Class: RivetCms::InvitationsController

Inherits:
AuthController show all
Defined in:
app/controllers/rivet_cms/invitations_controller.rb

Overview

Set-password links: signed, expiring, invalidated the moment a password is set (the token embeds the password salt). No mailers involved; the admin copies the link and delivers it however they like.

Instance Method Summary collapse

Instance Method Details

#show ⇒ Object 



8
9
10
 
# File 'app/controllers/rivet_cms/invitations_controller.rb', line 8

def show
  render inertia: "Auth/SetPassword", props: { name: @user.name, submit_path: invitation_path(params[:token]) }
end

#update ⇒ Object 



12
13
14
15
16
17
18
19
20
21
22
23
24
25
 
# File 'app/controllers/rivet_cms/invitations_controller.rb', line 12

def update
  if params[:password].blank?
    # An empty string is ignored by has_secure_password: update would
    # "succeed" without setting anything and sign in a pending user
    return redirect_to invitation_path(params[:token]), inertia: { errors: { password: [ "can't be blank" ] } }
  end

  if @user.update(password: params[:password])
    (@user)
    redirect_to root_path, notice: "You're in. Welcome to RivetCMS"
  else
    redirect_to invitation_path(params[:token]), inertia: { errors: @user.errors }
  end
end