Rails devise disable password recovery for certain user types

Question

In my Rails project I have different types of users one of which has the user_status :admin, which has full rights to edit content unlike the rest of the users. For obvious reasons I want to add additional security for these types of users, in particular, completely disable password recovery.

What is the correct way of overriding standard Devise password recovery (:recoverable Devise module) methods so that when a user tries to get a reset password link for a user which is an admin user (user_status == "admin") the system gives back the "standard email not found" message?

This is somewhat like the unanswered question: Restrict Devise password recovery to only certain users

Thank you in advance.

Answer 1

The method I chose and that worked for me was overriding the send_reset_password_instructions method of the User model by adding the following to models/user.rb:

def send_reset_password_instructions
  return false if self.user_status == 'admin'
  super
end

This makes Devise not do anything in case the email belongs to an admin account.