Modify the edit method in PasswordsController to include reset_password_token in the redirect URL. (#1650)

Author: kaekasui

app/controllers/devise_token_auth/passwords_controller.rb

@@ -56,7 +56,7 @@ def edit
             set_token_in_cookie(@resource, token)
           end
 
-          redirect_header_options = { reset_password: true }
+          redirect_header_options = { reset_password: true, reset_password_token: resource_params[:reset_password_token] }
           redirect_headers = build_redirect_headers(token.token,
                                                     token.client,
                                                     redirect_header_options)

test/controllers/devise_token_auth/passwords_controller_test.rb

@@ -229,42 +229,73 @@ class DeviseTokenAuth::PasswordsControllerTest < ActionController::TestCase
           end
 
           describe 'password reset link success' do
-            before do
-              get :edit,
-                  params: { reset_password_token: @mail_reset_token,
-                            redirect_url: @mail_redirect_url }
+            describe 'with require_client_password_reset_token is enabled' do
+              before do
+                DeviseTokenAuth.require_client_password_reset_token = true
+                get :edit,
+                    params: { reset_password_token: @mail_reset_token,
+                              redirect_url: @mail_redirect_url }
 
-              @resource.reload
+                @resource.reload
 
-              raw_qs = response.location.split('?')[1]
-              @qs = Rack::Utils.parse_nested_query(raw_qs)
+                raw_qs = response.location.split('?')[1]
+                @qs = Rack::Utils.parse_nested_query(raw_qs)
 
-              @access_token   = @qs['access-token']
-              @client_id      = @qs['client_id']
-              @client         = @qs['client']
-              @expiry         = @qs['expiry']
-              @reset_password = @qs['reset_password']
-              @token          = @qs['token']
-              @uid            = @qs['uid']
-            end
+                @reset_password_token = @qs['reset_password_token']
+              end
 
-            test 'response should have success redirect status' do
-              assert_equal 302, response.status
-            end
+              test 'response should have success redirect status' do
+                assert_equal 302, response.status
+              end
 
-            test 'response should contain auth params' do
-              assert @access_token
-              assert @client
-              assert @client_id
-              assert @expiry
-              assert @reset_password
-              assert @token
-              assert @uid
+              test 'response should contain reset_password_token param' do
+                assert_equal @mail_reset_token, @qs['reset_password_token']
+              end
             end
 
-            test 'response auth params should be valid' do
-              assert @resource.valid_token?(@token, @client_id)
-              assert @resource.valid_token?(@access_token, @client)
+            describe 'require_client_password_reset_token is disabled' do
+              before do
+                DeviseTokenAuth.require_client_password_reset_token = false
+                get :edit,
+                    params: { reset_password_token: @mail_reset_token,
+                              redirect_url: @mail_redirect_url }
+
+                @resource.reload
+
+                raw_qs = response.location.split('?')[1]
+                @qs = Rack::Utils.parse_nested_query(raw_qs)
+
+                @access_token   = @qs['access-token']
+                @client_id      = @qs['client_id']
+                @client         = @qs['client']
+                @expiry         = @qs['expiry']
+                @reset_password = @qs['reset_password']
+                @token          = @qs['token']
+                @uid            = @qs['uid']
+              end
+
+              test 'response should have success redirect status' do
+                assert_equal 302, response.status
+              end
+
+              test 'response should contain auth params' do
+                assert @access_token
+                assert @client
+                assert @client_id
+                assert @expiry
+                assert @reset_password
+                assert @token
+                assert @uid
+              end
+
+              test 'response auth params should be valid' do
+                assert @resource.valid_token?(@token, @client_id)
+                assert @resource.valid_token?(@access_token, @client)
+              end
+
+              test 'response should contain reset_password_token param' do
+                assert_equal @mail_reset_token, @qs['reset_password_token']
+              end
             end
           end
         end