Injecting route-specific dependencies to avoid controller duplication.

route-authenticators.rb

# config/routes.rb
defaults authenticator: UserAuthenticator do
  resources :todos
end

scope :api, defaults: { authenticator: APIAuthenticator, format: :json } do
  resources :todos
end

# app/lib/user_authenticator.rb
class UserAuthenticator
  def initialize(context)
    @context = context
  end

  def let_me_in?
    principal.exists?
  end

  def principal
    User.where(id: @context.session[:user_id]).limit(1)
  end
end

# app/lib/api_authenticator.rb
class APIAuthenticator
  def initialize(context)
    @context = context
  end

  # <your token verification here>
  def let_me_in?
    bearer_token == 'mAg!cKnUmB3R'
  end

  def bearer_token
    @context.request.headers['Authorization'].dup&.delete_prefix!('Bearer ')
  end
end

# app/controllers/concerns/authenticators.rb
module Authenticators
  extend ActiveSupport::Concern
  
  included do
    before_action :authenticator
  end

  def authenticator
    @_authenticator ||= params.delete(:authenticator).new(self)
  end
end

# app/controllers/todos.rb
class TodosController < ActionController::Base
  include Authenticators