Ruby on Rails product developer

Securing mission control with Rails 8 authentication.

Mission control is a new dashboard (Rails engine) for accessing and troubleshooting background jobs.

Apart from HTTP basic authentication, Mission Control allows developers to configure a base controller with custom authentication logic.

This can be achieved by defining a base_controller_class, in this case AdminController, which includes the Rails 8 Authentication concern. The concern ensures the user is authenticated before any action and redirects them to the new session page if not.

# config/application.rb

config.mission_control.jobs.base_controller_class = "AdminController"
config.mission_control.jobs.http_basic_auth_enabled = false

# app/controller/admin/controller.rb

class AdminController < ActionController::Base
  include Authentication
end

The above implementation will result in a UrlGenerationError because the authentication concern redirects unauthorized users to new_session_path

class Authentication
  ...
  def request_authentication
    session[:return_to_after_authenticating] = request.url
    redirect_to new_session_path, alert: "Please sign in first."
  end
  ...
end

The problem is that engine routes are isolated from the main app routes by default. To solve this, you need to call the route using the main_app routing proxy method. In this case, you can update the Authentication concern directly or override request_authentication.

class AdminController < ActionController::Base
  include Authentication

  private

  # Override concern method
  def request_authentication
    session[:return_to_after_authenticating] = request.url
    redirect_to main_app.new_session_path, alert: "Please sign in first."
  end
end