# `Macaw.Auth.Native.Provision`
[🔗](https://github.com/dcoai/macaw_auth/blob/v0.4.1/lib/macaw/auth/native/provision.ex#L1)

Just-in-time provisioning of directory users (ported from exio's
`External.resolve/2`): a directory user signing in for the first time
gets a `macaw_auth_users` row, with `source` the directory's name and no
password, and at every later sign-in the directory's word replaces the
row's roles and display name. The directory is the authority on who is
in which group, so a user removed from an admin group loses the role at
their next sign-in, not whenever someone remembers to edit the row.

Two refusals keep identities apart:

- a row with the username that another source owns (a local user, or
  another directory's) is never taken over (`:username_taken`): a
  directory that happens to have an `owner` entry doesn't become the
  local `owner`;
- a disabled row stays refused (`:disabled`), whatever the directory
  says, and is left as it is.

# `directory_user`

```elixir
@spec directory_user(module(), String.t(), map()) ::
  {:ok, Macaw.Auth.Native.UserRecord.t()}
  | {:error, :username_taken | :disabled | :invalid_username}
```

The row for a directory user the source `name` accepted, made or
refreshed: `{:ok, record}` or `{:error, :username_taken | :disabled |
:invalid_username}`.

---

*Consult [api-reference.md](api-reference.md) for complete listing*