"password_hash can't be blank" error when trying to register email with invalid format

[christophweegen]

Hello everybody,

just followed the guides to setup API authentication.

I played a bit around to see how errors are handled.

When I try to register a user with an invalid email like infoexample.com, I get following JSON response:

{
  "error": {
    "errors": {
      "email": [
        "has invalid format"
      ],
      "password_hash": [
        "can't be blank"
      ]
    },
    "message": "Couldn't create user",
    "status": 500
  }
}

While it makes sense to give out email has invalid format as error description, password_hash can't be blank isn't a useful error message in client applications, since a user can't do anything about this because setting the password hash is a "private" implementation detail and out of the user's control. Returning this error will only confuse users I guess.

Didn't look into the source yet and how it can be be easily avoided to return this error, just wanted to point that out and would like to hear your feedback.

Thanks a lot!

[danschultzer]

Yeah, it's because the final check in the changeset is whether the password hash exists: https://github.com/danschultzer/pow/blob/v1.0.14/lib/pow/ecto/schema/changeset.ex#L84

I think it makes more sense to have that check in maybe_put_password_hash/2 instead. I'll open a PR.

[danschultzer]

Fixed in #391 finally 🚀