wkhandClaude Opus 5.5
e14bada114
The app becomes a Rails 8 application; the Vue frontend moves to app/frontend and is served through vite_rails. - Without an account documents stay in the browser (IndexedDB). Sign-in is by magic link or the 6-digit code from the same mail; afterwards local documents can be uploaded into the account. - Server documents (/d/<id>) with versioned saves and a single-editor lock per browser tab; others see them read-only and follow by polling. - Sharing via link (works without an account) and via e-mail invitation, roles viewer/editor; the owner manages links and people. - Store gains a read-only mode that blocks all content changes. - Solid Queue, Cache and Cable share the one PostgreSQL database. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
23 lines
768 B
Ruby
23 lines
768 B
Ruby
# The page behind the link in a sign-in / invitation mail. Opening the link
|
|
# (GET) only shows a button; the sign-in happens on POST. Mail scanners
|
|
# fetch links on their own and would otherwise use up the one-time token.
|
|
class AuthController < ApplicationController
|
|
layout "auth"
|
|
rate_limit to: 30, within: 15.minutes, only: :create
|
|
|
|
def show
|
|
@token = params[:token].to_s
|
|
@link = MagicLink.find_by_token(@token)
|
|
render :invalid, status: :not_found unless @link
|
|
end
|
|
|
|
def create
|
|
link = MagicLink.find_by_token(params[:token])
|
|
return render(:invalid, status: :not_found) unless link
|
|
start_session_for(link.redeem!)
|
|
redirect_to link.destination
|
|
rescue ActiveRecord::RecordNotFound
|
|
render :invalid, status: :not_found
|
|
end
|
|
end
|