Localized routes

[renchap]

Hi Janko,

I am trying this new gem of yours to try to replace Devise in an existing app. It is much cleaner and easy to understand (and extend)!
So far I am managing to migrate most of the features I am using but I am having an issue with localized routes.

I need to have per-locale sign in and sign up routes, with Devise I used something like this:

# routes.rb
  all_locales_regexp = Regexp.union(
    I18n.available_locales.map(&:to_s) - [I18n.default_locale.to_s],
  )

  scope "(:locale)", locale: all_locales_regexp do
    devise_for :users

    get "/about", to: "pages#about", as: :about
    get "/legal", to: "pages#legal", as: :legal
end

# application_controller.rb
  before_action :set_locale
  def set_locale
    browser_preferred_locale = http_accept_language.compatible_language_from(I18n.available_locales)

    I18n.locale = \
          params[:loc] ||
         params[:locale] ||
          current_user.try(:locale) ||
          browser_preferred_locale ||
          I18n.default_locale
      end
  end

It allows me to have /users/sign_up (english) as well as /fr/users/sign_up (french) with the correct default locale.
I am then using these links in the various emails that are sent (password reset, account validation…), using the same locale as the page where the user made the request.

As Rodauth routes are handled separately from standard Rails routes I can not use this technique and I am not sure on how to do this properly. Do you have any idea on how I can replicate this behaviour without duplicating too many things?

[janko]

Hi Renault, nice to see you again 👋🏻

I believe you should be able set up locale path prefixes as follows:

class RodauthApp < Rodauth::Rails::App
  configure do
    # ...
    prefix { "/#{I18n.locale}/users" }
    # ...
  end

  route do |r|
    # ...
    all_locales = I18n.available_locales.map(&:to_s) - [I18n.default_locale.to_s]

    r.on [*all_locales, true], "users" do |locale|
      rails_request = ActionDispatch::Request.new(env)
      rails_request.params[:locale] = locale if locale

      r.rodauth
      r.pass
    end
    # ...
  end
end

This uses Roda's routing to match an optional locale prefix, using an array matcher, in combination with true matcher to achieve an optional segment.

The :locale set in the params here should be available in the controller callback, according to my glance at the Rails source code. We also define a dynamic path prefix based on I18n.locale that Rodauth will use for generating route paths.

Let me know if this works for you 🙂

[renchap]

Thanks, I will try this but it should do the trick.

I am moving forward slowly here because my usecase is a bit complex. I finally managed to find out how to change the format of the JSON responses to match the existing API.

As a loosely related question, how would you handle an app that needs to support all of:

• non JSON requests using the session
• JSON requests using the sessions, exactly the same as the non JSON request above (so JSON plugin, but no JWT, for logging in from a SPA without reloading the page)
• Mobile apps which are using the JSON API but needs a JWT

Currently if I enable both the JSON & JWT features, all JSON requests are considered JWT-enabled and do not set anything in the session.

I am wondering if it makes sense to use the /auth prefix with the default configuration, and use a secondary configuration with a /auth/jwt prefix which has the JWT feature enabled and is used by the mobile applications to create JWT-based sessions. My main concern here is that the /auth/jwt route should be configured with all the app-specific hooks configured in the main config. Does it makes sense?

[janko]

I think you should be able to accept all 3 kinds of requests through the same endpoints. Prior to the json plugin extraction, jwt feature would activate the "JWT mode" when the request was either a JSON request (json_request? returns true) or when it included a JWT token (jwt_token is present). I think this behaviour made sense when jwt feature was the only way to have a JSON API, and it was kept after json feature extraction mostly for backwards compatibility.

But I haven't considered the use case of supporting both JSON + Rails session and JWT requests, which actually makes a lot of sense how you described it. I think supporting it should be easy, overriding #use_jwt? to require a JWT token to be present in request headers should do it:

use_jwt? { jwt_token && super() }

The only thing I don't know is handling the login route, where a SPA client doesn't have any token to send. Maybe it would be better to check for the absence of cookie header instead:

use_jwt? { super() && !scope.env["HTTP_COOKIE"] }

[renchap]

I think I am bending a lot of assumptions of rodauth and the Rails integration with what I am working on, but the flexibility of Rodauth allows me to easily change the various behaviours to what I need :)

The main problem is indeed on how to differentiate between unauthenticated JSON requests from the SPA (no JWT) and the ones from the mobile applications (JWT). Checking if any cookies are set is an interesting idea, I guess no login/create account/forgot password request can happen as a first browser interaction, so there will be a Rails session cookie set when the requests comes from a browser.
I could also probably have my SPA add a special header to the requests it makes, and check those in use_jwt?, so by default JSON requests are JWT (which might be safer if one day I need to use the JWT-based API from a browser).
I also need to check if this works fine with CSRF protection and disable it only for JWT requests.

I will continue working on this and try to write a blog post to highlight how I did my migration from Devise, I think it might be interesting to some people 😃

[janko]

Yeah, a special header definitely sounds more reliable. Regarding CSRF protection, it's automatically skipped if #use_jwt? is true, if that helps.

Cool, I look forward to the article 🤘🏻

[renchap]

In case somebody needs it later, I ended up implementing the following:

class RodauthApp < Rodauth::Rails::App
  configure do
    prefix do
      if I18n.locale == I18n.default_locale
        "/auth"
      else
        "/#{I18n.locale}/auth"
      end
    end
  end

  route do |r|
    rodauth.check_active_session

    all_locales = I18n.available_locales.map(&:to_s) - [I18n.default_locale.to_s]
    r.on [*all_locales, true], "auth" do |locale|
      rails_request = ActionDispatch::Request.new(env)
      rails_request.params[:locale] = locale || I18n.default_locale
      r.rodauth
      r.pass
    end
end

And as a cross-over with my other discussion, I created a module with URL helpers taking the locale into account

module RodauthUrlHelpers
  %i[login reset_password reset_password_request create_account].each do |method|
    %i[path url].each do |suffix|
      define_method "user_#{method}_#{suffix}" do |*args, **options|
        I18n.with_locale(options[:locale]) do
          Rodauth::Rails.rodauth.send("#{method}_#{suffix}", *args, **options.except(:locale))
        end
      end
    end
  end
end

I am including it in my test helper as well as in my ApplicationController so they are available like the standard Rails helpers

class ApplicationController < ActionController::Base
    include RodauthUrlHelpers
    helper_method RodauthUrlHelpers.public_instance_methods
end

[janko]

Thanks for including this. Since there wasn't any official guide, I just created a wiki page showing a subset of this configuration – https://github.com/janko/rodauth-rails/wiki/Localized-Routes.