smpallen99/coherence

This system is an authentication library for Elixir and Phoenix applications, providing a comprehensive suite of user management features including registration, login, password recovery, account confirmation, and session tracking. It offers a modular architecture with overridable controllers, configurable services, and in-memory or database-backed credential stores. The library includes Mix tasks for code generation and cleanup, along with templates and localization support for the authentication flow.

13 changes.

This period focused on modernizing the Coherence authentication library to support Elixir 1.11 and Phoenix 1.3, including a configuration system refactor and the addition of new routing and responder modules. Significant effort was also dedicated to comprehensive test coverage, adding extensive tests for controllers, models, plugs, and services to ensure the reliability of the authentication features.

8 changes.

This period focused on enhancing the Coherence authentication system by introducing persistent login capabilities, service modules for account management, and in-memory credential stores. It also expanded the developer experience with new Mix tasks for code generation and cleanup, supported by comprehensive test coverage.

The Coherence authentication system now includes a complete set of generated templates and message files. This adds EEx templates for all authentication controllers (confirmation, invitation, password, registration, session, and unlock), email templates for account confirmation, password reset, invitation, and unlock notifications, and a comprehensive set of gettext message strings for user-facing text. These files provide the default UI and localization support for the authentication flow.

priv · high confidence

The repository now includes a \.formatter.exs\ file that configures the Elixir code formatter with local function names for Phoenix, Phoenix.Controller, Phoenix.Endpoint, and various test helpers, ensuring consistent code style across the project. Additionally, \.tool-versions\ specifies Erlang 25.3.2.5 and Elixir 1.14.5-otp-25, while \.travis.yml\ is added to configure the CI environment for Elixir 1.4–1.6 and OTP 20.0.

(repo-wide) · high confidence

A new \Coherence.Mix.Utils\ module was added to \lib/mix/mix\_utils.ex\. This module provides helper functions for generating database migration fields for various authentication features (such as recoverable, trackable, lockable, and confirmable), managing controller file templates, and validating Mix task arguments. It also includes a compatibility shim for the \Code.format\_string!/1\ function introduced in later Elixir versions.

lib/mix · high confidence

A new Rememberable schema has been introduced to support persistent login functionality. This addition enables the system to generate, store, and validate remember-me tokens, allowing users to remain logged in across browser sessions. The implementation includes logic for creating and updating login states, querying valid and invalid login attempts, and automatically cleaning up expired tokens.

lib/coherence/schemas · high confidence

Two new plugs have been introduced to the Coherence library: RequireLogin, which restricts controller access to authenticated users, and ValidateOption, which ensures specific project configuration options are enabled before allowing access. These changes provide a more granular way to enforce authentication and configuration requirements across the application.

lib/coherence/plugs · high confidence

The \lib/coherence/services\ directory now includes new Elixir modules (\ConfirmableService\, \LockableService\, \PasswordService\, \RememberableService\, \SessionService\, and \TrackableService\) that implement core authentication behaviors. These services handle user account confirmation, account locking after failed attempts, password reset token generation, remember-me cookie management, signed user token verification, and login activity tracking. Users can now configure and utilize these features for enhanced security and audit capabilities.

lib/coherence/services · high confidence

The Coherence package introduces two new Mix tasks to improve the developer experience. The \mix coh.clean\ task allows users to cleanly remove files generated by the installer, supporting granular removal of views, templates, models, controllers, and other components. Additionally, the \mix coh.gen.controllers\ task enables developers to generate customizable Coherence controllers, providing greater control over authentication flows. These additions streamline the lifecycle management of Coherence-generated code.

lib/mix/tasks · high confidence

The authentication plugs (Basic, Session, Token, and IP address) now use a new credential storage system. A new \Coherence.CredentialStore.Server\ provides an in-memory GenServer for caching user data, while \Coherence.CredentialStore.Session\ adds database persistence via the \Coherence.DbStore\ protocol. This allows session data to survive application restarts when configured, and provides a consistent interface for storing and retrieving user credentials across different authentication methods.

lib/coherence/plugs/authentication · high confidence

The main module now includes extensive @moduledoc text detailing all authentication features (Authenticatable, Invitable, Registerable, Confirmable, Recoverable, Trackable, Lockable, Unlockable, Rememberable) and their configuration options, as well as Mix task usage. This provides users with a complete reference for setting up and customizing the library.

lib · high confidence

The Coherence library has been refactored to support configurable authentication features. A new \Coherence.Config\ module centralizes all configuration options, including password hashing algorithms, token generation, and redirect URLs. The framework now provides \Coherence.Responders\ behaviors with default HTML and JSON implementations for consistent response handling across sessions, registrations, passwords, and invitations. Routing is managed via \Coherence.Router\ macros that dynamically generate public and protected routes based on enabled features. Additionally, a \Coherence.Schema\ module simplifies user model setup with helper functions for various authentication modes (e.g., lockable, trackable, invitable).

lib/coherence · high confidence

The application's configuration has been modernized to use the current Elixir \import Config\ syntax, replacing the legacy \Mix.Config\ approach. Environment variables are now supported for sensitive settings like database credentials, and the configuration structure has been updated to align with Phoenix 1.3+ project layouts, including explicit definitions for user schemas, permitted attributes for registration and invitations, and mailer adapters.

config · high confidence

The controllers in lib/coherence/controllers have been refactored into a two-part structure: lightweight public controllers (e.g., Coherence.ConfirmationController) that use the framework's :controller plug, and corresponding \*Base modules (e.g., Coherence.ConfirmationControllerBase) that contain the actual action logic. This change makes every controller action overridable, allowing users to customize behavior by overriding specific functions in their own controller modules. The base modules implement the core logic for confirmation, invitation, password, registration, session, and unlock flows, while the public controllers handle routing, layout, and validation plugs.

lib/coherence/controllers · high confidence

Add comprehensive test coverage for Coherence configuration, schema, and view helpers; Added comprehensive controller tests for authentication and account management; Added comprehensive test coverage for authentication plugs; Added test support infrastructure for the Coherence authentication system; Added tests for Mix tasks; Added tests for lockable, password, and trackable services; Added tests for the Rememberable model; Added tests for the credential store server.

The project has been updated to require Elixir 1.11 and support Phoenix 1.3, reflecting a significant framework upgrade. The \mix.exs\ configuration now specifies \elixir: "\~\> 1.11"\ and includes \phoenix\ version \\~\> 1.3\ in the dependencies. This change ensures compatibility with newer Elixir and Phoenix versions, potentially bringing performance improvements and access to newer language features, while also updating the application's OTP configuration to include \:ecto\, \:tzdata\, \:crypto\, and \:eex\ as extra applications.

(dependencies) · high confidence

Written by watchdog.canine.dev from the codebase's own history, inside the signed delivery this page is composed from.

• CAI 54 → 52 (-2.5)
• Rubric changed (rubric-2026.08.19 → rubric-2026.09.15) — scores are not directly comparable.

• Code Health 97 → 98 (+1.0)
• Architecture 100 → 85 (-15.5)
• Maturity 51 → 51 (+0.0)
• Readiness 34 → 36 (+1.8)
• Security 90 → 74 (-15.9)
• Accessibility 78 (new)

• Coverage not included — suite not readable by the collector
• Dependency hygiene not measured — no supported dependency manifest was read
• Duplicated block (12 lines × 2) (lib/mix/tasks/coh.gen.controllers.ex)
• Duplicated block (9 lines × 2) (lib/mix/tasks/coh.gen.controllers.ex)
• High CVE: [GHSA redacted] (mix.lock)
• High CVE: [GHSA redacted] (mix.lock)
• High CVE: [GHSA redacted] (mix.lock)
• High CVE: [GHSA redacted] (mix.lock)
• Medium CVE: EEF-[CVE redacted] (mix.lock)
• Medium CVE: EEF-[CVE redacted] (mix.lock)
• Medium CVE: [GHSA redacted] (mix.lock)
• No exposed public API
• Test reliability not included
• TooManyMethods: Install (lib/mix/tasks/coh.install.ex)
• dormant codebase — no living knowledge left to concentrate

• Documentation: no installation or build instructions (README.md)
• Documentation: no usage examples (README.md)
• Duplicated block (16 lines × 2) (lib/mix/tasks/coh.gen.controllers.ex)
• Duplicated block (8 lines × 2) (lib/mix/tasks/coh.gen.controllers.ex)
• High CVE: [GHSA redacted] (mix.lock)
• High CVE: [GHSA redacted] (mix.lock)
• High CVE: [GHSA redacted] (mix.lock)
• High CVE: [GHSA redacted] (mix.lock)
• Leaked secret: signing-key (config/test.exs)
• Medium CVE: EEF-[CVE redacted] (mix.lock)
• Medium CVE: EEF-[CVE redacted] (mix.lock)
• Medium CVE: [GHSA redacted] (mix.lock)
• No SBOM
• No artifact signing
• No build provenance
• No dependency advisory monitoring
• Outdated: credo
• Outdated: dialyxir
• Outdated: ecto_sql
• Outdated: floki
• …and 8 more

Written by watchdog.canine.dev from the codebase's own history, inside the signed delivery this page is composed from.

smpallen99/coherence was measured the same way every project in this corpus was: the same rubric, at a pinned commit, with the result published in full. Point a surveyor at a repository you know and see whether you agree with it.