rails-auth-patterns

Rails Authentication Patterns

The authentication approach is an orthogonal project fact, not an architecture axis — a native project can use Devise, an extracted project can use built-in auth. Match what the project already has; never suggest replacing one approach with another unless explicitly asked.

See patterns.md for detailed code examples.

Detecting the Auth Approach

Read it from the project-conventions fingerprint (Auth category), or detect directly:

1. grep "devise" Gemfile → Devise
2. grep "has_secure_password" app/models/ → built-in auth
3. Check for app/controllers/sessions_controller.rb → custom auth
4. Rails 8+? → built-in generator available

Approach	Use When
Rails 8 generator	New Rails 8+ projects, full control, no gem dependencies
has_secure_password (manual)	Simple auth, full control, pre-Rails 8
Devise	Multi-feature auth (confirmable, lockable, omniauthable)

Rails 8 Built-In Auth

What the Generator Creates

bin/rails generate authentication
# Creates: User model, Session model, SessionsController,
# Authentication concern, PasswordsController, PasswordsMailer, migrations

Key Rails 8 Features (Non-Obvious)

generates_token_for with automatic invalidation:

class User < ApplicationRecord
  has_secure_password
  has_many :sessions, dependent: :destroy

  normalizes :email_address, with: -> { _1.strip.downcase }

  # Token auto-invalidates when password_salt changes (i.e., password changed)
  generates_token_for :password_reset, expires_in: 15.minutes do
    password_salt&.last(10)
  end

  # Token auto-invalidates when email changes
  generates_token_for :email_confirmation, expires_in: 24.hours do
    email_address
  end

  # Non-expiring token (e.g., unsubscribe links)
  generates_token_for :unsubscribe
end

# Generate: user.generate_token_for(:password_reset)
# Find:     User.find_by_token_for(:password_reset, token)  # nil if expired/invalid
# Find!:    User.find_by_token_for!(:password_reset, token) # raises if invalid