app/controllers/devise_jwt_auth/passwords_controller.rb
# This is where users arrive after visiting the password reset confirmation link.
This is where users arrive after visiting the password reset confirmation link.
This is where users arrive after visiting the password reset confirmation link .
def edit
      @resource = resource_class.with_reset_password_token(resource_params[:reset_password_token])
      if @resource&.reset_password_period_valid?
        @resource.skip_confirmation! if confirmable_enabled? && !@resource.confirmed_at
        @resource.allow_password_change = true if recoverable_enabled?
        @resource.save!
        yield @resource if block_given?
        if require_client_password_reset_token?
          clear_refresh_token_cookie
          redirect_to DeviseJwtAuth::Url.generate(
            @redirect_url,
            reset_password_token: resource_params[:reset_password_token]
          )
        else
          update_refresh_token_cookie
          redirect_to @redirect_url
        end
      else
        render_edit_error
      end
    end
def edit @resource = resource_class . with_reset_password_token ( resource_params [ :reset_password_token ] ) if @resource &. reset_password_period_valid? @resource . skip_confirmation! if confirmable_enabled? && ! @resource . confirmed_at @resource . allow_password_change = true if recoverable_enabled? @resource . save! yield @resource if block_given? if require_client_password_reset_token? clear_refresh_token_cookie redirect_to DeviseJwtAuth :: Url . generate ( @redirect_url , reset_password_token : resource_params [ :reset_password_token ] ) else update_refresh_token_cookie redirect_to @redirect_url end else render_edit_error end end
This is where users arrive after visiting the password reset confirmation link.
This is where users arrive after visiting the password reset confirmation link .
# ensure that user is confirmed # allow user to change password once without current_password # TODO: do we put the refresh token here?