feat(controllers): add EmailConfirmationsController, create

examples/blog/app/controllers/login_sessions_controller.rb

@@ -0,0 +1,41 @@
+class LoginSessionsController < ApplicationController
+  before_action :require_authentication
+
+  # "Your devices": every remembered browser for the signed-in user, with
+  # whichever one answered THIS request called out separately so the view
+  # can label it "this device" instead of just another row in the list.
+  def index
+    render(:index, locals: {
+             current_session: current_login_session,
+             other_sessions: other_login_sessions.order(:created_at, :desc).to_a,
+             notice: flash[:notice]
+           })
+  end
+
+  # Revokes one remembered browser. revoke_login_session! already checks
+  # ownership (a foreign id, or one belonging to someone else, is a no-op),
+  # so there is nothing else to authorize here.
+  def destroy
+    flash[:notice] = if revoke_login_session!(params['id'])
+                        t('login_sessions.revoked_notice')
+                      else
+                        t('login_sessions.not_found')
+                      end
+    redirect url_for(:login_sessions)
+  end
+
+  def sign_out_others
+    sign_out_all_other_sessions
+    flash[:notice] = t('login_sessions.signed_out_others_notice')
+    redirect url_for(:login_sessions)
+  end
+
+  # "TestBrowser/1.0 from 203.0.113.7" - falls back to the generic
+  # "unknown browser"/"unknown address" strings for rows remembered before
+  # this metadata started being captured (a plain nil column, not a bug).
+  def device_detail_for(login_session)
+    t('login_sessions.device_detail',
+      user_agent: login_session.user_agent || t('login_sessions.unknown_user_agent'),
+      ip_address: login_session.ip_address || t('login_sessions.unknown_ip_address'))
+  end
+end