# `Macaw.Auth.Ash.Config`
[🔗](https://github.com/dcoai/macaw_auth_ash/blob/v0.3.2/lib/macaw/auth/ash/config.ex#L1)

`Macaw.Auth.Ash`'s configuration, read from the application environment
and checked, so a fault names its key rather than failing a sign-in
somewhere deeper:

    config :macaw_auth, Macaw.Auth.Ash,
      user_resource: MyApp.Accounts.User,
      token_resource: MyApp.Accounts.Token,   # default: the user resource's
      domain: MyApp.Accounts,                 # default: the user resource's
      strategies: [:password, :nas],          # or strategy: :password
      roles_from: :roles,                     # or {MyApp.Accounts, :roles_of}
      username_field: :email,                 # default: the first strategy's identity field
      display_name_field: :name,              # optional
      source_field: :source,                  # optional; without it every user is "local"
      disabled_field: :disabled_at,           # optional, boolean or timestamp
      idle_days: 14

- `strategies` are AshAuthentication strategy names on the user
  resource, tried in order as `Macaw.Auth.Native`'s sources are: the
  first that knows the user decides (`Macaw.Auth.Ash.authenticate/2`).
  Each is a password strategy or a `Macaw.Auth.Ash.Strategy.Ldap`.
- `roles_from` is an attribute holding a list of strings, or `{m, f}`
  called with the user record.
- `idle_days`: a session unused this long expires; 1 to 3650, as the
  native backend's `session_idle_days`. **The user resource's
  `token_lifetime` must be at least this long**: the JWT's expiry is a
  session's absolute limit (`Macaw.Auth.Ash.Sessions`), so a shorter
  lifetime would end sessions before they are idle. It is checked here,
  not left to a host to notice.

Two of the resources' own faults are refused here too, though a compile
warning names them first (Spark reports a verifier's error as a warning,
so they compile unless warnings are errors): a token resource without
`Macaw.Auth.Ash.Notifier`, and an LDAP strategy on the user resource,
named in `strategies` or not, whose field option isn't an attribute.

Read on every call (`get/0`), not cached: it is a handful of keyword
lookups, and a test or a host that changes it sees the change at once.
A fault raises `ArgumentError`: it is a deployment bug, not a refusal.

# `t`

```elixir
@type t() :: %Macaw.Auth.Ash.Config{
  disabled_field: atom() | nil,
  display_name_field: atom() | nil,
  domain: module(),
  idle_days: pos_integer(),
  primary_key: atom(),
  roles_from: atom() | {module(), atom()},
  source_field: atom() | nil,
  strategies: [struct()],
  token_resource: module(),
  user_resource: module(),
  username_field: atom()
}
```

# `get`

```elixir
@spec get() :: t()
```

The configuration, checked; raises `ArgumentError` naming a fault.

# `parse!`

```elixir
@spec parse!(keyword()) :: t()
```

Checks `settings` (a keyword list) as `get/0` does.

---

*Consult [api-reference.md](api-reference.md) for complete listing*