Question

My rails application uses devise to handle registration, authentication, etc. I’m using the confirmable module. The bug is this– when a user registers with email, Devise is sending two confirmation emails with different confirmation links. One link works, the other directs the user to an error page.

Devise spits out a message associated with the error: “Confirmation token is invalid” and takes the user to the Resend Confirmation Email page.

I’m hosting with heroku and using sendgrid to send the emails. update: The bug also occurs on localhost.

I have no idea where the root of this bug is, and this might be more code than what you need to see:

models/user.rb

...

devise :database_authenticatable, :registerable, :omniauthable,
     :recoverable, :rememberable, :trackable, :validatable, 
     :confirmable, :authentication_keys => [:login]

...

## callbacks
after_create :account_created

# called after the account is first created
def account_created

  # check if this activiy has already been created
  if !self.activities.where(:kind => "created_account").blank?
    puts "WARNING: user ##{self.id} already has a created account activity!"
    return
  end

  # update points
  self.points += 50
  self.save

  # create activity
  act = self.activities.new
  act.kind = "created_account"
  act.created_at = self.created_at
  act.save

end

...

def confirmation_required?
  super && (self.standard_account? || self.email_changed)
end

...

controllers/registrations_controller.rb

class RegistrationsController < Devise::RegistrationsController
  def update
    unless @user.last_sign_in_at.nil?

      puts "--------------double checking whether password confirmation is required--"
      ## if the user has not signed in yet, we don't want to do this.

      @user = User.find(current_user.id)
      # uncomment if you want to require password for email change
      email_changed = @user.email != params[:user][:email]
      password_changed = !params[:user][:password].empty?

      # uncomment if you want to require password for email change
      # successfully_updated = if email_changed or password_changed

      successfully_updated = if password_changed
        params[:user].delete(:current_password) if params[:user][:current_password].blank?
        @user.update_with_password(params[:user])
      else
        params[:user].delete(:current_password)
        @user.update_without_password(params[:user])
      end

      if successfully_updated
        # Sign in the user bypassing validation in case his password changed
        sign_in @user, :bypass => true
        if email_changed
          flash[:blue] = "Your account has been updated! Check your email to confirm your new address. Until then, your email will remain unchanged."
        else
          flash[:blue] = "Account info has been updated!"
        end
        redirect_to edit_user_registration_path
      else
        render "edit"
      end
    end
  end
end

controllers/omniauth_callbacks_controller

class OmniauthCallbacksController < Devise::OmniauthCallbacksController

  skip_before_filter :verify_authenticity_token

    def facebook
        user = User.from_omniauth(request.env["omniauth.auth"])
    if user.persisted?
      flash.notice = "Signed in!"

      # if the oauth_token is expired or nil, update it...
      if (DateTime.now > (user.oauth_expires_at || 99.years.ago) )
        user.update_oauth_token(request.env["omniauth.auth"])
      end

      sign_in_and_redirect user
    else
      session["devise.user_attributes"] = user.attributes
      redirect_to new_user_registration_url
    end
    end
end

config/routes.rb

...

devise_for :users, controllers: {omniauth_callbacks: "omniauth_callbacks", 
                                :registrations => "registrations"}

...

I’m happy to provide more information if needed. I’m also open to customizing/overriding the devise mailer behavior, but I don’t know how to go about that.

Much thanks!

Answer 1

Solved!

I was able to override Devise::Mailer and force a stack trace to find out exactly what was causing duplicate emails. Devise::Mailer#confirmation_instructions was being called twice, and I found out that the problem was with my :after_create callback, shown below:

in models/user.rb…

after_create :account_created

# called after the account is first created
def account_created

...

  # update points
  self.points += 50
  self.save

...

end

Calling self.save somehow caused the mailer to be triggered again. I solved the problem by changing when the points are added. I got rid of the after_create call and overrode the confirm! method in devise to look like this:

def confirm!
  super
  account_created
end

So now the user record doesn’t get modified (adding points) until after confirmation. No more duplicate emails!