Rails%203%20In%20Action

The projects API
The respond_with method here will return the JSON representation of Project.all
when you make a JSON request to this path by calling to_json on the object. Rails
knows to return JSON data back from any request with the format (that’s the bit after
the dot in api/v1/projects.json) of JSON. Rails handles all of this internally for you,
which is nice of it to do. Let’s find out if this new controller and its only action make
the spec pass with bin/rspec spec/api/v1/projects_spec.rb:
1 example, 0 failures
There you have it, your first API route and action are serving up data! Now you’re
going to need to restrict what this action returns to only the projects that the user can
read, but you’ll need to first authenticate a user based on their token, which is made
easy with Devise.
13.1.3 API authentication
Your next task is authenticating the user who’s making the request in your API. The
first step is to do something with the token parameter that gets passed through with
your request. A sensible place to check this token would be in Api::V1::Base-
Controller, because you want to authenticate for all controllers in the API (although
there’s only one, for now). For this authentication, you’ll find if there’s a user with the
token passed in by using a before_filter like this in app/controllers/api/v1/base
_controller.rb:
before_filter :authenticate_user
private
def authenticate_user
@current_user = User.find_by_authentication_token(params[:token])
end
def current_user
@current_user
end
To check and see if this is working, you’ll alter your test in spec/api/v1/
projects_spec.rb to generate another project, give the user read access to only that
project, and check that the response from the API only contains that project. To do
this, you’ll add a new before to the “projects viewable by this user” context inside the
spec, using the code from the following listing.
Listing 13.4 spec/api/v1/projects_spec.rb
context "projects viewable by this user" do
before do
Factory(:project, :name => "Access Denied")
end
...
end
355