API on Rails example with fake controller and concern.

authable.rb

module Authable
  def current_user
    @current_user ||= User.find_by(auth_token: request.headers['Authorization'])
  end

  def authenticate_with_token!
    render json: { errors: "Not authenticated" }, status: :unauthorized unless current_user.present?
  end
end

authable_test.rb

require 'test_helper'

class DummyController < ApplicationController
  include Authable

  before_action :authenticate_with_token!

  def index
    render nothing: true
  end
end

class DummyControllerTest < ActionController::TestCase
  test "#authenticate_with_token! returns an error when no Authorization header is present" do
    with_routing do |set|
      set.draw do
        resources :dummy, only: :index
      end

      get :index

      assert_response :unauthorized
      assert_equal json_response_body[:errors], "Not authenticated"
    end
  end
end