Model or controller: My Rails app makes API calls requiring OAuth tokens, stored as session variables. Where should the method go?

Question

Let's say I'm making a Rails app that registers a user with Github's OAuth and then makes Github API calls on their behalf. It seems logical that I store the user's OAuth token as a session variable.

I could put an api_request method in a GithubAPI model, and pass in the access token as an argument each time I want to call it, but that's not DRY.

I'd like to put the method in the model and just access the session from inside the model, but you're not supposed to access session variables in a model.

I could put it in a GithubController , but you're not supposed to make calls from one controller to another.

Which is the lesser evil? Is there some better alternative?

Answer 1

Your first suggestion is correct. What you should do is make a attr_accessor called current token on the user model. initialize that value when you get the current user so methods on the user model have that variable available.