ruby-on-railsrubyruby-on-rails-3authenticationdevise

Rails devise disable password recovery for certain user types


In my Rails project I have different types of users one of which has the user_status :admin, which has full rights to edit content unlike the rest of the users. For obvious reasons I want to add additional security for these types of users, in particular, completely disable password recovery.

What is the correct way of overriding standard Devise password recovery (:recoverable Devise module) methods so that when a user tries to get a reset password link for a user which is an admin user (user_status == "admin") the system gives back the "standard email not found" message?

This is somewhat like the unanswered question: Restrict Devise password recovery to only certain users

Thank you in advance.


Solution

  • For any future viewers, here's another way to do it. Vitaly's example did work for me, but I was still getting the "Your password email has been sent." notice (I wanted a separate alert to flash), so I went another route.

    Extending the Devise::PasswordsController was the easiest solution for me:

    class Devise::Extends::PasswordsController < Devise::PasswordsController
    
      def create
        if some_condition?
          redirect_to :root
          flash[:alert] = 'You cannot reset your password, buddy.'
        else
          super
        end
      end
    

    Then, in routes.rb:

    devise_for :users, controllers: { passwords: 'devise/extends/passwords' }
    

    That will direct your app to the extended controller, then hit the devise controller ("super") if your condition is not met.