How to sign in a user without a password?

[notramo]

When using email magic links, TOTP code, or SMS code, or any method where the user does not provide a password, how to sign in the user using MartenAuth::User?

[notramo]

@ellmetha, is it possible with the current implementation?

[ellmetha]

@notramo Yes, it is possible with the current implementation and marten-auth allows you to do that easily. You just need to call the User#set_unusable_password method when creating your user record and then call MartenAuth#sign_in with your User record and the current request object at sign in time.

For example:

# At sign up time.
user = User.new(...)
user.set_unusable_password
user.save!

# At sign in time.
MartenAuth.sign_in(user, request)

This technique is used by other shards that provide passwordless authentication, such as msa7/multi_auth. You can check out the Marten example in this repository for a more concrete example.

[notramo]

Thanks. Is it included in the documentation? I could not find it.

[ellmetha]

User#sign_in is definitely documented, but we may be missing a mention to the User#set_unusable_password method.

Edit: added in 3cf33e1.