Cannot update field without password required.

[danschultzer]

Cannot update field without password required.

[danschultzer]

You can extend the users context easily: https://github.com/danschultzer/pow/blob/master/lib/pow/ecto/context.ex#L7-L20

In this case I wouldn't combine the two, but instead just keep the default context methods inside Pow, and create one specifically for my manager actions. It's better to have different contexts depending on how you interact with the underlying user struct. But if you do wish to change or extend how the default context is working then the above docs is how you do it!

[danschultzer]

I wouldn't use any Pow methods, but instead create a context module for manager API calls. This can work better for security as you can limit that particular changeset to just accepting role changes.

This is one way of setting it up:

defmodule MyApp.UserManagement do
  alias MyApp.Users.User

  def update_role(user, attrs) do
    user
    |> User.role_changeset(attrs)
    |> Repo.update()
  end
end

defmodule MyApp.Users.User do
  # ...

  def role_changeset(user_or_changeset, attrs) do
    cast(user_or_changeset, attrs, [:role])
  end
end

Pow.Ecto.Context (that Pow.Operations uses by default) is the context API for handling registration and authentication with Pow, and just that. Any other kind of operations should be moved to a dedicated context.

[jung-hunsoo]

I agree. To create another context is easy and manageable. But I'd like to know if there's a flexible and configurable way to achieve this.

I believe this feature will be one of frequently requested by developers. If so, how about providing Myapp.Users context for better extensibility by default?