implement api auth.

1 files changed, 27 insertions, 1 deletions

diff --git a/app/controllers/api/controller.rb b/app/controllers/api/controller.rb
index 6c90721..05fdedb 100644
--- a/app/controllers/api/controller.rb
+++ b/app/controllers/api/controller.rb
@@ -2,10 +2,36 @@ class Api::Controller < ActionController::Base
   # Prevent CSRF attacks by raising an exception.
   # For APIs, you may want to use :null_session instead.
   protect_from_forgery with: :null_session
+  before_action :authenticate!
 
-  def current_session
+  protected
+
+  def current_session(session_id = auth_token[:session_id])
+    @current_session ||= UserSession.authenticate(session_id)
   end
 
   def current_user
+    @current_user ||= User.find(current_session.try(:user_id))
+  rescue ActiveRecord::RecordNotFound
+    nil
+  end
+
+  private
+
+  def authenticate!
+    return if current_user.present?
+    return render json: { errors: ['Not Authenticated'] }, status: :unauthorized
+  rescue JWT::VerificationError, JWT::DecodeError
+    return render json: { errors: ['Not Authenticated'] }, status: :unauthorized
+  end
+
+  def auth_token
+    @auth_token ||= JsonWebToken.decode(http_token)
+  end
+
+  def http_token
+    if request.headers['Authorization'].present?
+      request.headers['Authorization'].split(' ').last
+    end
   end
 end