Ruby on Rails update user attributes without password - ruby-on-rails

Question

I am trying to create a means for a user to update their details without a password. I am using BCrypt with has_secure_password in my user model so that when a user signs up or changes password, the password and password_confirmation fields are checked to match before being saved to password_digest. I also have the following validation for setting a password:
validates :password, presence: true, length: { minimum: 5 }
As is users are able to update their password fine (so long as it meets the validations by being at least 5 characters long). But if a user tries to update their details (I have separate views/forms for updating password and updating other non-required attributes) then it gives an error saying "Password can't be blank, Password is too short (minimum is 5 characters)"
I have read through a lot of previous stackoverflow questions/answers and the closest I've got is adding , allow_blank: true to the end of the validation. This pretty much works as I want it to as BCrypt handles the validation if the password is blank so when signing up a user can't give a blank password, and users are able to change their details without a password. However when updating a password if the user gives a blank password then something weird happens. The blank password doesn't save (As it shouldn't since because BCrypt still needs a matching password and password_confirmation, which can't be blank), however the controller acts as though it does and passes the notice "password updated.". Here is my code in the controller:
def update
if Current.user.update(password_params)
redirect_to root_path, notice: "Password updated."
else
render :edit
end
end
private
def password_params
params.require(:user).permit(:password, :password_confirmation)
end
I am particularly confused as to why Current.user.update(password_params) seems to be returning true (hence redirecting to the root path and passing the notice mentioned before) but the password definitely hasn't been updated. I have checked by logging out and back in again with the previous password and a blank password does not allow me to log in.

Answer 1

In cases like these, your best chance is to go to the source code of has_secure_password. You will find following code there:
define_method("#{attribute}=") do |unencrypted_password|
if unencrypted_password.nil?
self.public_send("#{attribute}_digest=", nil)
elsif !unencrypted_password.empty?
instance_variable_set("##{attribute}", unencrypted_password)
cost = ActiveModel::SecurePassword.min_cost ? BCrypt::Engine::MIN_COST : BCrypt::Engine.cost
self.public_send("#{attribute}_digest=", BCrypt::Password.create(unencrypted_password, cost: cost))
end
end
when you call has_secure_password this code will create setter where attribute is password. It will dynamically create following method:
def password=(unencrypted_password)
if unencrypted_password.nil?
self.password_digest = nil
elsif !unencrypted_password.empty?
#password = unencrypted_password
cost = ActiveModel::SecurePassword.min_cost ? BCrypt::Engine::MIN_COST : BCrypt::Engine.cost
self.password_digest = BCrypt::Password.create(unencrypted_password, cost: cost))
end
end
This method then gets called when you assign attributes to your model:
Current.user.update(password_params)
As you can see newly defined method contains simple condition with two branches:
If you set password to nil it will delete the password_digest
If you set password to nonempty string it will store password hash to password_digest attribute
That is all. When your user sends empty password this method decides to do nothing and ignores the empty string, it doesn't get automatically assigned as empty password. Model pretty much completely ignores input (if password_confirmation is also empty), nothing gets saved, no validation is violated which means that Current.user.update(password_params) returns success and your controller proceeds with "Password updated." branch.
Now, when you know about this behaviour what can you do about it?
Let's say you model looks like this
class User < ApplicationRecord
has_secure_password
validates :password, presence: true, length: { minimum: 5 }
end
And you want your validation to work in two cases
When new user is created
When users update their password
First case is easy, as you mentioned in your question if you use allow_blank: true instead of presence: true validation is handled by has_secure_password if password is empty and if it is not, password will proceed through the validation.
But than we get to other requirements:
User has to be able update other attributes then just password
We still want to validate password if it gets updated
These two requirements rule out the presence: true part of the validation, it cannot be there. Same thing applies to allow_blank: true. In this case you probably want to use conditional validation:
class User < ApplicationRecord
has_secure_password
validates :password, length: { minimum: 5 }, if: :password_required?
private
def password_required?
password.present?
end
end
This code ensures that validation is executed every time user fills in the password. It doesn't matter if it's create or update action.
Now to the last thing.
What if user leaves empty password.
From your question I suppose you want to show validation error if user sends empty password. From description above User model doesn't know that it should validate the password at all. You have to tell your model about it eg. like this:
class User < ApplicationRecord
has_secure_password
validates :password, length: { minimum: 5 }, if: :password_required?
def enforce_password_validation
#enforce_password_validation = true
end
private
def password_required?
#enforce_password_validation || password.present?
end
end
Now you could use it like this in your controller:
def update
user = Current.user
user.enforce_password_validation
if user.update(password_params)
redirect_to root_path, notice: "Password updated."
else
render :edit
end
end
private
def password_params
params.require(:user).permit(:password, :password_confirmation)
end
Now validation should fail even if user submits empty password.

Answer 2

I made the same configuration as the first answer.
This my User.rb model
class User < ApplicationRecord
validates :email, presence: true
validates :password, length: { minimum: 6 }, if: :password_required?
validates :password_confirmation, length: { minimum: 6 }, if: :password_required?
has_secure_password
private
def password_required?
false || password.present?
end
end
It worked adding false at the beginning of the method.
Now, in my controller, I have this:
class UsersController < ApplicationController
...
def confirm_email
user = User.find_by(token: params[:token])
user.update(is_confirmed?: true)
redirect_to login_path, notice: "You've confirmed your account"
end
...
end
I hope this helps!

Answer 3

For the validation of the password in your model try this instead :
validates :password, presence: true, length: { minimum: 5 }, on: :create
This line mean that the validation will be only call on :create method not :update anymore. So that you can remove the allow_bank and your update password will work fine