static func authenticate(credentials: Credentials) throws -> Auth.User {
  switch credentials {
    case let id as Identifier:
      guard let user = try User.find(id.id) else {
        throw Abort.custom(status: .forbidden, message: “Invalid user identifier.”)
      }
      return user
    case let accessToken as AccessToken:
      guard let user = try User.query().filter(“access_token”, accessToken.string).first() else {
        throw Abort.custom(status: .forbidden, message: “Invalid access token.”)
      }
      return user
    case let apiKey as APIKey:
      guard let user = try User.query().filter(“username”, apiKey.id).first(),
      try BCrypt.verify(password: apiKey.secret, matchesHash: user.password) else {
        throw Abort.custom(status: .networkAuthenticationRequired, message: “Invalid user name or password.”)
      }
      if try BCrypt.verify(password: apiKey.secret, matchesHash: user.password) {
        return user
      } else {
        throw Abort.custom(status: .networkAuthenticationRequired, message: “Invalid user name or password.”)
      }
    default:
      let type = type(of: credentials)
      throw Abort.custom(status: .forbidden, message: “Unsupported credential type: \(type).”)
  }
}