ecto-changeset-patterns

Ecto Changeset Patterns

RULES — Follow these with no exceptions

1. Create separate named changesets per operation — registration_changeset, email_changeset, password_changeset; never overload a single changeset/2
2. Never require foreign key fields in cast_assoc child changesets — the parent sets them automatically; requiring them causes "can't be blank" errors
3. Compose changesets with pipes — each validation step is a separate function for reuse and clarity
4. Use unsafe_validate_unique paired with unique_constraint — never one without the other; unsafe_validate_unique gives fast UI feedback, unique_constraint handles race conditions
5. Use update_change/3 for field transformations — trimming, downcasing, slugifying happen in the changeset, never in the controller or context
6. Accept opts \\ [] for conditional validation — allows callers to toggle validation rules without creating yet another changeset function
7. Validate at the changeset level, not in context functions — context functions should be thin wrappers around Repo calls

Separate Changesets Per Operation

Different operations need different validation rules. Don't overload changeset/2.

defmodule MyApp.Accounts.User do
  use Ecto.Schema
  import Ecto.Changeset

  schema "users" do
    field :email, :string
    field :username, :string
    field :password, :string, virtual: true, redact: true
    field :hashed_password, :string, redact: true
    field :bio, :string

    timestamps()
  end

  # Registration — all fields, password hashing
  def registration_changeset(user, attrs, opts \\ []) do
    user
    |> cast(attrs, [:email, :username, :password])
    |> validate_email(opts)
    |> validate_username()
    |> validate_password(opts)
  end

  # Email change — only email, requires reconfirmation
  def email_changeset(user, attrs, opts \\ []) do
    user
    |> cast(attrs, [:email])
    |> validate_email(opts)
  end

  # Password change — only password
  def password_changeset(user, attrs, opts \\ []) do
    user
    |> cast(attrs, [:password])
    |> validate_password(opts)
    |> put_password_hash()
  end

  # Profile update — non-sensitive fields only
  def profile_changeset(user, attrs) do
    user
    |> cast(attrs, [:username, :bio])
    |> validate_username()
  end
end