gistfile1.txt

commit fb1751b5de594f64d04ad7c5cfe5080f20027cfa
Author: Caleb Thompson <[email protected]>
Date:   Mon Jul 8 08:24:53 2013 -0400

    wip - Don't validate Users when resetting password
    
    There are plenty of reasons other than that the password was not
    entered that validation might fail, such as when new validations have
    been added since the person's last log in.
    
    * Check for presence of new_password in User#update_password rather than
      validating
    * Save without validating when changing password

diff --git a/lib/clearance/user.rb b/lib/clearance/user.rb
index 63b468f..cc30f53 100644
--- a/lib/clearance/user.rb
+++ b/lib/clearance/user.rb
@@ -69,15 +69,15 @@ module Clearance
     end
 
     def update_password(new_password)
-      self.password_changing = true
-      self.password = new_password
-
-      if valid?
+      if new_password.present?
+        self.password_changing = true
+        self.password = new_password
         self.confirmation_token = nil
         generate_remember_token
+        save validate: false
+      else
+        false
       end
-
-      save
     end
 
     private
diff --git a/spec/controllers/passwords_controller_spec.rb b/spec/controllers/passwords_controller_spec.rb
index 5257be9..39af0bd 100644
--- a/spec/controllers/passwords_controller_spec.rb
+++ b/spec/controllers/passwords_controller_spec.rb
@@ -112,27 +112,54 @@ describe Clearance::PasswordsController do
     end
 
     describe 'on PUT to #update with password' do
-      before do
-        @new_password = 'new_password'
-        @user.encrypted_password.should_not == @new_password
-        put :update, :user_id => @user, :token => @user.confirmation_token,
-          :password_reset => { :password => @new_password }
-        @user.reload
-      end
-
       it 'should update password' do
-        @user.encrypted_password.should == @new_password
+        reset_password('new_password')
+
+        @user.encrypted_password.should == 'new_password'
       end
 
       it 'should clear confirmation token' do
+        reset_password
+
         @user.confirmation_token.should be_nil
       end
 
       it 'should set remember token' do
+        reset_password
+
         @user.remember_token.should_not be_nil
       end
 
-      it { should redirect_to_url_after_update }
+      it 'should reset the password of an invalid user' do
+        User.validate -> { false }
+
+        reset_password('new_password')
+
+        flash[:notice].should have_content(I18n.t('flashes.failure_after_update'))
+      end
+
+      def invalid_user
+        Class.new(User) do
+          include Clearance::User
+          include ActiveModel::Validations
+
+          attr_reader :foo
+          validates :foo, presence: true
+        end.new
+      end
+
+      it 'should redirect to url_after_update' do
+        reset_password
+
+        response.should redirect_to(controller.send(:url_after_update))
+      end
+
+      def reset_password(new_password = 'new_password')
+        @user.encrypted_password.should_not == new_password
+        put :update, :user_id => @user, :token => @user.confirmation_token,
+          :password_reset => { :password => new_password }
+        @user.reload
+      end
     end
 
     describe 'on PUT to #update with blank password' do