1 module Authentication 2 extend ActiveSupport::Concern 3 4 included do 5 before_action :require_authentication 6 helper_method :authenticated? 7 end 8 9 class_methods do 10 def allow_unauthenticated_access(**options) 11 skip_before_action :require_authentication, **options 12 end 13 end 14 15 private 16 def authenticated? 17 resume_session 18 end 19 20 def require_authentication 21 resume_session || request_authentication 22 end 23 24 def resume_session 25 Current.session ||= find_session_by_cookie 26 end 27 28 def find_session_by_cookie 29 Session.find_by(id: cookies.signed[:session_id]) if cookies.signed[:session_id] 30 end 31 32 def request_authentication 33 session[:return_to_after_authenticating] = request.url 34 redirect_to new_session_path 35 end 36 37 def after_authentication_url 38 session.delete(:return_to_after_authenticating) || root_url 39 end 40 41 def start_new_session_for(user) 42 user.sessions.create!(user_agent: request.user_agent, ip_address: request.remote_ip).tap do |session| 43 Current.session = session 44 cookies.signed.permanent[:session_id] = { value: session.id, httponly: true, same_site: :lax } 45 end 46 end 47 48 def terminate_session 49 Current.session.destroy 50 cookies.delete(:session_id) 51 end 52 end 53