# web/controllers/authentication.rb
module Web
  module Authentication
    module Skip
      def authenticate!
      end
    end

    def self.included(action)
      action.class_eval do
        before :authenticate!
        expose :current_user
      end
    end

    private

    def authenticate!
      unauthorized! unless authenticated?
    end

    def authenticated?
      !current_user.nil? && !session_expired?
    end

    def session_expired?
      # in case :expire_after would be nil, convert into Integer
      Time.now.to_i > session[:expire_after].to_i
    end

    def current_user
      @current_user ||= AspUserRepository.new.find(session[:user_id])
    end

    def unauthorized!
      session[:user_id] = nil

      flash[:error] = 'Auth error, Please Log in again.'
      self.status = 401

      redirect_to routes.login_path
    end
  end
end