Add config option to disable signin after password reset

README.md

@@ -66,6 +66,7 @@ Clearance.configure do |config|
   config.sign_in_guards = []
   config.user_model = "User"
   config.parent_controller = "ApplicationController"
+  config.sign_in_on_password_reset = false
 end
 ```
 

app/controllers/clearance/passwords_controller.rb

@@ -33,7 +33,7 @@ def update
     @user = find_user_for_update
 
     if @user.update_password(password_from_password_reset_params)
-      sign_in @user
+      sign_in @user if Clearance.configuration.sign_in_on_password_reset?
       redirect_to url_after_update
       session[:password_reset_token] = nil
     else

lib/clearance/configuration.rb

@@ -118,6 +118,12 @@ class Configuration
     # @return [Array<String>]
     attr_accessor :allowed_backdoor_environments
 
+    # Controls wether users are automatically signed in after successfully
+    # resetting their password.
+    # Defaults to `true`.
+    # @return [Boolean]
+    attr_writer :sign_in_on_password_reset
+
     def initialize
       @allow_sign_up = true
       @allowed_backdoor_environments = ["test", "ci", "development"]
@@ -134,6 +140,7 @@ def initialize
       @secure_cookie = false
       @signed_cookie = false
       @sign_in_guards = []
+      @sign_in_on_password_reset = true
     end
 
     def signed_cookie=(value)
@@ -214,6 +221,10 @@ def reload_user_model
     def rotate_csrf_on_sign_in?
       !!rotate_csrf_on_sign_in
     end
+
+    def sign_in_on_password_reset?
+      @sign_in_on_password_reset
+    end
   end
 
   # @return [Clearance::Configuration] Clearance's current configuration

spec/requests/password_maintenance_spec.rb

@@ -2,17 +2,36 @@
 
 describe "Password maintenance" do
   context "when updating the password" do
-    it "signs the user in and redirects" do
-      user = create(:user, :with_forgotten_password)
+    let(:user) { create(:user, :with_forgotten_password) }
+
+    before(:each) do
+      Clearance.configure do |config|
+        config.sign_in_on_password_reset = sign_in_on_password_reset
+      end
 
       put user_password_url(user), params: {
         user_id: user,
         token: user.confirmation_token,
         password_reset: { password: "my_new_password" },
       }
+    end
+
+    context "if `sign_in_on_password_reset` option is true" do
+      let(:sign_in_on_password_reset) { true }
+
+      it "signs the user in and redirects" do
+        expect(response).to redirect_to(Clearance.configuration.redirect_url)
+        expect(cookies["remember_token"]).to be_present
+      end
+    end
+
+    context "if `sign_in_on_password_reset` option is false" do
+      let(:sign_in_on_password_reset) { false }
 
-      expect(response).to redirect_to(Clearance.configuration.redirect_url)
-      expect(cookies["remember_token"]).to be_present
+      it "redirects, but does not sign in the user" do
+        expect(response).to redirect_to(Clearance.configuration.redirect_url)
+        expect(cookies["remember_token"]).not_to be_present
+      end
     end
   end
 end