<%= simple_format @article.body %>
<%# Partial for comments %>
<%= render @comments %>
```
The typical flow: the request arrives at the Router, which dispatches to the appropriate Controller. The Controller interacts with the Model to retrieve or modify data, then passes this data to the View for HTML rendering.
### Question 2: What is Active Record and How Does Rails ORM Work?
Active Record is Rails' ORM (Object-Relational Mapping) that implements the Active Record pattern. Each Model class represents a database table, and each instance represents a row.
```ruby
# app/models/user.rb
# Active Record automatically maps columns to attributes
class User < ApplicationRecord
# The 'users' table is automatically associated
# Columns: id, email, name, created_at, updated_at
has_secure_password # BCrypt for password
has_many :articles, foreign_key: :author_id
has_one :profile, dependent: :destroy
has_and_belongs_to_many :roles
# Validations
validates :email, presence: true,
uniqueness: { case_sensitive: false },
format: { with: URI::MailTo::EMAIL_REGEXP }
# Callbacks
before_save :normalize_email
# Class methods for queries
def self.admins
joins(:roles).where(roles: { name: 'admin' })
end
private
def normalize_email
self.email = email.downcase.strip
end
end
```
```ruby
# Active Record query examples
# Rails console or within a service
# Creation
user = User.create!(email: 'dev@example.com', name: 'Alice', password: 'secret123')
# Reading with conditions
active_users = User.where(active: true).order(:name)
user = User.find_by(email: 'dev@example.com')
# Chained queries (lazy evaluation)
recent_admins = User.admins
.where('created_at > ?', 1.month.ago)
.includes(:profile)
.limit(10)
# N+1 prevention with eager loading
articles = Article.includes(:author, :comments).published
# Update
user.update!(name: 'Alice Martin')
# Transactions
User.transaction do
user.debit_balance!(100)
recipient.credit_balance!(100)
Payment.create!(from: user, to: recipient, amount: 100)
end
```
Active Record converts Ruby methods into optimized SQL queries. Methods like `where`, `joins`, `includes` are lazy - the query is only executed when iterating or calling `to_a`.
### Question 3: Explain the Rails Migration System
Migrations allow versioning database schema with Ruby. They are reversible and enable controlled evolution of data structure.
```ruby
# db/migrate/20260203100000_create_products.rb
# Migration to create a table
class CreateProducts < ActiveRecord::Migration[7.1]
def change
create_table :products do |t|
t.string :name, null: false
t.text :description
t.decimal :price, precision: 10, scale: 2, null: false
t.integer :stock_quantity, default: 0
t.references :category, null: false, foreign_key: true
t.boolean :active, default: true
t.timestamps # created_at and updated_at automatic
end
# Indexes for performance
add_index :products, :name
add_index :products, [:category_id, :active]
end
end
```
```ruby
# db/migrate/20260203110000_add_slug_to_products.rb
# Migration to modify an existing table
class AddSlugToProducts < ActiveRecord::Migration[7.1]
def change
add_column :products, :slug, :string
add_index :products, :slug, unique: true
# Fill existing slugs
reversible do |dir|
dir.up do
Product.find_each do |product|
product.update_column(:slug, product.name.parameterize)
end
end
end
# Make non-nullable after filling
change_column_null :products, :slug, false
end
end
```
```bash
# Essential migration commands
rails db:migrate # Run pending migrations
rails db:rollback # Undo last migration
rails db:rollback STEP=3 # Undo last 3 migrations
rails db:migrate:status # See migration status
rails db:seed # Run db/seeds.rb
rails db:reset # Drop, create, migrate, seed
```
Migrations must be reversible. The `change` method is smart and can automatically reverse common operations. For complex cases, use `up` and `down` separately.
## Advanced Active Record
### Question 4: How to Optimize N+1 Queries in Rails?
The N+1 problem occurs when an initial query is followed by N additional queries to load associations. Rails provides several eager loading methods to solve this issue.
```ruby
# app/controllers/orders_controller.rb
class OrdersController < ApplicationController
def index
# ❌ N+1 PROBLEM: 1 query + N queries per order
# @orders = Order.all
# In the view: order.user.name generates a query per order
# ✅ SOLUTION with includes (eager loading)
@orders = Order.includes(:user, :items)
.where(status: 'completed')
.order(created_at: :desc)
# Generates only 3 queries total
end
def show
# includes: loads associations separately (2-3 queries)
@order = Order.includes(items: :product).find(params[:id])
# preload: forces separate loading
@order = Order.preload(:items, :user).find(params[:id])
# eager_load: forces LEFT OUTER JOIN (1 query)
@order = Order.eager_load(:items).find(params[:id])
end
end
```
```ruby
# app/models/order.rb
class Order < ApplicationRecord
belongs_to :user
has_many :items, class_name: 'OrderItem'
has_many :products, through: :items
# Scope with default includes
scope :with_details, -> { includes(:user, items: :product) }
# Counter cache to avoid COUNT queries
# Requires: add_column :users, :orders_count, :integer, default: 0
belongs_to :user, counter_cache: true
end
```
```ruby
# N+1 detection with Bullet gem (development)
# config/environments/development.rb
config.after_initialize do
Bullet.enable = true
Bullet.alert = true
Bullet.bullet_logger = true
Bullet.rails_logger = true
end
# Bullet will show alerts when:
# - An N+1 query is detected
# - Unnecessary eager loading is present
# - A counter cache should be used
```
The rule: use `includes` by default (Rails chooses the optimal strategy), `preload` when forcing separate queries, `eager_load` when filtering on associations.
### Question 5: Explain Scopes and Query Objects in Rails
Scopes encapsulate reusable query conditions. For complex queries, Query Objects offer better organization and testability.
```ruby
# app/models/product.rb
class Product < ApplicationRecord
# Simple scopes
scope :active, -> { where(active: true) }
scope :in_stock, -> { where('stock_quantity > 0') }
scope :featured, -> { where(featured: true) }
# Scopes with parameters
scope :cheaper_than, ->(price) { where('price < ?', price) }
scope :in_category, ->(category) { where(category: category) }
# Chainable scopes
scope :available, -> { active.in_stock }
# Scope with joins
scope :with_recent_orders, -> {
joins(:order_items)
.where('order_items.created_at > ?', 30.days.ago)
.distinct
}
# Scope with subquery
scope :bestsellers, -> {
where(id: OrderItem.group(:product_id)
.order('COUNT(*) DESC')
.limit(10)
.select(:product_id))
}
end
```
```ruby
# app/queries/products_search_query.rb
# Query Object for complex searches
class ProductsSearchQuery
def initialize(relation = Product.all)
@relation = relation
end
def call(params)
@relation = filter_by_category(params[:category])
@relation = filter_by_price_range(params[:min_price], params[:max_price])
@relation = filter_by_search(params[:q])
@relation = apply_sorting(params[:sort])
@relation
end
private
def filter_by_category(category)
return @relation if category.blank?
@relation.where(category_id: category)
end
def filter_by_price_range(min, max)
@relation = @relation.where('price >= ?', min) if min.present?
@relation = @relation.where('price <= ?', max) if max.present?
@relation
end
def filter_by_search(query)
return @relation if query.blank?
@relation.where('name ILIKE ? OR description ILIKE ?',
"%#{query}%", "%#{query}%")
end
def apply_sorting(sort)
case sort
when 'price_asc' then @relation.order(price: :asc)
when 'price_desc' then @relation.order(price: :desc)
when 'newest' then @relation.order(created_at: :desc)
else @relation.order(:name)
end
end
end
# Usage in controller
@products = ProductsSearchQuery.new(Product.active).call(params)
```
Scopes are perfect for simple, reusable conditions. Query Objects suit complex searches with multiple optional filters and composition logic.
## Routing and Controllers
### Question 6: How Does RESTful Routing Work in Rails?
Rails encourages RESTful routes that map HTTP verbs to CRUD actions. The router translates URLs into specific controller calls.
```ruby
# config/routes.rb
Rails.application.routes.draw do
# Standard RESTful routes (7 actions)
resources :articles do
# Nested routes
resources :comments, only: [:create, :destroy]
# Member routes (act on an instance)
member do
post :publish
delete :archive
end
# Collection routes (act on the collection)
collection do
get :drafts
get :search
end
end
# API routes with namespace
namespace :api do
namespace :v1 do
resources :products, only: [:index, :show, :create, :update] do
resources :reviews, shallow: true
end
end
end
# Custom route
get 'dashboard', to: 'dashboard#index'
# Route constraints
constraints(SubdomainConstraint.new) do
resources :admin_settings
end
# Root route
root 'home#index'
end
```
```bash
# rails routes - Shows all generated routes
#
# Verb URI Pattern Controller#Action
# GET /articles articles#index
# POST /articles articles#create
# GET /articles/new articles#new
# GET /articles/:id/edit articles#edit
# GET /articles/:id articles#show
# PATCH /articles/:id articles#update
# DELETE /articles/:id articles#destroy
# POST /articles/:id/publish articles#publish
# GET /articles/drafts articles#drafts
```
Generated route helpers (`article_path(@article)`, `new_article_path`) allow referencing URLs dynamically and maintainably.
### Question 7: Explain Callbacks and Filters in Controllers
Callbacks (before_action, after_action, around_action) allow executing code before, after, or around controller actions.
```ruby
# app/controllers/application_controller.rb
class ApplicationController < ActionController::Base
# CSRF protection enabled by default
protect_from_forgery with: :exception
# Global callback for authentication
before_action :authenticate_user!
# Global error handling
rescue_from ActiveRecord::RecordNotFound, with: :not_found
rescue_from ActionController::ParameterMissing, with: :bad_request
private
def not_found
render json: { error: 'Resource not found' }, status: :not_found
end
def bad_request(exception)
render json: { error: exception.message }, status: :bad_request
end
end
```
```ruby
# app/controllers/admin/products_controller.rb
class Admin::ProductsController < ApplicationController
# Callbacks with options
before_action :require_admin
before_action :set_product, only: [:show, :edit, :update, :destroy]
after_action :log_activity, only: [:create, :update, :destroy]
# Conditional callback
before_action :check_stock, only: [:update], if: :stock_changed?
def create
@product = Product.new(product_params)
if @product.save
redirect_to [:admin, @product], notice: 'Product created.'
else
render :new, status: :unprocessable_entity
end
end
def update
if @product.update(product_params)
redirect_to [:admin, @product], notice: 'Product updated.'
else
render :edit, status: :unprocessable_entity
end
end
private
def require_admin
redirect_to root_path unless current_user&.admin?
end
def set_product
@product = Product.find(params[:id])
end
def stock_changed?
params[:product][:stock_quantity].present?
end
def log_activity
ActivityLog.create!(
user: current_user,
action: action_name,
resource: @product
)
end
def product_params
params.require(:product).permit(:name, :price, :description, :stock_quantity)
end
end
```
Callbacks execute in declaration order. Use `skip_before_action` in subclasses to disable inherited callbacks. Avoid callbacks with too much business logic - prefer Service Objects.
## Services and Architecture
### Question 8: How to Implement Service Objects in Rails?
Service Objects encapsulate complex business logic that belongs neither in Models nor Controllers. They improve testability and follow the single responsibility principle.
```ruby
# app/services/order_processor.rb
# Service Object with standardized interface
class OrderProcessor
def initialize(order, payment_method:)
@order = order
@payment_method = payment_method
end
def call
return failure('Order already processed') if @order.processed?
ActiveRecord::Base.transaction do
validate_stock!
process_payment!
update_inventory!
send_confirmation!
@order.update!(status: 'completed', processed_at: Time.current)
end
success(@order)
rescue PaymentError => e
failure("Payment failed: #{e.message}")
rescue InsufficientStockError => e
failure("Stock insufficient: #{e.message}")
end
private
def validate_stock!
@order.items.each do |item|
unless item.product.stock_quantity >= item.quantity
raise InsufficientStockError, item.product.name
end
end
end
def process_payment!
result = PaymentGateway.charge(
amount: @order.total,
method: @payment_method,
description: "Order ##{@order.id}"
)
raise PaymentError, result.error unless result.success?
@order.update!(payment_reference: result.transaction_id)
end
def update_inventory!
@order.items.each do |item|
item.product.decrement!(:stock_quantity, item.quantity)
end
end
def send_confirmation!
OrderMailer.confirmation(@order).deliver_later
end
def success(data)
Result.new(success: true, data: data)
end
def failure(error)
Result.new(success: false, error: error)
end
Result = Struct.new(:success, :data, :error, keyword_init: true) do
def success? = success
def failure? = !success
end
end
```
```ruby
# app/controllers/orders_controller.rb
class OrdersController < ApplicationController
def create
@order = current_user.orders.build(order_params)
if @order.save
result = OrderProcessor.new(@order, payment_method: params[:payment_method]).call
if result.success?
redirect_to @order, notice: 'Order confirmed!'
else
@order.update!(status: 'payment_failed')
flash.now[:alert] = result.error
render :new, status: :unprocessable_entity
end
else
render :new, status: :unprocessable_entity
end
end
end
```
The Service Object pattern follows a simple convention: one class, one responsibility, one public `call` method. Returning a Result object enables clean success and failure handling.
### Question 9: Explain Concerns in Rails
Concerns allow extracting and sharing code between Models or Controllers. They use `ActiveSupport::Concern` for clean inclusion syntax.
```ruby
# app/models/concerns/sluggable.rb
# Reusable Concern for generating slugs
module Sluggable
extend ActiveSupport::Concern
included do
# Code executed on inclusion
before_validation :generate_slug, if: :should_generate_slug?
validates :slug, presence: true, uniqueness: true
end
# Class methods
class_methods do
def find_by_slug!(slug)
find_by!(slug: slug)
end
def sluggable_source(column = :title)
@sluggable_source = column
end
def sluggable_source_column
@sluggable_source || :title
end
end
# Instance methods
def to_param
slug
end
private
def should_generate_slug?
slug.blank? || send("#{self.class.sluggable_source_column}_changed?")
end
def generate_slug
source = send(self.class.sluggable_source_column)
return if source.blank?
base_slug = source.parameterize
self.slug = unique_slug(base_slug)
end
def unique_slug(base)
slug = base
counter = 1
while self.class.where(slug: slug).where.not(id: id).exists?
slug = "#{base}-#{counter}"
counter += 1
end
slug
end
end
```
```ruby
# app/models/article.rb
class Article < ApplicationRecord
include Sluggable
sluggable_source :title # Optional, :title by default
end
# app/models/product.rb
class Product < ApplicationRecord
include Sluggable
sluggable_source :name
end
```
```ruby
# app/controllers/concerns/pagination.rb
# Concern for controllers
module Pagination
extend ActiveSupport::Concern
included do
helper_method :page_param, :per_page_param
end
private
def paginate(relation)
relation.page(page_param).per(per_page_param)
end
def page_param
params[:page]&.to_i || 1
end
def per_page_param
[params[:per_page]&.to_i || 25, 100].min
end
end
```
Concerns are useful for truly shared code. Avoid creating Concerns just to "shorten" a Model - that hides complexity without reducing it.
## Testing with RSpec
### Question 10: How to Structure RSpec Tests in Rails?
RSpec is the standard testing framework for Rails. A good test structure includes Model specs, Controller specs, Service specs, and integration tests.
```ruby
# spec/models/user_spec.rb
require 'rails_helper'
RSpec.describe User, type: :model do
# Factories with FactoryBot
let(:user) { build(:user) }
let(:admin) { build(:user, :admin) }
describe 'validations' do
it { is_expected.to validate_presence_of(:email) }
it { is_expected.to validate_uniqueness_of(:email).case_insensitive }
it 'validates email format' do
user.email = 'invalid'
expect(user).not_to be_valid
expect(user.errors[:email]).to include('is invalid')
end
end
describe 'associations' do
it { is_expected.to have_many(:articles).dependent(:destroy) }
it { is_expected.to have_one(:profile) }
it { is_expected.to belong_to(:organization).optional }
end
describe '#full_name' do
it 'returns first and last name combined' do
user = build(:user, first_name: 'John', last_name: 'Doe')
expect(user.full_name).to eq('John Doe')
end
it 'handles missing last name' do
user = build(:user, first_name: 'John', last_name: nil)
expect(user.full_name).to eq('John')
end
end
describe '.active' do
it 'returns only active users' do
active = create(:user, active: true)
inactive = create(:user, active: false)
expect(User.active).to include(active)
expect(User.active).not_to include(inactive)
end
end
end
```
```ruby
# spec/services/order_processor_spec.rb
require 'rails_helper'
RSpec.describe OrderProcessor do
let(:user) { create(:user) }
let(:product) { create(:product, stock_quantity: 10, price: 100) }
let(:order) { create(:order, user: user, items: [build(:order_item, product: product, quantity: 2)]) }
subject { described_class.new(order, payment_method: 'card') }
describe '#call' do
context 'when order is valid' do
before do
allow(PaymentGateway).to receive(:charge).and_return(
OpenStruct.new(success?: true, transaction_id: 'txn_123')
)
end
it 'processes the order successfully' do
result = subject.call
expect(result).to be_success
expect(order.reload.status).to eq('completed')
end
it 'decrements product stock' do
expect { subject.call }.to change { product.reload.stock_quantity }.by(-2)
end
it 'sends confirmation email' do
expect { subject.call }
.to have_enqueued_mail(OrderMailer, :confirmation)
.with(order)
end
end
context 'when payment fails' do
before do
allow(PaymentGateway).to receive(:charge).and_return(
OpenStruct.new(success?: false, error: 'Card declined')
)
end
it 'returns failure result' do
result = subject.call
expect(result).to be_failure
expect(result.error).to include('Card declined')
end
it 'does not update order status' do
expect { subject.call }.not_to change { order.reload.status }
end
end
end
end
```
```ruby
# spec/requests/api/v1/products_spec.rb
require 'rails_helper'
RSpec.describe 'API V1 Products', type: :request do
let(:user) { create(:user) }
let(:headers) { { 'Authorization' => "Bearer #{user.api_token}" } }
describe 'GET /api/v1/products' do
let!(:products) { create_list(:product, 3, :active) }
it 'returns list of products' do
get '/api/v1/products', headers: headers
expect(response).to have_http_status(:ok)
expect(json_response['data'].size).to eq(3)
end
it 'filters by category' do
category = create(:category)
categorized = create(:product, category: category)
get '/api/v1/products', params: { category_id: category.id }, headers: headers
expect(json_response['data'].map { |p| p['id'] }).to eq([categorized.id])
end
end
describe 'POST /api/v1/products' do
let(:valid_params) do
{ product: { name: 'New Product', price: 99.99, category_id: create(:category).id } }
end
it 'creates a new product' do
expect {
post '/api/v1/products', params: valid_params, headers: headers
}.to change(Product, :count).by(1)
expect(response).to have_http_status(:created)
end
end
end
```
Best practices: use `let` for data, `describe` for methods/contexts, `context` for conditions, and `it` for specific assertions. One test should test one thing.
### Question 11: How to Use Factories with FactoryBot?
FactoryBot enables creating test data declaratively and maintainably. Factories replace static fixtures.
```ruby
# spec/factories/users.rb
FactoryBot.define do
factory :user do
# Sequences for uniqueness
sequence(:email) { |n| "user#{n}@example.com" }
first_name { Faker::Name.first_name }
last_name { Faker::Name.last_name }
password { 'password123' }
confirmed_at { Time.current }
# Traits for variations
trait :admin do
role { 'admin' }
after(:create) do |user|
user.permissions.create!(name: 'admin_access')
end
end
trait :unconfirmed do
confirmed_at { nil }
end
trait :with_profile do
after(:create) do |user|
create(:profile, user: user)
end
end
trait :with_articles do
transient do
articles_count { 3 }
end
after(:create) do |user, evaluator|
create_list(:article, evaluator.articles_count, author: user)
end
end
# Inherited factory
factory :admin_user do
admin
with_profile
end
end
end
```
```ruby
# spec/factories/orders.rb
FactoryBot.define do
factory :order do
user
status { 'pending' }
trait :with_items do
transient do
items_count { 2 }
end
after(:create) do |order, evaluator|
create_list(:order_item, evaluator.items_count, order: order)
order.recalculate_total!
end
end
trait :completed do
status { 'completed' }
processed_at { Time.current }
with_items
end
trait :high_value do
after(:create) do |order|
create(:order_item, order: order, quantity: 10, unit_price: 500)
order.recalculate_total!
end
end
end
end
```
```ruby
# Usage in tests
RSpec.describe OrderProcessor do
# build: non-persisted instance
let(:user) { build(:user) }
# create: persisted to DB
let(:order) { create(:order, :with_items, user: user) }
# create_list: multiple instances
let(:products) { create_list(:product, 5) }
# Combining traits
let(:admin) { create(:user, :admin, :with_profile) }
# Override attributes
let(:expensive_order) { create(:order, :with_items, items_count: 10) }
# build_stubbed: faster, for unit tests
let(:stubbed_user) { build_stubbed(:user) }
end
```
Prefer `build` or `build_stubbed` over `create` when persistence isn't necessary - this significantly speeds up tests.
## Background Jobs
### Question 12: How to Use Active Job and Sidekiq in Rails?
Active Job provides a unified interface for background jobs, regardless of backend (Sidekiq, Resque, etc.). Sidekiq is the popular choice for its performance with Redis.
```ruby
# app/jobs/process_order_job.rb
class ProcessOrderJob < ApplicationJob
queue_as :default
# Retry configuration
retry_on ActiveRecord::Deadlocked, wait: 5.seconds, attempts: 3
retry_on Net::OpenTimeout, wait: :polynomially_longer, attempts: 10
discard_on ActiveJob::DeserializationError
# Sidekiq options (if Sidekiq backend)
sidekiq_options retry: 5, backtrace: true
def perform(order_id)
order = Order.find(order_id)
OrderProcessor.new(order).call
rescue ActiveRecord::RecordNotFound
# Order deleted between enqueue and execution
Rails.logger.warn("Order #{order_id} not found, skipping job")
end
end
```
```ruby
# app/jobs/batch_email_job.rb
class BatchEmailJob < ApplicationJob
queue_as :mailers
# Rate limiting with Sidekiq Enterprise or throttle gem
sidekiq_options throttle: { threshold: 100, period: 1.minute }
def perform(user_ids, template_id)
template = EmailTemplate.find(template_id)
User.where(id: user_ids).find_each do |user|
UserMailer.custom_email(user, template).deliver_later
end
end
end
```
```ruby
# Enqueuing jobs
# Immediate
ProcessOrderJob.perform_later(order.id)
# Delayed
ProcessOrderJob.set(wait: 5.minutes).perform_later(order.id)
# At specific time
ProcessOrderJob.set(wait_until: Date.tomorrow.noon).perform_later(order.id)
# Specific queue
ProcessOrderJob.set(queue: :critical).perform_later(order.id)
# Synchronous (for tests or debugging)
ProcessOrderJob.perform_now(order.id)
```
```ruby
# config/sidekiq.yml
:concurrency: 10
:queues:
- [critical, 3] # High priority, weight 3
- [default, 2] # Medium priority, weight 2
- [mailers, 1] # Low priority, weight 1
- [low, 1]
:schedule:
cleanup_job:
cron: '0 3 * * *' # Every day at 3am
class: CleanupJob
```
Active Job abstracts the backend, but accessing specific features (batches, rate limiting) often requires coupling to the chosen backend.
## API Development
### Question 13: How to Build a RESTful API with Rails?
Rails facilitates building JSON APIs with API-only Controllers and serializers. A good API is versioned, documented, and secure.
```ruby
# app/controllers/api/v1/base_controller.rb
module Api
module V1
class BaseController < ActionController::API
include ActionController::HttpAuthentication::Token::ControllerMethods
before_action :authenticate_token!
rescue_from ActiveRecord::RecordNotFound, with: :not_found
rescue_from ActiveRecord::RecordInvalid, with: :unprocessable_entity
rescue_from ActionController::ParameterMissing, with: :bad_request
private
def authenticate_token!
authenticate_or_request_with_http_token do |token, options|
@current_user = User.find_by(api_token: token)
end
end
def current_user
@current_user
end
def not_found(exception)
render json: { error: 'Resource not found', details: exception.message },
status: :not_found
end
def unprocessable_entity(exception)
render json: { error: 'Validation failed', details: exception.record.errors },
status: :unprocessable_entity
end
def bad_request(exception)
render json: { error: 'Bad request', details: exception.message },
status: :bad_request
end
end
end
end
```
```ruby
# app/controllers/api/v1/products_controller.rb
module Api
module V1
class ProductsController < BaseController
before_action :set_product, only: [:show, :update, :destroy]
def index
@products = Product.active
.includes(:category)
.page(params[:page])
.per(params[:per_page] || 20)
render json: {
data: ProductSerializer.new(@products).serializable_hash,
meta: pagination_meta(@products)
}
end
def show
render json: ProductSerializer.new(@product, include: [:category, :reviews])
end
def create
@product = Product.new(product_params)
@product.save!
render json: ProductSerializer.new(@product), status: :created
end
def update
@product.update!(product_params)
render json: ProductSerializer.new(@product)
end
def destroy
@product.destroy!
head :no_content
end
private
def set_product
@product = Product.find(params[:id])
end
def product_params
params.require(:product).permit(:name, :description, :price, :category_id)
end
def pagination_meta(collection)
{
current_page: collection.current_page,
total_pages: collection.total_pages,
total_count: collection.total_count
}
end
end
end
end
```
```ruby
# app/serializers/product_serializer.rb
# With jsonapi-serializer gem
class ProductSerializer
include JSONAPI::Serializer
attributes :id, :name, :description, :price, :created_at
attribute :formatted_price do |product|
"$#{product.price.to_f.round(2)}"
end
belongs_to :category
has_many :reviews
link :self do |product|
Rails.application.routes.url_helpers.api_v1_product_url(product)
end
end
```
API best practices: version via namespace, use appropriate HTTP codes, paginate collections, and provide clear error messages.
### Question 14: How to Implement JWT Authentication in Rails?
JWT (JSON Web Tokens) is a popular stateless authentication method for APIs. The token encodes user identity and validity.
```ruby
# app/services/jwt_service.rb
class JwtService
SECRET_KEY = Rails.application.credentials.secret_key_base
ALGORITHM = 'HS256'.freeze
class << self
def encode(payload, exp = 24.hours.from_now)
payload[:exp] = exp.to_i
payload[:iat] = Time.current.to_i
JWT.encode(payload, SECRET_KEY, ALGORITHM)
end
def decode(token)
decoded = JWT.decode(token, SECRET_KEY, true, algorithm: ALGORITHM)
HashWithIndifferentAccess.new(decoded.first)
rescue JWT::ExpiredSignature
raise AuthenticationError, 'Token has expired'
rescue JWT::DecodeError
raise AuthenticationError, 'Invalid token'
end
end
end
```
```ruby
# app/controllers/api/v1/auth_controller.rb
module Api
module V1
class AuthController < ActionController::API
def login
user = User.find_by(email: params[:email])
if user&.authenticate(params[:password])
token = JwtService.encode(user_id: user.id)
render json: {
token: token,
user: UserSerializer.new(user),
expires_at: 24.hours.from_now
}
else
render json: { error: 'Invalid credentials' }, status: :unauthorized
end
end
def refresh
token = JwtService.encode(user_id: current_user.id)
render json: { token: token, expires_at: 24.hours.from_now }
end
end
end
end
```
```ruby
# app/controllers/concerns/jwt_authenticatable.rb
module JwtAuthenticatable
extend ActiveSupport::Concern
included do
before_action :authenticate_jwt!
end
private
def authenticate_jwt!
header = request.headers['Authorization']
token = header&.split(' ')&.last
raise AuthenticationError, 'Missing token' unless token
decoded = JwtService.decode(token)
@current_user = User.find(decoded[:user_id])
rescue AuthenticationError => e
render json: { error: e.message }, status: :unauthorized
rescue ActiveRecord::RecordNotFound
render json: { error: 'User not found' }, status: :unauthorized
end
def current_user
@current_user
end
end
```
For production, consider: refresh tokens, token blacklisting for logout, and short expiration times. Gems like `devise-jwt` simplify implementation.
## Caching and Performance
### Question 15: How to Implement Caching in Rails?
Rails offers several caching levels: fragment caching, Russian Doll caching, low-level caching. The choice depends on the use case.
```ruby
# config/environments/production.rb
config.action_controller.perform_caching = true
config.cache_store = :redis_cache_store, {
url: ENV['REDIS_URL'],
namespace: 'myapp:cache',
expires_in: 1.day,
race_condition_ttl: 10.seconds
}
```
```erb
<%# app/views/products/index.html.erb %>
<%# Fragment caching with automatic cache key %>
<% @products.each do |product| %>
<%# Cache based on product's updated_at %>
<% cache product do %>
<%= render product %>
<% end %>
<% end %>
<%# Russian Doll caching - nested cache %>
<% cache ['v1', @category] do %>