Auth. When registering a new user, it checks if password and email is correct, and invoke login/2 which assigns :current_user and pipes through Guardian.Plug.sign_in. It raises error when using @current_user in views, saying assign @current_user not available in eex template.

auth.ex

defmodule Cvapp.Auth do
  import Comeonin.Bcrypt, only: [checkpw: 2, dummy_checkpw: 0]
  import Plug.Conn

  def login(conn, user) do
    conn
    |> assign(:current_user, user)
    |> Guardian.Plug.sign_in(user, :access)
  end

  def login_by_email_and_pass(conn, email, given_pass, opts) do
    repo = Keyword.fetch!(opts, :repo)
    user = repo.get_by(Cvapp.User, email: email)

    cond do
      user && checkpw(given_pass, user.password_hash) ->
        {:ok, login(conn, user)}
      user ->
        {:error, :unauthorized, conn}
      true ->
        dummy_checkpw()
        {:error, :not_found, conn}
    end
  end
end

router.ex

defmodule Cvapp.Router do
  use Cvapp.Web, :router

  pipeline :browser do
    plug :accepts, ["html"]
    plug :fetch_session
    plug :fetch_flash
    plug :protect_from_forgery
    plug :put_secure_browser_headers
  end

  pipeline :maybe_browser_authd do
    plug Guardian.Plug.VerifySession
  end
  
  pipeline :browser_auth do
    plug Guardian.Plug.VerifySession
    plug Guardian.Plug.EnsureAuthenticated, handler: YourHandler, "typ" => "access"
    plug Guardian.Plug.LoadResource
  end

  pipeline :api do
    plug :accepts, ["json"]
  end

  # Publicly accessible routes
  scope "/", Cvapp do
    pipe_through [:browser, :maybe_browser_authd]

    get "/", PageController, :index
    resources "/users", UserController, only: [:new, :show, :create]
    resources "/sessions", SessionController, only: [:new, :create, :delete]
  end

  # Authentication required routes
  scope "/", Cvapp do
    pipe_through [:browser, :browser_auth]
    resource "/users", UserController, only: [:index]
  end
  
  # Other scopes may use custom stacks.
  # scope "/api", Cvapp do
  #   pipe_through :api
  # end
end

session_controller.ex

defmodule Cvapp.SessionController do
  use Cvapp.Web, :controller

  def new(conn, _) do
    render conn, "new.html"
  end

  def create(conn, %{"session" => %{"email" => user, "password" => pass}}) do
    case Cvapp.Auth.login_by_email_and_pass(conn, user, pass, repo: Repo) do
      {:ok, conn} ->
        conn
        |> put_flash(:info, "Innlogget")
        |> redirect(to: page_path(conn, :index))
      {:error, _reason, conn} ->
        conn
        |> put_flash(:error, "Feil brukernavn/passord")
        |> render("new.html")
    end
  end

  def delete(conn, _) do
    conn
    |> Guardian.Plug.sign_out
    |> put_flash(:info, "Logget ut")
    |> redirect(to: "/")
  end
end

user_controller.ex

defmodule Cvapp.UserController do
  use Cvapp.Web, :controller
  alias Cvapp.User

  def index(conn, _params) do
    users = Repo.all(User)
    render conn, "index.html", users: users
  end

  def new(conn, _params) do
    changeset = User.changeset(%User{})
    render conn, "new.html", changeset: changeset
  end

  def create(conn, %{"user" => user_params}) do
    changeset = User.registration_changeset(%User{}, user_params)
    case Repo.insert(changeset) do
      {:ok, user} ->
        conn
        |> Cvapp.Auth.login(user)
        |> put_flash(:info, "Kontoen ble opprettet")
        |> redirect(to: user_path(conn, :index))
      {:error, changeset} ->
        conn
         |> render("new.html", changeset: changeset)
    end
  end
end