password reset requests

app/controllers/admin/auth_controller.rb

@@ -21,5 +21,44 @@ module Admin
       reset_session
       redirect_to admin_login_path
     end
+
+    def reset_request
+    end
+
+    def send_reset
+      user = User.find_by(email: request_params[:email])
+      redirect_to(admin_reset_request_path) and return if user.nil?
+
+      user.setup_reset
+      # TODO: user mailer deliver_now
+      redirect_to admin_reset_request_path,
+                  success: "Reset request sent! Please check your email for instructions."
+    end
+
+    def reset
+      user = User.find_by(reset_token: params[:reset_token])
+      redirect_to(admin_reset_request_path) and return if user.nil?
+    end
+
+    def reset_password
+      user = User.find_by(reset_token: params[:reset_token])
+      redirect_to(admin_reset_request_path) and return if user.nil?
+
+      if user.update(reset_params)
+        redirect_to admin_login_path, success: "Password has been reset. Please log in."
+      else
+        redirect_to(admin_reset_request_path)
+      end
+    end
+
+    private
+
+      def request_params
+        params.require(:auth).permit(:email)
+      end
+
+      def reset_params
+        params.require(:auth).permit(:password, :password_confirmation)
+      end
   end
 end

app/controllers/admin/profile_controller.rb

@@ -19,7 +19,10 @@ module Admin
       end
     end
 
-    def lost_password
+    private
+
+      def user_params
+        params.require(:user).permit(:name, :email, :password, :password_confirmation)
       end
   end
 end