recruiter login + index

app/controllers/application_controller.rb

@@ -1,7 +1,21 @@
 class ApplicationController < ActionController::Base
   protect_from_forgery with: :exception
 
-  def current_candidate
-    @current_candidate ||= Candidate.find_by(test_hash: session[:test_id])
+  def current_recruiter
+    @current_recruiter ||= User.find_by(id: session[:user]) if session[:user]
   end
+
+  def current_candidate
+    @current_candidate ||= Candidate.find_by(test_hash: session[:test_id]) if session[:test_id]
+  end
+
+  private
+
+    def auth_params
+      params.require(:auth).permit(:email, :password)
+    end
+
+    def authorize_recruiter
+      redirect_to recruiter_login_path unless current_recruiter
+    end
 end

app/controllers/recruiter_controller.rb

@@ -0,0 +1,40 @@
+class RecruiterController < ApplicationController
+  before_action :authorize_recruiter, except: [:login, :auth]
+
+  def index
+    @candidates = current_recruiter.candidates
+  end
+
+  def new
+    @candidate = Candidate.new
+  end
+
+  def create
+  end
+
+  def login
+    redirect_to recruiter_path unless current_recruiter.nil?
+  end
+
+  def auth
+    recruiter = User.find_by(email: auth_params[:email])
+
+    if recruiter && recruiter.authenticate(auth_params[:password])
+      session[:user] = recruiter.to_i
+      redirect_to recruiter_path
+    else
+      redirect_to recruiter_login_path, flash: { error: "Sorry, incorrect email or password." }
+    end
+  end
+
+  def logout
+    reset_session
+    redirect_to recruiter_login_path
+  end
+
+  private
+
+    def candidate_params
+      params.require(:candidate).permit(:name, :email, :experience, :quiz_id)
+    end
+end