Rails 8에서 Devise 걷어내기 — has_secure_password로 마이그레이션한 실전 기록

# Inertia.js가 보내는 것
{ email: "user@example.com", password: "secret" }

# Rails ParamsWrapper가 변환한 것
{ email: "...", password: "...", session: { email: "...", password: "..." } }

# Devise/Warden이 찾는 것
{ user: { email: "...", password: "..." } }  # ← 이게 없다

# 컨트롤러에서 이렇게 세팅하면
params[:user] = { email: params[:email], password: params[:password] }

# Warden은 이걸 안 본다. 대신 이걸 본다:
request.params["user"]  # ← Rack::Request#params, 별도 객체

# 땜질 버전 — 이러면 동작은 한다
def normalize_sign_in_params
  user_params = { "email" => params[:email], "password" => params[:password] }
  params[resource_name] = user_params
  request.params[resource_name.to_s] = user_params  # Rack 레벨도 세팅
end

# db/migrate/20260331_migrate_devise_to_has_secure_password.rb
class MigrateDeviseToHasSecurePassword < ActiveRecord::Migration[8.1]
  def change
    rename_column :users, :encrypted_password, :password_digest

    create_table :sessions do |t|
      t.references :user, null: false, foreign_key: true
      t.string :token, null: false
      t.string :ip_address
      t.string :user_agent
      t.timestamps
    end
    add_index :sessions, :token, unique: true
  end
end

# Before
class User < ApplicationRecord
  devise :database_authenticatable, :registerable,
         :recoverable, :rememberable, :validatable,
         :jwt_authenticatable, jwt_revocation_strategy: JwtDenylist
end

# After
class User < ApplicationRecord
  has_secure_password

  has_many :sessions, dependent: :destroy

  validates :email, presence: true, uniqueness: true,
            format: { with: URI::MailTo::EMAIL_REGEXP }
  normalizes :email, with: ->(email) { email.strip.downcase }

  def self.authenticate_by(email:, password:)
    user = find_by(email: email.to_s.strip.downcase)
    user&.authenticate(password) || nil
  end
end

# app/controllers/concerns/authentication.rb
module Authentication
  extend ActiveSupport::Concern

  included do
    helper_method :current_user, :user_signed_in?
  end

  def sign_in(user)
    sess = user.sessions.create!(
      token: SecureRandom.urlsafe_base64(32),
      ip_address: request.remote_ip,
      user_agent: request.user_agent
    )
    session[:session_token] = sess.token
  end

  def sign_out
    current_session&.destroy
    session.delete(:session_token)
    @current_user = nil
  end

  def current_user
    @current_user ||= current_session&.user
  end

  def user_signed_in?
    current_user.present?
  end

  def authenticate_user!
    unless user_signed_in?
      flash[:alert] = "로그인이 필요합니다."
      redirect_to login_path
    end
  end

  private

  def current_session
    return @current_session if defined?(@current_session)
    token = session[:session_token]
    @current_session = Session.includes(:user).find_by(token: token) if token
  end
end

# Before: normalize_sign_in_params 핵이 필요했음
module Web
  class SessionsController < Devise::SessionsController
    def create
      normalize_sign_in_params
      super
    end

    private
    def normalize_sign_in_params
      user_params = { "email" => params[:email], "password" => params[:password] }
      params[resource_name] = user_params
      request.params[resource_name.to_s] = user_params
    end
  end
end

# After: 직접 읽으면 끝
module Web
  class SessionsController < ApplicationController
    def create
      user = User.authenticate_by(
        email: params[:email],
        password: params[:password]
      )

      unless user
        flash[:alert] = "이메일 또는 비밀번호가 올바르지 않습니다."
        redirect_to login_path
        return
      end

      sign_in(user)
      redirect_to after_sign_in_path_for(user), notice: "로그인되었습니다."
    end
  end
end

# app/services/jwt_service.rb
module JwtService
  SECRET = Rails.application.secret_key_base
  ALGORITHM = "HS256"

  def self.encode(user)
    payload = {
      sub: user.id,
      exp: 30.days.from_now.to_i,
      iat: Time.current.to_i
    }
    JWT.encode(payload, SECRET, ALGORITHM)
  end

  def self.decode(token)
    decoded = JWT.decode(token, SECRET, true, algorithm: ALGORITHM)
    decoded.first
  rescue JWT::DecodeError, JWT::ExpiredSignature
    nil
  end

  def self.revoke(token)
    payload = decode(token)
    JwtDenylist.create!(jti: payload["jti"]) if payload
  end
end

# 잘못된 코드
if request.format.json? || request.xhr?
  render json: { success: true, redirect_to: "/" }  # Inertia도 여기로 빠짐
else
  redirect_to "/"
end

# 올바른 코드
redirect_to after_sign_in_path_for(user), notice: "로그인되었습니다."

u = User.find_by(email: "test@example.com")
u.authenticate("password123!")  # => false

# 올바른 방법
u.password = "password123!"
u.password_confirmation = "password123!"
u.save!
u.authenticate("password123!")  # => User 객체 반환

# 에러
NameError: uninitialized constant Devise

# 해결
mv config/initializers/devise.rb config/initializers/devise.rb.bak

# deprecated (8.0)
ActiveRecord::Base.connection.execute("SELECT 1")

# 8.1 권장
ActiveRecord::Base.lease_connection.execute("SELECT 1")