Fix password validation during password reset

fixes #28

app/models/user.rb

@@ -33,10 +33,12 @@ class User < ApplicationRecord
   end
 
   def reset_password(new_password, new_password_confirmation)
-    if new_password == new_password_confirmation && ::Devise.ldap_update_password
+    self.password = new_password
-      Devise::LDAP::Adapter.update_password(login_with, new_password)
+    self.password_confirmation = new_password_confirmation
-    end
+    return false unless valid?
-    clear_reset_password_token if valid?
+
+    Devise::LDAP::Adapter.update_password(login_with, new_password)
+    clear_reset_password_token
     save
   end
 

spec/features/devise/password_reset.rb

@@ -16,17 +16,39 @@ RSpec.describe 'Password reset', type: :feature do
     expect(user.reload.reset_password_token).to be_a(String)
   end
 
-  scenario "Reset password" do
+  describe "Password reset form" do
     # Generate a raw reset token, since the stored one is only a digest
-    token = user.send(:set_reset_password_token)
+    let(:token) { user.send(:set_reset_password_token) }
-    logout
-    visit edit_user_password_path(reset_password_token: token)
-    expect(page).to have_content 'Change your password'
 
-    fill_in :user_password, with: 'a new password'
+    before do
-    fill_in :user_password_confirmation, with: 'a new password with a typo'
+      logout
-    click_button 'Change my password'
+    end
 
-    expect(page).to have_content 'Confirmation does not match'
+    scenario "Submit with invalid passwords" do
+      expect(Devise::LDAP::Adapter).not_to receive(:update_password)
+
+      visit edit_user_password_path(reset_password_token: token)
+      fill_in :user_password, with: 'nice try'
+      fill_in :user_password_confirmation, with: 'nice try o'
+      click_button 'Change my password'
+      expect(page).to have_content 'Password is too short'
+
+      fill_in :user_password, with: 'a new password'
+      fill_in :user_password_confirmation, with: 'a new password with a typo'
+      click_button 'Change my password'
+      expect(page).to have_content 'Password confirmation doesn\'t match'
+    end
+
+    scenario "Submit with valid passwords" do
+      expect(Devise::LDAP::Adapter).to receive(:update_password)
+        .with(user.cn, 'catch me if you can').and_return(true)
+
+      visit edit_user_password_path(reset_password_token: token)
+      fill_in :user_password, with: 'catch me if you can'
+      fill_in :user_password_confirmation, with: 'catch me if you can'
+      click_button 'Change my password'
+      expect(page).to have_content 'Your password has been changed successfully'
+      expect(user.reload.reset_password_token).to be_nil
+    end
   end
 end