session.rb

class Session
  attr_reader :session, :params

  def initialize(session, params)
    @session = session
    @params = params
  end

  def login(email, password)
    if account = Account.find_by_email(email)
      if account.authenticate(password)
        self.account = account
        return true
      end
    end
    false
  end

  def account
    return @account if defined?(@account)
    @account =
      if account_id && auth_serial
        Account.find_by_id_and_auth_serial(account_id, auth_serial)
      elsif auth_token
        Account.find_by_auth_token(auth_token)
      end
  end

  def account=(account)
    @account = account
    if account
      session[:account_id] = account.id
      session[:auth_serial] = account.auth_serial
    else
      session.delete(:account_id)
      session.delete(:auth_serial)
    end
  end

  def invalidate_auth_serial!
    if account
      account.increment_counter!(:auth_serial)
      self.account = account.reload
    end
  end

  def auth_token
    params[:auth_token]
  end

  def account_id
    session[:account_id]
  end

  def auth_serial
    session[:auth_serial]
  end
end