Merge pull request #12 from codeableorg/feature-register-and-login-user

Feature register and login user

Author: Lian Nivin

api/Gemfile

@@ -14,7 +14,7 @@ gem 'puma', '~> 3.11'
 # Use Redis adapter to run Action Cable in production
 # gem 'redis', '~> 4.0'
 # Use ActiveModel has_secure_password
-# gem 'bcrypt', '~> 3.1.7'
+gem 'bcrypt', '~> 3.1.7'
 
 # Use ActiveStorage variant
 # gem 'mini_magick', '~> 4.8'

api/Gemfile.lock

@@ -48,6 +48,7 @@ GEM
       minitest (~> 5.1)
       tzinfo (~> 1.1)
     arel (9.0.0)
+    bcrypt (3.1.13)
     bootsnap (1.4.4)
       msgpack (~> 1.0)
     builder (3.2.3)
@@ -160,6 +161,7 @@ PLATFORMS
 
 DEPENDENCIES
   active_model_serializers
+  bcrypt (~> 3.1.7)
   bootsnap (>= 1.1.0)
   byebug
   listen (>= 3.0.5, < 3.2)

api/app/controllers/application_controller.rb

@@ -1,2 +1,31 @@
 class ApplicationController < ActionController::API
-end
+  include ActionController::Cookies
+
+  before_action :require_login
+
+  def require_login
+    authenticate_token || render_unauthorized('Access denied')
+  end
+
+  def current_user
+    @current_user ||= authenticate_token
+  end
+
+  private
+
+  def render_unauthorized(message)
+    errors = { errors: { message: message } }
+    render json: errors, status: :unauthorized
+  end
+
+  def authenticate_token
+    user = User.find_by_token(cookies.signed[:auth_token])
+    regenerate_and_signed_token(user) if user
+  end
+
+  def regenerate_and_signed_token(user)
+    user.regenerate_token
+    cookies.signed[:auth_token] = { value: user.token, httponly: true }
+    user
+  end
+end

api/app/controllers/sessions_controller.rb

@@ -0,0 +1,35 @@
+class SessionsController < ApplicationController
+  skip_before_action :require_login, only: [:register, :login]
+
+  def login
+    user = User.valid_login?(params[:email], params[:password])
+    if user
+      regenerate_and_signed_token(user)
+      render json: user
+    else
+      render json: { errors: 'Incorrect email or password' },
+             status: :bad_request
+    end
+  end
+
+  def register
+    user = User.new(user_params)
+    if user.save
+      render json: user
+    else
+      render json: { errors: user.errors}
+    end
+   
+  end
+
+  def destroy
+    current_user.invalidate_token
+    cookies.delete :auth_token
+    head :ok
+  end
+
+  private
+  def user_params
+    params.permit(:name, :email, :password, :role)
+  end
+end

api/app/models/user.rb

@@ -0,0 +1,18 @@
+class User < ApplicationRecord
+  has_secure_password
+  has_secure_token
+
+  validates :email, :name, :role, presence: true
+  validates :email, uniqueness: true
+
+ 
+
+  def invalidate_token
+    update(token: nil)
+  end
+
+  def self.valid_login?(email, password)
+    user = find_by(email: email)
+    user if user&.authenticate(password)
+  end
+end

api/config/initializers/cors.rb

@@ -1,16 +1,10 @@
-# Be sure to restart your server when you modify this file.
+Rails.application.config.middleware.insert_before 0, Rack::Cors do
+  allow do
+    origins 'localhost:3000'
 
-# Avoid CORS issues when API is called from the frontend app.
-# Handle Cross-Origin Resource Sharing (CORS) in order to accept cross-origin AJAX requests.
-
-# Read more: https://github.com/cyu/rack-cors
-
-# Rails.application.config.middleware.insert_before 0, Rack::Cors do
-#   allow do
-#     origins 'example.com'
-#
-#     resource '*',
-#       headers: :any,
-#       methods: [:get, :post, :put, :patch, :delete, :options, :head]
-#   end
-# end
+    resource '*',
+      headers: :any,
+      methods: [:get, :post, :put, :patch, :delete, :options, :head],
+      credentials: true
+  end
+end

api/config/routes.rb

@@ -1,3 +1,10 @@
 Rails.application.routes.draw do
-  # For details on the DSL available within this file, see http://guides.rubyonrails.org/routing.html
+  scope '/api' do
+    # sessions routes
+    post '/login', to: 'sessions#login'
+    post '/register', to: 'sessions#register'
+
+    delete '/logout', to: 'sessions#destroy'
+
+  end
 end

api/db/migrate/20190711201636_create_users.rb

@@ -0,0 +1,14 @@
+class CreateUsers < ActiveRecord::Migration[5.2]
+  def change
+    create_table :users do |t|
+      t.string :name
+      t.string :token
+      t.string :email
+      t.string :password_digest
+      t.string :role
+
+      t.timestamps
+    end
+    add_index :users, :token
+  end
+end

api/db/schema.rb

@@ -10,13 +10,16 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema.define(version: 2019_07_09_175149) do
+ActiveRecord::Schema.define(version: 2019_07_11_201636) do
+
+  # These are extensions that must be enabled in order to support this database
+  enable_extension "plpgsql"
 
   create_table "active_storage_attachments", force: :cascade do |t|
     t.string "name", null: false
     t.string "record_type", null: false
-    t.integer "record_id", null: false
-    t.integer "blob_id", null: false
+    t.bigint "record_id", null: false
+    t.bigint "blob_id", null: false
     t.datetime "created_at", null: false
     t.index ["blob_id"], name: "index_active_storage_attachments_on_blob_id"
     t.index ["record_type", "record_id", "name", "blob_id"], name: "index_active_storage_attachments_uniqueness", unique: true
@@ -41,4 +44,16 @@
     t.datetime "updated_at", null: false
   end
 
+  create_table "users", force: :cascade do |t|
+    t.string "name"
+    t.string "token"
+    t.string "email"
+    t.string "password_digest"
+    t.string "role"
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
+    t.index ["token"], name: "index_users_on_token"
+  end
+
+  add_foreign_key "active_storage_attachments", "active_storage_blobs", column: "blob_id"
 end

api/db/seeds.rb

@@ -1,7 +1,3 @@
-# This file should contain all the record creation needed to seed the database with its default values.
-# The data can then be loaded with the rails db:seed command (or created alongside the database with db:setup).
-#
-# Examples:
-#
-#   movies = Movie.create([{ name: 'Star Wars' }, { name: 'Lord of the Rings' }])
-#   Character.create(name: 'Luke', movie: movies.first)
+User.destroy_all
+User.create(name: 'Lian Nivin', email: 'liam@kampu.pe', role: "regular", password: '123456')
+User.create(name: 'Cristian Berly', email: 'berli@kampu.pe', role: "owner", password: '123456')