Where is the users password actually updated in Devise::PasswordsController?

Question

I am quite new to rails Device gem. and Trying to understand how it work.

In my project, there is Devise::PasswordsController.

  def update
    self.resource = resource_class.reset_password_by_token(resource_params)
    yield resource if block_given?

    if resource.errors.empty?
      resource.unlock_access! if unlockable?(resource)
      if Devise.sign_in_after_reset_password
        flash_message = resource.active_for_authentication? ? :updated : :updated_not_active
        set_flash_message!(:notice, flash_message)
        resource.after_database_authentication
        sign_in(resource_name, resource)
      else
        set_flash_message!(:notice, :updated_not_active)
      end
      respond_with resource, location: after_resetting_password_path_for(resource)
    else
      set_minimum_password_length
      respond_with resource
    end
  end

This will update new password to database.

In my server log. I can see UPDATE SQL query executed.

UPDATE `users` SET `reset_password_sent_at` = NULL, `encrypted_password` = 'somevalue......', `reset_password_token` = NULL, `updated_at` = '2020-xx-xx xx:xx:xx' WHERE `users`.`id` = xxx

but,

Why Can't I find any ruby code equivalent to this? as in resource.update things like that.

Sorry if my question is doesn't make sense. And if so, please correct my misunderstanding.

Where can I find the function that executes SQL?

Answer 1

The actual update is happening in Devise::Models::Recoverable#reset_password which is called by #reset_password_by_token.

# Update password saving the record and clearing token. Returns true if
# the passwords are valid and the record was saved, false otherwise.
def reset_password(new_password, new_password_confirmation)
  if new_password.present?
    self.password = new_password
    self.password_confirmation = new_password_confirmation
    save
  else
    errors.add(:password, :blank)
    false
  end
end