# `Macaw.Auth.Native.Source.Password`
[🔗](https://github.com/dcoai/macaw_auth/blob/v0.4.1/lib/macaw/auth/native/source/password.ex#L1)

Local users: a `macaw_auth_users` row with a password hash.

    %{type: :password}                 # named "local"
    %{type: :password, name: "staff"}

It knows a user when their row has a password hash; a directory user's
row (no hash) is not its to judge, and the attempt passes on.

- An unknown user and a wrong password are one refusal,
  `:invalid_credentials`, and take the same time: an unknown user spends
  the hasher's `no_user_verify/0`, so the response time can't tell which
  usernames exist.
- The password is checked before the account's state, so `:disabled` is
  only ever said to someone who knows the password.
- A hash made with other parameters, or by the other algorithm, is
  replaced at a successful sign-in (`Macaw.Auth.Native.Hasher`).

# `t`

```elixir
@type t() :: %Macaw.Auth.Native.Source.Password{
  hasher: module(),
  name: String.t(),
  repo: module()
}
```

---

*Consult [api-reference.md](api-reference.md) for complete listing*