libr-2/app/controllers/api/v1/sessions_controller.rb

class Api::V1::SessionsController < Devise::SessionsController
  skip_before_action :verify_authenticity_token, raise: false
  after_action :clear_session

  before_action :check_god_token, only: [:callback]

  def create
    warden.authenticate!(:scope => resource_name, :recall => "#{controller_path}#failure")
    render json: user_json
  end

  def user_json(user= current_user)
    {
      user: {
        id: user.id,
        name: user.name,
        email: user.email,
        token: JWT.encode({id: user.id}, 'tuxue', 'HS256')
      }
    }
  end

  def destroy
    sign_out(resource_name)
  end

  def failure
    render :json => {:success => false, :errors => '用户名或者密码错误,请重试'}, status: :forbidden
  end

  def callback
    @current_user = app_auth params[:uid], params[:provider], params[:name], params[:email], params[:avatar]
    if @current_user.persisted?
      render json: user_json(@current_user)
    else
      return failure
    end
  end

  private

  def app_auth uid, provider, name, email, avatar
    identity = Identity.find_or_create_by(uid: uid, provider: provider)
    user = identity.user
    if user
      user
    else
      user = User.create_user_from_oauth(uid, provider, name, email, avatar)
      identity.user = user
      identity.save!
      user
    end
  end

  def clear_session
    session.clear
  end

  def check_god_token
    god_token = request.headers["Authorization"].try(:split, ' ').try(:last)
    return render json: {message: 'You are fake!'}, status: 401 if god_token != 'love_libr'
  end

end