plataformatec/devise — Issue #1413: Password reset doesn't use find_for_authentication
Author: nixme
Created: 2011-11-03 17:28:20+00:00
State: open

We store emails in a separate table from users so that users can login through multiple email addresses. Most of this comes down to overriding `find_for_authentication` (https://github.com/plataformatec/devise/blob/master/lib/devise/models/authenticatable.rb#L114) to do a JOIN and convert the where clause.

However, the Recoverable strategy uses `find_or_initialize_with_errors` which does a a `to_adapter.find_first` call directly (https://github.com/plataformatec/devise/blob/master/lib/devise/models/authenticatable.rb#L135). This also means password reset doesn't get the `case_insensitive_keys` and `strip_whitespace_keys` treatment (seems like they should be in `filter_auth_params` anyhow).

Now we could just override `find_or_initialize_with_errors`, but I'm wondering if there's a better way for consistency. If I'm not fundamentally misunderstanding something, I can put together a patch.