`after_database_authentication` is called even if `active_for_authentication?` returns false

[alecvn]

Environment

• Ruby 3.1.3
• Rails 6.1.7.3
• Devise 4.8.0

Current behavior

I'm using authenticatable and have implemented a boolean flag on my User model called deactivated which I use like so:

def active_for_authentication?
    super && !deactivated
end

I also have some logic that I would like to call only when the user has logged in successfully:

def after_database_authentication
    SuccessfulAuthenticationService.call
end

I have found that SuccessfulAuthenticationService is called even if active_for_authentication? is false.

Expected behavior

I would expect after_database_authentication to only be called if active_for_authentication? returns true. Instead, it seems I now have to manually check it like so:

def after_database_authentication
    SuccessfulAuthenticationService.call if active_for_authentication?
end

Is this the intended behaviour? If so, I suggest that the documentation for after_database_authentication be updated to explicitly state what constitutes "successful" authentication, which seems to simply be matching credentials.