Devise ignoring customized create method

Question

Users have to confirm their email account via a link sent to them after registration through devise's confirmable.

Right now if a user who has not confirmed their account gets the unhelpful error:

Your email or password is incorrect.

I have tried adding the below to the SessionsController:

def create
  user = User.where(email: params[:user][:email]).take
  unless user.confirmed?
    super
  end
  flash[:alert] = "Your account has not been confirmed."
end

My routes are

  devise_for :users, path: 'users', controllers: {
    sessions: "users/sessions"
  }

However, signing in as any user (confirmed or not), seems to bypass this entire method. (Even if I put in binding.pry.)

UPDATE:

Devise only ignores the unique create method. If I put in a binding.pry in any other method (new or delete), devise will catch it.

Answer 1

The sessions create doesn't get called if the user isn't confirmed, so this is why you're not able to reach the create method.

Try this

class User < ActiveRecord
  
  protected
  
  def confirmation_required?
    false
  end
end

This will allow the user to proceed to the create action in sessions_controller and you can test there if the user is actually confirmed.