lynndylanhurley/devise_token_auth — pull request #71 by booleanbetrayal (2014-11-10 18:39:30+00:00)
Title: fix(registration and update): Ensure UID is updated alongside Email, and Case Sensitivity is Honored

@lynndylanhurley -

I missed a `registrations_controller::create` condition in #57 and fixed that. However, in additional testing I also discovered that `uid` was not being updated alongside `email` address, meaning from an authentication standpoint, the `uid` would never update to reflect the user's desired address change. I swore this worked at some point, but perhaps it broke recently as a result of being more `resource` friendly? I've added fixes and tests for both conditions, but it's arguable that `uid` should be abandoned entirely when using email based authentication (would require changes in `sessions_controller` as well any other place `uid` is explicitly referenced).

I've found another problem that arises from correctly updating `uid` though, as `ng-token-auth` is not context-aware of these updates and will preserve the old `uid` value in the `auth_tokens` hash. Meaning, after updating their email address and subsequently hitting a restricted HTTP call, the user will immediately be logged out. This is something that will probably have to happen in the response interceptor logic.

Let me know what your thoughts are. I can workaround it in client code as needed for now.