add access tokens

app/models/access_token.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+# == Schema Information
+#
+# Table name: access_tokens
+#
+#  id         :bigint           not null, primary key
+#  sha256     :text             not null
+#  token      :text             not null
+#  created_at :datetime         not null
+#  updated_at :datetime         not null
+#  user_id    :bigint           not null
+#
+# Indexes
+#
+#  index_access_tokens_on_sha256   (sha256) UNIQUE
+#  index_access_tokens_on_user_id  (user_id)
+#
+# Foreign Keys
+#
+#  fk_rails_...  (user_id => users.id)
+#
+class AccessToken < ApplicationRecord
+  TOKEN_LENGTH = 22
+
+  belongs_to :user
+
+  before_validation :set_sha256, on: :create
+
+  attribute :token, :string, default: -> { SecureRandom.base58(TOKEN_LENGTH) }
+
+  encrypts :token
+
+  private
+
+  def set_sha256
+    self.sha256 = Digest::SHA256.hexdigest(token)
+  end
+end

app/models/user.rb

@@ -45,6 +45,7 @@ class User < ApplicationRecord
   EMAIL_REGEXP = /[^@,\s]+@[^@,\s]+/
 
   belongs_to :account
+  has_one :access_token, dependent: :destroy
 
   devise :database_authenticatable, :recoverable, :rememberable, :validatable, :trackable
   devise :registerable, :omniauthable, omniauth_providers: [:google_oauth2] if Docuseal.multitenant?
@@ -54,6 +55,10 @@ class User < ApplicationRecord
 
   scope :active, -> { where(deleted_at: nil) }
 
+  def access_token
+    super || build_access_token.tap(&:save!)
+  end
+
   def active_for_authentication?
     !deleted_at?
   end