Question

In my app, im disallowing user registrations and having it being managed by the sole admin user as the application is only intended to be use by a very small team of people.

When I create a user at the moment though. I’m being directed to the user that I created is being automatically signed in and im being redirected to the homepage with a flash message thanking me for signing in.

This isn’t right and present’s a problem when I create more then one user as I recieve an error telling me that im already signed in.

Here’s my user.rb

class User < ActiveRecord::Base
  # Include default devise modules. Others available are:
  # :token_authenticatable, :confirmable,
  # :lockable, :timeoutable and :omniauthable
  devise :database_authenticatable, :registerable,
         :recoverable, :rememberable, :trackable, :validatable

  # Setup accessible (or protected) attributes for your model
  attr_accessible :email, :username, :password, :password_confirmation, :remember_me
end

My users_controller.rb

class UsersController < ApplicationController
  # GET /users
  # GET /users.xml
  def index
    @users = User.all

    respond_to do |format|
      format.html # index.html.erb
      format.xml  { render :xml => @users }
    end
  end

  # GET /users/1
  # GET /users/1.xml
  def show
    @user = User.find(params[:id])

    respond_to do |format|
      format.html # show.html.erb
      format.xml  { render :xml => @user }
    end
  end

  # GET /users/new
  # GET /users/new.xml
  def new
    @user = User.new
    @current_method = "new"

    respond_to do |format|
      format.html # new.html.erb
      format.xml  { render :xml => @user }
    end
  end

  # GET /users/1/edit
  def edit
    @user = User.find(params[:id])
  end

  # POST /users
  # POST /users.xml
  def create
    @user = User.new(params[:user])

    respond_to do |format|
      if @user.save
        format.html { redirect_to(@user, :notice => 'User was successfully created.') }
        format.xml  { render :xml => @user, :status => :created, :location => @user }
      else
        format.html { render :action => "new" }
        format.xml  { render :xml => @user.errors, :status => :unprocessable_entity }
      end
    end
  end

  # PUT /users/1
  # PUT /users/1.xml
  def update
    @user = User.find(params[:id])

    respond_to do |format|
      if @user.update_attributes(params[:user])
        format.html { redirect_to(@user, :notice => 'User was successfully updated.') }
        format.xml  { head :ok }
      else
        format.html { render :action => "edit" }
        format.xml  { render :xml => @user.errors, :status => :unprocessable_entity }
      end
    end
  end

  # DELETE /users/1
  # DELETE /users/1.xml
  def destroy
    @user = User.find(params[:id])
    @user.destroy

    respond_to do |format|
      format.html { redirect_to(users_url) }
      format.xml  { head :ok }
    end
  end
end

My routes

DocumentManager::Application.routes.draw do

  devise_for :users

  get "index/index"
  devise_for :users, :controllers => {:sessions => 'sessions'}
  resources :clients, :jobs, :users


end

Can anyone point me in the right direction or know how to get the functionality that im looking for?

As I said. I need the redirect to go back to the User creation screen, the user not to be signed in automaticly and the flash message to be something differant.

Answer 1

This happens because you’re using the Devise registrations controller which logs the user in after signing up. Also, you aren’t disabling the registration module, so everyone will be able to create an account accessing /users/sign_up.

In order to do what you want, do this:

1. Remove the registerable module;
2. Restrict the access of users controller to only admins through a before_filter;
3. Remove one of the devise_for on your routes;
4. Use the users controllers to create your users;

You may also set a random password and ask the user to generate a first time password sending the edit password link after signing in.