class ApplicationForm
  include ::ActiveModel::Model
end

class SecurityForm < ApplicationForm
  attr_accessor :current_password, :password, :password_confirmation

  validates :current_password, :password, :password_confirmation, presence: true

  def update
    return false unless valid?

    self
  end
end

class SecurityController < AuthController
  def update
    @security_form = SecurityForm.from_params(form_params, record: current_user)
    if @security_form.update
      # redirect_to next step with all params
    else
      # render errors
    end
  end

  def form_params
    params.require(:security_form).permit(:current_password, :password, :password_confirmation)
  end
end