# The page behind the link in a sign-in / invitation mail. Opening the link
# (GET) only shows a button; the sign-in happens on POST. Mail scanners
# fetch links on their own and would otherwise use up the one-time token.
class AuthController < ApplicationController
  layout "auth"
  rate_limit to: 30, within: 15.minutes, only: :create

  def show
    @token = params[:token].to_s
    @link = MagicLink.find_by_token(@token)
    render :invalid, status: :not_found unless @link
  end

  def create
    link = MagicLink.find_by_token(params[:token])
    return render(:invalid, status: :not_found) unless link
    start_session_for(link.redeem!)
    redirect_to link.destination
  rescue ActiveRecord::RecordNotFound
    render :invalid, status: :not_found
  end
end