Skip to content

Conversation

driveton
Copy link

The gem currently uses a dedicated model for sign_in tokens which seems not that needed while we can use generate_token_for to allow users logging in without a password similar to password resets.

user.rb

generates_token_for :passwordless_sign_in, expires_in: 1.day do
    "#{email}-#{updated_at.to_i}"
end 

passwordlesses_controller.rb

def revoke_tokens
      @user.touch
end
  • Invalidates the token after a day (same to the current behavior)
  • Invalidates the token if the user updates their password
  • Invalidates the token if the user signs in with the token
  • We remove the need to track tokens in a model

@driveton driveton changed the title use generate_token_for instead of dedicated model for passwordless Use generate_token_for instead of dedicated model for passwordless Jun 16, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant