Devise user authentication in grape

Question

I have a rails application that contains all front-end part , administrative and register/login/logout (Devise).

I also have a part with more dynamic maps that is written in javascript React. It runs on a controller / view separately in the same application.

I created an api using Grape to expose the data to React.

My question is how to know that the user is logged in without the use of tokens.

Which way ? I can use cookies and session stored in the browser? How would?

I can get the user id by:

user_id = env['rack.session']['warden.user.user.key'].first.first

That would be fine?

User.find(user_id)

It's safe?

Answer 1

One of my application I have use devise authentication like below:

api.rb

#require 'grape'
module Base
  class API < Grape::API
    prefix 'api'
    version 'v1', :using => :header, :vendor => 'vendor'
    format :json

    helpers do
      def current_user
        user = User.where(authentication_token: params[:auth_token], is_approved: true).first
        if user
          @current_user = user
        else
          false
        end
      end

      def authenticate!
        error!('401 Unauthorized', 401) unless current_user
      end

    end


    # load the rest of the API
    mount V1::Registration
    mount V1::Sessions

  end
end

sessions.rb

module V1
  class Sessions < Grape::API
    version 'v1', using: :path
    format :json
    prefix :api

    resource :sessions do

      ##<$ User Sign In API $>##
      desc 'Authenticate user and return user object / access token'

      params do
        requires :email, type: String, desc: 'User email'
        requires :password, type: String, desc: 'User Password'
      end

      post do
        email = params[:email]
        password = params[:password]

        if email.nil? or password.nil?
          error!({error_code: 404, error_message: 'Invalid Email or Password.'}, 401)
          return
        end

        user = User.where(email: email.downcase).first
        if user.nil?
          error!({error_code: 404, error_message: 'Invalid Email or Password.'}, 401)
          return
        end

        if !user.valid_password?(password)
          error!({error_code: 404, error_message: 'Invalid Email or Password.'}, 401)
          return
        else
          user.ensure_authentication_token
          user.save
          {status: 'ok', auth_token: user.authentication_token}
        end
      end

      desc 'Destroy the access token'
      params do
        requires :auth_token, type: String, desc: 'User Access Token'
      end
      delete ':auth_token' do
        auth_token = params[:auth_token]
        user = User.where(authentication_token: auth_token).first
        if user.nil?
          error!({error_code: 404, error_message: 'Invalid access token.'}, 401)
          return
        else
          user.reset_authentication_token
          {status: 'ok'}
        end
      end

    end
  end
end