FIX: handle invalid password reset token

app/controllers/users_controller.rb

@@ -504,8 +504,8 @@ class UsersController < ApplicationController
               success: false,
               message: @error,
               errors: @user&.errors&.to_hash,
-              is_developer: UsernameCheckerService.is_developer?(@user.email),
+              is_developer: UsernameCheckerService.is_developer?(@user&.email),
-              admin: @user.admin?
+              admin: @user&.admin?
             }
           else
             render json: {

spec/controllers/users_controller_spec.rb

@@ -303,11 +303,9 @@ describe UsersController do
     context 'invalid token' do
       render_views
 
-      before do
-        get :password_reset, params: { token: "evil_trout!" }
-      end
-
       it 'disallows login' do
+        get :password_reset, params: { token: "evil_trout!" }
+
         expect(response).to be_success
 
         expect(CGI.unescapeHTML(response.body))
@@ -319,6 +317,16 @@ describe UsersController do
 
         expect(session[:current_user_id]).to be_blank
       end
+
+      it "responds with proper error message" do
+        put :password_reset, params: {
+          token: "evil_trout!", password: "awesomeSecretPassword"
+        }, format: :json
+
+        expect(response).to be_success
+        expect(JSON.parse(response.body)["message"]).to eq(I18n.t('password_reset.no_token'))
+        expect(session[:current_user_id]).to be_blank
+      end
     end
 
     context 'valid token' do