ruby on rails - devise_token_auth , bcrypt check equality on tokens -

i'm using devise_token_auth gem build public api. destroy session (sign_out) have send : uid (mail), client_id, , access-token (associated client_id)

this method devise_token_auth gem checks if token still available, , if valid. github code

def token_is_current?(token, client_id) # ghetto hashwithindifferentaccess expiry     = self.tokens[client_id]['expiry'] || self.tokens[client_id][:expiry] token_hash = self.tokens[client_id]['token'] || self.tokens[client_id][:token]  return true if (   # ensure expiry , token set   expiry , token ,    # ensure token has not yet expired   datetime.strptime(expiry.to_s, '%s') > time.now ,    # ensure token valid   bcrypt::password.new(token_hash) == token ) 

end

i have issues line bcrypt::password.new(token_hash) == token

what know :

• token_hash token extracted db
• token came header of request

• the line using bcrypt "==" method compare, is

  def ==(secret); super(bcrypt::engine.hash_secret(secret, @salt)); end

since using method check equality, check doesn't pass, unless explicity checking strings values.

why use bcrypt compare 2 tokens, , not compare 2 strings. reading : bcrypt ruby doc i understand point of using bcrypt passwords why tokens ?