, confirmation, OAuth2
• Check existing strategies: AshAuthentication.Info.strategies(MyApp.User)

Password Strategy

authentication do
  strategies do
    password :password do
      identity_field :email
      hashed_password_field :hashed_password
      resettable do
        sender MyApp.PasswordResetSender
      end
    end
  end
end

# Required attributes
attributes do
  attribute :email, :ci_string, allow_nil?: false, public?: true
  attribute :hashed_password, :string, allow_nil?: false, sensitive?: true
end

identities do
  identity :unique_email, [:email]
end

Magic Link Strategy

authentication do
  strategies do
    magic_link do
      identity_field :email
      sender MyApp.MagicLinkSender
    end
  end
end

# Sender implementation required
defmodule MyApp.MagicLinkSender do
  use AshAuthentication.Sender

  def send(user_or_email, token, _opts) do
    MyApp.Emails.deliver_magic_link(user_or_email, token)
  end
end

API Key Strategy