Skip to content

Generate reset token finders for has_secure_password - #2750

Open
RaphaelFakhri wants to merge 1 commit into
Shopify:mainfrom
RaphaelFakhri:fix-secure-password-reset-token-finders
Open

RaphaelFakhri wants to merge 1 commit into
Shopify:mainfrom
RaphaelFakhri:fix-secure-password-reset-token-finders

Conversation

@RaphaelFakhri

Copy link
Copy Markdown

Motivation

Since Rails 8.0, has_secure_password on an Active Record model defines find_by_<attribute>_reset_token and find_by_<attribute>_reset_token! class methods. The ActiveModelSecurePassword compiler only reads the InstanceMethodsOnActivation modules, so the finders are missing from the generated RBI, and calls like User.find_by_password_reset_token(token) fail with "Method does not exist" in Sorbet.

Implementation

For every <attribute>_reset_token method the compiler already finds, it checks whether the model responds to find_by_<attribute>_reset_token. If it does, the compiler adds both finders as class methods:

  • find_by_<attribute>_reset_token(token) returns T.nilable(Model), backed by find_by_token_for.
  • find_by_<attribute>_reset_token!(token) returns Model, backed by find_by_token_for!.

The respond_to? check keeps plain Active Model classes and models with reset_token: false unchanged, because Rails only defines the finders when the class supports generates_token_for.

Tests

Added a spec for an Active Record model with has_secure_password that asserts the finders are generated. The spec fails without the compiler change and passes with it. The existing specs for plain Active Model classes still pass unchanged.

Fixes #2749

@RaphaelFakhri
RaphaelFakhri requested a review from a team as a code owner October 22, 2026 13:17

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

has_secure_password reset token finders are missing from DSL RBIs

1 participant