Class: Hitch::ApplicationController

Inherits:
ApplicationController
  • Object
show all
Includes:
HostValidation, IssuerUrl, OauthParameterValidation
Defined in:
app/controllers/hitch/application_controller.rb

Overview

All gem controllers inherit from the host's ApplicationController so the host's authentication concern, layout, helpers, and middleware apply automatically. The gem only adds OAuth-specific behavior on top.

Instance Method Summary collapse

Instance Method Details

#current_principal ⇒ Object

Resolve the current authenticated principal.

  1. Call the host-configured method (default :current_user) if the host defines it — covers Devise, has_secure_password apps, and anything that exposes a current_user-style helper.
  2. Otherwise fall back to Rails 8's built-in authentication generator, which exposes the signed-in user as Current.user (delegated from Current.session) and defines NO current_user controller method. Without this fallback, a stock Rails 8 auth app would treat every visitor as unauthenticated and the consent screen would never render.

Returns nil when neither resolves — the controllers handle nil as "unauthenticated".



41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
 
# File 'app/controllers/hitch/application_controller.rb', line 41

def current_principal
  method_name = Hitch.configuration.principal_method
  return send(method_name) if respond_to?(method_name, true)

  # Rails 8 built-in auth exposes the signed-in user as Current.user,
  # populated by the host's `resume_session` — which normally runs
  # inside the `require_authentication` before_action that we skip (it
  # redirects via a host route that doesn't resolve in the engine).
  # So resume the session ourselves before reading Current.user;
  # without this, a signed-in user looks unauthenticated here and the
  # consent screen loops back to login. `resume_session` is idempotent
  # (Current.session ||= …); guarded for hosts that don't define it.
  resume_session if respond_to?(:resume_session, true)
  return Current.user if defined?(Current) && Current.respond_to?(:user)

  nil
end