allow only one confirmation

lynndylanhurley · Oct 30, 2017 · 89fccba · 89fccba
1 parent 915058a
commit 89fccba
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 0 deletions.
diff --git a/app/controllers/devise_token_auth/confirmations_controller.rb b/app/controllers/devise_token_auth/confirmations_controller.rb
@@ -10,6 +10,10 @@ def show
         token_hash = BCrypt::Password.create(token)
         expiry     = (Time.now + @resource.token_lifespan).to_i
 
+        if @resource.sign_in_count > 0
+          expiry     = (Time.now + 1.second).to_i
+        end
+
         @resource.tokens[client_id] = {
           token:  token_hash,
           expiry: expiry

diff --git a/test/controllers/devise_token_auth/confirmations_controller_test.rb b/test/controllers/devise_token_auth/confirmations_controller_test.rb
@@ -61,6 +61,12 @@ def token_and_client_config_from(body)
         test 'User shoud have the Last checkin filled' do
           assert @resource.last_sign_in_at?
         end
+
+        test 'user already confirmed' do
+          assert @resource.sign_in_count > 0 do
+            assert expiry == (Time.now + Time.now + 1.second).to_i
+          end
+        end
       end
 
       describe 'failure' do