has_secure_password authenticate inside validation on password update

Question

I'm using has_secure_password in a User model. I have implemented a way for users to change their password outside of the model, but to keep things DRY, I'm trying to move the validations needed from the controller to the model.

The User model looks something like this:

class User
  include Mongoid::Document
  include ActiveModel::SecurePassword

  has_secure_password

  field: :password_digest, type: String

  attr_accessible :password, :password_confirmation, :current_password
end

Users change their passwords by submitting the following:

user[current_password] - Currently stored password
user[password] - New password
user[password_confirmation] - New password confirmation

I'm using update_attributes(params[:user]) on the User model for the current user. My problem is that calling update_attributes updates the password_digest before using validations, so the following code won't work:

def password_validation_required?
  password_digest.blank? || !password.blank? || !password_confirmation.blank?
end

validate(on: :update, if: :password_validation_required?) do
  unless authenticate(current_password)
    add(:current_password, 'invalid password')
  end
end

authenticate is authenticating based on the new password_digest generated from user[password]. Is there an elegant way to access the old password_digest value for authentication? One idea I had was to re-query the user to gain access to another authenticate method that will authenticate against the old password_digest value. The problem is that it's not a clean solution.

I'd redefine password= api.rubyonrails.org/classes/ActiveModel/SecurePassword/… — apneadiving
The problem with redefining password= is that I'd have to add a lot of logic inside of it which would prevent future features needing to use password= (such as user.password = ... in some administration feature) — Parazuce
I'd only move the digest creation in a before_save, or ... see answer — apneadiving

Gavin Gavin · Accepted Answer · 2013-01-28T08:37:11

I think this one's a bit cleaner than @Parazuce's:

  validate :validates_current_password

  private

  def validates_current_password
    return if password_digest_was.nil? || !password_digest_changed?
    unless BCrypt::Password.new(password_digest_was) == current_password
      errors.add(:current_password, "is incorrect")
    end
  end

has_secure_password authenticate inside validation on password update

2 Answers