**Course Title:** Mastering Ruby on Rails: Building Scalable Web Applications **Section Title:** User Authentication and Authorization **Topic:** Build a user authentication system with registration, login, and role-based access control.(Lab topic) **Introduction:** Now that we have covered the basics of user authentication and authorization in Rails, it's time to put our knowledge into practice. In this lab topic, we will build a comprehensive user authentication system with registration, login, and role-based access control. **Registration System:** To start, we will create a registration system that allows new users to sign up for our application. We will use the Devise gem to handle user authentication. **Step 1: Create a new Rails application** First, let's create a new Rails application. Open your terminal and run the following command: ```bash rails new authentication_system ``` **Step 2: Add Devise to your Gemfile** In your Gemfile, add the following line: ```ruby gem 'devise' ``` Run `bundle install` to install the Devise gem. **Step 3: Run the Devise installer** Run the following command to install Devise: ```bash rails generate devise:install ``` **Step 4: Configure Devise** In your `config/application.rb` file, add the following line: ```ruby config.assets.initialize_on_precompile = false ``` This will allow Devise to work properly. **Step 5: Create a User model** Run the following command to create a User model: ```bash rails generate devise User ``` This will create a User model and a users table in your database. **Step 6: Add attributes to the User model** In your `app/models/user.rb` file, add the following attributes: ```ruby class User < ApplicationRecord # Include default devise modules. Others available are: # :confirmable, :lockable, :timeoutable and :omniauthable devise :database_authenticatable, :registerable, :recoverable, :rememberable, :trackable, :validatable # Add attributes here enum role: [:user, :admin] end ``` This will add a role attribute to the User model. **Step 7: Create a registration form** In your `app/views/devise/registrations/new.html.erb` file, add the following code: ```erb <h2>Sign up</h2> <%= form_for(resource, as: resource_name, url: registration_path(resource_name)) do |form| %> <%= form.label :email %> <%= form.email_field :email %> <%= form.label :password %> <%= form.password_field :password %> <%= form.label :role %> <%= form.select :role, User.roles.keys %> <%= form.submit "Sign up" %> <% end %> ``` This will create a registration form with an email, password, and role field. **Step 8: Configure routes** In your `config/routes.rb` file, add the following lines: ```ruby Rails.application.routes.draw do # Other routes... devise_for :users end ``` This will configure the routes for the registration form. **Login System:** Now that we have created a registration system, let's create a login system. **Step 9: Create a login form** In your `app/views/devise/sessions/new.html.erb` file, add the following code: ```erb <h2>Log in</h2> <%= form_for(resource, as: resource_name, url: session_path(resource_name)) do |form| %> <%= form.label :email %> <%= form.email_field :email %> <%= form.label :password %> <%= form.password_field :password %> <%= form.submit "Log in" %> <% end %> ``` This will create a login form with an email and password field. **Step 10: Configure routes** In your `config/routes.rb` file, add the following lines: ```ruby Rails.application.routes.draw do # Other routes... devise_for :users do get '/users/sign_out' => 'devise/sessions#destroy' end end ``` This will configure the routes for the login form. **Role-Based Access Control:** Now that we have created a registration and login system, let's add role-based access control. **Step 11: Add a before_action** In your `app/controllers/application_controller.rb` file, add the following code: ```ruby class ApplicationController < ActionController::Base before_action :authenticate_user! end ``` This will require users to be authenticated before accessing any pages. **Step 12: Create a roles controller** Run the following command to create a roles controller: ```bash rails generate controller Roles ``` **Step 13: Add a index action** In your `app/controllers/roles_controller.rb` file, add the following code: ```ruby class RolesController < ApplicationController def index if current_user.admin? # Show admin dashboard else # Show user dashboard end end end ``` This will create an index action that shows different dashboards based on the user's role. **Conclusion:** In this lab topic, we created a comprehensive user authentication system with registration, login, and role-based access control. We used the Devise gem to handle user authentication and added role-based access control using a roles attribute on the User model. We also created a roles controller to show different dashboards based on the user's role. **What's next?** In our next topic, we will cover Introduction to RESTful APIs and Best Practices. **External Resources:** * Devise documentation: [https://github.com/heartcombo/devise](https://github.com/heartcombo/devise) * Rails documentation: [https://guides.rubyonrails.org/](https://guides.rubyonrails.org/) * Ruby documentation: [https://ruby-doc.org/](https://ruby-doc.org/) **Leave a comment/ask for help** If you have any questions or need help with any of the steps, please leave a comment below. We will respond as soon as possible.