Duplicate error messages

[moray95]

I have integrated devise_token_auth to my Ruby on Rails application and have encountered a strange issue with errors. Sometimes, the requests managed by devise_token_auth returns the same error multiple times in the errors field. Here is an example of such responses:

{
  "status": "error",
  "data": {
    "id": null,
    "provider": "email",
    "uid": "",
    "name": null,
    "nickname": null,
    "image": null,
    "email": "[email protected]",
    "created_at": null,
    "updated_at": null
  },
  "errors": {
    "email": [
      "has already been taken",
      "has already been taken"
    ],
    "full_messages": [
      "Email has already been taken",
      "Email has already been taken"
    ]
  }
}

To reproduce the issue just clone this repository, containing a basic setup for devise_token_auth, and once the server is running, send the request below twice. The first one will succeed and the second one will fail with duplicate errors, like the one above.

POST /auth HTTP/1.1
Content-Type: application/json
Host: localhost:3000
Connection: close
Content-Length: 115

{"email":"[email protected]","password":"my_super_strong_password","confirm_success_url":"http://localhost:3000"}

[stephanebruckert]

How did you fix it @moray95 ?

---

Meanwhile...

validatable validates both the email and the password, which is why we shouldn't do any of those in models, otherwise it would be validated twice. In my case, only the email was validated twice, whereas I wasn't adding any extra validation in my model. So I ended up removing validatable and made my own validation on password and password_confirmation:

  validates_presence_of :password, on: :create
  validates :password,
    length: { minimum: 8 },
    allow_blank: true
  validate  :password_complexity
  validates_confirmation_of :password
  validates_presence_of :password_confirmation, if: lambda {| u| u.password.present? }

  private

    def password_complexity
      return unless password
      if password.include?(username) || !password.match(/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)./)
        errors.add(:password, "Must include at least one lowercase letter, one uppercase letter and one digit")
      end
    end

[maknz]

I'm seeing the same problem here, if you attempt to sign up with an email already in use, you get multiple validation errors.

    "errors": {
        "email": [
            "has already been taken",
            "has already been taken"
        ],
        "full_messages": [
            "Email has already been taken",
            "Email has already been taken"
        ]
    }

devise (4.3.0)
devise_token_auth (0.1.42)

Ruby 2.4.1, Rails 5.1.1, using Postgres (pg 0.21.0)

[roseliux]

I have the same problem.

[ethagnawl]

It seems like this issue could potentially be caused by the following piece of code in DeviseTokenAuth::Concerns::User:

# Hack to check if devise is already enabled
unless self.method_defined?(:devise_modules)
  devise :database_authenticatable, :registerable,
              :recoverable, :trackable, :validatable, :confirmable
else
  self.devise_modules.delete(:omniauthable)
end

I've also noticed that if you place the include before your own call to devise, the error message will appear three times.

[roseliux]

I hope they fix this.

[rmcsharry]

Same issue here. Posted a stack overflow question here.

[lynndylanhurley]

I'll take a look at this tomorrow. Does anyone have the time to submit a PR with a failing test?

[ethagnawl]

@lynndylanhurley In attempting to write a failing test, I've realized this issue seems to only affect Rails >= 5.1.0. So, I've got a failing test, but can't submit a PR because (I'm pretty sure) it would involve changing the gemspec.

Hopefully that information is of some use to you!

[jduff]

I ran into this on the released version of the gem, seems to be fixed on master since #981 was merged though.

[zachfeldman]

Good to know. We should be cutting a release soon per @lynndylanhurley !

[MaicolBen]

I checked and is fixed in master as @jduff said, so I'm closing this

[Hoss3770]

A similar issue showed up again in 1.1.5 and 1.1.4
If I use :validatable or not it does not make a difference.
I always get 422 Unprocessable Entity instead of "Email already taken" error.
Any clues?