user.ex

defmodule MyApp.User do
  use MyApp.Web, :model

  schema "users" do
    field :email, :string
    field :encrypted_password, :string
    field :is_admin, :boolean, default: false
    field :password, :string, virtual: true

    timestamps
  end

  @allowed_fields [
    :email,
    :encrypted_password,
    :is_admin,
    :password,
  ]
  @sensitive_fields [
    :is_admin,
  ]

  def changeset(model, params \\ :empty) do
    model
    |> cast(params, @allowed_fields)
  end

  def secure_changeset(model, params \\ :empty) do
    Enum.reduce(@sensitive_fields, changeset(model, params), &(delete_change(&2, &1)))
  end
end