heartcombo / devise

Flexible authentication solution for Rails with Warden.
http://blog.plataformatec.com.br/tag/devise/
MIT License
23.89k stars 5.54k forks source link

`after_database_authentication` is called even if `active_for_authentication?` returns false #5577

Open alecvn opened 1 year ago

alecvn commented 1 year ago

Environment

Current behavior

I'm using authenticatable and have implemented a boolean flag on my User model called deactivated which I use like so:

def active_for_authentication?
    super && !deactivated
end

I also have some logic that I would like to call only when the user has logged in successfully:

def after_database_authentication
    SuccessfulAuthenticationService.call
end

I have found that SuccessfulAuthenticationService is called even if active_for_authentication? is false.

Expected behavior

I would expect after_database_authentication to only be called if active_for_authentication? returns true. Instead, it seems I now have to manually check it like so:

def after_database_authentication
    SuccessfulAuthenticationService.call if active_for_authentication?
end

Is this the intended behaviour? If so, I suggest that the documentation for after_database_authentication be updated to explicitly state what constitutes "successful" authentication, which seems to simply be matching credentials.