change the code to use what Devise does by default and update the tests

app/controllers/users/confirmations_controller.rb

@@ -49,15 +49,12 @@ class Users::ConfirmationsController < Devise::ConfirmationsController
     elsif resource.errors.empty?
       set_official_position if resource.has_official_email?
 
-      if !resource.confirmed_at || resource.unconfirmed_email
-        resource.confirm # Last change: confirm happens here for people with passwords instead of af the top of the show action
-        message = :confirmed
+      if resource.confirm
+        set_flash_message(:notice, :confirmed) if is_flashing_format?
+        respond_with_navigational(resource) { redirect_to after_confirmation_path_for(resource_name, resource) }
       else
-        message = :already_confirmed
+        respond_with_navigational(resource.errors, status: :unprocessable_entity) { render :new, status: :unprocessable_entity }
       end
-
-      set_flash_message(:notice, message) if is_flashing_format?
-      respond_with_navigational(resource) { redirect_to after_confirmation_path_for(resource_name, resource) }
     else
       respond_with_navigational(resource.errors, status: :unprocessable_entity) { render :new }
     end

spec/controllers/users/confirmations_controller_spec.rb

@@ -10,11 +10,19 @@ describe Users::ConfirmationsController do
       expect { get :show, params: { token: "non_existent" } }.to raise_error ActiveRecord::RecordNotFound
     end
 
-    it "redirect to sign_in page with a existent token " do
+    it "returns a 422 code with a existent and used token " do
       user = create(:user, confirmation_token: "token1")
 
       get :show, params: { user: user, confirmation_token: "token1" }
 
+      expect(response).to have_http_status(:unprocessable_entity)
+    end
+
+    it "redirect to sign_in page with a existent and not used token " do
+      user = create(:user, confirmation_token: "token1", confirmed_at: "")
+
+      get :show, params: { user: user, confirmation_token: "token1" }
+
       expect(response).to redirect_to(new_user_session_path)
     end
   end