/authentication

# Generate authentication for User model
bin/rails generate authentication User

# Or specify custom model name
bin/rails generate authentication Account

# Generate with custom attributes
bin/rails generate authentication User first_name:string last_name:string

# app/models/user.rb
class User < ApplicationRecord
  has_secure_password
  
  validates :email, presence: true, uniqueness: true
  validates :password, length: { minimum: 8 }, if: -> { new_record? || !password.blank? }
  
  normalizes :email, with: ->(email) { email.strip.downcase }
  
  before_save :normalize_email
  
  private
  
  def normalize_email
    self.email = email.downcase.strip
  end
end

# app/controllers/authentication_controller.rb
class AuthenticationController < ApplicationController
  skip_before_action :authenticate_user!, only: [:new, :create]
  
  def new
    # Login page
  end
  
  def create
    user = User.find_by(email: params[:email])
    
    if user&.authenticate(params[:password])
      login(user)
      redirect_to root_path, notice: 'Logged in successfully'
    else
      flash.now[:alert] = 'Invalid email or password'
      render :new, status: :unprocessable_entity
    end
  end
  
  def destroy
    logout
    redirect_to root_path, notice: 'Logged out successfully'
  end
  
  private
  
  def login(user)
    session[:user_id] = user.id
    @current_user = user
  end
  
  def logout
    session[:user_id] = nil
    @current_user = nil
  end
end

# app/controllers/registrations_controller.rb
class RegistrationsController < ApplicationController
  skip_before_action :authenticate_user!
  
  def new
    @user = User.new
  end
  
  def create
    @user = User.new(user_params)
    
    if @user.save
      login(@user)
      redirect_to root_path, notice: 'Account created successfully'
    else
      render :new, status: :unprocessable_entity
    end
  end
  
  private
  
  def user_params
    params.require(:user).permit(:email, :password, :password_confirmation, :first_name, :last_name)
  end
  
  def login(user)
    session[:user_id] = user.id
    @current_user = user
  end
end

# app/controllers/application_controller.rb
class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception
  
  before_action :authenticate_user!
  
  private
  
  def authenticate_user!
    redirect_to login_path, alert: 'Please log in to continue' unless current_user
  end
  
  def current_user
    @current_user ||= User.find(session[:user_id]) if session[:user_id]
  end
  helper_method :current_user
  
  def logged_in?
    !!current_user
  end
  helper_method :logged_in?
  
  def require_login
    unless logged_in?
      flash[:alert] = 'You must be logged in to access this page'
      redirect_to login_path
    end
  end
end

<!-- app/views/authentication/new.html.erb -->
<div class="authentication-form">
  <h1>Log In</h1>
  
  <%= form_with url: login_path, local: true, class: "auth-form" do |form| %>
    <div class="form-group">
      <%= form.label :email, "Email" %>
      <%= form.email_field :email, required: true, autofocus: true, class: "form-control" %>
    </div>
    
    <div class="form-group">
      <%= form.label :password, "Password" %>
      <%= form.password_field :password, required: true, class: "form-control" %>
    </div>
    
    <div class="form-actions">
      <%= form.submit "Log In", class: "btn btn-primary" %>
    </div>
  <% end %>
  
  <div class="auth-links">
    <%= link_to "Don't have an account? Sign up", signup_path %>
  </div>
</div>

<!-- app/views/registrations/new.html.erb -->
<div class="authentication-form">
  <h1>Sign Up</h1>
  
  <%= form_with model: @user, url: signup_path, local: true, class: "auth-form" do |form| %>
    <% if @user.errors.any? %>
      <div class="error-messages">
        <h3><%= pluralize(@user.errors.count, "error") %> prohibited this account from being saved:</h3>
        <ul>
          <% @user.errors.full_messages.each do |message| %>
            <li><%= message %></li>
          <% end %>