# please improve this rails action,
# if you'd like to put some code in another file please state so:
# authentication API
def auth
  user = User.find(params[:username])
  if user.check_password(params[:password])
    token = new Token({
        user_id: user.id,
        token_value: [*('a'..'z'),*('0'..'9')].shuffle[0,8].join,
        valid_thru: Time.now + 1.day })
    token.save!
    render json: {user: user, token: token}
  else
    render json: { errors: ["wrong username or password"] }, status: :unauthorized
  end
end


# token.rb
# token class
class Token < ApplicationRecord
    belongs_to :user
end