Reconfirmation is broken if you use an email_confirmation field

[brycesenz]

This is somewhere between a bug and just a heads up for future developers -

In my User model, in addition to the email attribute, I have an email_confirmation field as well. Very simple validation - it doesn't save a User record with the email attribute unless it has a confirmation as well.

Anyway, where this presents a problem is when you're trying to make a model reconfirmable. The logic in the confirm! action will actually fail in this case (lack of an email_confirmation field). My solution was to take this bit of code from that action:

if self.class.reconfirmable && unconfirmed_email.present?
  skip_reconfirmation!
  self.email = unconfirmed_email
  self.unconfirmed_email = nil

  # We need to validate in such cases to enforce e-mail uniqueness
  save(:validate => true)
else
  save(:validate => false)
end 

And change it to this:

if self.class.reconfirmable && unconfirmed_email.present?
  skip_reconfirmation!
  self.email = unconfirmed_email
  self.email_confirmation = unconfirmed_email
  self.unconfirmed_email = nil

  # We need to validate in such cases to enforce e-mail uniqueness
  save(:validate => true)
else
  save(:validate => false)
end 

Do you guys think that this issue is potentially common enough that it warrants checking if an email_confirmation field exists, and then setting it?

[josevalim]

Thanks for the warning! I would advise your email confirmation to work as confirmations in Rails. The way the confirmation validation on Rails works is that it validates only if a value was a set, so if email_confirmation is nil, no error pops up, we have written about it in the past. This is the perfect scenario for showing errors on your UI but not requiring a confirmation at the API (which is silly).

[brycesenz]

Cool, that makes sense. I really like the tips on using confirmation validation - that actually makes things a lot cleaner. Cheers!

[jmschp]

Hey

What about if we want to enforce confirmation?

As stated in Rails validation guides

This check is performed only if email_confirmation is not nil. To require confirmation, make sure to add a presence check for the confirmation attribute

class Person < ApplicationRecord
  validates :email, confirmation: true
  validates :email_confirmation, presence: true
end

It will not be possible to use config.reconfirmable = true