sessions_controller.rb

class SessionsController < ApplicationController
  skip_before_action :require_login, only: [:new, :create]

  def new
  end

  def create
    @user = authenticate_session(session_params, email_or_username: [:email, :username])

    if sign_in(@user)
      redirect_to @user
    else
      render :new
    end
  end

  def destroy
    sign_out
    redirect_to root_path
  end

  private

  def session_params
    params.require(:session).permit(:email_or_username, :password)
  end
end