feat(controllers): extend posts_controller with publish and unpublish

examples/blog/app/controllers/session_controller.rb

@@ -0,0 +1,47 @@
+class SessionController < ApplicationController
+  def new
+    render(:new, locals: { errors: [] })
+  end
+
+  def create
+    credentials = params.require('user').permit(:email, :password, :remember_me).to_h
+    user = User.find_by(email: credentials['email'])
+
+    if user && user.authenticate(credentials['password'])
+      sign_in(user, remember: credentials['remember_me'] == '1')
+      respond_to do |format|
+        format.html do
+          flash[:notice] = t('sessions.signed_in_notice')
+          redirect after_authentication_url
+        end
+        format.json { json(user.as_json(methods: [:email])) }
+      end
+    else
+      respond_to do |format|
+        format.html do
+          status(422)
+          render(:new, locals: { errors: [t('sessions.invalid_credentials')] })
+        end
+        # 401, not 422 like the HTML branch above: there is no resource
+        # here whose validation failed (no User object at all when the
+        # email does not match anyone), just a rejected authentication
+        # attempt - the JSON:API status a client should actually branch on.
+        format.json do
+          json({ errors: [jsonapi_error(status: 401, pointer: '/data/attributes/password',
+                                         title: 'invalid credentials', detail: t('sessions.invalid_credentials'))] }, 401)
+        end
+      end
+    end
+  end
+
+  def destroy
+    sign_out
+    respond_to do |format|
+      format.html do
+        flash[:notice] = t('sessions.signed_out_notice')
+        redirect url_for(:root)
+      end
+      format.json { json({ message: t('sessions.signed_out_notice') }) }
+    end
+  end
+end