Question

I’m trying to convert an existing Admin model to Devise. We already have a password hash but it’s obviously not Devise compatible. What I would like to do is accept the login form and check the provided password against the encrypted password. If it’s not correct, use the old hash to check the password and if it matches, empty the old password_hash field and set Devise’s password to the provided password and save the model.

What’s the best way to move forward? I suspect that I need to override something, perhaps in a custom controller, but I’m not entirely sure how to proceed.

Answer 1

You can let Devise do the “hard work” of encrypting the password with the new crypt scheme, as shown in https://gist.github.com/1704632:

class User < ActiveRecord::Base
  alias :devise_valid_password? :valid_password?

  def valid_password?(password)
    begin
      super(password)
    rescue BCrypt::Errors::InvalidHash
      return false unless Digest::SHA1.hexdigest(password) == encrypted_password
      logger.info "User #{email} is using the old password hashing method, updating attribute."
      self.password = password
      true
    end
  end
end