From ecc1857f63d8e8a3669c5a822cae866a1e4fb9ca Mon Sep 17 00:00:00 2001 From: Shivam Mishra Date: Thu, 28 Aug 2025 14:27:05 +0530 Subject: [PATCH] feat: don't allow SAML user to reset password --- .../devise_overrides/passwords_controller.rb | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/app/controllers/devise_overrides/passwords_controller.rb b/app/controllers/devise_overrides/passwords_controller.rb index 17dd32086..a17ca1d98 100644 --- a/app/controllers/devise_overrides/passwords_controller.rb +++ b/app/controllers/devise_overrides/passwords_controller.rb @@ -3,6 +3,7 @@ class DeviseOverrides::PasswordsController < Devise::PasswordsController skip_before_action :require_no_authentication, raise: false skip_before_action :authenticate_user!, raise: false + before_action :check_saml_user, only: [:create] def create @user = User.from_email(params[:email]) @@ -43,4 +44,13 @@ class DeviseOverrides::PasswordsController < Devise::PasswordsController message: message }, status: status end + + def check_saml_user + return if params[:email].blank? + + user = User.from_email(params[:email]) + return unless user&.saml_user? + + build_response(I18n.t('messages.reset_password_saml_user'), 403) + end end