api_authentication_gem

# Gemfile
gem 'api_authentication_gem'

class CreateApiAuthTables < ActiveRecord::Migration[7.0]
  def change
    create_table :api_auth_refresh_tokens do |t|
      t.integer  :user_id,    null: false
      t.string   :token,      null: false
      t.datetime :expires_at, null: false
      t.datetime :revoked_at
      t.timestamps
    end
    add_index :api_auth_refresh_tokens, :token,   unique: true
    add_index :api_auth_refresh_tokens, :user_id

    create_table :api_auth_revoked_tokens do |t|
      t.string   :jti,        null: false
      t.datetime :expires_at, null: false
      t.timestamps
    end
    add_index :api_auth_revoked_tokens, :jti, unique: true

    create_table :api_auth_password_resets do |t|
      t.string   :identifier, null: false
      t.string   :token,      null: false
      t.datetime :expires_at, null: false
      t.datetime :used_at
      t.timestamps
    end
    add_index :api_auth_password_resets, :token,      unique: true
    add_index :api_auth_password_resets, :identifier

    create_table :api_auth_lockouts do |t|
      t.string   :identifier,      null: false
      t.integer  :failed_attempts, default: 0, null: false
      t.datetime :locked_until
      t.timestamps
    end
    add_index :api_auth_lockouts, :identifier, unique: true

    # only needed if you use magic links
    create_table :api_auth_magic_links do |t|
      t.string   :identifier, null: false
      t.string   :token,      null: false
      t.datetime :expires_at, null: false
      t.datetime :used_at
      t.timestamps
    end
    add_index :api_auth_magic_links, :token,      unique: true
    add_index :api_auth_magic_links, :identifier

    # only needed if you use session tracking
    create_table :api_auth_sessions do |t|
      t.integer  :user_id,    null: false
      t.string   :jti,        null: false
      t.string   :ip_address
      t.string   :user_agent
      t.datetime :expires_at, null: false
      t.datetime :revoked_at
      t.timestamps
    end
    add_index :api_auth_sessions, :jti,     unique: true
    add_index :api_auth_sessions, :user_id
  end
end

# config/initializers/api_auth.rb

ApiAuthenticationGem.configure do |config|
  config.secret_key = ENV["API_AUTH_SECRET_KEY"]

  config.user_class             = "User"
  config.token_expiry           = 15 * 60       # 15 min
  config.min_password_length    = 8

  config.refresh_tokens_enabled = true
  config.refresh_token_expiry   = 30 * 24 * 60 * 60  # 30 days

  config.revocation_enabled     = true

  config.lockout_enabled        = true
  config.max_login_attempts     = 5
  config.lockout_duration       = 15 * 60

  # optional features
  config.magic_link_enabled       = false
  config.session_tracking_enabled = false

  # hooks — all optional
  config.on_signup         = ->(user)  { puts "signed up: #{user.email}" }
  config.on_login          = ->(user)  { puts "logged in: #{user.email}" }
  config.on_login_failure  = ->(email) { puts "failed login: #{email}" }
  config.on_logout         = ->(jti)   { puts "logged out: #{jti}" }
  config.on_password_reset = ->(user)  { puts "password reset: #{user.email}" }
end

class User < ApplicationRecord
  has_secure_password
  validates :email, presence: true, uniqueness: true
end

class AuthController < ApplicationController
  def signup
    result = ApiAuthenticationGem::Auth.signup(email: params[:email], password: params[:password])
    if result[:error]
      render json: result, status: :unprocessable_entity
    else
      render json: result, status: :created
    end
  end

  def login
    result = ApiAuthenticationGem::Auth.login(
      email:      params[:email],
      password:   params[:password],
      ip_address: request.remote_ip,
      user_agent: request.user_agent
    )
    result[:error] ? render(json: result, status: :unauthorized) : render(json: result)
  end

  def refresh
    result = ApiAuthenticationGem::Auth.refresh(refresh_token: params[:refresh_token])
    result[:error] ? render(json: result, status: :unauthorized) : render(json: result)
  end

  def logout
    token = request.headers["Authorization"]&.split(" ")&.last
    render json: ApiAuthenticationGem::Auth.revoke(token: token)
  end

  def forgot_password
    result = ApiAuthenticationGem::Auth.request_password_reset(email: params[:email])
    # send result[:reset_token] by email — don't expose it in the response
    render json: { message: result[:message] }
  end

  def reset_password
    result = ApiAuthenticationGem::Auth.reset_password(
      reset_token:  params[:token],
      new_password: params[:password]
    )
    result[:error] ? render(json: result, status: :unprocessable_entity) : render(json: result)
  end

  # magic links
  def send_magic_link
    result = ApiAuthenticationGem::Auth.send_magic_link(email: params[:email])
    # send result[:magic_token] by email — don't expose it in the response
    render json: { message: result[:message] }
  end

  def verify_magic_link
    result = ApiAuthenticationGem::Auth.verify_magic_link(token: params[:token])
    result[:error] ? render(json: result, status: :unauthorized) : render(json: result)
  end

  # session tracking
  def sessions
    authenticate_user!
    render json: ApiAuthenticationGem::Auth.active_sessions(user_id: @current_user.id)
  end

  def revoke_session
    authenticate_user!
    render json: ApiAuthenticationGem::Auth.revoke_session(jti: params[:jti])
  end

  def revoke_all_sessions
    authenticate_user!
    render json: ApiAuthenticationGem::Auth.revoke_all_sessions(user_id: @current_user.id)
  end
end

Rails.application.routes.draw do
  post   "signup",             to: "auth#signup"
  post   "login",              to: "auth#login"
  post   "refresh",            to: "auth#refresh"
  delete "logout",             to: "auth#logout"
  post   "forgot_password",    to: "auth#forgot_password"
  post   "reset_password",     to: "auth#reset_password"
  post   "magic_link",         to: "auth#send_magic_link"
  post   "magic_link/verify",  to: "auth#verify_magic_link"
  get    "sessions",           to: "auth#sessions"
  delete "sessions/:jti",      to: "auth#revoke_session"
  delete "sessions",           to: "auth#revoke_all_sessions"
end

class ApplicationController < ActionController::API
  include ApiAuthenticationGem::Concerns::Authenticatable
end

class PostsController < ApplicationController
  before_action :authenticate_user!

  def index
    render json: current_user.posts
  end
end

class AdminController < ApplicationController
  before_action :authenticate_user!
  before_action -> { authorize_role!("admin") }

  def dashboard
    render json: { message: "welcome #{current_user.email}" }
  end
end

# step 1 — request a link
result = ApiAuthenticationGem::Auth.send_magic_link(email: "user@example.com")
# deliver result[:magic_token] by email

# step 2 — user clicks the link
result = ApiAuthenticationGem::Auth.verify_magic_link(token: params[:token])
# => { token: "...", user: ..., refresh_token: "..." }

# list active sessions
ApiAuthenticationGem::Auth.active_sessions(user_id: user.id)

# revoke one session (sign out a specific device)
ApiAuthenticationGem::Auth.revoke_session(jti: "some-jti")

# sign out everywhere
ApiAuthenticationGem::Auth.revoke_all_sessions(user_id: user.id)

ApiAuthenticationGem.configure do |config|
  config.algorithm   = "RS256"
  config.private_key = OpenSSL::PKey::RSA.new(File.read("private.pem"))
  config.public_key  = OpenSSL::PKey::RSA.new(File.read("public.pem"))
  config.user_class  = "User"
end

ApiAuthenticationGem::RevokedToken.cleanup!