1. Let’s start by looking at your application’s routes file. Open config/routes.rb in your text editor.

   You’ve added a couple of resources to the routes file. First, you defined :books. This added a series of routes to your application for creating, reading, updating, and deleting your books. Then, you added another resource :reviews. This added similar routes, but they’re focused on reviews instead of books.

   Now that your application has users, it might be tempting to add a :users resource. This would be useful if we were going to change user data, but we don’t need to change any user data to log someone in.

   We just need to keep track of a user once they’ve logged in to your bookstore. We’ll represent this as a session - a user creates a new session when they log in.

2. Let’s add a :session resource to your routes file. Before the end of config/routes.rb, add the following line:

   resource :session
   

3. Save your changes.

Let’s see what your application routes look like now.

1. Open Terminal, go the bookstore directory, and run rake routes.

   Aww, your routes are getting so big 😍

   When a user logs in, they’re going to create a new session. What path will they visit to create a new session?

   They’ll go to /session/new.

   new_session GET    /session/new(.:format)                     sessions#new
   

2. Start your application’s web server and visit the new session path at http://localhost:3000/session/new.

Oh boy, another Routing Error! 😝

1. The error tells you what’s wrong…

   uninitialized constant SessionsController
   

2. Fix this familiar error and come back when you get a different one.

Were you able to get past the Routing Error?

No worries if you’re stuck, we’ll help you out 😊

1. You’re getting a Routing Error because you application doesn’t have a SessionsController.

   To fix this, you need to create a SessionsController.

   All controllers follow a similar pattern. They live inside the app/controllers directory, and they’re filename matches their name.

   For example, the SessionsController will be a file named app/controllers/sessions_controller.

   Controllers also share the same roots. Do you remember what your BooksController looked like when you first added it?

   class BooksControllers < ApplicationController
   end
   

   There wasn’t much to it, remember?

2. If you didn’t create an empty SessionsController (app/controllers/sessions_controller), go ahead and create now.

   class SessionsController < ApplicationController
   end
   

3. Then, revisit http://localhost:3000/session/new to see your next error!

1. Now, you’re getting an Unknown action error. Just like the last error, it’s giving you a hint.

   The action 'new' could not be found for SessionsController
   

   You know what to do, right?!

   

2. Fix that error. When you’re done, you’ll get one more error.

1. What did you come up with?! Are you seeing a new error??

   You had to add a new method to the SessionsController.

   def new
   end
   

2. If you didn’t already add the new method, go ahead and add it now.

We’re sooooo close to the end of the error train.

Can you think of reason why you’re getting an ActionController::UnknownFormat error? It looks crazy, but we’ve seen this plenty of times before.

You’re getting an ActionController::UnknownFormat error because the SessionsController new action doesn’t have a template.

1. Fix this error!

   Remember, templates for the SessionsController will live inside app/views/sessions.

   When you’re done, http://localhost:3000/session/new will render a blank page.

1. Did you figure out how to add the SessionsController new template?

   You had to add a new directory.

   mkdir app/views/sessions
   

   Then, you had to create an empty template file named new.html.erb inside app/views/sessions.

   touch app/views/sessions/new.html.erb
   

2. If you didn’t already, add the empty SessionsController new template file (app/views/sessions/new.html.erb).

   If you’re following the steps we just laid out, you’ll have to stop your application’s web server before running the commands. When you’re done, you can restart it.

   Ah, has a blank page ever looked so good?

1. Open app/views/sessions/new.html.erb and add the following:

   <%= form_for(:session, url: session_path) do |f| %>
   <% end %>
   

   The form_for might look a little familiar. We’ve used it to build forms for adding and updating books, and adding new reviews. However, there are a few differences.

   In the past forms you’ve built with form_for, you started by passing an instance of the record you wanted to update or create. For example, the new books form has a new instance of Book.

   <%= form_for(@book) do |f| %>
   

   We aren’t doing this for the new session form because we’re not going to save the session in the database. We’re going to save it in the browser (more on that later).

   Unlike the other forms, we have to specify a URL for the new session form. form_for can figure out where to send the form data when given an instance of a class; otherwise, you have to expcitily set the URL.

   Other than that, the new session form is just like the other forms you’ve built.

2. Using the new book form in app/views/books/new.html.erb as an example, add two text fields to the new sessions form.

   First, add a text field labeled “Username”.

   Then, add a text field labeled “Password”.

   Finally, add a form submission button.

1. What does your solution look like? It should look something like this:

   <%= form_for(:session, url: session_path) do |f| %>
     <ul>
       <li>
         <%= f.label :username %>
         <%= f.text_field :username %>
       </li>
   
       <li>
         <%= f.label :password %>
         <%= f.text_field :password %>
       </li>
     </ul>
   
     <%= f.submit(class: "button") %>
   <% end %>
   

2. Update your solution to match this solution. Save your changes and take a look at the form by visiting http://localhost:3000/session/new.

First, we can change the “Password” field from a text field to a password field.

1. Reopen app/views/sessions/new.html.erb and change

   <%= f.text_field :password %>
   

   to

   <%= f.password_field :password %>
   

2. Now, let’s change the text of the form submission button to “Login”. Change

   <%= f.submit(class: "button") %>
   

   to

   <%= f.submit("Login", class: "button") %>
   

3. Save your changes, revisit http://localhost:3000/session/new, and try logging in!

   You should have a user with username “CatPower” and a password of “password”.

…

You know how to deal with Unknown action errors, right?!

1. Fix this error!

   When you’re done, submitting the form shouldn’t do anything.

1. How did you get past that Unknown action error?

   You added an empty create method to the SessionsController, right?

   def create
   end
   

2. If you didn’t already, add an empty create method to the SessionsController.

Nothing happens when you try to login, but how could anything happen. The new session form is being submitted to the SessionsController create method, and that method is empty.

Let’s update the create method so users can login.

1. Just like past forms, the new session form data is available in the SessionsController inside the params hash. If you take a look at your application’s web server’s output, you can see the params coming in.

   Parameters: {"utf8"=>"✓", "authenticity_token"=>"C2s/BLrDEpUMmOL+FMx6SqNzLTqKvcLlvpw32+lD2O32Aryi9Kt0tlWVM+gUS3DYhQt1+3q0Tn3kqakWdZylVw==", "session"=>{"username"=>"CatPower", "password"=>"[FILTERED]"}, "commit"=>"Login"}
   

   The form data is tucked in the session hash, and it includes a username and password.

   We can use the form data with the authenticate method to log users in.

2. First, we’ll need to find the user by their username. Add the following code inside the create method:

   user = User.find_by(username: params[:session][:username])
   

   find_by is a handy method that let’s us get records from your database with something other than an id. We’re using find_by here to get the user by their username.

3. Now that we have the user’s record, we can check if they’ve given us a valid password. Add the following code to the create mehtod:

   if user.authenticate(params[:session][:password])
     flash[:notice] = "Welcome back, #{user.username}!"
     session[:user_id] = user.id
     redirect_to root_path
   else
     flash[:alert] = "Sorry, your username or password is invalid."
     render :new
   end
   

   First, we’ll try to authenticate the user. If the user is successfully authenticated, we’ll

   • show them a success message
   • save their id in the browser’s session as user_id
   • send them to the root_path

   If the user cannot be authenticated, we’ll

   • show them a failure message
   • re-render the new template so they can try logging in again

4. There’s a lot happening here, so let’s try to break it down to get a better feel for what each of these lines of code is doing.

   Before we continue, save your changes.

1. Open app/views/layouts/application.html.erb.

2. Before the container div, add the following lines:

   <% if flash[:notice] %>
     <p class="notice"> <%= flash[:notice] %> </p>
   <% end %>
   
   <% if flash[:alert] %>
     <p class="alert"> <%= flash[:alert] %> </p>
   <% end %>
   

   If anything is inside flash[:notice] or flash[:alert], we’ll render their contents.

3. Save your changes.

Now that you have a fully functional create method, let’s take it out for a spin!

1. Go to http://localhost:3000/session/new and try logging in with an invalid username.

   …

   

1. Open app/views/controllers/sessions_controller.rb. Inside the create method change

   if user.authenticate(params[:session][:password])
   

   to

   if user && user.authenticate(params[:session][:password])
   

   With this change, user.authenticate will only be called if the user exists.

2. Save your changes, revisit http://localhost:3000/session/new, and try logging in with an invalid username again.

Yay! That’s a lot better, isn’t it?

1. Now try logging in as “CatPower”, but use an invalid password. You should still get the failure message.

2. Finally, try logging in as “CatPower” using “password” as the password.

YAYAY!!!

1. Try clicking around the bookstore.

   The success message should go way as soon as you visit a new page.

Now that you’re logged in, let’s make it so you can log out!

Let’s add a “Log out” link to your bookstore’s header.

1. Open app/views/layouts/application.html.erb. Change the “navigation” div from

   <div class="navigation">
     <div class="center">
       <%= link_to "My Super Rad Bookstore", root_path %>
     </div>
   </div>
   

   to:

   <div class="navigation">
     <div class="left">
     </div>
   
     <div class="center">
       <%= link_to "My Super Rad Bookstore", root_path %>
     </div>
   
     <div class="right">
       <%= link_to "Log Out", session_path, method: :delete %>
     </div>
   </div>
   

   Inside the “navigation” div, we’re adding two divs: a “left” div and a “right” div. The “left” div is there to just keep things aligned. The “right” div is really the one we’re interested in.

   In the “right” div, we’re adding a “Log Out” link. When the link is clicked, it will send a DELETE request to the session_path (/session).

2. Visit http://localhost:3000 to see the new “Log Out” link.

   What do you think will happen if you try logging out? Give it a try 🙃

1. Since the “Log Out” link sends a DELETE request, it gets routed to the SessionsController destroy method. Whelp, that explains the error you’re seeing.

   The action 'destroy' could not be found for SessionsController
   

2. Let’s create the destroy method. Open the SessionsController (app/controllers/sessions_controller.rb), and add the following method:

   def destroy
     session[:user_id] = nil
     flash[:notice] = "See ya next time!"
     redirect_to root_path
   end
   

   The first line of this method removes the user_id we saved in the session by setting session[:user_id] to nil. The second line shows a friendly message confirming the user has been logged out. The final line redirects the user to the root_path.

3. Save your changes and try logging out! After you’ve logged out, stop your application’s web server.