wkhandClaude Opus 5.5
e14bada114
The app becomes a Rails 8 application; the Vue frontend moves to app/frontend and is served through vite_rails. - Without an account documents stay in the browser (IndexedDB). Sign-in is by magic link or the 6-digit code from the same mail; afterwards local documents can be uploaded into the account. - Server documents (/d/<id>) with versioned saves and a single-editor lock per browser tab; others see them read-only and follow by polling. - Sharing via link (works without an account) and via e-mail invitation, roles viewer/editor; the owner manages links and people. - Store gains a read-only mode that blocks all content changes. - Solid Queue, Cache and Cable share the one PostgreSQL database. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
44 lines
1.3 KiB
Ruby
44 lines
1.3 KiB
Ruby
# Cookie session (signed session id), resumed on every request. Everything
|
|
# is usable without signing in; controllers call `require_authentication`
|
|
# where an account is needed.
|
|
module Authentication
|
|
extend ActiveSupport::Concern
|
|
|
|
included do
|
|
before_action :resume_session
|
|
helper_method :signed_in?
|
|
end
|
|
|
|
private
|
|
|
|
def signed_in? = Current.user.present?
|
|
|
|
def resume_session
|
|
Current.session = Session.find_by(id: cookies.signed[:session_id]) if cookies.signed[:session_id]
|
|
touch_session if Current.session
|
|
end
|
|
|
|
def touch_session
|
|
s = Current.session
|
|
return if s.last_active_at && s.last_active_at > 1.hour.ago
|
|
s.update_columns(last_active_at: Time.current)
|
|
s.user.update_columns(last_seen_at: Time.current)
|
|
end
|
|
|
|
def require_authentication
|
|
render json: { error: "unauthenticated" }, status: :unauthorized unless signed_in?
|
|
end
|
|
|
|
def start_session_for(user)
|
|
reset_session
|
|
Current.session = user.sessions.create!(user_agent: request.user_agent, ip_address: request.remote_ip, last_active_at: Time.current)
|
|
cookies.signed.permanent[:session_id] = { value: Current.session.id, httponly: true, same_site: :lax, secure: Rails.env.production? }
|
|
end
|
|
|
|
def terminate_session
|
|
Current.session&.destroy
|
|
Current.session = nil
|
|
cookies.delete(:session_id)
|
|
end
|
|
end
|