# Canonical read-side session and BAN boundary, shared by API and storage controllers.
module RequestAccess
  extend ActiveSupport::Concern

  def current_user = @current_user

  private

  def authenticate_user
    code = session[:inheritance_code]
    return if code.blank?

    @current_user = User.find_by(inheritance_code: code)
  end

  def reject_banned_ip_address!
    ip_address = IpAddress.find_by(ip_address: IPAddr.new(request.remote_ip).hton)
    return unless ip_address&.banned?

    head :forbidden
  end

  def reject_banned_user!
    return unless current_user&.banned?

    head :forbidden
  end
end