price-point-api/app/controllers/sessions_controller.rb

class SessionsController < ApplicationController
  skip_before_action :authenticate!, only: [ :create ]

  def create
    user = User.find_by(email: login_params[:email])

    unless user.present? && user.authenticate(login_params[:password])
      raise Unauthorized
    end

    session = user.sessions.create!

    render_success(user: user, token: session.token)
  end

  def destroy
    @current_session.destroy!
    render_success(nil)
  end

  private

  def login_params
    params.permit(:email, :password)
  end
end