Skip to content

Support password reset from any verified email

Jarka Košanová requested to merge 16311-password-reset-mail into master

What does this MR do and why?

It overrides the default behaviour of Devise gem so that users can request forgotten password to any email they have verified.

Before this change users could request password reset email only to their primary email. After this change they can request the email to any verified email.

How to set up and validate locally

  1. Enable the password_reset_any_verified_email feature flag: Feature.enable(:password_reset_any_verified_email)
  2. Go to your profile email settings (eg. http://localhost:3000/-/profile/emails) and check that besides a primary email you have at least one verified and one unverified email (root user from seed complies with this criteria)
  3. Sign out and go to forgot your password page (eg. http://localhost:3000/users/password/new)
  4. Enter the primary email and check you received an email (http://localhost:3000/rails/letter_opener)
    • Check the To email address is the same as the email you entered in the form
    • This worked already before this change
  5. Enter one of the secondary verified emails and check you received an email
    • Check the To email address is the same as the email you entered in the form
    • This is a new functionality and should not work on master
  6. Enter one of the secondary unverified emails and check if you received an email. You should not receive one

Note: It might take time to see the emails delivered.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #16311 (closed)

Follow-up: #411590

Edited by Jarka Košanová

Merge request reports