auth_controller.rb

class AuthController < ApplicationController

  def index
    user = User.find_for_authentication(:email => params[:email])
    if user.valid_password?(params[:password])
      if user.try?(:session) #  check for session
        session = user.session
        if session.expires > Date.new # session has expired, refresh
          session.ip_address = request.remote_ip
          session.expires = Time.now + 30.minutes
          session.save
          user.save
          render :text => 'Success'
        else # session hasn't expired, check remote ip
          if session.ip_address == request.remote_ip
            render :text => 'Success'
          else # remote ip didn't match, deny
            render :text => 'Already Logged In'
          end
        end
      else # no session, create one
        session = Session.new(
          user: user,
          ip_address: request.remote_ip,
          expires: Time.now + 30.minutes
        )
        user.session = session
        user.save
        render :text => 'Success'
      end
    else
      render :text => 'Incorrect Login'
    end
  end
  
end