Enable Devise recoverable

app/controllers/users/passwords_controller.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+class Users::PasswordsController < Devise::PasswordsController
+  skip_after_action :verify_authorized
+  skip_after_action :verify_policy_scoped
+
+  # GET /resource/password/new
+  # def new
+  #   super
+  # end
+
+  # POST /resource/password
+  # def create
+  #   super
+  # end
+
+  # GET /resource/password/edit?reset_password_token=abcdef
+  # def edit
+  #   super
+  # end
+
+  # PUT /resource/password
+  # def update
+  #   super
+  # end
+
+  # protected
+
+  # def after_resetting_password_path_for(resource)
+  #   super(resource)
+  # end
+
+  # The path used after sending reset password instructions
+  # def after_sending_reset_password_instructions_path_for(resource_name)
+  #   super(resource_name)
+  # end
+end

app/models/user.rb

@@ -6,7 +6,7 @@ class User < ApplicationRecord
     :database_authenticatable,
     # :lockable,
     # :omniauthable,
-    # :recoverable,
+    :recoverable,
     :registerable,
     :rememberable,
     # :timeoutable,

app/views/users/passwords/edit.html.erb

@@ -0,0 +1,32 @@
+<div class="container">
+  <h2><%= translate '.change_your_password' %></h2>
+
+  <%= simple_form_for resource,
+                      as: resource_name,
+                      url: password_path(resource_name),
+                      html: { method: :put } do |f| %>
+    <%= f.error_notification %>
+
+    <%= f.input :reset_password_token, as: :hidden %>
+    <%= f.full_error :reset_password_token %>
+
+    <div class="form-inputs">
+      <%= f.input :password,
+                  label: translate('.new_password'),
+                  required: true,
+                  autofocus: true,
+                  hint: (translate('devise.shared.minimum_password_length', count: @minimum_password_length) if @minimum_password_length),
+                  input_html: { autocomplete: 'new-password' } %>
+
+      <%= f.input :password_confirmation,
+                  label: translate('.confirm_new_password'),
+                  required: true %>
+    </div>
+
+    <div class="form-actions">
+      <%= f.button :submit, translate('.change_my_password') %>
+    </div>
+  <% end %>
+
+  <%= render 'users/shared/links' %>
+</div>

app/views/users/passwords/new.html.erb

@@ -0,0 +1,20 @@
+<div class="container">
+  <h2><%= translate '.forgot_your_password' %></h2>
+
+  <%= simple_form_for resource, as: resource_name, url: password_path(resource_name) do |f| %>
+    <%= f.error_notification %>
+
+    <div class="form-inputs">
+      <%= f.input :email,
+                  required: true,
+                  autofocus: true,
+                  input_html: { autocomplete: 'email' } %>
+    </div>
+
+    <div class="form-actions">
+      <%= f.button :submit, translate('.send_me_reset_password_instructions') %>
+    </div>
+  <% end %>
+
+  <%= render 'users/shared/links' %>
+</div>

config/initializers/devise.rb

@@ -208,7 +208,7 @@ Devise.setup do |config|
   # ==> Configuration for :recoverable
   #
   # Defines which key will be used when recovering the password for an account
-  # config.reset_password_keys = [:email]
+  config.reset_password_keys = [:email]
 
   # Time interval you can reset your password with a reset password key.
   # Don't put a too small interval or your users won't have the time to
@@ -217,7 +217,7 @@ Devise.setup do |config|
 
   # When set to false, does not sign a user in automatically after their password is
   # reset. Defaults to true, so a user is signed in automatically after a reset.
-  # config.sign_in_after_reset_password = true
+  config.sign_in_after_reset_password = false
 
   # ==> Configuration for :encryptable
   # Allow you to use another hashing or encryption algorithm besides bcrypt (default).

config/routes.rb

@@ -25,6 +25,7 @@ Rails.application.routes.draw do
     sessions:      'users/sessions',
     registrations: 'users/registrations',
     confirmations: 'users/confirmations',
+    passwords:     'users/passwords',
   }
 
   resources :membership_applications, only: %i[new create]