phx_auth_plus

# Changelog


All notable changes to this project will be documented in this file.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [0.3.2] - 2026-08-23


### Fixed


- Renamed internal module `PhxAuthPlus.Gen.Auth.Test` to `PhxAuthPlus.Gen.Auth.TestFiles` to avoid a name collision with `ExUnit.Test` on macOS, which caused `function create_auth_test/9 is undefined (module PhxAuthPlus.Gen.Auth.Test is not available)` at runtime

## [0.3.1] - 2026-08-23


### Fixed


- Test fixtures `override_token_authenticated_at` and `offset_user_token` were setting `authenticated_at` directly on the `user_tokens` table, but that column does not exist. `authenticated_at` is a virtual field on the `User` schema, derived from `token.inserted_at` in the token verification queries. On macOS with PostgreSQL this caused a "column not found" error; on Windows with SQLite it was silently ignored. Both fixtures now update `inserted_at` instead

## [0.3.0] - 2026-08-19


### Added


- Password reset (forgot password) flow for LiveView mode: `UserForgotPasswordLive` and `UserResetPasswordLive` with routes `/users/forgot-password` and `/users/reset-password/:token`
- "Forgot your password?" link in the login page
- `get_user_by_confirmation_token/1` in the Accounts context for verifying confirmation tokens independently from magic link tokens

### Fixed


- **Email confirmation flow**: `UserConfirmationLive.mount/3` was using `get_user_by_magic_link_token` (context `"login"`) to verify confirmation tokens (context `"confirm"`), causing "invalid or expired" errors. Now tries magic link first, then confirmation token, so both flows work through the same `/users/log-in/:token` route
- **Sudo mode / settings access**: `verify_session_token_query` and `verify_magic_link_token_query` in `UserToken` were not setting the virtual `authenticated_at` field, causing `sudo_mode?/1` to always return `false` and blocking access to `/users/settings` with "You must re-authenticate to access this page." Both queries now select `%{user | authenticated_at: token.inserted_at}`
- **Confirmation + login**: `UserSessionController.create/2` with `_action: "confirmed"` was calling `login_user_by_magic_link` (context `"login"`) on a confirmation token (context `"confirm"`). Now calls `confirm_user/1` then `log_in_user/2` via a dedicated `confirm_and_log_in/2` function

### Changed


- Refactored the monolithic `phx_auth_plus.gen.auth.ex` generator (3333 lines) into 11 focused modules under `PhxAuthPlus.Gen.Auth.*` (Config, Schema, Context, Plug, LiveViews, Controllers, Layout, Router, Migration, Test, UI), with the main task file as a thin orchestrator (214 lines)
- `UserConfirmationLive` error message changed from "Magic link is invalid or it has expired" to "Confirmation link is invalid or it has expired"

## [0.2.0] - 2026-08-19


### Changed


- Aligned LiveViews, session controller, and routes with Phoenix 1.8.9 `phx.gen.auth` templates
- Added magic link authentication alongside password-based login
- Added `update_password` route for password updates from settings
- Added `fetch_current_scope_for_user` plug to the browser pipeline
- Updated `create_auth_test` and `create_accounts_fixtures` for the new auth flow and scope usage
- Made `hashed_password` nullable in the migration (magic link users may not have a password)
- Made `signed_in_path/1` public in `UserAuth`
- Layout header now includes dynamic auth menu (login/register, email/settings/logout)
- Moved hashing test config from the removed `phx_auth_plus.install` task into `phx_auth_plus.gen.auth`
- Updated README and GUIDE to reflect the new architecture (scope system, magic link, file layout)
- Updated token validity: session 14 days (was 60), magic link 15 minutes (new)

### Removed


- `phx_auth_plus.install` task (was auto-triggered by Igniter on `mix deps.get`, interrupting dependency download and compilation). The hashing config is now applied by `phx_auth_plus.gen.auth` directly.

## [0.1.0] - 2026-08-19


### Added


- Complete email + password authentication generator based on Phoenix `phx.gen.auth`
- User schema with registration, email, password, and confirmation changesets
- UserToken schema with session, reset password, confirm, and change email tokens
- UserNotifier for email delivery (confirmation, reset password, change email)
- Accounts context with full auth functions:
  - Registration and session management
  - Password reset (forgot password flow)
  - Account confirmation by email
  - Email change with confirmation
  - Password change with current password validation
- UserAuth plug with:
  - `log_in_user` / `log_out_user` with session renewal
  - "Remember me" with secure signed cookies
  - `fetch_current_scope_for_user` from session or cookie
  - `redirect_if_user_is_authenticated` and `require_authenticated_user` plugs
  - LiveView `on_mount` hooks (`mount_current_scope`, `require_authenticated`, `redirect_if_user_is_authenticated`)
- LiveView auth pages (default): login, registration, settings, confirmation
- Controller-based auth pages (with `--no-live`): session, registration, settings, reset password, confirmation
- Router configuration with guest and authenticated pipelines
- Database migration for users and tokens tables
- Support for multiple hashing libraries: bcrypt (default Unix), pbkdf2 (default Windows), argon2
- Support for binary UUID keys (`--binary-id`)
- Support for custom table name (`--table`)
- Support for custom web module (`--web`)
- Support for umbrella projects (`--context-app`)
- Built with Igniter for AST-based code generation

### Why


Phoenix 1.8 replaced `mix phx.gen.auth` with a magic-link-only generator.
This package restores the complete email + password authentication that
many applications still need, including password reset, account confirmation,
and "remember me" functionality, while also supporting magic link login.