Rails won't properly assess conditional before_save callback - ruby-on-rails

Question

I have my app schema defaulting the User.role attribute to "new". My goal for my before_save callback is for the User model to change the user.role attribute to "admin" if the user being created is the first one, otherwise it leaves it alone.
User.rb
class User < ActiveRecord::Base
# Include default devise modules. Others available are:
# :confirmable, :lockable, :timeoutable and :omniauthable
devise :database_authenticatable, :registerable,
:recoverable, :rememberable, :trackable, :validatable
ROLES = %w[admin moderator member new]
after_save :assign_role
def assign_role
if self == User.first
self.role = "admin"
self.touch
end
end
def is?(requested_role)
self.role == requested_role.to_s
end
end
Rails console
vagrant#vagrant-ubuntu-trusty-64:/vagrant$ rails c
Loading development environment (Rails 4.2.1)
2.1.5 :001 > User.any?
(0.3ms) SELECT COUNT(*) FROM "users"
=> false
2.1.5 :002 > User.last
User Load (0.4ms) SELECT "users".* FROM "users" ORDER BY "users"."id" DESC
LIMIT 1
=> #<User id: 1, email: "**************", encrypted_password: "$
2a$10$FEOjKX1UAZwiEVPbXXW.TOCyh2d7iwIuIRKn8YmYWk....", reset_password_token: nil
, reset_password_sent_at: nil, remember_created_at: nil, sign_in_count: 1, curre
nt_sign_in_at: "2015-08-20 14:23:31", last_sign_in_at: "2015-08-20 14:23:31", cu
rrent_sign_in_ip: #<IPAddr: IPv4:10.0.2.2/255.255.255.255>, last_sign_in_ip: #<I
PAddr: IPv4:10.0.2.2/255.255.255.255>, created_at: "2015-08-20 14:23:31", update
d_at: "2015-08-20 14:23:31", confirmation_token: nil, confirmed_at: nil, confirm
ation_sent_at: nil, role: "new">
2.1.5 :003 > User.last
User Load (1.3ms) SELECT "users".* FROM "users" ORDER BY "users"."id" DESC
LIMIT 1
=> #<User id: 2, email: "***********.com", encrypted_password: "$2a$10$OtjtlW
BAcrqlws1q5N/ICe6Hjytb0GhKGrVmdcin.Op...", reset_password_token: nil, reset_pass
word_sent_at: nil, remember_created_at: nil, sign_in_count: 1, current_sign_in_a
t: "2015-08-20 14:24:44", last_sign_in_at: "2015-08-20 14:24:44", current_sign_i
n_ip: #<IPAddr: IPv4:10.0.2.2/255.255.255.255>, last_sign_in_ip: #<IPAddr: IPv4:
10.0.2.2/255.255.255.255>, created_at: "2015-08-20 14:24:44", updated_at: "2015-
08-20 14:24:44", confirmation_token: nil, confirmed_at: nil, confirmation_sent_a
t: nil, role: "new">
2.1.5 :004 >
The first user created in the console should have role:"admin" instead of role:"new"
EDIT:
save new user form
<div class="border-form-div">
<h2 class="text-center">Create a new account</h2>
<%= form_for(resource, :as => resource_name, :url => registration_path(resource_name)) do |f| %>
<%= devise_error_messages! %>
<%= f.email_field :email, :autofocus => true, :placeholder => 'Email address' %>
<%= f.hidden_field :role, :value => "new" %>
<%= f.password_field :password, :placeholder => 'Password' %>
<%= f.password_field :password_confirmation, :placeholder => 'Password confirmation' %>
<%= f.submit "Sign up", :class => 'btn btn-primary center-block' %>
<% end %>
</div>
user_controller.rb
class UserController < ApplicationController
before_action :authenticate_user!
params.require(:user).permit(:username, :email, :password, :encrypted_password, :role)
end
The controller is fairly empty because I'm using devise to handle all the account management

Answer 1

before_save {|user| user.role = "admin"}, unless: :user_exists?
def user_exists?
User.any?
end