Type 'User' does not conform to protocol 'ModelAuthenticatable'

Related Projects Vapor
1

Trying to apply Vapor Doc Security -> Authentication when adding the snippet:

extension User: ModelAuthenticatable {
    static let usernameKey = \User.$email
    static let passwordHashKey = \User.$passwordHash

    func verify(password: String) throws -> Bool {
        try Bcrypt.verify(password, created: self.passwordHash)
    }
}

I get the message from Xcode:

Capture d’écran 2026-02-25 à 14.14.47
Capture d’écran 2026-02-25 à 14.14.471318×318 48.5 KB

Is it safe to Add stubs for conformance ?

If so, what exactly should be the code to be added in the closures ?

    static var usernameKey: KeyPath<User, FluentKit.FieldProperty<User, String>> {
        <#code#>
    }
    
    static var passwordHashKey: KeyPath<User, FluentKit.FieldProperty<User, String>> {
        <#code#>
    }

Sorry I am too new in Vapor to find out by myself ! Thanks for helping.

2

What does your user model look like?

3

Quite the same as in the Docs I believe :

import Fluent
import Vapor

final class User: Model, @unchecked Sendable, Content {
    static let schema = "users"
    
    @ID(key: .id)
    var id: UUID?
    
    @Field(key:"name")
    var name: String
    
    @Field(key:"password_hash")
    var passwordHash: String
    
    @Field(key:"email")
    var email: String
    
    @Children(for: \.$user)
    var todos: [Todo]
    
    init(){}
    
    init(id: UUID? = nil, name: String, email: String, passwordHash: String) {
        self.id = id
        self.name = name
        self.email = email
        self.passwordHash = passwordHash
    }
    func toDTO() -> UserDTO {
        .init(
            id: self.id,
            name: self.$name.value,
            email: self.$email.value,
            passwordHash: self.$passwordHash.value
        )
    }
}

only a children field more.

I am using Xcode 26.2. Is this not linked to the new thread safe policy ?

4

Ah yeah it’s the Sendable issues with key-paths. Try something like VaporAuthExample/Sources/App/Models/User.swift at main · 0xTim/VaporAuthExample · GitHub

5

yes @0xTim that's what I did, following assistant's tip:

extension User: ModelAuthenticatable {
    static var usernameKey: KeyPath<User, FluentKit.FieldProperty<User, String>> { \User.$email }
    
    static var passwordHashKey: KeyPath<User, FluentKit.FieldProperty<User, String>> { \User.$password }

    func verify(password: String) throws -> Bool {
        try Bcrypt.verify(password, created: self.password)
    }
}

(Note that in the meantime, for convenience, I changed passwordHash to password)

Now my problem is I do not get the login route as per Vapor Doc to run:

Here is the controller :

    func boot(routes: any RoutesBuilder) throws {
        let users = routes.grouped("users")
        users.post(use: self.create)
        let passwordProtected = users.grouped(User.authenticator(), User.guardMiddleware())
        passwordProtected.post("login", use: self.login)
    }
    
    @Sendable
    func login(req: Request) async throws -> ClientTokenResponse {
        let user = try req.auth.require(User.self)
        print(user)
        let payload = try SessionToken(with: user)
        return ClientTokenResponse(token: try await req.jwt.sign(payload))
    }

In my database I have at least one user:

Capture d’écran 2026-02-26 à 10.07.59
Capture d’écran 2026-02-26 à 10.07.591288×228 13.9 KB

Let's consider Emile. The command :

% echo -n "emile@example.com:secret" | base64

produces:
ZW1pbGVAZXhhbXBsZS5jb206c2VjcmV0

But when I send the request:
% curl -H "Authorization: Basic ZW1pbGVAZXhhbXBsZS5jb206c2VjcmV0" http://127.0.0.1:8080/users/login

I receive an error:
{"reason":"Not Found","error":true}**%**

I can't figure out what I am doing wrong. Can someone help ?

6

For one adding User.guardMiddleware() on the login route doesn't really make sense as that throws a 401 if the user is not logged in. You're also trying to verify a plaintext password using bcrypt, or at least that's what you showed in your DB screenshot/token creation command. Finally, regarding your 404, did you register your controller using app.register(collection: YourControllerHere()?

7

@ptoffy doesn't make sense ? Yet this is the snippet from Vapor Doc -> Authentication -> JWT :

let passwordProtected = app.grouped(User.authenticator(), User.guardMiddleware())
passwordProtected.post("login") { req async throws -> ClientTokenResponse in
    let user = try req.auth.require(User.self)
    let payload = try SessionToken(with: user)
    return ClientTokenResponse(token: try await req.jwt.sign(payload))
}

Regarding the paswword for Basic Authorization, I followed this section of the doc:

Capture d’écran 2026-02-26 à 11.11.13
Capture d’écran 2026-02-26 à 11.11.131598×546 58.7 KB

Should I not ?

Finally, at least I can confirm the controller is registred in the routes:

func routes(_ app: Application) throws {
    app.get { req async in
        "It works!"
    }
    app.get("hello") { req async -> String in
        "Hello, world!"
    }
    try app.register(collection: UserController())
}

So what can I do next ?

8

Looking at your database - is your password stored in plaintext?

9

Obviously, yes.
OK @0xTim I got it. Password hashigh is in the next lab !

10

:+1:

Just to be clear, the issue you’re hitting is that your verify function is trying to check the hash of your password provided with the password stored and they obviously don’t match because they’re stored in plaintext (and please, please, please never do this)

11

So I suppose a good practice would be to have a passwordHash property in User and a password one in UserDTO. And make the conversion in the toModel() function at the call of UserController's create() function.

Right?

12

Have a password in the CreateUserDTO but not in the UserDTO - you don’t want to be returning password hashes in your responses

13

Ok @0xTim that's how I did it:

I replaced the password column in Users by password_hash, and updated the migration CreateUser accordingly.

In the UserDTO however I kept the password property and modified the toModel() function as follows:

        if let password = self.password {
            model.passwordHash = try Bcrypt.hash(password)
        }

I update the user authentication verify func:

extension User: ModelAuthenticatable {
    static var usernameKey: KeyPath<User, FluentKit.FieldProperty<User, String>> { \User.$email }
    
    static var passwordHashKey: KeyPath<User, FluentKit.FieldProperty<User, String>> { \User.$passwordHash }

    func verify(password: String) throws -> Bool {
        try Bcrypt.verify(password, created: self.passwordHash)
    }
}

Which now operates on passwordHash indeed.

By the way, in the reverse function toDTO() in User model, I just set password to nil:

    func toDTO() -> UserDTO {
        .init(
            id: self.id,
            name: self.$name.value,
            email: self.$email.value,
            password: nil
        )
    }

I also updated the create() function of the UserController to decode on userDTO:

    @Sendable
    func create(req: Request) async throws -> UserDTO {
        let user = try req.content.decode(UserDTO.self).toModel()
        try await user.save(on: req.db)
        return user.toDTO()
    }

At least I managed to have the passwordHashes stored in the database, instead of the passwords themselves :relieved_face:

Capture d’écran 2026-02-26 à 13.35.53
Capture d’écran 2026-02-26 à 13.35.531850×320 55.5 KB

The bad news is I still have the same error when trying to login as previously :slightly_frowning_face:

14

@simon68 it looks like you're making a GET request to a POST endpoint, that's why you get a 404. You need to add -X POST to your curl request

curl -X POST \
  -H "Authorization: Basic ZW1pbGVAZXhhbXBsZS5jb206c2VjcmV0" \
  http://127.0.0.1:8080/users/login
15

ok @ptoffy I thought it had to be something stupid, and it was ! Thanks.

17

Hi all,

got a new issue I want to share.

Testing my login route manually with :

curl -X POST http://127.0.0.1:8081/users/login -H "Authorization: Basic Ym9iQGV4YW1wbGUuY29tOnNlY3JldA=="

Produces the expected result :

{"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VySWQiOiIwQTI0MzI5NS0xNUI4LTRERUMtQTExMi03MzczNTk0QTgxRUYiLCJleHBpcmF0aW9uIjoxNzczODQxNTcxLjE1MjQ3N30.ZM6ogjEIxo3ogVp996da9eMu8zaP1_fqjl-05MbPjPk"}

However, loging in from my app with:

    func login() async {
        guard let login = profile.login else { return }
        print ("login \(login)")
        let url = URL(string: API_URL + "login")!
        var request = URLRequest(url: url)
        request.httpMethod = "GET"
        request.setValue("Basic \(login)", forHTTPHeaderField: "Authorization")
        do {
            let (data, _) = try await URLSession.shared.data(for: request)
            let decoded = try JSONDecoder().decode(ClientTokenResponse.self, from: data)
            profile.token = decoded.token
        } catch {
            print("Erreur : \(error)")
        }
    }

Where :

struct ClientTokenResponse: Codable {
    var token: String
}

Produces an error:

keyNotFound(CodingKeys(stringValue: "token", intValue: nil), Swift.DecodingError.Context(codingPath: [], debugDescription: "No value associated with key CodingKeys(stringValue: \"token\", intValue: nil) (\"token\").", underlyingError: nil))

How can token be nil in this case ? What does intValue mean where a String in expected ?

By the way, I ensured the login was correct with the line :

print ("login \(login)")

And it matches the one sent manually :

login Ym9iQGV4YW1wbGUuY29tOnNlY3JldA==

What do I miss here ? Thanks for your help.

18

What is in the Vapor logs? Is the response status code 200 or something else?

19

Sorry @0xTim , what do you mean by Vapor logs?

The server log ?

[ INFO ] POST /users/login [request-id: 68FE08E8-96DA-4430-AB81-1D55F5A1C5CF]
User(output: SQLiteSQLRow(row: [users_id: "0A243295-15B8-4DEC-A112-7373594A81EF", users_name: "Bob", users_email: "bob@example.com", users_password_hash: "$2b$12$MfmSkmmSpAKokRVBm7r6Q.jkENJKO0DR9gqHV5.Rb.lSTgaHFVfxi"], decoder: SQLiteKit.SQLiteDataDecoder(json: SQLiteKit.SQLiteDataDecoder.FakeSendable<Foundation.JSONDecoder>(value: Foundation.JSONDecoder))))
20

Yeah are here any errors in the server log? And if you print the response body and status code back from the server, it should show you some hints as to what’s going on

21

This line looks suspicious though, given the log you showed - they don’t line up