sessions_controller.rb

class Api::SessionsController < ApplicationController
  before_action :current_user, except: :create

  def show
    render json: @user, serializer: UserSerializer
  end

  def create
    @auth = false
    if params[:password].present?
      @user = User.where(email:params[:email]).first if params[:email].present?
      if @user && @user.authenticate(params[:password])
        @auth = true
      end

    end

    if params[:auth_token].present?
      @user = User.where(auth_token: params[:auth_token]).first
      @user.type.constantize.find(@user.id)
      @auth = true
    end  
    

    if @auth
      render json:  UserTokenSerializer.new(@user)
    else
      render nothing: true, status: 403
    end
  end
end