feat(controllers): add EmailConfirmationsController, create

examples/blog/app/controllers/email_confirmations_controller.rb

@@ -0,0 +1,42 @@
+class EmailConfirmationsController < ApplicationController
+  # Resend form - for whoever's original confirmation link expired out of
+  # their inbox, landed in spam, or was simply never sent because a typo in
+  # the signup form pointed User#generates_token_for at an address they
+  # don't control.
+  def new
+    render(:new)
+  end
+
+  # Same enumeration-safe shape as PasswordResetsController#create: the
+  # response never reveals whether the address has an account here, or
+  # whether it is already confirmed - branching on either would turn this
+  # form into a one-guess-at-a-time oracle for both facts.
+  def create
+    email = params.require('email_confirmation').permit(:email).to_h['email']
+    user = User.find_by(email: email)
+    if user && !user.confirmed?
+      NotificationMailer.confirmation_instructions(user.id, user.generate_token_for(:email_confirmation)).deliver_later
+    end
+    flash[:notice] = t('email_confirmations.instructions_sent_notice')
+    redirect url_for(:new_session)
+  end
+
+  # Reached via a plain GET from the link in the confirmation email, like
+  # PasswordResetsController#edit - safe to expose over GET (and to visit
+  # more than once) because, unlike a password reset, confirming does not
+  # hand the visitor anything sensitive and does not itself change the
+  # fingerprint (email) the token was minted under, so a bookmarked or
+  # double-clicked link keeps working instead of dying after first use.
+  def show
+    user = User.find_by_token_for(:email_confirmation, params['token'])
+    unless user
+      flash[:notice] = t('email_confirmations.invalid_token_notice')
+      redirect url_for(:new_email_confirmation)
+      return
+    end
+
+    user.update!(confirmed_at: Time.now.utc) unless user.confirmed?
+    flash[:notice] = t('email_confirmations.confirmed_notice')
+    redirect url_for(:root)
+  end
+end