Rails 7 has_secure_password doesn't throw validation error on update when password is blank - rails-activerecord

Question

I'm running Rails 7.0.4 right now.
Here's my User Model
class User < ApplicationRecord
has_secure_password
validates :fullname, presence: true, length: { maximum: 100 }
validates :email, presence: true,
format: {with: URI::MailTo::EMAIL_REGEXP, message: "Please use a valid email address."},
uniqueness: true
end
Given a standard user,
When I update the password with blank information,
I expect a validation error "can't be blank" to get thrown.
What I get instead is no error thrown and what looks like a successful database transaction with no rollback.
Here's an example where I use the update method on an instance of User and see the validation doesn't get thrown and prevent the transaction.
pry(main)> u = User.first
User Load (0.3ms) SELECT "users".* FROM "users" ORDER BY "users"."id" ASC LIMIT $1 [["LIMIT", 1]]
=> #<User:0x0000000108e89280
id: 1,
fullname: "foo",
email: "foo#bar.com",
password_digest: "[FILTERED]",
created_at: Fri, 06 Jan 2023 04:13:52.650976000 UTC +00:00,
updated_at: Fri, 06 Jan 2023 04:13:52.672566000 UTC +00:00,
company_id: nil,
auth_token: "[FILTERED]">
[4] pry(main)> u.update(password: '', password_confirmation: '')
TRANSACTION (0.2ms) BEGIN
User Exists? (0.5ms) SELECT 1 AS one FROM "users" WHERE "users"."email" = $1 AND "users"."id" != $2 LIMIT $3 [["email", "foo#bar.com"], ["id", 1], ["LIMIT", 1]]
TRANSACTION (0.2ms) COMMIT
=> true
And here is the continuation of the above session where I attempt to just set the attributes and call save directly. This is what I understand the update and update_attributes methods do under the hood.
[5] pry(main)> u.password
=> nil
[6] pry(main)> attributes = { password: '', password_confirmation: '' }
=> {:password=>"", :password_confirmation=>""}
[7] pry(main)> u.attributes
=> {"id"=>1,
"fullname"=>"foo",
"email"=>"foo#bar.com",
"password_digest"=>"$2a$12$W5CwTg.DjhLZdSiXDvD2fuWinwbMtmavK46IZCR27EzopLgfQzQxy",
"created_at"=>Fri, 06 Jan 2023 04:13:52.650976000 UTC +00:00,
"updated_at"=>Fri, 06 Jan 2023 04:13:52.672566000 UTC +00:00,
"company_id"=>nil,
"auth_token"=>
"eyJfcmFpbHMiOnsibWVzc2FnZSI6Ik1RPT0iLCJleHAiOm51bGwsInB1ciI6InVzZXIvc2Vzc2lvbnMifX0=--239334c38fd5527b383c22d7aad6277f07743b3f6ecd2de846d42731c22e39d5"}
[8] pry(main)> u.attributes = attributes
=> {:password=>"", :password_confirmation=>""}
[9] pry(main)> u
=> #<User:0x0000000108e89280
id: 1,
fullname: "foo",
email: "foo#bar.com",
password_digest: "[FILTERED]",
created_at: Fri, 06 Jan 2023 04:13:52.650976000 UTC +00:00,
updated_at: Fri, 06 Jan 2023 04:13:52.672566000 UTC +00:00,
company_id: nil,
auth_token: "[FILTERED]">
[10] pry(main)> u.save
TRANSACTION (0.2ms) BEGIN
User Exists? (0.3ms) SELECT 1 AS one FROM "users" WHERE "users"."email" = $1 AND "users"."id" != $2 LIMIT $3 [["email", "foo#bar.com"], ["id", 1], ["LIMIT", 1]]
TRANSACTION (0.2ms) COMMIT
=> true
Shouldn't save trigger the validation errors, which are in has_secure_password?

Answer 1

Here's the current sourcecode for the update method.
def update(id, attributes)
if id.is_a?(Array)
idx = -1
id.collect { |one_id| idx += 1; update(one_id, attributes[idx]) }
else
object = find(id)
object.update_attributes(attributes)
object
end
end
And that refers to the update_attributes method here:
def update_attributes(attributes)
self.attributes = attributes
save
end
And here's the has_secure_password sourcecode:
def has_secure_password(options = {})
# Load bcrypt gem only when has_secure_password is used.
# This is to avoid ActiveModel (and by extension the entire framework)
# being dependent on a binary library.
begin
require "bcrypt"
rescue LoadError
$stderr.puts "You don't have bcrypt installed in your application. Please add it to your Gemfile and run bundle install"
raise
end
include InstanceMethodsOnActivation
if options.fetch(:validations, true)
include ActiveModel::Validations
# This ensures the model has a password by checking whether the password_digest
# is present, so that this works with both new and existing records. However,
# when there is an error, the message is added to the password attribute instead
# so that the error message will make sense to the end-user.
validate do |record|
record.errors.add(:password, :blank) unless record.password_digest.present?
end
validates_length_of :password, maximum: ActiveModel::SecurePassword::MAX_PASSWORD_LENGTH_ALLOWED
validates_confirmation_of :password, allow_blank: true
end
end
After studying the has_secure_password sourcecode I saw that it only throws the blank validation error when password_digest is blank.
So the solution here that I've found is to create a validation of my own in the model class to check for presence upon updates, and to pass it my own message. I also see that this method doesn't check for password strength, so I needed to add in password strength regex.
Here is the new model class and it works as expected.
The downside is that this implementation doesn't pull apart the different parts of the regex that it doesn't fail. So if the password is missing a symbol it will just render the entire format validation error instead of specifically saying "Password must include a symbol."
class User < ApplicationRecord
has_secure_password
validates :fullname, presence: true, length: { maximum: 100 }
validates :email, presence: true,
format: {with: URI::MailTo::EMAIL_REGEXP, message: "be a valid email format"},
uniqueness: true
PASSWORD_REQUIREMENTS = /\A
(?=.{6,}) # At least 6 characters long
(?=.*\d)
(?=.*[a-z])
(?=.*[A-Z])
(?=.*[[:^alnum:]])
/x
validates :password, presence: true,
format: { with: PASSWORD_REQUIREMENTS,
message: 'must be at least 6 characters long, contain a number, a lower and upper letter, and have one special character.' }
end