# #179 NEW Rails 8 Authentication Generator: Build Registrations feature

- URL: https://superails.com/posts/179-new-rails-8-authentication-generator-build-registrations-feature
- Published: 2024-07-21
- Duration: 10:48
- Access: free
- Topics: authentication
- Playlists: Rails Authentication generator

Rails will now have a default authentication generator out of the box!

In the previous episode we ran the generator, allowing existing users to sign in. 

Now let's add a "registrations" feature, that will enable sign ups (creation of new users). 

I hope this feature gets merged into Rails too!

Yet, to make this authentication solution viable in production, you will still need to add AT LEAST "password reset" and "email confirmation" functionality.

I highly recommend to use Devise for authentication, rather than reinvent the wheel.

Episode source code: https://github.com/corsego/178-rails-8-authentication-generator/commit/b94b002dc7c4c685fb86956cab1fc3e3d9233473
Based on this blogpost: https://blog.corsego.com/rails-8-authentication-registration

## Transcript

Hello. So at the moment, rails is working on a new authentication generator, and so far they have added a possibility for users to create a generator to create the users and sessions and allow users to log in via an email and password. And in the previous episode, we implemented this solution based on this pull request in a new Rails application. So it looks like this. I have a homepage that is accessible to anybody. I have a dashboard page that is accessible to only logged in users, and I can log in as an existing user. So I log in, and here I'm logged in. I can visit the, the dashboard page and I can sign out. I cannot visit the dashboard page anymore. And, uh, again, this request does not, uh, give us, uh, a possibility to actually create a user. So to register, it only allows already registered users that have an email and password to send in if the email and password combination is, uh, a valid and let's, uh, add, uh, registrations, uh, to this application to make the solution actually more, uh, viable in a real application. So at the moment, we have, uh, our sessions controller that was created by the generator. And let's create a, a registrations controller to allow you just to actually sign in. So I will cope with the sessions controller. I will name it the registrations, controller registrations, uh, in the roots, I will, uh, create the resource registration. And I'll actually say only, uh, they're going to have only a new and the great action. And for the resource session, we will have, uh, uh, at the moment we have like all the actions, we'll have only, uh, new, great and destroy. This way will not have, uh, root for, uh, control actions that do not actually exist. Okay. So in the new, we will, uh, allow, uh, unauthenticated access to new and create, same as in sessions controller. Um, this looks good in the create action instead of user authenticated by, they're going to use, uh, user.new. Uh, so we'll have, let's say user equals user new perhaps permit email address, and, uh, password. And we'll have, if user save, start, new session, redirect to send signed up. Uh, else redirect to new session URL, uh, with an alert. Uh, uh, yeah, let this be the alert message for now. Let's, uh, see if this works. Let's now go and, uh, create a new view, uh, to let users register a new form. So, uh, we have our sessions new, and in similar fashion, we're going to create registrations, new registrations. And here in the new view, the only difference is going to be they're going to submit the form, not to the session URL, but to the registration URL, email password, sign up. And let's see if this, uh, works. So, uh, I have the server running. I will, uh, go to not sessions new, but Reggie registrations you. Yeah, it should be registration, not plural. Okay. And here I have this form, email and password. Let's try to create a user Sign up. And, uh, I seem to have sent up successfully. Okay, it, uh, seems to be working. Let's try, uh, adding the links to sign in and sign up in the NF bar. So I will go to our application, HTML here. I will, uh, add a link to sign in, uh, new session path, sign up, new registration path. Okay. We have the links to sign in and sign up. Let's, uh, try sign in, uh, in as the user that we have recently created it. Folks, I can visit the dashboard page. I will click on sign in and sign up. And you see these pages are also accessible. And this is, uh, not very nice. Uh, we are actually authenticated, but we still can visit the sign in and send up pages. And if you have a look at our sessions controller or our registrations controller, it happens because, uh, we have allow unauthenticated access for the new action. And this unauthenticated is not defined. It is new. So to make the sign in and send up, uh, actually unaccessible and for, to make this line work in the, uh, for sent in users, we would need to add the another, uh, before action. Uh, before action. That would be let's open authentication dot RB. So we have this required authentication that we are skipping with the saying, allow authenticated access. Uh, but we need to actually say resume session so that we try to find a user if there is found for their new action. So I will say before action, uh, require what was name, uh, resume session, resume session, and only for, Uh, for the new action. So in registrations controller. And the same in, uh, sessions controller. So now I will refresh and you see I'm redirected to the route page. So no more the sending and send up pages. Uh, they're not accessible to send in users anymore. Let's, uh, hide them in the views. So if authenticated, we will not show this, I will put them behind an else, uh, statement. Okay? Authenticated users do not have the, the visibility of the sign in and sign up links. Let's, uh, try to sign out, uh, sign up as the use that we already have created the, in the application. And we have this escalate unique constraint, failed, uh, message. So we are validating the email uniqueness in the database. Uh, here it is, we validating the email uniqueness, but we're not validating it in the, uh, model. That's why we get this error. So I will go to the user model and uh, I will add some validations. I will say validates email. Um, address uniqueness. True, uh, presence. True. Okay, let's try once again, I will try to input this user details. And we get this. Uh, yeah, it isn't try. Okay, let's try once again, I missed something. So signing up as a user that already exists. Yeah, I get, try another email or password error because in registrations, control of it did not, did not customize our errors. So let's say user errors, full messages, two sentence. Let's try once again. Okay. It will sign in. Let's, uh, try sign up as a user that, uh, already exists and we've got this error. Email address has been taken. So errors are rendered correctly. And just in case, uh, for the backend, uh, validation, we should maybe also validate the format of the email. So it can say something like format. And in the format it'll have with the, and then there, there is this helper. Let's try opening it. It would be URI, uh, mail tool, email Rex. So we're going to validate it with this email Rex. This way we can be more sure that the email address provided is, uh, good. Let's again try creating a new user. Uh, yeah, I don't see whether they're in the same, in, in or send up. Let's maybe add this in the views. I will go to new registration here. I will say H one, uh, create an account. Uh, in new session, I will have another H one sign in. Okay, so here, create an account. Create an account, it works. I'm signed up. I will, uh, visit dashboard. It works. I will sign out. I will go to sign in as this account. It works now again, as the same account. I will try to create an account with the same email, email and password. And I get this email address has already been taken error. So everything looks, uh, good and uh, this way have kind of implemented the, uh, both, uh, sign in and sign up functionality into our application. Now, one lasting I don't like is the flash messages that scattered all around. I will remove them from their views and put them, uh, in the shared layout. So here I will have the alert and notice color green for notice. Red for alert. Not putting a lot of mind into this, just a quick solution. Okay? Now we don't have the alerts, uh, anymore in our views. We have them in a shared location. So one final time. Uh, yeah, this, you see if we don't, we have like flash rendered into places. If we will have it just in one place. Let refresh, sign, uh, up. Okay, flash is trending nicely, so everything seems to be broken. Okay? Thanks for being with me and see you in the next one.