From 79fc57a82a1988d992004679a9f729b8e6892a1c Mon Sep 17 00:00:00 2001 From: David Heinemeier Hansson Date: Wed, 3 Dec 2025 10:39:47 +0100 Subject: [PATCH] Use built-in authenticate_or_request_with_http_token Hat tip to @adrienpoly --- app/controllers/concerns/authentication.rb | 12 +++--------- app/models/identity.rb | 6 ++++-- 2 files changed, 7 insertions(+), 11 deletions(-) diff --git a/app/controllers/concerns/authentication.rb b/app/controllers/concerns/authentication.rb index 5dc3fb866..398f71b03 100644 --- a/app/controllers/concerns/authentication.rb +++ b/app/controllers/concerns/authentication.rb @@ -56,15 +56,9 @@ module Authentication end def authenticate_by_bearer_token - authorization_scheme, bearer_token = request.authorization.to_s.split(" ", 2) - - if authorization_scheme == "Bearer" && bearer_token.present? - access_token = Identity::AccessToken.find_by(token: bearer_token) - - if access_token && access_token.allows?(request.method) - Current.identity = access_token.identity - else - head :unauthorized + authenticate_or_request_with_http_token do |token| + if identity = Identity.find_by_permissable_access_token(token, method: request.method) + Current.identity = identity end end end diff --git a/app/models/identity.rb b/app/models/identity.rb index 43466bd30..7495e37c3 100644 --- a/app/models/identity.rb +++ b/app/models/identity.rb @@ -14,8 +14,10 @@ class Identity < ApplicationRecord validates :email_address, format: { with: URI::MailTo::EMAIL_REGEXP } normalizes :email_address, with: ->(value) { value.strip.downcase.presence } - def self.find_by_access_token(token) - AccessToken.find_by(token: token)&.identity + def self.find_by_permissable_access_token(token, method:) + if (access_token = AccessToken.find_by(token: token)) && access_token.allows?(method) + access_token.identity + end end def send_magic_link(**attributes)