wkhandClaude Opus 5.5
e14bada114
The app becomes a Rails 8 application; the Vue frontend moves to app/frontend and is served through vite_rails. - Without an account documents stay in the browser (IndexedDB). Sign-in is by magic link or the 6-digit code from the same mail; afterwards local documents can be uploaded into the account. - Server documents (/d/<id>) with versioned saves and a single-editor lock per browser tab; others see them read-only and follow by polling. - Sharing via link (works without an account) and via e-mail invitation, roles viewer/editor; the owner manages links and people. - Store gains a read-only mode that blocks all content changes. - Solid Queue, Cache and Cable share the one PostgreSQL database. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
38 lines
1.3 KiB
Ruby
38 lines
1.3 KiB
Ruby
module Api
|
|
class AuthController < BaseController
|
|
rate_limit to: 20, within: 1.hour, only: :magic_link, with: -> { too_many }
|
|
rate_limit to: 30, within: 15.minutes, only: :code, with: -> { too_many }
|
|
|
|
# POST /api/auth/magic_link { email, return_to }
|
|
# Always the same answer, so it can't be used to find out who has an account.
|
|
def magic_link
|
|
email = params.require(:email).to_s
|
|
unless MagicLink.throttled?(email)
|
|
link = MagicLink.issue!(email:, return_to: params[:return_to])
|
|
AuthMailer.magic_link(link, link.token, link.code).deliver_later
|
|
end
|
|
render json: { ok: true }
|
|
rescue ActiveRecord::RecordInvalid
|
|
render json: { error: "invalid_email" }, status: :unprocessable_entity
|
|
end
|
|
|
|
# POST /api/auth/code { email, code } -- the 6-digit code from the mail
|
|
def code
|
|
link = MagicLink.find_by_code(params.require(:email), params.require(:code))
|
|
return render(json: { error: "invalid_code" }, status: :unprocessable_entity) unless link
|
|
start_session_for(link.redeem!)
|
|
render json: { user: Current.user.as_json, redirect: link.destination }
|
|
end
|
|
|
|
# DELETE /api/auth/session
|
|
def logout
|
|
terminate_session
|
|
render json: { ok: true }
|
|
end
|
|
|
|
private
|
|
|
|
def too_many = render(json: { error: "rate_limited" }, status: :too_many_requests)
|
|
end
|
|
end
|