1 class PasswordsController < ApplicationController 2 allow_unauthenticated_access 3 before_action :set_user_by_token, only: %i[ edit update ] 4 5 def new 6 end 7 8 def create 9 if user = User.find_by(email_address: params[:email_address]) 10 PasswordsMailer.reset(user).deliver_later 11 end 12 13 redirect_to new_session_path, notice: "Password reset instructions sent (if user with that email address exists)." 14 end 15 16 def edit 17 end 18 19 def update 20 if @user.update(params.permit(:password, :password_confirmation)) 21 redirect_to new_session_path, notice: "Password has been reset." 22 else 23 redirect_to edit_password_path(params[:token]), alert: "Passwords did not match." 24 end 25 end 26 27 private 28 def set_user_by_token 29 @user = User.find_by_password_reset_token!(params[:token]) 30 rescue ActiveSupport::MessageVerifier::InvalidSignature 31 redirect_to new_password_path, alert: "Password reset link is invalid or has expired." 32 end 33 end 34