Changelog

View Source

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[0.3.1] - 2026-08-23

Fixed

  • Test fixtures override_token_authenticated_at and offset_user_token were setting authenticated_at directly on the user_tokens table, but that column does not exist. authenticated_at is a virtual field on the User schema, derived from token.inserted_at in the token verification queries. On macOS with PostgreSQL this caused a "column not found" error; on Windows with SQLite it was silently ignored. Both fixtures now update inserted_at instead

[0.3.0] - 2026-08-19

Added

  • Password reset (forgot password) flow for LiveView mode: UserForgotPasswordLive and UserResetPasswordLive with routes /users/forgot-password and /users/reset-password/:token
  • "Forgot your password?" link in the login page
  • get_user_by_confirmation_token/1 in the Accounts context for verifying confirmation tokens independently from magic link tokens

Fixed

  • Email confirmation flow: UserConfirmationLive.mount/3 was using get_user_by_magic_link_token (context "login") to verify confirmation tokens (context "confirm"), causing "invalid or expired" errors. Now tries magic link first, then confirmation token, so both flows work through the same /users/log-in/:token route

  • Sudo mode / settings access: verify_session_token_query and verify_magic_link_token_query in UserToken were not setting the virtual authenticated_at field, causing sudo_mode?/1 to always return false and blocking access to /users/settings with "You must re-authenticate to access this page." Both queries now select %{user | authenticated_at: token.inserted_at}

  • Confirmation + login: UserSessionController.create/2 with _action: "confirmed" was calling login_user_by_magic_link (context "login") on a confirmation token (context "confirm"). Now calls confirm_user/1 then log_in_user/2 via a dedicated confirm_and_log_in/2 function

Changed

  • Refactored the monolithic phx_auth_plus.gen.auth.ex generator (3333 lines) into 11 focused modules under PhxAuthPlus.Gen.Auth.* (Config, Schema, Context, Plug, LiveViews, Controllers, Layout, Router, Migration, Test, UI), with the main task file as a thin orchestrator (214 lines)
  • UserConfirmationLive error message changed from "Magic link is invalid or it has expired" to "Confirmation link is invalid or it has expired"

[0.2.0] - 2026-08-19

Changed

  • Aligned LiveViews, session controller, and routes with Phoenix 1.8.9 phx.gen.auth templates
  • Added magic link authentication alongside password-based login
  • Added update_password route for password updates from settings
  • Added fetch_current_scope_for_user plug to the browser pipeline
  • Updated create_auth_test and create_accounts_fixtures for the new auth flow and scope usage
  • Made hashed_password nullable in the migration (magic link users may not have a password)
  • Made signed_in_path/1 public in UserAuth
  • Layout header now includes dynamic auth menu (login/register, email/settings/logout)
  • Moved hashing test config from the removed phx_auth_plus.install task into phx_auth_plus.gen.auth
  • Updated README and GUIDE to reflect the new architecture (scope system, magic link, file layout)
  • Updated token validity: session 14 days (was 60), magic link 15 minutes (new)

Removed

  • phx_auth_plus.install task (was auto-triggered by Igniter on mix deps.get, interrupting dependency download and compilation). The hashing config is now applied by phx_auth_plus.gen.auth directly.

[0.1.0] - 2026-08-19

Added

  • Complete email + password authentication generator based on Phoenix phx.gen.auth
  • User schema with registration, email, password, and confirmation changesets
  • UserToken schema with session, reset password, confirm, and change email tokens
  • UserNotifier for email delivery (confirmation, reset password, change email)
  • Accounts context with full auth functions:
    • Registration and session management
    • Password reset (forgot password flow)
    • Account confirmation by email
    • Email change with confirmation
    • Password change with current password validation
  • UserAuth plug with:
    • log_in_user / log_out_user with session renewal
    • "Remember me" with secure signed cookies
    • fetch_current_scope_for_user from session or cookie
    • redirect_if_user_is_authenticated and require_authenticated_user plugs
    • LiveView on_mount hooks (mount_current_scope, require_authenticated, redirect_if_user_is_authenticated)
  • LiveView auth pages (default): login, registration, settings, confirmation
  • Controller-based auth pages (with --no-live): session, registration, settings, reset password, confirmation
  • Router configuration with guest and authenticated pipelines
  • Database migration for users and tokens tables
  • Support for multiple hashing libraries: bcrypt (default Unix), pbkdf2 (default Windows), argon2
  • Support for binary UUID keys (--binary-id)
  • Support for custom table name (--table)
  • Support for custom web module (--web)
  • Support for umbrella projects (--context-app)
  • Built with Igniter for AST-based code generation

Why

Phoenix 1.8 replaced mix phx.gen.auth with a magic-link-only generator. This package restores the complete email + password authentication that many applications still need, including password reset, account confirmation, and "remember me" functionality, while also supporting magic link login.