Ruby on Rail's Authlogic gem - password confirmation only for password reset and the edit page

Answer 1

I would do it this way, add accessors old_password, reset_password (boolean that we set to true when reseting password):

attr_accessor :old_password, :reset_password

Now, we need to validate the old password when updating, but not reseting:

validate :old_password_valid, :unless => [:reset_password]

def old_password_valid
  errors.add(:old_password, "You must introduce your password") if !new_record? && !valid_password?(old_password)
end

So far, we've validated that the old password is valid when the user is updating their profile.

Now, to ask for the new password or not, Authlogic adds a method 'require_password?' to your user model, you have to override it. I did this way:

def require_password?
  password_changed? || (crypted_password.blank? && !new_record?) || reset_password
end

Basically asks for the password (and confirmation) when: 1) User updating password, 2) User activating their account (so they still haven't got a password), 3) user resetting password.

Hope this helps.