**Course Title:** Mastering Ruby on Rails: Building Scalable Web Applications **Section Title:** RESTful API Development with Rails **Topic:** Develop a RESTful API for a task management system with authentication and JSON responses.(Lab topic) **Objective:** By the end of this topic, students will be able to design, develop, and deploy a RESTful API for a task management system using Ruby on Rails, including authentication and JSON responses. **Prerequisites:** - Familiarity with Ruby on Rails and its ecosystem - Understanding of RESTful API principles and concepts - Experience with Active Record and database interactions **Lab Topic Overview:** In this lab topic, we will build a RESTful API for a task management system. The API will allow users to create, read, update, and delete tasks, as well as authenticate and authorize users. We will use JSON responses and implement authentication using JSON Web Tokens (JWT). **Step 1: Setting up the Project Structure** Create a new Rails project using the command `rails new task_management_api`. This will create a basic project structure for our task management API. ```bash rails new task_management_api ``` **Step 2: Defining the Task Model** Create a new model for our tasks using the command `rails generate model Task title:string description:text`. This will create a new file `task.rb` in the `app/models` directory. ```bash rails generate model Task title:string description:text ``` **Step 3: Defining the Task Controller** Create a new controller for our tasks using the command `rails generate controller Tasks index show create update destroy`. This will create a new file `tasks_controller.rb` in the `app/controllers` directory. ```bash rails generate controller Tasks index show create update destroy ``` **Step 4: Implementing Authentication with JWT** Install the `jwt` gem using the command `gem install jwt`. This will allow us to implement authentication using JSON Web Tokens. ```bash gem install jwt ``` Create a new file `authenticatable.rb` in the `app/models` directory to define our user model. ```ruby class User < ApplicationRecord has_secure_password has_many :tasks end ``` Create a new file `jwt.rb` in the `config/initializers` directory to configure JWT. ```ruby Rails.application.config.middleware.use JWT::Tokenizer ``` Create a new file `authenticatable.rb` in the `app/controllers` directory to implement authentication. ```ruby class ApplicationController < ActionController::Base before_action :authenticate_user! private def authenticate_user! token = request.headers['Authorization'] if token begin user = User.find_by(id: JWT.decode(token, 'secret_key', [Algorithm::HS256]).first) if user session[:user_id] = user.id else render json: { error: 'Invalid token' }, status: :unauthorized end rescue StandardError => e render json: { error: 'Invalid token' }, status: :unauthorized end else render json: { error: 'No token provided' }, status: :unauthorized end end end ``` **Step 5: Implementing API Endpoints** Create a new file `tasks_controller.rb` in the `app/controllers` directory to implement API endpoints. ```ruby class TasksController < ApplicationController before_action :authenticate_user! def index tasks = Task.all render json: tasks end def show task = Task.find(params[:id]) render json: task end def create task = Task.new(task_params) if task.save render json: task, status: :created else render json: { error: 'Task not created' }, status: :unprocessable_entity end end def update task = Task.find(params[:id]) if task.update(task_params) render json: task else render json: { error: 'Task not updated' }, status: :unprocessable_entity end end def destroy task = Task.find(params[:id]) if task.destroy render json: { message: 'Task deleted' } else render json: { error: 'Task not deleted' }, status: :unprocessable_entity end end private def task_params params.require(:task).permit(:title, :description) end end ``` **Step 6: Testing the API** Create a new file `tasks_spec.rb` in the `spec/controllers` directory to test our API endpoints. ```ruby require 'rails_helper' RSpec.describe TasksController, type: :controller do let(:user) { User.create!(email: 'user@example.com', password: 'password') } describe 'GET /tasks' do it 'returns all tasks' do task1 = Task.create!(title: 'Task 1', description: 'Description 1') task2 = Task.create!(title: 'Task 2', description: 'Description 2') get '/tasks', headers: { Authorization: JWT.encode(user.id, 'secret_key', [Algorithm::HS256]) } expect(response.status).to eq(200) expect(response.body).to eq([task1, task2].to_json) end end describe 'GET /tasks/:id' do it 'returns a single task' do task = Task.create!(title: 'Task 1', description: 'Description 1') get "/tasks/#{task.id}", headers: { Authorization: JWT.encode(user.id, 'secret_key', [Algorithm::HS256]) } expect(response.status).to eq(200) expect(response.body).to eq(task.to_json) end end describe 'POST /tasks' do it 'creates a new task' do post '/tasks', headers: { Authorization: JWT.encode(user.id, 'secret_key', [Algorithm::HS256]) }, json: { title: 'Task 1', description: 'Description 1' } expect(response.status).to eq(201) expect(response.body).to eq({ id: 1, title: 'Task 1', description: 'Description 1' }.to_json) end end describe 'PUT /tasks/:id' do it 'updates a task' do task = Task.create!(title: 'Task 1', description: 'Description 1') put "/tasks/#{task.id}", headers: { Authorization: JWT.encode(user.id, 'secret_key', [Algorithm::HS256]) }, json: { title: 'Task 2', description: 'Description 2' } expect(response.status).to eq(200) expect(response.body).to eq({ id: task.id, title: 'Task 2', description: 'Description 2' }.to_json) end end describe 'DELETE /tasks/:id' do it 'deletes a task' do task = Task.create!(title: 'Task 1', description: 'Description 1') delete "/tasks/#{task.id}", headers: { Authorization: JWT.encode(user.id, 'secret_key', [Algorithm::HS256]) } expect(response.status).to eq(200) expect(response.body).to eq({ message: 'Task deleted' }.to_json) end end end ``` **Conclusion:** In this lab topic, we built a RESTful API for a task management system using Ruby on Rails, including authentication and JSON responses. We implemented authentication using JSON Web Tokens and defined API endpoints for creating, reading, updating, and deleting tasks. We also tested our API endpoints using RSpec. **Exercise:** * Implement a user registration system using Devise. * Add a feature to allow users to assign tasks to other users. * Implement a feature to allow users to mark tasks as completed. **External Resources:** * [JSON Web Tokens (JWT) documentation](https://jwt.io/) * [Devise documentation](https://github.com/heartcombo/devise) * [Rails API documentation](https://guides.rubyonrails.org/api.html) **Leave a comment or ask for help:**