lynndylanhurley / lynndylanhurley/devise_token_auth
Updating users.email with confirmable enabled also updates uid.
- Dominant language
- Ruby
- Stars
- 3.6k
- Forks
- 1.1k
- PR merge metrics
- No merged PRs in 30d
Description
Updating users.email will update the uid.
Is this correct behavior?
The expected behavior is that user.update (email: "xxxxx") does not update uid and email.
We expect these to be updated when we complete the change from the token given in the authentication email.
rails console
```
$ user = User.find(1)
$ user.update(email: "hoge@example.com")
User Update (0.5ms) UPDATE `users` SET `users`.`uid` = 'hoge@example.com', `users`.`confirmation_token` = 'xxxxxxxxxxxxxx', `users`.`confirmation_sent_at` = '2020-01-16 08:55:22', `users`.`unconfirmed_email` = 'hoge@example.com
', `users`.`updated_at` = '2020-01-16 08:55:22' WHERE `users`.`id` = 1
```
app/models/user.rb
```
# frozen_string_literal: true
class User < ActiveRecord::Base
devise :database_authenticatable, :registerable,
:recoverable, :rememberable, :trackable, :confirmable
include DeviseTokenAuth::Concerns::User
def postpone_email_change?
true
end
end
```
devise_token_auth gem version : 1.1.3
devise gem version : 4.7.1
ruby version : 2.6.5
rails version : 6.0.2.1
Contributor guide
Research direction
Start with app/models/user.rb, especially the Devise modules and postpone_email_change? override, then reproduce the behavior from the reported Rails console session. Trace how a direct user.update email call changes uid and confirmation fields, and compare it with the confirmation-token flow. Done means the intended distinction between direct updates and confirmed email changes is established and covered by the project’s tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rails, ruby
- Domain
- api, authentication, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100