portrayal VS authentication-zero

I've been had great success building form objects with portrayal (https://github.com/scottscheapflights/portrayal) and ActiveModel. You can put validations into them, use them as form objects. Auto-filter the params based on class-level `portrayal.attributes` by making a `from_params`-type constructor. You're right that it'd be nice to have this out of the box, but this is just a few lines of glue code to setup. I'm in process of working on a new app template that does that.

Subsequently, we need a way to authenticate our users to associate prompts with them. Rather than using an incumbent like Devise, I chose to use a different approach. The authentication-zero gem can flexibly generate an authentication system, as opposed to including it as an engine. Conveniently, it comes with options such as:

If you don’t need a good amount of features that Devise brings to the table, I‘d skip it entirely. Look up has_secure_password, that will be enough for a vast amount of applications with authentication. Maybe combine with cancancan for authorization. Once you feel you have a grip on those, re-evaluate devise or take a look at https://github.com/lazaronixon/authentication-zero which will transparently integrate into your app instead of providing a Rube Goldberg machine (that’s what devise will feel like for beginners for a long time).

I keep going back and forth between Devise and something a little more friendly like authentication-zero gem for authentication.

For those that have used the authentication-zero gem or are familiar with its functionality, what is the best way to upgrade it in a project when new functionality is released?

True. I tend to stay away from gems that try to integrate into multiple parts of your app to provide some sort of comprehensive solution. The kinds of gems I recommend are: 1) libraries (you call into them when you need them) 2) mounted apps on a url, isolated from the rest of your app 3) generators (this one seems nice, the author mentioned it in another HN thread: https://github.com/lazaronixon/authentication-zero).

Check out https://github.com/lazaronixon/authentication-zero

I prefer to use authentication-zero, which generates code for me in the same application using has_secure_password, has good security practices, uses the same functions as Rails, and allows me to modify the flow to my liking.