Macaw.Auth.Native.Source.Password (macaw_auth v0.4.1)

Local users: a macaw_auth_users row with a password hash.

%{type: :password}                 # named "local"
%{type: :password, name: "staff"}

It knows a user when their row has a password hash; a directory user's row (no hash) is not its to judge, and the attempt passes on.

An unknown user and a wrong password are one refusal, :invalid_credentials, and take the same time: an unknown user spends the hasher's no_user_verify/0, so the response time can't tell which usernames exist.
The password is checked before the account's state, so :disabled is only ever said to someone who knows the password.
A hash made with other parameters, or by the other algorithm, is replaced at a successful sign-in (Macaw.Auth.Native.Hasher).

Summary

t()

@type t() :: %Macaw.Auth.Native.Source.Password{
  hasher: module(),
  name: String.t(),
  repo: module()
}