#12260

Committed 08 Apr 2026 01:28PM UTC coverage: 13.721% (-10.8%) from 24.549%

Build Type

push

Committed by GitHub

Commit Message

Add model tests for MultiEmailUser and MultiEmailUserEmail

Coverage Stats

229 of 1669 relevant lines covered (13.72%)

0.55 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

0.0

/app/controllers/devise_token_auth/registrations_controller.rb

# frozen_string_literal: true

module DeviseTokenAuth
  class RegistrationsController < DeviseTokenAuth::ApplicationController
    before_action :set_user_by_token, only: [:destroy, :update]
    before_action :validate_sign_up_params, only: :create
    before_action :validate_account_update_params, only: :update
    skip_after_action :update_auth_header, only: [:create, :destroy]

    def create
      build_resource

      unless @resource.present?
        raise DeviseTokenAuth::Errors::NoResourceDefinedError,
              "#{self.class.name} #build_resource does not define @resource,"\
              ' execution stopped.'
      end

      # give redirect value from params priority
      @redirect_url = params.fetch(
        :confirm_success_url,
        DeviseTokenAuth.default_confirm_success_url
      )

      # success redirect url is required
      if confirmable_enabled? && !@redirect_url
        return render_create_error_missing_confirm_success_url
      end

      # if whitelist is set, validate redirect_url against whitelist
      return render_create_error_redirect_url_not_allowed if blacklisted_redirect_url?(@redirect_url)

      # override email confirmation, must be sent manually from ctrl
      callback_name = defined?(ActiveRecord) && resource_class < ActiveRecord::Base ? :commit : :create
      resource_class.set_callback(callback_name, :after, :send_on_create_confirmation_instructions)
      resource_class.skip_callback(callback_name, :after, :send_on_create_confirmation_instructions)

      if @resource.respond_to? :skip_confirmation_notification!
        # Fix duplicate e-mails by disabling Devise confirmation e-mail
        @resource.skip_confirmation_notification!
      end

      begin
        if @resource.save
          yield @resource if block_given?

          unless @resource.confirmed?
            # user will require email authentication
            @resource.send_confirmation_instructions({
              client_config: params[:config_name],
              redirect_url: @redirect_url
            })
          end

          if active_for_authentication?
            # email auth has been bypassed, authenticate user
            @token = @resource.create_token
            @resource.save!
            update_auth_header
          end

          render_create_success
        else
          clean_up_passwords @resource
          render_create_error
        end
      rescue ActiveRecord::RecordNotUnique
        clean_up_passwords @resource
        @resource.errors.add(:email, :taken)
        render_create_error
      end
    end

    def update
      if @resource
        if @resource.send(resource_update_method, account_update_params)
          yield @resource if block_given?
          render_update_success
        else
          render_update_error
        end
      else
        render_update_error_user_not_found
      end
    end

    def destroy
      if @resource
        @resource.destroy
        yield @resource if block_given?
        render_destroy_success
      else
        render_destroy_error
      end
    end

    def sign_up_params
      params.permit(*params_for_resource(:sign_up))
    end

    def account_update_params
      params.permit(*params_for_resource(:account_update))
    end

    protected

    def build_resource
      @resource            = resource_class.new(sign_up_params)
      @resource.provider   = provider

      # honor devise configuration for case_insensitive_keys
      if resource_class.case_insensitive_keys.include?(:email)
        @resource.email = sign_up_params[:email].try(:downcase)
      else
        @resource.email = sign_up_params[:email]
      end
    end

    def render_create_error_missing_confirm_success_url
      response = {
        status: 'error',
        data:   resource_data
      }
      message = I18n.t('devise_token_auth.registrations.missing_confirm_success_url')
      render_error(422, message, response)
    end

    def render_create_error_redirect_url_not_allowed
      response = {
        status: 'error',
        data:   resource_data
      }
      message = I18n.t('devise_token_auth.registrations.redirect_url_not_allowed', redirect_url: @redirect_url)
      render_error(422, message, response)
    end

    def render_create_success
      render json: {
        status: 'success',
        data:   resource_data
      }
    end

    def render_create_error
      render json: {
        status: 'error',
        data:   resource_data,
        errors: resource_errors
      }, status: 422
    end

    def render_update_success
      render json: {
        status: 'success',
        data:   resource_data
      }
    end

    def render_update_error
      render json: {
        status: 'error',
        errors: resource_errors
      }, status: 422
    end

    def render_update_error_user_not_found
      render_error(404, I18n.t('devise_token_auth.registrations.user_not_found'), status: 'error')
    end

    def render_destroy_success
      render json: {
        status: 'success',
        message: I18n.t('devise_token_auth.registrations.account_with_uid_destroyed', uid: @resource.uid)
      }
    end

    def render_destroy_error
      render_error(404, I18n.t('devise_token_auth.registrations.account_to_destroy_not_found'), status: 'error')
    end

    private

    def resource_update_method
      if DeviseTokenAuth.check_current_password_before_update == :attributes
        'update_with_password'
      elsif DeviseTokenAuth.check_current_password_before_update == :password && account_update_params.key?(:password)
        'update_with_password'
      elsif account_update_params.key?(:current_password)
        'update_with_password'
      else
        'update'
      end
    end

    def validate_sign_up_params
      validate_post_data sign_up_params, I18n.t('errors.messages.validate_sign_up_params')
    end

    def validate_account_update_params
      validate_post_data account_update_params, I18n.t('errors.messages.validate_account_update_params')
    end

    def validate_post_data which, message
      render_error(:unprocessable_entity, message, status: 'error') if which.empty?
    end

    def active_for_authentication?
      !@resource.respond_to?(:active_for_authentication?) || @resource.active_for_authentication?
    end
  end
end

1	# frozen_string_literal: true
2
3	module DeviseTokenAuth	×
4	class RegistrationsController < DeviseTokenAuth::ApplicationController	×
5	before_action :set_user_by_token, only: [:destroy, :update]	×
6	before_action :validate_sign_up_params, only: :create	×
7	before_action :validate_account_update_params, only: :update	×
8	skip_after_action :update_auth_header, only: [:create, :destroy]	×
9
10	def create	×
11	build_resource	×
12
13	unless @resource.present?	×
14	raise DeviseTokenAuth::Errors::NoResourceDefinedError,	×
15	"#{self.class.name} #build_resource does not define @resource,"\	×
16	' execution stopped.'	×
17	end	×
18
19	# give redirect value from params priority
20	@redirect_url = params.fetch(	×
21	:confirm_success_url,	×
22	DeviseTokenAuth.default_confirm_success_url	×
23	)	×
24
25	# success redirect url is required
26	if confirmable_enabled? && !@redirect_url	×
27	return render_create_error_missing_confirm_success_url	×
28	end	×
29
30	# if whitelist is set, validate redirect_url against whitelist
31	return render_create_error_redirect_url_not_allowed if blacklisted_redirect_url?(@redirect_url)	×
32
33	# override email confirmation, must be sent manually from ctrl
34	callback_name = defined?(ActiveRecord) && resource_class < ActiveRecord::Base ? :commit : :create	×
35	resource_class.set_callback(callback_name, :after, :send_on_create_confirmation_instructions)	×
36	resource_class.skip_callback(callback_name, :after, :send_on_create_confirmation_instructions)	×
37
38	if @resource.respond_to? :skip_confirmation_notification!	×
39	# Fix duplicate e-mails by disabling Devise confirmation e-mail
40	@resource.skip_confirmation_notification!	×
41	end	×
42
43	begin	×
44	if @resource.save	×
45	yield @resource if block_given?	×
46
47	unless @resource.confirmed?	×
48	# user will require email authentication
49	@resource.send_confirmation_instructions({	×
50	client_config: params[:config_name],	×
51	redirect_url: @redirect_url	×
52	})	×
53	end	×
54
55	if active_for_authentication?	×
56	# email auth has been bypassed, authenticate user
57	@token = @resource.create_token	×
58	@resource.save!	×
59	update_auth_header	×
60	end	×
61
62	render_create_success	×
63	else	×
64	clean_up_passwords @resource	×
65	render_create_error	×
66	end	×
67	rescue ActiveRecord::RecordNotUnique	×
68	clean_up_passwords @resource	×
69	@resource.errors.add(:email, :taken)	×
70	render_create_error	×
71	end	×
72	end	×
73
74	def update	×
75	if @resource	×
76	if @resource.send(resource_update_method, account_update_params)	×
77	yield @resource if block_given?	×
78	render_update_success	×
79	else	×
80	render_update_error	×
81	end	×
82	else	×
83	render_update_error_user_not_found	×
84	end	×
85	end	×
86
87	def destroy	×
88	if @resource	×
89	@resource.destroy	×
90	yield @resource if block_given?	×
91	render_destroy_success	×
92	else	×
93	render_destroy_error	×
94	end	×
95	end	×
96
97	def sign_up_params	×
98	params.permit(*params_for_resource(:sign_up))	×
99	end	×
100
101	def account_update_params	×
102	params.permit(*params_for_resource(:account_update))	×
103	end	×
104
105	protected	×
106
107	def build_resource	×
108	@resource = resource_class.new(sign_up_params)	×
109	@resource.provider = provider	×
110
111	# honor devise configuration for case_insensitive_keys
112	if resource_class.case_insensitive_keys.include?(:email)	×
113	@resource.email = sign_up_params[:email].try(:downcase)	×
114	else	×
115	@resource.email = sign_up_params[:email]	×
116	end	×
117	end	×
118
119	def render_create_error_missing_confirm_success_url	×
120	response = {	×
121	status: 'error',	×
122	data: resource_data	×
123	}	×
124	message = I18n.t('devise_token_auth.registrations.missing_confirm_success_url')	×
125	render_error(422, message, response)	×
126	end	×
127
128	def render_create_error_redirect_url_not_allowed	×
129	response = {	×
130	status: 'error',	×
131	data: resource_data	×
132	}	×
133	message = I18n.t('devise_token_auth.registrations.redirect_url_not_allowed', redirect_url: @redirect_url)	×
134	render_error(422, message, response)	×
135	end	×
136
137	def render_create_success	×
138	render json: {	×
139	status: 'success',	×
140	data: resource_data	×
141	}	×
142	end	×
143
144	def render_create_error	×
145	render json: {	×
146	status: 'error',	×
147	data: resource_data,	×
148	errors: resource_errors	×
149	}, status: 422	×
150	end	×
151
152	def render_update_success	×
153	render json: {	×
154	status: 'success',	×
155	data: resource_data	×
156	}	×
157	end	×
158
159	def render_update_error	×
160	render json: {	×
161	status: 'error',	×
162	errors: resource_errors	×
163	}, status: 422	×
164	end	×
165
166	def render_update_error_user_not_found	×
167	render_error(404, I18n.t('devise_token_auth.registrations.user_not_found'), status: 'error')	×
168	end	×
169
170	def render_destroy_success	×
171	render json: {	×
172	status: 'success',	×
173	message: I18n.t('devise_token_auth.registrations.account_with_uid_destroyed', uid: @resource.uid)	×
174	}	×
175	end	×
176
177	def render_destroy_error	×
178	render_error(404, I18n.t('devise_token_auth.registrations.account_to_destroy_not_found'), status: 'error')	×
179	end	×
180
181	private	×
182
183	def resource_update_method	×
184	if DeviseTokenAuth.check_current_password_before_update == :attributes	×
185	'update_with_password'	×
186	elsif DeviseTokenAuth.check_current_password_before_update == :password && account_update_params.key?(:password)	×
187	'update_with_password'	×
188	elsif account_update_params.key?(:current_password)	×
189	'update_with_password'	×
190	else	×
191	'update'	×
192	end	×
193	end	×
194
195	def validate_sign_up_params	×
196	validate_post_data sign_up_params, I18n.t('errors.messages.validate_sign_up_params')	×
197	end	×
198
199	def validate_account_update_params	×
200	validate_post_data account_update_params, I18n.t('errors.messages.validate_account_update_params')	×
201	end	×
202
203	def validate_post_data which, message	×
204	render_error(:unprocessable_entity, message, status: 'error') if which.empty?	×
205	end	×
206
207	def active_for_authentication?	×
208	!@resource.respond_to?(:active_for_authentication?) \|\| @resource.active_for_authentication?	×
209	end	×
210	end	×
211	end	×

mgmodell / devise_token_auth_multi_email / #12260

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous