Ruby on Rails 面接質問: 2026年トップ25

# app/models/article.rb
# Modelはデータとビジネスロジックを管理します
class Article < ApplicationRecord
  # データのバリデーション
  validates :title, presence: true, length: { minimum: 5 }
  validates :body, presence: true

  # 他のモデルとの関連
  belongs_to :author, class_name: 'User'
  has_many :comments, dependent: :destroy
  has_many :tags, through: :article_tags

  # 再利用可能なクエリのためのスコープ
  scope :published, -> { where(published: true) }
  scope :recent, -> { order(created_at: :desc).limit(10) }

  # ライフサイクルコールバック
  before_save :generate_slug

  private

  def generate_slug
    self.slug = title.parameterize if title_changed?
  end
end

# app/controllers/articles_controller.rb
# Controllerはリクエストを受け取り、レスポンスを取りまとめます
class ArticlesController < ApplicationController
  before_action :authenticate_user!, except: [:index, :show]
  before_action :set_article, only: [:show, :edit, :update, :destroy]

  def index
    @articles = Article.published.recent.includes(:author)
  end

  def show
    @comments = @article.comments.includes(:user)
  end

  def create
    @article = current_user.articles.build(article_params)

    if @article.save
      redirect_to @article, notice: '記事を作成しました。'
    else
      render :new, status: :unprocessable_entity
    end
  end

  private

  def set_article
    @article = Article.find(params[:id])
  end

  def article_params
    params.require(:article).permit(:title, :body, :published, tag_ids: [])
  end
end

<%# app/views/articles/show.html.erb %>
<%# Viewはデータを HTML 形式で表示します %>
<article class="article-detail">
  <header>
    <h1><%= @article.title %></h1>
    <p class="meta">
      投稿者: <%= @article.author.name %> •
      <%= l @article.created_at, format: :long %>
    </p>
  </header>

  <div class="content">
    <%= simple_format @article.body %>
  </div>

  <%# コメント用のパーシャル %>
  <%= render @comments %>
</article>

# app/models/user.rb
# Active Recordはカラムを属性に自動的にマッピングします
class User < ApplicationRecord
  # 'users' テーブルが自動的に対応付けられます
  # カラム: id, email, name, created_at, updated_at

  has_secure_password # パスワード用のBCrypt

  has_many :articles, foreign_key: :author_id
  has_one :profile, dependent: :destroy
  has_and_belongs_to_many :roles

  # バリデーション
  validates :email, presence: true,
                    uniqueness: { case_sensitive: false },
                    format: { with: URI::MailTo::EMAIL_REGEXP }

  # コールバック
  before_save :normalize_email

  # クエリ用のクラスメソッド
  def self.admins
    joins(:roles).where(roles: { name: 'admin' })
  end

  private

  def normalize_email
    self.email = email.downcase.strip
  end
end

# Active Recordのクエリ例
# Railsコンソールやサービス内で使用

# 作成
user = User.create!(email: 'dev@example.com', name: 'Alice', password: 'secret123')

# 条件付きの読み取り
active_users = User.where(active: true).order(:name)
user = User.find_by(email: 'dev@example.com')

# チェーンクエリ (lazy evaluation)
recent_admins = User.admins
                    .where('created_at > ?', 1.month.ago)
                    .includes(:profile)
                    .limit(10)

# eager loading による N+1 の防止
articles = Article.includes(:author, :comments).published

# 更新
user.update!(name: 'Alice Martin')

# トランザクション
User.transaction do
  user.debit_balance!(100)
  recipient.credit_balance!(100)
  Payment.create!(from: user, to: recipient, amount: 100)
end

# db/migrate/20260203100000_create_products.rb
# テーブル作成のためのマイグレーション
class CreateProducts < ActiveRecord::Migration[7.1]
  def change
    create_table :products do |t|
      t.string :name, null: false
      t.text :description
      t.decimal :price, precision: 10, scale: 2, null: false
      t.integer :stock_quantity, default: 0
      t.references :category, null: false, foreign_key: true
      t.boolean :active, default: true

      t.timestamps # created_at と updated_at を自動付与
    end

    # パフォーマンスのためのインデックス
    add_index :products, :name
    add_index :products, [:category_id, :active]
  end
end

# db/migrate/20260203110000_add_slug_to_products.rb
# 既存テーブルを変更するマイグレーション
class AddSlugToProducts < ActiveRecord::Migration[7.1]
  def change
    add_column :products, :slug, :string
    add_index :products, :slug, unique: true

    # 既存スラッグを埋める
    reversible do |dir|
      dir.up do
        Product.find_each do |product|
          product.update_column(:slug, product.name.parameterize)
        end
      end
    end

    # 埋めた後にNOT NULLに変更
    change_column_null :products, :slug, false
  end
end

# 必須のマイグレーションコマンド
rails db:migrate              # 保留中のマイグレーションを実行
rails db:rollback             # 直前のマイグレーションを取り消し
rails db:rollback STEP=3      # 直前3件のマイグレーションを取り消し
rails db:migrate:status       # マイグレーション状態を確認
rails db:seed                 # db/seeds.rb を実行
rails db:reset                # Drop, create, migrate, seed

# app/controllers/orders_controller.rb
class OrdersController < ApplicationController
  def index
    # ❌ N+1問題: 1クエリ + 注文ごとにNクエリ
    # @orders = Order.all
    # ビュー内で order.user.name が注文ごとにクエリを発行

    # ✅ includes (eager loading) による解決策
    @orders = Order.includes(:user, :items)
                   .where(status: 'completed')
                   .order(created_at: :desc)
    # 合計で3クエリのみ発行
  end

  def show
    # includes: 関連を別のクエリで読み込む (2-3クエリ)
    @order = Order.includes(items: :product).find(params[:id])

    # preload: 別クエリでの読み込みを強制
    @order = Order.preload(:items, :user).find(params[:id])

    # eager_load: LEFT OUTER JOIN を強制 (1クエリ)
    @order = Order.eager_load(:items).find(params[:id])
  end
end

# app/models/order.rb
class Order < ApplicationRecord
  belongs_to :user
  has_many :items, class_name: 'OrderItem'
  has_many :products, through: :items

  # デフォルトの includes 付きスコープ
  scope :with_details, -> { includes(:user, items: :product) }

  # COUNT クエリ回避のための counter cache
  # 必要: add_column :users, :orders_count, :integer, default: 0
  belongs_to :user, counter_cache: true
end

# Bullet gem による N+1 検出 (development)
# config/environments/development.rb
config.after_initialize do
  Bullet.enable = true
  Bullet.alert = true
  Bullet.bullet_logger = true
  Bullet.rails_logger = true
end

# Bullet が次の場合に警告を表示します:
# - N+1 クエリが検出された
# - 不要な eager loading が存在する
# - counter cache を使用すべき

# app/models/product.rb
class Product < ApplicationRecord
  # シンプルなスコープ
  scope :active, -> { where(active: true) }
  scope :in_stock, -> { where('stock_quantity > 0') }
  scope :featured, -> { where(featured: true) }

  # 引数を受け取るスコープ
  scope :cheaper_than, ->(price) { where('price < ?', price) }
  scope :in_category, ->(category) { where(category: category) }

  # チェーン可能なスコープ
  scope :available, -> { active.in_stock }

  # joins を含むスコープ
  scope :with_recent_orders, -> {
    joins(:order_items)
      .where('order_items.created_at > ?', 30.days.ago)
      .distinct
  }

  # サブクエリを含むスコープ
  scope :bestsellers, -> {
    where(id: OrderItem.group(:product_id)
                       .order('COUNT(*) DESC')
                       .limit(10)
                       .select(:product_id))
  }
end

# app/queries/products_search_query.rb
# 複雑な検索のための Query Object
class ProductsSearchQuery
  def initialize(relation = Product.all)
    @relation = relation
  end

  def call(params)
    @relation = filter_by_category(params[:category])
    @relation = filter_by_price_range(params[:min_price], params[:max_price])
    @relation = filter_by_search(params[:q])
    @relation = apply_sorting(params[:sort])
    @relation
  end

  private

  def filter_by_category(category)
    return @relation if category.blank?
    @relation.where(category_id: category)
  end

  def filter_by_price_range(min, max)
    @relation = @relation.where('price >= ?', min) if min.present?
    @relation = @relation.where('price <= ?', max) if max.present?
    @relation
  end

  def filter_by_search(query)
    return @relation if query.blank?
    @relation.where('name ILIKE ? OR description ILIKE ?',
                    "%#{query}%", "%#{query}%")
  end

  def apply_sorting(sort)
    case sort
    when 'price_asc' then @relation.order(price: :asc)
    when 'price_desc' then @relation.order(price: :desc)
    when 'newest' then @relation.order(created_at: :desc)
    else @relation.order(:name)
    end
  end
end

# コントローラーでの使用
@products = ProductsSearchQuery.new(Product.active).call(params)

# config/routes.rb
Rails.application.routes.draw do
  # 標準的な RESTful ルート (7アクション)
  resources :articles do
    # ネストされたルート
    resources :comments, only: [:create, :destroy]

    # メンバールート (1インスタンスに対して動作)
    member do
      post :publish
      delete :archive
    end

    # コレクションルート (コレクションに対して動作)
    collection do
      get :drafts
      get :search
    end
  end

  # namespace を使った API ルート
  namespace :api do
    namespace :v1 do
      resources :products, only: [:index, :show, :create, :update] do
        resources :reviews, shallow: true
      end
    end
  end

  # カスタムルート
  get 'dashboard', to: 'dashboard#index'

  # ルートの制約
  constraints(SubdomainConstraint.new) do
    resources :admin_settings
  end

  # ルートパス
  root 'home#index'
end

# rails routes - 生成されたすべてのルートを表示
#
# Verb   URI Pattern                    Controller#Action
# GET    /articles                      articles#index
# POST   /articles                      articles#create
# GET    /articles/new                  articles#new
# GET    /articles/:id/edit             articles#edit
# GET    /articles/:id                  articles#show
# PATCH  /articles/:id                  articles#update
# DELETE /articles/:id                  articles#destroy
# POST   /articles/:id/publish          articles#publish
# GET    /articles/drafts               articles#drafts

# app/controllers/application_controller.rb
class ApplicationController < ActionController::Base
  # CSRF 保護はデフォルトで有効
  protect_from_forgery with: :exception

  # 認証用のグローバルコールバック
  before_action :authenticate_user!

  # グローバルなエラーハンドリング
  rescue_from ActiveRecord::RecordNotFound, with: :not_found
  rescue_from ActionController::ParameterMissing, with: :bad_request

  private

  def not_found
    render json: { error: 'リソースが見つかりません' }, status: :not_found
  end

  def bad_request(exception)
    render json: { error: exception.message }, status: :bad_request
  end
end

# app/controllers/admin/products_controller.rb
class Admin::ProductsController < ApplicationController
  # オプション付きコールバック
  before_action :require_admin
  before_action :set_product, only: [:show, :edit, :update, :destroy]
  after_action :log_activity, only: [:create, :update, :destroy]

  # 条件付きコールバック
  before_action :check_stock, only: [:update], if: :stock_changed?

  def create
    @product = Product.new(product_params)

    if @product.save
      redirect_to [:admin, @product], notice: '商品を作成しました。'
    else
      render :new, status: :unprocessable_entity
    end
  end

  def update
    if @product.update(product_params)
      redirect_to [:admin, @product], notice: '商品を更新しました。'
    else
      render :edit, status: :unprocessable_entity
    end
  end

  private

  def require_admin
    redirect_to root_path unless current_user&.admin?
  end

  def set_product
    @product = Product.find(params[:id])
  end

  def stock_changed?
    params[:product][:stock_quantity].present?
  end

  def log_activity
    ActivityLog.create!(
      user: current_user,
      action: action_name,
      resource: @product
    )
  end

  def product_params
    params.require(:product).permit(:name, :price, :description, :stock_quantity)
  end
end

# app/services/order_processor.rb
# 標準化されたインターフェースを持つ Service Object
class OrderProcessor
  def initialize(order, payment_method:)
    @order = order
    @payment_method = payment_method
  end

  def call
    return failure('注文は処理済みです') if @order.processed?

    ActiveRecord::Base.transaction do
      validate_stock!
      process_payment!
      update_inventory!
      send_confirmation!

      @order.update!(status: 'completed', processed_at: Time.current)
    end

    success(@order)
  rescue PaymentError => e
    failure("支払いに失敗しました: #{e.message}")
  rescue InsufficientStockError => e
    failure("在庫不足: #{e.message}")
  end

  private

  def validate_stock!
    @order.items.each do |item|
      unless item.product.stock_quantity >= item.quantity
        raise InsufficientStockError, item.product.name
      end
    end
  end

  def process_payment!
    result = PaymentGateway.charge(
      amount: @order.total,
      method: @payment_method,
      description: "注文 ##{@order.id}"
    )

    raise PaymentError, result.error unless result.success?
    @order.update!(payment_reference: result.transaction_id)
  end

  def update_inventory!
    @order.items.each do |item|
      item.product.decrement!(:stock_quantity, item.quantity)
    end
  end

  def send_confirmation!
    OrderMailer.confirmation(@order).deliver_later
  end

  def success(data)
    Result.new(success: true, data: data)
  end

  def failure(error)
    Result.new(success: false, error: error)
  end

  Result = Struct.new(:success, :data, :error, keyword_init: true) do
    def success? = success
    def failure? = !success
  end
end

# app/controllers/orders_controller.rb
class OrdersController < ApplicationController
  def create
    @order = current_user.orders.build(order_params)

    if @order.save
      result = OrderProcessor.new(@order, payment_method: params[:payment_method]).call

      if result.success?
        redirect_to @order, notice: '注文を確定しました!'
      else
        @order.update!(status: 'payment_failed')
        flash.now[:alert] = result.error
        render :new, status: :unprocessable_entity
      end
    else
      render :new, status: :unprocessable_entity
    end
  end
end

# app/models/concerns/sluggable.rb
# スラッグ生成のための再利用可能な Concern
module Sluggable
  extend ActiveSupport::Concern

  included do
    # include 時に実行されるコード
    before_validation :generate_slug, if: :should_generate_slug?
    validates :slug, presence: true, uniqueness: true
  end

  # クラスメソッド
  class_methods do
    def find_by_slug!(slug)
      find_by!(slug: slug)
    end

    def sluggable_source(column = :title)
      @sluggable_source = column
    end

    def sluggable_source_column
      @sluggable_source || :title
    end
  end

  # インスタンスメソッド
  def to_param
    slug
  end

  private

  def should_generate_slug?
    slug.blank? || send("#{self.class.sluggable_source_column}_changed?")
  end

  def generate_slug
    source = send(self.class.sluggable_source_column)
    return if source.blank?

    base_slug = source.parameterize
    self.slug = unique_slug(base_slug)
  end

  def unique_slug(base)
    slug = base
    counter = 1

    while self.class.where(slug: slug).where.not(id: id).exists?
      slug = "#{base}-#{counter}"
      counter += 1
    end

    slug
  end
end

# app/models/article.rb
class Article < ApplicationRecord
  include Sluggable

  sluggable_source :title # 任意、既定は :title
end

# app/models/product.rb
class Product < ApplicationRecord
  include Sluggable

  sluggable_source :name
end

# app/controllers/concerns/pagination.rb
# コントローラー用の Concern
module Pagination
  extend ActiveSupport::Concern

  included do
    helper_method :page_param, :per_page_param
  end

  private

  def paginate(relation)
    relation.page(page_param).per(per_page_param)
  end

  def page_param
    params[:page]&.to_i || 1
  end

  def per_page_param
    [params[:per_page]&.to_i || 25, 100].min
  end
end

# spec/models/user_spec.rb
require 'rails_helper'

RSpec.describe User, type: :model do
  # FactoryBot のファクトリ
  let(:user) { build(:user) }
  let(:admin) { build(:user, :admin) }

  describe 'validations' do
    it { is_expected.to validate_presence_of(:email) }
    it { is_expected.to validate_uniqueness_of(:email).case_insensitive }

    it 'メールの形式を検証する' do
      user.email = 'invalid'
      expect(user).not_to be_valid
      expect(user.errors[:email]).to include('is invalid')
    end
  end

  describe 'associations' do
    it { is_expected.to have_many(:articles).dependent(:destroy) }
    it { is_expected.to have_one(:profile) }
    it { is_expected.to belong_to(:organization).optional }
  end

  describe '#full_name' do
    it '姓名を結合して返す' do
      user = build(:user, first_name: 'John', last_name: 'Doe')
      expect(user.full_name).to eq('John Doe')
    end

    it '姓が無い場合も処理する' do
      user = build(:user, first_name: 'John', last_name: nil)
      expect(user.full_name).to eq('John')
    end
  end

  describe '.active' do
    it 'アクティブなユーザーのみを返す' do
      active = create(:user, active: true)
      inactive = create(:user, active: false)

      expect(User.active).to include(active)
      expect(User.active).not_to include(inactive)
    end
  end
end

# spec/services/order_processor_spec.rb
require 'rails_helper'

RSpec.describe OrderProcessor do
  let(:user) { create(:user) }
  let(:product) { create(:product, stock_quantity: 10, price: 100) }
  let(:order) { create(:order, user: user, items: [build(:order_item, product: product, quantity: 2)]) }

  subject { described_class.new(order, payment_method: 'card') }

  describe '#call' do
    context '注文が有効なとき' do
      before do
        allow(PaymentGateway).to receive(:charge).and_return(
          OpenStruct.new(success?: true, transaction_id: 'txn_123')
        )
      end

      it '注文を正常に処理する' do
        result = subject.call

        expect(result).to be_success
        expect(order.reload.status).to eq('completed')
      end

      it '商品の在庫を減らす' do
        expect { subject.call }.to change { product.reload.stock_quantity }.by(-2)
      end

      it '確認メールを送信する' do
        expect { subject.call }
          .to have_enqueued_mail(OrderMailer, :confirmation)
          .with(order)
      end
    end

    context '支払いが失敗するとき' do
      before do
        allow(PaymentGateway).to receive(:charge).and_return(
          OpenStruct.new(success?: false, error: 'Card declined')
        )
      end

      it '失敗結果を返す' do
        result = subject.call

        expect(result).to be_failure
        expect(result.error).to include('Card declined')
      end

      it '注文ステータスは更新しない' do
        expect { subject.call }.not_to change { order.reload.status }
      end
    end
  end
end

# spec/requests/api/v1/products_spec.rb
require 'rails_helper'

RSpec.describe 'API V1 Products', type: :request do
  let(:user) { create(:user) }
  let(:headers) { { 'Authorization' => "Bearer #{user.api_token}" } }

  describe 'GET /api/v1/products' do
    let!(:products) { create_list(:product, 3, :active) }

    it '商品一覧を返す' do
      get '/api/v1/products', headers: headers

      expect(response).to have_http_status(:ok)
      expect(json_response['data'].size).to eq(3)
    end

    it 'カテゴリで絞り込む' do
      category = create(:category)
      categorized = create(:product, category: category)

      get '/api/v1/products', params: { category_id: category.id }, headers: headers

      expect(json_response['data'].map { |p| p['id'] }).to eq([categorized.id])
    end
  end

  describe 'POST /api/v1/products' do
    let(:valid_params) do
      { product: { name: '新商品', price: 99.99, category_id: create(:category).id } }
    end

    it '新しい商品を作成する' do
      expect {
        post '/api/v1/products', params: valid_params, headers: headers
      }.to change(Product, :count).by(1)

      expect(response).to have_http_status(:created)
    end
  end
end

# spec/factories/users.rb
FactoryBot.define do
  factory :user do
    # 一意性確保のためのシーケンス
    sequence(:email) { |n| "user#{n}@example.com" }
    first_name { Faker::Name.first_name }
    last_name { Faker::Name.last_name }
    password { 'password123' }
    confirmed_at { Time.current }

    # バリエーションのためのトレイト
    trait :admin do
      role { 'admin' }
      after(:create) do |user|
        user.permissions.create!(name: 'admin_access')
      end
    end

    trait :unconfirmed do
      confirmed_at { nil }
    end

    trait :with_profile do
      after(:create) do |user|
        create(:profile, user: user)
      end
    end

    trait :with_articles do
      transient do
        articles_count { 3 }
      end

      after(:create) do |user, evaluator|
        create_list(:article, evaluator.articles_count, author: user)
      end
    end

    # 継承ファクトリ
    factory :admin_user do
      admin
      with_profile
    end
  end
end

# spec/factories/orders.rb
FactoryBot.define do
  factory :order do
    user
    status { 'pending' }

    trait :with_items do
      transient do
        items_count { 2 }
      end

      after(:create) do |order, evaluator|
        create_list(:order_item, evaluator.items_count, order: order)
        order.recalculate_total!
      end
    end

    trait :completed do
      status { 'completed' }
      processed_at { Time.current }
      with_items
    end

    trait :high_value do
      after(:create) do |order|
        create(:order_item, order: order, quantity: 10, unit_price: 500)
        order.recalculate_total!
      end
    end
  end
end

# テストでの使用
RSpec.describe OrderProcessor do
  # build: 永続化しないインスタンス
  let(:user) { build(:user) }

  # create: DBに保存
  let(:order) { create(:order, :with_items, user: user) }

  # create_list: 複数インスタンス
  let(:products) { create_list(:product, 5) }

  # トレイトの組み合わせ
  let(:admin) { create(:user, :admin, :with_profile) }

  # 属性の上書き
  let(:expensive_order) { create(:order, :with_items, items_count: 10) }

  # build_stubbed: 高速、ユニットテスト向け
  let(:stubbed_user) { build_stubbed(:user) }
end

# app/jobs/process_order_job.rb
class ProcessOrderJob < ApplicationJob
  queue_as :default

  # リトライ設定
  retry_on ActiveRecord::Deadlocked, wait: 5.seconds, attempts: 3
  retry_on Net::OpenTimeout, wait: :polynomially_longer, attempts: 10
  discard_on ActiveJob::DeserializationError

  # Sidekiq オプション (バックエンドが Sidekiq の場合)
  sidekiq_options retry: 5, backtrace: true

  def perform(order_id)
    order = Order.find(order_id)

    OrderProcessor.new(order).call
  rescue ActiveRecord::RecordNotFound
    # キュー投入から実行までの間に注文が削除された場合
    Rails.logger.warn("Order #{order_id} not found, skipping job")
  end
end

# app/jobs/batch_email_job.rb
class BatchEmailJob < ApplicationJob
  queue_as :mailers

  # Sidekiq Enterprise や throttle gem によるレート制限
  sidekiq_options throttle: { threshold: 100, period: 1.minute }

  def perform(user_ids, template_id)
    template = EmailTemplate.find(template_id)

    User.where(id: user_ids).find_each do |user|
      UserMailer.custom_email(user, template).deliver_later
    end
  end
end

# ジョブのキュー投入
# 即時
ProcessOrderJob.perform_later(order.id)

# 遅延
ProcessOrderJob.set(wait: 5.minutes).perform_later(order.id)

# 指定時刻
ProcessOrderJob.set(wait_until: Date.tomorrow.noon).perform_later(order.id)

# 特定のキュー
ProcessOrderJob.set(queue: :critical).perform_later(order.id)

# 同期実行 (テストやデバッグ用)
ProcessOrderJob.perform_now(order.id)

# config/sidekiq.yml
:concurrency: 10
:queues:
  - [critical, 3]    # 高優先度、重み 3
  - [default, 2]     # 中優先度、重み 2
  - [mailers, 1]     # 低優先度、重み 1
  - [low, 1]

:schedule:
  cleanup_job:
    cron: '0 3 * * *'  # 毎日午前 3 時
    class: CleanupJob

# app/controllers/api/v1/base_controller.rb
module Api
  module V1
    class BaseController < ActionController::API
      include ActionController::HttpAuthentication::Token::ControllerMethods

      before_action :authenticate_token!

      rescue_from ActiveRecord::RecordNotFound, with: :not_found
      rescue_from ActiveRecord::RecordInvalid, with: :unprocessable_entity
      rescue_from ActionController::ParameterMissing, with: :bad_request

      private

      def authenticate_token!
        authenticate_or_request_with_http_token do |token, options|
          @current_user = User.find_by(api_token: token)
        end
      end

      def current_user
        @current_user
      end

      def not_found(exception)
        render json: { error: 'リソースが見つかりません', details: exception.message },
               status: :not_found
      end

      def unprocessable_entity(exception)
        render json: { error: 'バリデーションに失敗しました', details: exception.record.errors },
               status: :unprocessable_entity
      end

      def bad_request(exception)
        render json: { error: 'リクエストが不正です', details: exception.message },
               status: :bad_request
      end
    end
  end
end

# app/controllers/api/v1/products_controller.rb
module Api
  module V1
    class ProductsController < BaseController
      before_action :set_product, only: [:show, :update, :destroy]

      def index
        @products = Product.active
                           .includes(:category)
                           .page(params[:page])
                           .per(params[:per_page] || 20)

        render json: {
          data: ProductSerializer.new(@products).serializable_hash,
          meta: pagination_meta(@products)
        }
      end

      def show
        render json: ProductSerializer.new(@product, include: [:category, :reviews])
      end

      def create
        @product = Product.new(product_params)
        @product.save!

        render json: ProductSerializer.new(@product), status: :created
      end

      def update
        @product.update!(product_params)
        render json: ProductSerializer.new(@product)
      end

      def destroy
        @product.destroy!
        head :no_content
      end

      private

      def set_product
        @product = Product.find(params[:id])
      end

      def product_params
        params.require(:product).permit(:name, :description, :price, :category_id)
      end

      def pagination_meta(collection)
        {
          current_page: collection.current_page,
          total_pages: collection.total_pages,
          total_count: collection.total_count
        }
      end
    end
  end
end

# app/serializers/product_serializer.rb
# jsonapi-serializer gem を使用
class ProductSerializer
  include JSONAPI::Serializer

  attributes :id, :name, :description, :price, :created_at

  attribute :formatted_price do |product|
    "$#{product.price.to_f.round(2)}"
  end

  belongs_to :category
  has_many :reviews

  link :self do |product|
    Rails.application.routes.url_helpers.api_v1_product_url(product)
  end
end

# app/services/jwt_service.rb
class JwtService
  SECRET_KEY = Rails.application.credentials.secret_key_base
  ALGORITHM = 'HS256'.freeze

  class << self
    def encode(payload, exp = 24.hours.from_now)
      payload[:exp] = exp.to_i
      payload[:iat] = Time.current.to_i
      JWT.encode(payload, SECRET_KEY, ALGORITHM)
    end

    def decode(token)
      decoded = JWT.decode(token, SECRET_KEY, true, algorithm: ALGORITHM)
      HashWithIndifferentAccess.new(decoded.first)
    rescue JWT::ExpiredSignature
      raise AuthenticationError, 'トークンの有効期限が切れています'
    rescue JWT::DecodeError
      raise AuthenticationError, 'トークンが無効です'
    end
  end
end

# app/controllers/api/v1/auth_controller.rb
module Api
  module V1
    class AuthController < ActionController::API
      def login
        user = User.find_by(email: params[:email])

        if user&.authenticate(params[:password])
          token = JwtService.encode(user_id: user.id)
          render json: {
            token: token,
            user: UserSerializer.new(user),
            expires_at: 24.hours.from_now
          }
        else
          render json: { error: '認証情報が正しくありません' }, status: :unauthorized
        end
      end

      def refresh
        token = JwtService.encode(user_id: current_user.id)
        render json: { token: token, expires_at: 24.hours.from_now }
      end
    end
  end
end

# app/controllers/concerns/jwt_authenticatable.rb
module JwtAuthenticatable
  extend ActiveSupport::Concern

  included do
    before_action :authenticate_jwt!
  end

  private

  def authenticate_jwt!
    header = request.headers['Authorization']
    token = header&.split(' ')&.last

    raise AuthenticationError, 'トークンがありません' unless token

    decoded = JwtService.decode(token)
    @current_user = User.find(decoded[:user_id])
  rescue AuthenticationError => e
    render json: { error: e.message }, status: :unauthorized
  rescue ActiveRecord::RecordNotFound
    render json: { error: 'ユーザーが見つかりません' }, status: :unauthorized
  end

  def current_user
    @current_user
  end
end

# config/environments/production.rb
config.action_controller.perform_caching = true
config.cache_store = :redis_cache_store, {
  url: ENV['REDIS_URL'],
  namespace: 'myapp:cache',
  expires_in: 1.day,
  race_condition_ttl: 10.seconds
}

<%# app/views/products/index.html.erb %>
<%# 自動キャッシュキーによるフラグメントキャッシング %>
<% @products.each do |product| %>
  <%# 商品の updated_at をベースとしたキャッシュ %>
  <% cache product do %>
    <%= render product %>
  <% end %>
<% end %>

<%# ロシアンドールキャッシング - ネストしたキャッシュ %>
<% cache ['v1', @category] do %>
  <h2><%= @category.name %></h2>

  <% @category.products.each do |product| %>
    <% cache ['v1', product] do %>
      <%= render product %>
    <% end %>
  <% end %>
<% end %>

<%# 条件付きキャッシュ %>
<% cache_if current_user.nil?, @product do %>
  <%= render @product %>
<% end %>

# app/models/product.rb
class Product < ApplicationRecord
  # ロシアンドールキャッシュ無効化のため親を touch
  belongs_to :category, touch: true

  # カスタムキャッシュキー
  def cache_key_with_version
    "#{super}/#{reviews.maximum(:updated_at)&.to_i}"
  end
end

# サービスでのローレベルキャッシング
class DashboardStatsService
  def call
    Rails.cache.fetch('dashboard:stats', expires_in: 15.minutes) do
      {
        total_users: User.count,
        active_users: User.where('last_sign_in_at > ?', 30.days.ago).count,
        total_orders: Order.completed.count,
        revenue_mtd: Order.completed.where(created_at: Time.current.beginning_of_month..).sum(:total)
      }
    end
  end
end

# レースコンディション保護付きキャッシュ
Rails.cache.fetch('popular_products', expires_in: 1.hour, race_condition_ttl: 10.seconds) do
  Product.bestsellers.limit(10).to_a
end

# 明示的な無効化
Rails.cache.delete('dashboard:stats')
Rails.cache.delete_matched('products:*')

# データベース最適化
# config/database.yml
production:
  pool: <%= ENV.fetch("RAILS_MAX_THREADS") { 5 } %>
  prepared_statements: true
  advisory_locks: true

# app/models/order.rb
class Order < ApplicationRecord
  # 頻繁なクエリ向けの複合インデックス
  # add_index :orders, [:user_id, :status, :created_at]

  # 必要な列のみ選択
  scope :summary, -> { select(:id, :status, :total, :created_at) }

  # 大量データ向けのバッチ処理
  def self.process_pending
    pending.find_each(batch_size: 1000) do |order|
      ProcessOrderJob.perform_later(order.id)
    end
  end

  # 繰り返し計算を避ける
  def self.revenue_by_month
    completed
      .group("DATE_TRUNC('month', created_at)")
      .sum(:total)
  end
end

# メモリ最適化
# config/puma.rb
workers ENV.fetch("WEB_CONCURRENCY") { 2 }
threads_count = ENV.fetch("RAILS_MAX_THREADS") { 5 }
threads threads_count, threads_count

preload_app!

before_fork do
  ActiveRecord::Base.connection_pool.disconnect!
end

on_worker_boot do
  ActiveRecord::Base.establish_connection
end

# rack-mini-profiler によるプロファイリング
# Gemfile
group :development do
  gem 'rack-mini-profiler'
  gem 'memory_profiler'
  gem 'stackprof'
end

# config/initializers/mini_profiler.rb
if defined?(Rack::MiniProfiler)
  Rack::MiniProfiler.config.position = 'bottom-right'
  Rack::MiniProfiler.config.start_hidden = true
end

# 遅延読み込みとページネーション
class ProductsController < ApplicationController
  def index
    @products = Product.active
                       .includes(:category, :primary_image)
                       .page(params[:page])
                       .per(24)

    # 次ページのプリフェッチ
    if @products.next_page
      Rails.cache.fetch("products:page:#{@products.next_page}", expires_in: 5.minutes) do
        Product.active.page(@products.next_page).per(24).to_a
      end
    end
  end
end

# CSRF 保護
# app/controllers/application_controller.rb
class ApplicationController < ActionController::Base
  # 既定で有効、トークン無効時に例外を発生
  protect_from_forgery with: :exception

  # API では :null_session を使う
  # protect_from_forgery with: :null_session
end

# ビューでは form 要素にトークンが自動で含まれます
# <%= form_with ... %> は authenticity_token を含む

# AJAX リクエスト向け
# csrf_meta_tags の値で X-CSRF-Token ヘッダーを追加