Logging in a user and creating a session.

[rogadev]

I feel stupid looking at these docs but I certainly don't see a section where it says "this is how you log a user in using email and password" so maybe I'm not crazy.

How on earth am I supposed to log in a user? I've created a user, that's fine. There was decent enough documentation on that. Now how do I log them in? And why is this not something that is clearly laid out in the documentation? Please feel free to link me if I'm mistaken.

[pilcrowonpaper]

Signing in the user means you create and assign a session:

https://www.lucia-auth.com/learn/basics/sessions

[rogadev]

Sure, but I'd like to authenticate my user before creating a session. How does Lucia want me to authenticate the user before I create the session and allow the user to access auth-guarded content?

If you hit ctrl + F and search for "password" you'll see it only mentioned once on the page and that relates to invalidating a session.

[pilcrowonpaper]

You want to use keys for authenticating users

https://lucia-auth.com/learn/basics/keys

[rogadev]

Okay, I think I understand.

1. Use validateKeyPassword(username, pw) to get the key.
2. Extract the userId from the key.
3. Use createSession(userId) to create a session.
4. Use createSessionCookies(session) to save your session to cookies.

Is that about the sum of it? I do have to say, that seems like a lot of script to do what most packages do with signIn(username, pw). Have you thought about a more streamlined method to login with traditional email/username and password, create a session and save to cookies? Or is there a good reason that's a bad idea?

I'm still just a beginner, so I am authentically quite curious. My program has done an atrocious job at teaching us anything to do with auth, so I greatly appreciate any insight you can provide. 🙏

[pilcrowonpaper]

Yeah that's correct. If we did provide something like signIn(), we'd have to have a similar function for different methods and having a few primitives that can be combined to make your auth system was the way I decided to take the project. It takes a bit more time to start, but once you understand the few APIs we provide, you can handle most situations.