rubocop VS Devise

https://github.com/rubocop/rubocop/issues/8091#issuecomment-...

perhaps they are biased against the tool from participating in a campaign to police the name in the past.

gem "rubocop" - https://github.com/rubocop/rubocop | Set up code guidelines for your dev team, I recommend using whatever Standard recommends.

I believe if you use the `||` operator instead of `or`, then things just work out fine. I agree it is really annoying. But I am pretty sure if you use a tool like RuboCop https://github.com/rubocop/rubocop (a static code analysis tool) then it will catch bugs like this. Note that I am not recommending Ruby. But in my experience if you want to work with a language and it has a community style guide and a linter that enforces it, it will save me some heartache.

Adopt some sort of consistent formatting. Your top-level module starts off indented, seems like wasted space. May I suggest RuboCop?

By default, out of the box, RuboCop comes with a default set of pre-configured rules. The documentation will tell you Rubocop's default rules.

RuboCop is a Ruby static code analyzer (a.k.a. linter) and code formatter. Out of the box it will enforce many of the guidelines outlined in the community Ruby Style Guide. Apart from reporting the problems discovered in your code, RuboCop can also automatically fix many of them for you.

But I will encourage you to adopt Rubocop to enforce the style you want, so that if others want to contribute, they can write with spaces and then run rubocop -a and end up with the styling you prefer. Tabs indentation support was added a couple of years back: https://github.com/rubocop/rubocop/pull/7867

In my last job I encountered my first Rails codebase ever (mostly REST APIs but a few server-rendered views as well). After the initial chaotic impression of the codebase (it was a startup after all) with all the Rails magic on top, I really fell in love with the framework after a more experienced Rails dev introduced a few key conventions and helpful libraries to the codebase.

Out of those, I’d at least add the RuboCop [1] linter and the BetterSpecs [2] guidelines to this list. Both helped tremendously in eliminating bikeshedding in the team and freeing up brainpower to solve actual problems. The first one helped me learn intricacies of Ruby bit by bit right in my IDE and the latter guided us to write tests in a style that’s easy to maintain and trust.

[1] https://github.com/rubocop/rubocop

[2] https://www.betterspecs.org/

Use devise gem, which is probably the most famous rails authentication system.

IMHO the stateful opaque token approach is simple enough that it can (and often does) get baked into whatever language/framework you’re using to write your app. In addition, the very nature of session tokens is such that the logic for what the token actually means/represents lives in your app, on the server.

So, that may be why we don’t see more “opaque session token” standards/libraries out there as an alternative to JWTs.

But if you want an existing example, Devise for Rails [1] has been around a while.

[1] https://github.com/heartcombo/devise

Users can signup and login via the Devise gem and create their organizations.

However for smaller apps it might be an overkill. In "real-life" production systems, overengineering is one of the biggest crimes. This is true any framework and technology, so in Rails you might want to use Rodauth since it is big and interesting and challenging, but then again, if you are building a simple greenfield MVP you do not have the time or need, for a big, complex solution. In those cases Rails developers usually go for Devise. It is one of the most known Rails gems, in multiple Rails surveys it was both number 1 in popularity, likability and "most frustrating" rankings.

Since Rails 7, there's more and more tooling that enables us, developers, to roll our own authentication. Devise is great and has been an amazing companion over the years. It also has this neat little feature - an authenticated route constraint which "hides" certain routes from people that are not signed in.

[changelog] https://github.com/heartcombo/devise/blob/main/CHANGELOG.md [upgrade guide] https://github.com/heartcombo/devise/wiki/How-To:-Upgrade-to-Devise-4.9.0-%5BHotwire-Turbo-integration%5D

As much as this article is about user authorization, there's something important we need to cover: user authentication. Without it, any authorization policies we try to define later on will be useless. But there is no need to write authentication from scratch. Let's use Devise.

With around 50 new gems released daily, it is common to use trending libraries for managing everyday tasks. You probably use Devise for authentication, Cancan for authorization, Kaminari for pagination, or run tests with Rspec.

Devise is an authentication library built on top of Warden, a Rack-based authentication framework.

devise: An authentication library designed for Rails