eminuxCRM/app/controllers/password_resets_controller.rb

class PasswordResetsController < ApplicationController
  skip_before_action :require_login

  def new; end

  def create
    user = User.active.find_by(email: params[:email].to_s.downcase.strip)
    if user
      user.generate_password_reset_token!
      PasswordMailer.reset(user).deliver_later
    end
    redirect_to login_path, notice: "Se l'email esiste, riceverai le istruzioni per il reset."
  end

  def edit
    @user = User.find_by(password_reset_token: params[:token])
    return if @user&.password_reset_token_valid?

    redirect_to new_password_reset_path, alert: "Link di reset non valido o scaduto."
  end

  def update
    @user = User.find_by(password_reset_token: params[:token])
    unless @user&.password_reset_token_valid?
      redirect_to new_password_reset_path, alert: "Link di reset non valido o scaduto." and return
    end

    if @user.update(password_params)
      @user.clear_password_reset_token!
      redirect_to login_path, notice: "Password aggiornata. Ora puoi accedere."
    else
      render :edit, status: :unprocessable_entity
    end
  end

  private

  def password_params
    params.require(:user).permit(:password, :password_confirmation)
  end
end