Rails devise disable password recovery for certain user types

Question

In my Rails project I have different types of users one of which has the user_status :admin, which has full rights to edit content unlike the rest of the users. For obvious reasons I want to add additional security for these types of users, in particular, completely disable password recovery.

What is the correct way of overriding standard Devise password recovery (:recoverable Devise module) methods so that when a user tries to get a reset password link for a user which is an admin user (user_status == "admin") the system gives back the "standard email not found" message?

This is somewhat like the unanswered question: Restrict Devise password recovery to only certain users

Thank you in advance.

Answer 1

For any future viewers, here's another way to do it. Vitaly's example did work for me, but I was still getting the "Your password email has been sent." notice (I wanted a separate alert to flash), so I went another route.

Extending the Devise::PasswordsController was the easiest solution for me:

class Devise::Extends::PasswordsController < Devise::PasswordsController

  def create
    if some_condition?
      redirect_to :root
      flash[:alert] = 'You cannot reset your password, buddy.'
    else
      super
    end
  end

Then, in routes.rb:

devise_for :users, controllers: { passwords: 'devise/extends/passwords' }

That will direct your app to the extended controller, then hit the devise controller ("super") if your condition is not met.