Authentication

┌─────────────┐     ┌─────────────┐     ┌─────────────┐
│   Client    │────▶│ Better Auth │────▶│   Backend   │
│ (iOS/Web)   │     │   (Next.js) │     │   (Rails)   │
└─────────────┘     └─────────────┘     └─────────────┘
      │                    │                   │
      │  1. Login request  │                   │
      │───────────────────▶│                   │
      │                    │  2. Verify creds  │
      │                    │──────────────────▶│
      │                    │  3. User data     │
      │                    │◀──────────────────│
      │  4. JWT token      │                   │
      │◀───────────────────│                   │
      │                    │                   │
      │  5. API request with JWT               │
      │───────────────────────────────────────▶│
      │  6. Response                           │
      │◀───────────────────────────────────────│

POST /api/auth/sync-user
{
  "user_id": "better_auth_id",
  "email": "user@example.com",
  "name": "User Name"
}

module JwtAuthenticatable
  extend ActiveSupport::Concern

  included do
    before_action :authenticate_jwt!
  end

  def authenticate_jwt!
    token = request.headers["Authorization"]&.split(" ")&.last
    raise UnauthorizedError unless token
    
    @jwt_claims = BetterAuth::JwtVerifier.verify(token)
  end

  def current_user_id
    @jwt_claims["sub"]
  end

  def current_user
    @current_user ||= User.find_by(auth_user_id: current_user_id)
  end
end

class Api::Internal::BaseController < ApplicationController
  include JwtAuthenticatable
  before_action :require_evo!

  def require_evo!
    raise ForbiddenError unless current_user&.evo?
  end
end

# Correct - join on auth_user_id
User.find_by(auth_user_id: user_id)

# Wrong - this looks up wrong user
User.find(user_id)

class CampaignSubmission < ApplicationRecord
  belongs_to :user, 
    foreign_key: :user_id, 
    primary_key: :auth_user_id
end

final class AuthSession: ObservableObject {
    enum State { 
        case booting, signedOut, signedIn, blocked(String) 
    }
    @Published private(set) var state: State
}

class Api::Internal::BrandsControllerTest < ActionController::TestCase
  include JwtTestStub

  setup do
    @admin = create_evo_user
    stub_jwt_for(@admin)
  end

  test "requires admin authentication" do
    get :index
    assert_response :success
  end
end