user.rb

class User < ApplicationRecord
  validates :name, :email, presence: true

  has_one  :current_auth_token, class_name: AuthToken
  #has_many :auth_tokens

  has_many :sessions
  has_many :credentials, through: :sessions

  has_many :application_users
  has_many :applications, through: :application_users

  def included_relationships
    rels = []
    rels << 'sessions'    if sessions.present?
    rels << 'credentials' if credentials.present?
    rels
  end

  def authenticate!(token_string)
    authenticate(token_string) ||
      raise(UsersApi::Exception::InvalidCredentials)
  end

  private

  def authenticate(token_string)
    return if auth_token.blank? || auth_token.used_at.present?

    ActiveSupport::SecurityUtils.
      secure_compare(auth_token.value, token_string) ? self : false
  end
end