application_controller.rb

@@ -10,8 +10,31 @@ class ApplicationController < ActionController::Base
   before_filter :initiate_handover
   before_filter -> { request.format = "html" unless params[:format] }
 
+  skip_before_action :verify_authenticity_token, if: :check_api_token
+
   protected
 
+  def check_api_token
+    return false if prevent_api_token_access
+
+    return false if request.format.to_sym != :json
+
+    uuid = request.headers["X-API-Token"]
+
+    return false if uuid.blank?
+
+    api_token = ApiToken.find_by(uuid: uuid, active: true)
+    raise ActionController::NotAuthorized if !api_token
+
+    sign_in(api_token.user)
+
+    return true
+  end
+
+  def prevent_api_token_access
+    false
+  end
+