authentication-flow

Name: authentication-flow
Author: ThibautBaissac

42installs79forks

How to install authentication-flow?

thibautbaissac/rails_ai_agents/authentication-flow

$npx -y skills add ThibautBaissac/rails_ai_agents --skill authentication-flow

Installs into the current project.

Summary

Implements authentication using Rails 8 built-in generator. Use when setting up user authentication, login/logout, session management, password reset flows, or securing controllers. WHEN NOT: Authorization and permissions (use Pundit policies), API token authentication, OAuth/SSO

Files · 1

View on GitHub

SKILL.md

1	# Rails 8 Authentication
2
3	## Overview
4
5	Rails 8 includes a built-in authentication generator that creates a complete, secure authentication system without external gems.
6
7	## Quick Start
8
9	```bash
10	# Generate authentication
11	bin/rails generate authentication
12
13	# Run migrations
14	bin/rails db:migrate
15	```
16
17	This creates:
18	- `User` model with `has_secure_password`
19	- `Session` model for secure sessions
20	- `Current` model for request-local storage
21	- Authentication concern for controllers
22	- Session and Password controllers
23	- Login/logout views
24
25	## Generated Structure
26
27	```
28	app/
29	├── models/
30	│ ├── user.rb # User with has_secure_password
31	│ ├── session.rb # Session tracking
32	│ └── current.rb # Current.user accessor
33	├── controllers/
34	│ ├── sessions_controller.rb # Login/logout
35	│ ├── passwords_controller.rb # Password reset
36	│ └── concerns/
37	│ └── authentication.rb # Auth helpers
38	└── views/
39	├── sessions/
40	│ └── new.html.erb # Login form
41	└── passwords/
42	├── new.html.erb # Forgot password
43	└── edit.html.erb # Reset password
44	```
45
46	## Core Components
47
48	### User Model
49
50	```ruby
51	# app/models/user.rb
52	class User < ApplicationRecord
53	has_secure_password
54	has_many :sessions, dependent: :destroy
55
56	normalizes :email_address, with: -> { _1.strip.downcase }
57
58	validates :email_address, presence: true, uniqueness: true,
59	format: { with: URI::MailTo::EMAIL_REGEXP }
60	end
61	```
62
63	### Session Model
64
65	```ruby
66	# app/models/session.rb
67	class Session < ApplicationRecord
68	belongs_to :user
69
70	before_create { self.token = SecureRandom.urlsafe_base64(32) }
71
72	def self.find_by_token(token)
73	find_by(token: token) if token.present?
74	end
75	end
76	```
77
78	### Current Model
79
80	```ruby
81	# app/models/current.rb
82	class Current < ActiveSupport::CurrentAttributes
83	attribute :session
84	delegate :user, to: :session, allow_nil: true
85	end
86	```
87
88	### Authentication Concern
89
90	```ruby
91	# app/controllers/concerns/authentication.rb
92	module Authentication
93	extend ActiveSupport::Concern
94
95	included do
96	before_action :require_authentication
97	helper_method :authenticated?
98	end
99
100	class_methods do
101	def allow_unauthenticated_access(**options)
102	skip_before_action :require_authentication, **options
103	end
104	end
105
106	private
107
108	def authenticated?
109	Current.session.present?
110	end
111
112	def require_authentication
113	resume_session \|\| request_authentication
114	end
115
116	def resume_session
117	if session_token = cookies.signed[:session_token]
118	if session = Session.find_by_token(session_token)
119	Current.session = session
120	end
121	end
122	end
123
124	def request_authentication
125	redirect_to new_session_path
126	end
127
128	def start_new_session_for(user)
129	session = user.sessions.create!
130	cookies.signed.permanent[:session_token] = { value: session.token, httponly: true }
131	Current.session = session
132	end
133
134	def terminate_session
135	Current.session&.destroy
136	cookies.delete(:session_token)
137	end
138	end
139	```
140
141	## Usage Patterns
142
143	### Protecting Controllers
144
145	```ruby
146	class ApplicationController < ActionController::Base
147	include Authentication
148
149	# All actions require authentication by default
150	end
151
152	class PostsController < ApplicationController
153	# All actions protected
154	end
155
156	class HomeController < ApplicationController
157	# Allow public access to specific actions
158	allow_unauthenticated_access only: [:index, :about]
159	end
160	```
161
162	### Accessing Current User
163
164	```ruby
165	# In controllers
166	Current.user
167	Current.user.email_address
168
169	# In views
170	<%= Current.user.email_address %>
171
172	# In models (use sparingly)
173	Current.user
174	```
175
176	### Login Flow
177
178	```ruby
179	# app/controllers/sessions_controller.rb
180	class SessionsController < ApplicationController
181	allow_unauthenticated_access only: [:new, :create]
182
183	def new
184	end
185
186	def create
187	if user = User.authenticate_by(email_address: params[:email_address],
188	password: params[:password])
189	start_new_session_for(user)
190	redirect_to root_path, notice: "Signed in successfully"
191	else
192	flash.now[:alert] = "Invalid email or password"
193	render :new, status: :unprocessable_entity
194	end
195	end
196
197	def destroy
198	terminate_session
199	redirect_to root_path, notice: "Signed out"
200	end
201	end
202	```
203
204	## Testing Authentication
205
206	### Request Specs
207
208	```ruby
209	# spec/requests/sessions_spec.rb
210	RSpec.describe "Sessions", type: :request do
211	let(:user) { create(:user, password: "password123") }
212
213	describe "POST /session" do
214	context "with valid credentials" do
215	it "sig

People who liked this also viewed

6 picks

Type

authentication-flow

42installs79forks

View on GitHub

How to install authentication-flow?

thibautbaissac/rails_ai_agents/authentication-flow

$npx -y skills add ThibautBaissac/rails_ai_agents --skill authentication-flow

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Rails 8 Authentication
2
3	## Overview
4
5	Rails 8 includes a built-in authentication generator that creates a complete, secure authentication system without external gems.
6
7	## Quick Start
8
9	```bash
10	# Generate authentication
11	bin/rails generate authentication
12
13	# Run migrations
14	bin/rails db:migrate
15	```
16
17	This creates:
18	- `User` model with `has_secure_password`
19	- `Session` model for secure sessions
20	- `Current` model for request-local storage
21	- Authentication concern for controllers
22	- Session and Password controllers
23	- Login/logout views
24
25	## Generated Structure
26
27	```
28	app/
29	├── models/
30	│ ├── user.rb # User with has_secure_password
31	│ ├── session.rb # Session tracking
32	│ └── current.rb # Current.user accessor
33	├── controllers/
34	│ ├── sessions_controller.rb # Login/logout
35	│ ├── passwords_controller.rb # Password reset
36	│ └── concerns/
37	│ └── authentication.rb # Auth helpers
38	└── views/
39	├── sessions/
40	│ └── new.html.erb # Login form
41	└── passwords/
42	├── new.html.erb # Forgot password
43	└── edit.html.erb # Reset password
44	```
45
46	## Core Components
47
48	### User Model
49
50	```ruby
51	# app/models/user.rb
52	class User < ApplicationRecord
53	has_secure_password
54	has_many :sessions, dependent: :destroy
55
56	normalizes :email_address, with: -> { _1.strip.downcase }
57
58	validates :email_address, presence: true, uniqueness: true,
59	format: { with: URI::MailTo::EMAIL_REGEXP }
60	end
61	```
62
63	### Session Model
64
65	```ruby
66	# app/models/session.rb
67	class Session < ApplicationRecord
68	belongs_to :user
69
70	before_create { self.token = SecureRandom.urlsafe_base64(32) }
71
72	def self.find_by_token(token)
73	find_by(token: token) if token.present?
74	end
75	end
76	```
77
78	### Current Model
79
80	```ruby
81	# app/models/current.rb
82	class Current < ActiveSupport::CurrentAttributes
83	attribute :session
84	delegate :user, to: :session, allow_nil: true
85	end
86	```
87
88	### Authentication Concern
89
90	```ruby
91	# app/controllers/concerns/authentication.rb
92	module Authentication
93	extend ActiveSupport::Concern
94
95	included do
96	before_action :require_authentication
97	helper_method :authenticated?
98	end
99
100	class_methods do
101	def allow_unauthenticated_access(**options)
102	skip_before_action :require_authentication, **options
103	end
104	end
105
106	private
107
108	def authenticated?
109	Current.session.present?
110	end
111
112	def require_authentication
113	resume_session \|\| request_authentication
114	end
115
116	def resume_session
117	if session_token = cookies.signed[:session_token]
118	if session = Session.find_by_token(session_token)
119	Current.session = session
120	end
121	end
122	end
123
124	def request_authentication
125	redirect_to new_session_path
126	end
127
128	def start_new_session_for(user)
129	session = user.sessions.create!
130	cookies.signed.permanent[:session_token] = { value: session.token, httponly: true }
131	Current.session = session
132	end
133
134	def terminate_session
135	Current.session&.destroy
136	cookies.delete(:session_token)
137	end
138	end
139	```
140
141	## Usage Patterns
142
143	### Protecting Controllers
144
145	```ruby
146	class ApplicationController < ActionController::Base
147	include Authentication
148
149	# All actions require authentication by default
150	end
151
152	class PostsController < ApplicationController
153	# All actions protected
154	end
155
156	class HomeController < ApplicationController
157	# Allow public access to specific actions
158	allow_unauthenticated_access only: [:index, :about]
159	end
160	```
161
162	### Accessing Current User
163
164	```ruby
165	# In controllers
166	Current.user
167	Current.user.email_address
168
169	# In views
170	<%= Current.user.email_address %>
171
172	# In models (use sparingly)
173	Current.user
174	```
175
176	### Login Flow
177
178	```ruby
179	# app/controllers/sessions_controller.rb
180	class SessionsController < ApplicationController
181	allow_unauthenticated_access only: [:new, :create]
182
183	def new
184	end
185
186	def create
187	if user = User.authenticate_by(email_address: params[:email_address],
188	password: params[:password])
189	start_new_session_for(user)
190	redirect_to root_path, notice: "Signed in successfully"
191	else
192	flash.now[:alert] = "Invalid email or password"
193	render :new, status: :unprocessable_entity
194	end
195	end
196
197	def destroy
198	terminate_session
199	redirect_to root_path, notice: "Signed out"
200	end
201	end
202	```
203
204	## Testing Authentication
205
206	### Request Specs
207
208	```ruby
209	# spec/requests/sessions_spec.rb
210	RSpec.describe "Sessions", type: :request do
211	let(:user) { create(:user, password: "password123") }
212
213	describe "POST /session" do
214	context "with valid credentials" do
215	it "sig

People who liked this also viewed

6 picks

Type