I do plan on covering an elasticsearch episode which is what I currently use on several apps. My only hesitation is requiring an extra dependency. I will also cover full text search on postgresql with something like pg_search. Thanks for the suggestion!

When you do something like

git flow feature start FEATURENAME

It will create a branch called feature/FEATURENAME and it will be copied from the develop branch.

From here, you can make your code changes as needed and then make your git commits as you normally would.

If you are wanting to move your work over to another computer, you can call git flow feature publish and it will create the branch on the remote repository. You can then checkout the feature on the other computer.

When all changes and commits are made, you call 

git flow feature finish #optionally passing -m 'COMMIT MESSAGE'

and this will merge your commit back into the develop branch. Alternatively, you can publish your commit again to the remote repository and then create a merge request.

By default, config/initializers/filter_parameter_logging.rb will filter the password

Rails.application.config.filter_parameters += [:password]

So, the logs would filter out the password and never be displayed in the logs. Whenever communicating with API, especially sending the password, you should always encrypt the communication with SSL. This is really no different than sending a POST request to a web login session. Unless the form is posted to an endpoint over SSL, the password would also be sent over plaintext.

Great questions!

If your application's traffic is not being served over SSL, anything that is sent or posted, would be essentially in plain text.  It was just illustrating the point that your worry about the API sending the plain text password would be the same worry for a login form. Unless the API endpoint as well as the login form are served over SSL, the password would have been sent over plaintext (and not encrypted via SSL). I suppose the confusion was plaintext. Technically, regardless, in both instances the password is sent as plaintext, but when served over an SSL connection, the plaintext password is protected.

With a user registration, it would function very similar to any other kind of form post that you would do. You should have some sort of registration endpoint within your API application that would create the user. You may have something like http://example.com/users/create where you would make an HTTP POST to via your app. You would pass in the parameters

{
  user: { 
    first_name: 'John',
    last_name: 'Doe',
    email: 'john.doe@example.com',
    password: '123456',
    password_confirmation: '123456'
  }
}

and your model would have the necessary validations to ensure password complexity, and email uniqueness. If the user is created, pass a successful response. Otherwise, you would respond with an error.

You would also need to provide an authenticate method for your user. In this example, we simply used devise to handle the user registration and authentication. While you could do something similar in an API only application, it might be a bit heavy. However, using the devise logic (not necessarily the views), will give you access to a lot of the built in functionality around locking out the user, confirmation signups, etc.

Depending on the architecture of your application, you can make the new user registration only available under the client portal. Also, if you are using some sort of role based authorization, make sure that you set the default access to a client role. 

Hope this helps!