Release 2.0.0.rc2.

More helpful sign-up message for Confirmable

.gitignore

@@ -8,5 +8,3 @@ rdoc/*
 pkg
 log
 test/tmp/*
-Gemfile.lock
-

.travis.yml

@@ -1,12 +1,16 @@
 script: "bundle exec rake test"
+before_install: gem update --system
 rvm:
   - 1.8.7
   - 1.9.2
+  - 1.9.3
   - ree
-  - rbx
-  - rbx-2.0
-  - jruby
+gemfile:
+  - gemfiles/Gemfile.rails-3.1.x
+  - Gemfile
 notifications:
   recipients:
     - jose.valim@plataformatec.com.br
     - carlos@plataformatec.com.br
+    - rodrigo.flores@plataformatec.com.br
+    - rafael.franca@plataformatec.com.br

CHANGELOG.rdoc

@@ -1,3 +1,96 @@
+== 2.0.0.rc2
+
+Notes: https://github.com/plataformatec/devise/wiki/How-To:-Upgrade-to-Devise-2.0
+
+* bug fix
+  * Fix incorrect message for locked account (by @jigyasa)
+  * Regenerate confirmation token on reconfirmation (by @nashby)
+  * Allow alternate ORMs to run compatibility setup code before Authenticatable is included (by @jm81)
+  * Do not run validations unless on reconfirmable branch
+
+* enhancements
+  * Redirect to the previous URL on timeout
+  * Inherit from the same Devise parent controller (by @sj26)
+  * Allow parent_controller to be customizable via Devise.parent_controller, useful for engines
+  * Allow router_name to be customizable via Devise.router_name, useful for engines
+
+* deprecation
+  * Move devise/shared/_links.erb to devise/_links.erb
+  * Devise only supports Rails 3.1 forward
+  * Deprecated support for nested devise_for blocks
+  * Deprecated support to devise.registrations.reasons and devise.registrations.inactive_signed_up in favor of devise.registrations.signed_up_but_*
+
+== 2.0.0.rc
+
+* enhancements
+  * Add support for e-mail reconfirmation on change (by @Mandaryn and @heimidal)
+  * Redirect users to sign in page after unlock (by @nashby)
+
+* deprecation
+  * Devise.apply_schema is deprecated
+  * Devise migration helpers are deprecated
+  * Usage of Devise.remember_across_browsers was deprecated
+  * Usage of Devise.confirm_within was deprecated in favor Devise.allow_unconfirmed_access_for
+  * Usage of rememberable with remember_token was removed
+  * Usage of recoverable without reset_password_sent_at was removed
+  * Usage of Devise.case_insensitive_keys equals to false was removed
+  * Usage of Devise.stateless_token= is deprecated in favor of appending :token_auth to Devise.skip_session_storage
+
+== 1.5.3
+
+* bug fix
+  * Ensure delegator converts scope to symbol (by @dmitriy-kiriyenko)
+  * Ensure passing :format => false to devise_for is not permanent
+  * Ensure path checker does not check invalid routes
+
+== 1.5.2
+
+* enhancements
+  * Add support for Rails 3.1 new mass assignment conventions (by @kirs)
+  * Add timeout_in method to Timeoutable, it can be overridden in a model (by @lest)
+
+* bug fix
+  * OmniAuth error message now shows the proper option (:strategy_class instead of :klass)
+
+== 1.5.1
+
+* bug fix
+  * Devise should not attempt to load OmniAuth strategies. Strategies should be loaded before hand by the developer or explicitly given to Devise.
+
+== 1.5.0
+
+* enhancements
+  * Timeoutable also skips tracking if skip_trackable is given
+  * devise_for now accepts :failure_app as an option
+  * Models can select the proper mailer via devise_mailer method (by @locomotivecms)
+  * Migration generator now uses the change method (by @nashby)
+  * Support to markerb templates on the mailer generator (by @sbounmy)
+  * Support for Omniauth 1.0 (older versions are no longer supported) (by @TamiasSibiricus)
+
+* bug fix
+  * Allow idempotent API requests
+  * Fix bug where logs did not show 401 as status code
+  * Change paranoid settings to behave as success instead of as failure
+  * Fix bug where activation messages were shown first than the credentials error message
+  * Instance variables are expired after sign out
+
+* deprecation
+  * redirect_location is deprecated, please use after_sign_in_path_for
+  * after_sign_in_path_for now redirects to session[scope_return_to] if any value is stored in it
+
+== 1.4.9
+
+* bug fix
+  * url helpers were not being set under some circumstances
+
+== 1.4.8
+
+* enhancements
+  * Add docs for assets pipeline and Heroku
+
+* bug fix
+  * confirmation_url was not being set under some circumstances
+
 == 1.4.7
 
 * bug fix
@@ -15,7 +108,7 @@
 
 * bug fix
   * Failure app tries the root path if a session one does not exist
-  * No need to finalize Devise helpers all the time (by github.com/bradleypriest)
+  * No need to finalize Devise helpers all the time (by @bradleypriest)
   * Reset password shows proper message if user is not active
   * `clean_up_passwords` sets the accessors to nil to skip validations
 
@@ -50,7 +143,7 @@
 * enhancements
   * Add :defaults and :format support on router
   * Add simple form generators
-  * Better localization for devise_error_messages! (by github.com/zedtux)
+  * Better localization for devise_error_messages! (by @zedtux)
 
 * bug fix
   * Ensure to_xml is properly white listened
@@ -59,20 +152,20 @@
 == 1.4.0
 
 * enhancements
-  * Added authenticated and unauthenticated to the router to route the used based on his status (by github.com/sj26)
-  * Improve e-mail regexp (by github.com/rodrigoflores)
-  * Add strip_whitespace_keys and default to e-mail (by github.com/swrobel)
-  * Do not run format and uniqueness validations on e-mail if it hasn't changed (by github.com/Thibaut)
-  * Added update_without_password to update models but not allowing the password to change (by github.com/fschwahn)
-  * Added config.paranoid, check the generator for more information (by github.com/rodrigoflores)
+  * Added authenticated and unauthenticated to the router to route the used based on his status (by @sj26)
+  * Improve e-mail regexp (by @rodrigoflores)
+  * Add strip_whitespace_keys and default to e-mail (by @swrobel)
+  * Do not run format and uniqueness validations on e-mail if it hasn't changed (by @Thibaut)
+  * Added update_without_password to update models but not allowing the password to change (by @fschwahn)
+  * Added config.paranoid, check the generator for more information (by @rodrigoflores)
 
 * bug fix
   * password_required? should not affect length validation
   * User cannot access sign up and similar pages if he is already signed in through a cookie or token
-  * Do not convert booleans to strings on finders (by github.com/xavier)
-  * Run validations even if current_password fails (by github.com/crx)
-  * Devise now honors routes constraints (by github.com/macmartine)
-  * Do not return the user resource when requesting instructions (by github.com/rodrigoflores)
+  * Do not convert booleans to strings on finders (by @xavier)
+  * Run validations even if current_password fails (by @crx)
+  * Devise now honors routes constraints (by @macmartine)
+  * Do not return the user resource when requesting instructions (by @rodrigoflores)
 
 == 1.3.4
 
@@ -87,31 +180,31 @@
 == 1.3.2
 
 * bug fix
-  * Fix another regression related to reset_password_sent_at (by github.com/alexdreher)
+  * Fix another regression related to reset_password_sent_at (by @alexdreher)
 
 == 1.3.1
 
 * enhancements
-  * Improve failure_app responses (by github.com/indirect)
+  * Improve failure_app responses (by @indirect)
   * sessions/new and registrations/new also respond to xml and json now
 
 * bug fix
-  * Fix a regression that occurred if reset_password_sent_at is not present (by github.com/stevehodgkiss)
+  * Fix a regression that occurred if reset_password_sent_at is not present (by @stevehodgkiss)
 
 == 1.3.0
 
 * enhancements
-  * All controllers can now handle different mime types than html using Responders (by github.com/sikachu)
-  * Added reset_password_within as configuration option to send the token for recovery (by github.com/jdguyot)
-  * Bump password length to 128 characters (by github.com/k33l0r)
-  * Add :only as option to devise_for (by github.com/timoschilling)
-  * Allow to override path after sending password instructions (by github.com/irohiroki)
-  * require_no_authentication has its own flash message (by github.com/jackdempsey)
+  * All controllers can now handle different mime types than html using Responders (by @sikachu)
+  * Added reset_password_within as configuration option to send the token for recovery (by @jdguyot)
+  * Bump password length to 128 characters (by @k33l0r)
+  * Add :only as option to devise_for (by @timoschilling)
+  * Allow to override path after sending password instructions (by @irohiroki)
+  * require_no_authentication has its own flash message (by @jackdempsey)
 
 * bug fix
   * Fix a bug where configuration options were being included too late
-  * Ensure Devise::TestHelpers can be used to tests Devise internal controllers (by github.com/jwilger)
-  * valid_password? should not choke on empty passwords (by github.com/mikel)
+  * Ensure Devise::TestHelpers can be used to tests Devise internal controllers (by @jwilger)
+  * valid_password? should not choke on empty passwords (by @mikel)
   * Calling devise more than once does not include previously added modules anymore
   * downcase_keys before validation
 
@@ -138,16 +231,16 @@
 
 * bug fix
   * Fix an issue causing infinite redirects in production
-  * rails g destroy works properly with devise generators (by github.com/andmej)
-  * before_failure callbacks should work on test helpers (by github.com/twinge)
-  * rememberable cookie now is httponly by default (by github.com/JamesFerguson)
-  * Add missing confirmation_keys (by github.com/JohnPlummer)
+  * rails g destroy works properly with devise generators (by @andmej)
+  * before_failure callbacks should work on test helpers (by @twinge)
+  * rememberable cookie now is httponly by default (by @JamesFerguson)
+  * Add missing confirmation_keys (by @JohnPlummer)
   * Ensure after_* hooks are called on RegistrationsController
   * When using database_authenticatable Devise will now only create an email field when appropriate (if using default authentication_keys or custom authentication_keys with email included)
-  * Ensure stateless token does not trigger timeout (by github.com/pixelauthority)
+  * Ensure stateless token does not trigger timeout (by @pixelauthority)
   * Implement handle_unverified_request for Rails 3.0.4 compatibility and improve FailureApp reliance on symbols
   * Consider namespaces while generating routes
-  * Custom failure apps no longer ignored in test mode (by github.com/jaghion)
+  * Custom failure apps no longer ignored in test mode (by @jaghion)
   * Do not depend on ActiveModel::Dirty
   * Manual sign_in now triggers remember token
   * Be sure to halt strategies on failures
@@ -156,7 +249,7 @@
   * Ensure there is no Mongoid injection
 
 * deprecations
-  * Deprecated anybody_signed_in? in favor of signed_in? (by github.com/gavinhughes)
+  * Deprecated anybody_signed_in? in favor of signed_in? (by @gavinhughes)
   * Removed --haml and --slim view templates
   * Devise::OmniAuth helpers were deprecated and removed in favor of Omniauth.config.test_mode
 
@@ -169,11 +262,11 @@
 * enhancements
   * Added OmniAuth support
   * Added ORM adapter to abstract ORM iteraction
-  * sign_out_via is available in the router to configure the method used for sign out (by github.com/martinrehfeld)
-  * Improved Ajax requests handling in failure app (by github.com/spastorino)
+  * sign_out_via is available in the router to configure the method used for sign out (by @martinrehfeld)
+  * Improved Ajax requests handling in failure app (by @spastorino)
   * Added request_keys to easily use request specific values (like subdomain) in authentication
   * Increased the size of friendly_token to 60 characters (reduces the chances of a successful brute attack)
-  * Ensure the friendly token does not include "_" or "-" since some e-mails may not autolink it properly (by github.com/rymai)
+  * Ensure the friendly token does not include "_" or "-" since some e-mails may not autolink it properly (by @rymai)
   * Extracted encryptors into :encryptable for better bcrypt support
   * :rememberable is now able to use salt as token if no remember_token is provided
   * Store the salt in session and expire the session if the user changes his password
@@ -182,7 +275,7 @@
   * Sign up now check if the user is active or not and redirect him accordingly setting the inactive_signed_up message
   * Use ActiveModel#to_key instead of #id
   * sign_out_all_scopes now destroys the whole session
-  * Added case_insensitive_keys that automatically downcases the given keys, by default downcases only e-mail (by github.com/adahl)
+  * Added case_insensitive_keys that automatically downcases the given keys, by default downcases only e-mail (by @adahl)
 
 * default behavior changes
   * sign_out_all_scopes defaults to true as security measure
@@ -191,12 +284,12 @@
 
 * bugfix
   * after_sign_in_path_for always receives a resource
-  * Do not execute Warden::Callbacks on Devise::TestHelpers (by github.com/sgronblo)
-  * Allow password recovery and account unlocking to change used keys (by github.com/RStankov)
+  * Do not execute Warden::Callbacks on Devise::TestHelpers (by @sgronblo)
+  * Allow password recovery and account unlocking to change used keys (by @RStankov)
   * FailureApp now properly handles nil request.format
   * Fix a bug causing FailureApp to return with HTTP Auth Headers for IE7
   * Ensure namespaces has proper scoped views
-  * Ensure Devise does not set empty flash messages (by github.com/sxross)
+  * Ensure Devise does not set empty flash messages (by @sxross)
 
 == 1.1.6
 
@@ -221,11 +314,11 @@
 
 * bugfix
   * Add reply-to to e-mail headers by default
-  * Updated the views generator to respect the rails :template_engine option (by github.com/fredwu)
+  * Updated the views generator to respect the rails :template_engine option (by @fredwu)
   * Check the type of HTTP Authentication before using Basic headers
-  * Avoid invalid_salt errors by checking salt presence (by github.com/thibaudgg)
-  * Forget user deletes the right cookie before logout, not remembering the user anymore (by github.com/emtrane)
-  * Fix for failed first-ever logins on PostgreSQL where column default is nil (by github.com/bensie)
+  * Avoid invalid_salt errors by checking salt presence (by @thibaudgg)
+  * Forget user deletes the right cookie before logout, not remembering the user anymore (by @emtrane)
+  * Fix for failed first-ever logins on PostgreSQL where column default is nil (by @bensie)
   * :default options is now honored in migrations
 
 == 1.1.2
@@ -241,16 +334,16 @@
 == 1.1.0
 
 * enhancements
-  * Rememberable module allows user to be remembered across browsers and is enabled by default (by github.com/trevorturk)
-  * Rememberable module allows you to activate the period the remember me token is extended (by github.com/trevorturk)
+  * Rememberable module allows user to be remembered across browsers and is enabled by default (by @trevorturk)
+  * Rememberable module allows you to activate the period the remember me token is extended (by @trevorturk)
   * devise_for can now be used together with scope method in routes but with a few limitations (check the documentation)
   * Support `as` or `devise_scope` in the router to specify controller access scope
-  * HTTP Basic Auth can now be disabled/enabled for xhr(ajax) requests using http_authenticatable_on_xhr option (by github.com/pellja)
+  * HTTP Basic Auth can now be disabled/enabled for xhr(ajax) requests using http_authenticatable_on_xhr option (by @pellja)
 
 * bug fix
   * Fix a bug in Devise::TestHelpers where current_user was returning a Response object for non active accounts
   * Devise should respect script_name and path_info contracts
-  * Fix a bug when accessing a path with (.:format) (by github.com/klacointe)
+  * Fix a bug when accessing a path with (.:format) (by @klacointe)
   * Do not add unlock routes unless unlock strategy is email or both
   * Email should be case insensitive
   * Store classes as string in session, to avoid serialization and stale data issues
@@ -261,10 +354,10 @@
 == 1.1.rc2
 
 * enhancements
-  * Allow to set cookie domain for the remember token. (by github.com/mantas)
+  * Allow to set cookie domain for the remember token. (by @mantas)
   * Added navigational formats to specify when it should return a 302 and when a 401.
-  * Added authenticate(scope) support in routes (by github.com/wildchild)
-  * Added after_update_path_for to registrations controller (by github.com/thedelchop)
+  * Added authenticate(scope) support in routes (by @wildchild)
+  * Added after_update_path_for to registrations controller (by @thedelchop)
   * Allow the mailer object to be replaced through config.mailer = "MyOwnMailer"
 
 * bug fix
@@ -312,10 +405,10 @@
 
 * enhancements
   * Support for latest MongoMapper
-  * Added anybody_signed_in? helper (by github.com/SSDany)
+  * Added anybody_signed_in? helper (by @SSDany)
 
 * bug fix
-  * confirmation_required? is properly honored on active? calls. (by github.com/paulrosania)
+  * confirmation_required? is properly honored on active? calls. (by @paulrosania)
 
 == 1.0.7
 
@@ -356,7 +449,7 @@
 == 1.0.2
 
 * enhancements
-  * Allows you set mailer content type (by github.com/glennr)
+  * Allows you set mailer content type (by @glennr)
 
 * bug fix
   * Uses the same content type as request on http authenticatable 401 responses
@@ -389,12 +482,12 @@
 
 * enhancements
   * Added gemspec to repo
-  * Added token authenticatable (by github.com/grimen)
+  * Added token authenticatable (by @grimen)
 
 == 0.9.1
 
 * bug fix
-  * Allow bigger salt size (by github.com/jgeiger)
+  * Allow bigger salt size (by @jgeiger)
   * Fix relative url root
 
 == 0.9.0
@@ -404,11 +497,11 @@
   * :success and :failure flash messages are now :notice and :alert
 
 * enhancements
-  * Added devise lockable (by github.com/mhfs)
+  * Added devise lockable (by @mhfs)
   * Warden 0.9.0 compatibility
   * Mongomapper 0.6.10 compatibility
-  * Added Devise.add_module as hooks for extensions (by github.com/grimen)
-  * Ruby 1.9.1 compatibility (by github.com/grimen)
+  * Added Devise.add_module as hooks for extensions (by @grimen)
+  * Ruby 1.9.1 compatibility (by @grimen)
 
 * bug fix
   * Accept path prefix not starting with slash
@@ -417,10 +510,10 @@
 == 0.8.2
 
 * enhancements
-  * Allow Devise.mailer_sender to be a proc (by github.com/grimen)
+  * Allow Devise.mailer_sender to be a proc (by @grimen)
 
 * bug fix
-  * Fix bug with passenger, update is required to anyone deploying on passenger (by github.com/dvdpalm)
+  * Fix bug with passenger, update is required to anyone deploying on passenger (by @dvdpalm)
 
 == 0.8.1
 
@@ -437,11 +530,11 @@
 * enhancements
   * Warden 0.8.0 compatibility
   * Add an easy for map.connect "sign_in", :controller => "sessions", :action => "new" to work
-  * Added :bcrypt encryptor (by github.com/capotej)
+  * Added :bcrypt encryptor (by @capotej)
 
 * bug fix
   * sign_in_count is also increased when user signs in via password change, confirmation, etc..
-  * More DataMapper compatibility (by github.com/lancecarlson)
+  * More DataMapper compatibility (by @lancecarlson)
 
 * deprecation
   * Removed DeviseMailer.sender
@@ -481,7 +574,7 @@
 == 0.7.1
 
 * enhancements
-  * Small enhancements for other plugins compatibility (by github.com/grimen)
+  * Small enhancements for other plugins compatibility (by @grimen)
 
 == 0.7.0
 
@@ -575,9 +668,9 @@
   * Fixed a bug where remember me module was not working properly
 
 * enhancements
-  * Moved encryption strategy into the Encryptors module to allow several algorithms (by github.com/mhfs)
-  * Implemented encryptors for Clearance, Authlogic and Restful-Authentication (by github.com/mhfs)
-  * Added support for MongoMapper (by github.com/shingara)
+  * Moved encryption strategy into the Encryptors module to allow several algorithms (by @mhfs)
+  * Implemented encryptors for Clearance, Authlogic and Restful-Authentication (by @mhfs)
+  * Added support for MongoMapper (by @shingara)
 
 == 0.4.3
 

Gemfile

@@ -2,27 +2,26 @@ source "http://rubygems.org"
 
 gemspec
 
-gem "rails", "~> 3.1.0"
-gem "oa-oauth", '~> 0.2.0', :require => "omniauth/oauth"
-gem "oa-openid", '~> 0.2.0', :require => "omniauth/openid"
-
+gem "rails", "~> 3.2.0"
+gem "omniauth", "~> 1.0.0"
+gem "omniauth-oauth2", "~> 1.0.0"
 gem "rdoc"
 
 group :test do
+  gem "omniauth-facebook"
+  gem "omniauth-openid", "~> 1.0.1"
   gem "webrat", "0.7.2", :require => false
   gem "mocha", :require => false
+
+  platforms :mri_18 do
+    gem "ruby-debug", ">= 0.10.3"
+  end
 end
 
 platforms :jruby do
-  gem 'activerecord-jdbc-adapter', :git => 'https://github.com/nicksieger/activerecord-jdbc-adapter.git'
-  gem 'activerecord-jdbcsqlite3-adapter'
-  gem 'jruby-openssl'
-end
-
-platforms :mri_18 do
-  group :test do
-    gem "ruby-debug", ">= 0.10.3"
-  end
+  gem "activerecord-jdbc-adapter"
+  gem "activerecord-jdbcsqlite3-adapter"
+  gem "jruby-openssl"
 end
 
 platforms :ruby do

Gemfile.lock

@@ -0,0 +1,167 @@
+PATH
+  remote: .
+  specs:
+    devise (2.0.0.rc)
+      bcrypt-ruby (~> 3.0)
+      orm_adapter (~> 0.0.3)
+      railties (~> 3.1)
+      warden (~> 1.1)
+
+GEM
+  remote: http://rubygems.org/
+  specs:
+    actionmailer (3.2.0)
+      actionpack (= 3.2.0)
+      mail (~> 2.4.0)
+    actionpack (3.2.0)
+      activemodel (= 3.2.0)
+      activesupport (= 3.2.0)
+      builder (~> 3.0.0)
+      erubis (~> 2.7.0)
+      journey (~> 1.0.0)
+      rack (~> 1.4.0)
+      rack-cache (~> 1.1)
+      rack-test (~> 0.6.1)
+      sprockets (~> 2.1.2)
+    activemodel (3.2.0)
+      activesupport (= 3.2.0)
+      builder (~> 3.0.0)
+    activerecord (3.2.0)
+      activemodel (= 3.2.0)
+      activesupport (= 3.2.0)
+      arel (~> 3.0.0)
+      tzinfo (~> 0.3.29)
+    activeresource (3.2.0)
+      activemodel (= 3.2.0)
+      activesupport (= 3.2.0)
+    activesupport (3.2.0)
+      i18n (~> 0.6)
+      multi_json (~> 1.0)
+    addressable (2.2.6)
+    arel (3.0.0)
+    bcrypt-ruby (3.0.1)
+    bson (1.5.1)
+    bson_ext (1.3.1)
+    builder (3.0.0)
+    columnize (0.3.5)
+    erubis (2.7.0)
+    faraday (0.7.5)
+      addressable (~> 2.2.6)
+      multipart-post (~> 1.1.3)
+      rack (>= 1.1.0, < 2)
+    hashie (1.2.0)
+    hike (1.2.1)
+    i18n (0.6.0)
+    journey (1.0.0)
+    json (1.6.5)
+    linecache (0.46)
+      rbx-require-relative (> 0.0.4)
+    mail (2.4.1)
+      i18n (>= 0.4.0)
+      mime-types (~> 1.16)
+      treetop (~> 1.4.8)
+    metaclass (0.0.1)
+    mime-types (1.17.2)
+    mocha (0.10.0)
+      metaclass (~> 0.0.1)
+    mongo (1.3.1)
+      bson (>= 1.3.1)
+    mongoid (2.3.4)
+      activemodel (~> 3.1)
+      mongo (~> 1.3)
+      tzinfo (~> 0.3.22)
+    multi_json (1.0.4)
+    multipart-post (1.1.4)
+    nokogiri (1.5.0)
+    oauth2 (0.5.1)
+      faraday (~> 0.7.4)
+      multi_json (~> 1.0.3)
+    omniauth (1.0.1)
+      hashie (~> 1.2)
+      rack
+    omniauth-facebook (1.0.0)
+      omniauth-oauth2 (~> 1.0.0)
+    omniauth-oauth2 (1.0.0)
+      oauth2 (~> 0.5.0)
+      omniauth (~> 1.0)
+    omniauth-openid (1.0.1)
+      omniauth (~> 1.0)
+      rack-openid (~> 1.3.1)
+    orm_adapter (0.0.5)
+    polyglot (0.3.3)
+    rack (1.4.1)
+    rack-cache (1.1)
+      rack (>= 0.4)
+    rack-openid (1.3.1)
+      rack (>= 1.1.0)
+      ruby-openid (>= 2.1.8)
+    rack-ssl (1.3.2)
+      rack
+    rack-test (0.6.1)
+      rack (>= 1.0)
+    rails (3.2.0)
+      actionmailer (= 3.2.0)
+      actionpack (= 3.2.0)
+      activerecord (= 3.2.0)
+      activeresource (= 3.2.0)
+      activesupport (= 3.2.0)
+      bundler (~> 1.0)
+      railties (= 3.2.0)
+    railties (3.2.0)
+      actionpack (= 3.2.0)
+      activesupport (= 3.2.0)
+      rack-ssl (~> 1.3.2)
+      rake (>= 0.8.7)
+      rdoc (~> 3.4)
+      thor (~> 0.14.6)
+    rake (0.9.2.2)
+    rbx-require-relative (0.0.5)
+    rdoc (3.12)
+      json (~> 1.4)
+    ruby-debug (0.10.4)
+      columnize (>= 0.1)
+      ruby-debug-base (~> 0.10.4.0)
+    ruby-debug-base (0.10.4)
+      linecache (>= 0.3)
+    ruby-openid (2.1.8)
+    sprockets (2.1.2)
+      hike (~> 1.2)
+      rack (~> 1.0)
+      tilt (~> 1.1, != 1.3.0)
+    sqlite3 (1.3.5)
+    sqlite3-ruby (1.3.3)
+      sqlite3 (>= 1.3.3)
+    thor (0.14.6)
+    tilt (1.3.3)
+    treetop (1.4.10)
+      polyglot
+      polyglot (>= 0.3.1)
+    tzinfo (0.3.31)
+    warden (1.1.0)
+      rack (>= 1.0)
+    webrat (0.7.2)
+      nokogiri (>= 1.2.0)
+      rack (>= 1.0)
+      rack-test (>= 0.5.3)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  activerecord-jdbc-adapter
+  activerecord-jdbcsqlite3-adapter
+  bson_ext (~> 1.3.0)
+  devise!
+  jruby-openssl
+  mocha
+  mongo (~> 1.3.0)
+  mongoid (~> 2.0)
+  omniauth (~> 1.0.0)
+  omniauth-facebook
+  omniauth-oauth2 (~> 1.0.0)
+  omniauth-openid (~> 1.0.1)
+  rails (~> 3.2.0)
+  rdoc
+  ruby-debug (>= 0.10.3)
+  sqlite3-ruby
+  webrat (= 0.7.2)

README.rdoc

@@ -1,5 +1,9 @@
+*IMPORTANT:* Devise 2.0.0.rc is out. If you are upgrading, please read: https://github.com/plataformatec/devise/wiki/How-To:-Upgrade-to-Devise-2.0-migration-schema-style
+
 == Devise
 
+{<img src="https://secure.travis-ci.org/plataformatec/devise.png" />}[http://travis-ci.org/plataformatec/devise]
+
 Devise is a flexible authentication solution for Rails based on Warden. It:
 
 * Is Rack based;
@@ -28,13 +32,13 @@ It's comprised of 12 modules:
 
 The Devise Wiki has lots of additional information about Devise including many "how-to" articles and answers to the most frequently asked questions. Please browse the Wiki after finishing this README:
 
-http://wiki.github.com/plataformatec/devise
+https://wiki.github.com/plataformatec/devise
 
 === Bug reports
 
 If you discover a problem with Devise, we would like to know about it. However, we ask that you please review these guidelines before submitting a bug report:
 
-http://github.com/plataformatec/devise/wiki/Bug-reports
+https://github.com/plataformatec/devise/wiki/Bug-reports
 
 If you found a security bug, do *NOT* use the GitHub issue tracker. Send email or a private GitHub message to the maintainers listed at the bottom of the README.
 
@@ -42,7 +46,7 @@ If you found a security bug, do *NOT* use the GitHub issue tracker. Send email o
 
 If you have any questions, comments, or concerns, please use the Google Group instead of the GitHub issue tracker:
 
-http://groups.google.com/group/plataformatec-devise
+https://groups.google.com/group/plataformatec-devise
 
 === RDocs
 
@@ -56,21 +60,21 @@ If you need to use Devise with Rails 2.3, you can always run `gem server` from t
 
 There are a few example applications available on GitHub that demonstrate various features of Devise with different versions of Rails. You can view them here:
 
-http://github.com/plataformatec/devise/wiki/Example-Applications
+https://github.com/plataformatec/devise/wiki/Example-Applications
 
 === Extensions
 
 Our community has created a number of extensions that add functionality above and beyond what is included with Devise. You can view a list of available extensions and add your own here:
 
-http://github.com/plataformatec/devise/wiki/Extensions
+https://github.com/plataformatec/devise/wiki/Extensions
 
 === Contributing
 
 We hope that you will consider contributing to Devise. Please read this short overview for some information about how to get started:
 
-http://github.com/plataformatec/devise/wiki/Contributing
+https://github.com/plataformatec/devise/wiki/Contributing
 
-You will usually want to write tests for your changes.  To run the test suite, `cd` into Devise's top-level directory and run `bundle install` and `rake`.  For the tests to pass, you will need to have a MongoDB server (version 1.6 or newer) running on your system.
+You will usually want to write tests for your changes.  To run the test suite, `cd` into Devise's top-level directory and run `bundle install` and `rake`.  For the tests to pass, you will need to have a MongoDB server (version 2.0 or newer) running on your system.
 
 == Installation
 
@@ -86,7 +90,7 @@ The generator will install an initializer which describes ALL Devise's configura
 
   rails generate devise MODEL
 
-Replace MODEL by the class name used for the applications users, it's frequently 'User' but could also be 'Admin'. This will create a model (if one does not exist) and configure it with default Devise modules. Next, you'll usually run db:migrate as the generator will have created a migration file (if your ORM supports them). This generator also configures your config/routes.rb file, continue reading this file to understand exactly what the generator produces and how to use it.
+Replace MODEL by the class name used for the applications users, it's frequently 'User' but could also be 'Admin'. This will create a model (if one does not exist) and configure it with default Devise modules. Next, you'll usually run db:migrate as the generator will have created a migration file (if your ORM supports them). This generator also configures your config/routes.rb file, continue reading this file to understand exactly what the generator produces and how to use it. Finally, if your server was already running, then restart it as Rails doesn't automatically load methods from a new gem.
 
 Support for Rails 2.3.x can be found by installing Devise 1.0.x from the v1.0 branch.
 
@@ -208,7 +212,7 @@ Devise allows you to set up as many roles as you want. For example, you may have
 
 We built Devise to help you quickly develop an application that uses authentication. However, we don't want to be in your way when you need to customize it.
 
-Since Devise is an engine, all its views are packaged inside the gem. These views will help you get started, but after sometime you may want to change them. If this is the case, you just need to invoke the following generator, and it will copy all views to your application:
+Since Devise is an engine, all its views are packaged inside the gem. These views will help you get started, but after some time you may want to change them. If this is the case, you just need to invoke the following generator, and it will copy all views to your application:
 
   rails generate devise:views
 
@@ -289,7 +293,7 @@ The Devise mailer uses a similar pattern to create subject messages:
 
 Take a look at our locale file to check all available messages. You may also be interested in one of the many translations that are available on our wiki:
 
-http://github.com/plataformatec/devise/wiki/I18n
+https://github.com/plataformatec/devise/wiki/I18n
 
 === Test helpers
 
@@ -313,7 +317,7 @@ If you're using RSpec and want the helpers automatically included within all +de
     config.include Devise::TestHelpers, :type => :controller
   end
 
-Do not use such helpers for integration tests such as Cucumber or Webrat. Instead, fill in the form or explicitly set the user in session. For more tips, check the wiki (http://wiki.github.com/plataformatec/devise).
+Do not use such helpers for integration tests such as Cucumber or Webrat. Instead, fill in the form or explicitly set the user in session. For more tips, check the wiki (https://wiki.github.com/plataformatec/devise).
 
 === Omniauth
 
@@ -329,25 +333,36 @@ Devise supports ActiveRecord (default) and Mongoid. To choose other ORM, you jus
 
 Devise implements encryption strategies for Clearance, Authlogic and Restful-Authentication. To make use of these strategies, you need set the desired encryptor in the encryptor initializer config option and add :encryptable to your model. You might also need to rename your encrypted password and salt columns to match Devise's fields (encrypted_password and password_salt).
 
+== Troubleshooting
+
+=== Heroku
+
+Using devise on Heroku with Ruby on Rails 3.1 requires setting:
+
+  config.assets.initialize_on_precompile = false
+
+Read more about the potential issues at http://guides.rubyonrails.org/asset_pipeline.html
+
 == Additional information
 
 === Warden
 
 Devise is based on Warden, which is a general Rack authentication framework created by Daniel Neighman. We encourage you to read more about Warden here:
 
-http://github.com/hassox/warden
+https://github.com/hassox/warden
 
 === Contributors
 
 We have a long list of valued contributors. Check them all at:
 
-http://github.com/plataformatec/devise/contributors
+https://github.com/plataformatec/devise/contributors
 
 === Maintainers
 
-* José Valim (http://github.com/josevalim)
-* Carlos Antônio da Silva (http://github.com/carlosantoniodasilva)
+* José Valim (https://github.com/josevalim)
+* Carlos Antônio da Silva (https://github.com/carlosantoniodasilva)
+* Rodrigo Flores (https://github.com/rodrigoflores)
 
 == License
 
-MIT License. Copyright 2010 Plataforma Tecnologia. http://blog.plataformatec.com.br
+MIT License. Copyright 2011 Plataforma Tecnologia. http://blog.plataformatec.com.br

app/controllers/devise/confirmations_controller.rb

@@ -1,21 +1,17 @@
-class Devise::ConfirmationsController < ApplicationController
-  include Devise::Controllers::InternalHelpers
-
+class Devise::ConfirmationsController < DeviseController
   # GET /resource/confirmation/new
   def new
     build_resource({})
-    render_with_scope :new
   end
 
   # POST /resource/confirmation
   def create
     self.resource = resource_class.send_confirmation_instructions(params[resource_name])
 
-    if successful_and_sane?(resource)
-      set_flash_message(:notice, :send_instructions) if is_navigational_format?
+    if successfully_sent?(resource)
       respond_with({}, :location => after_resending_confirmation_instructions_path_for(resource_name))
     else
-      respond_with_navigational(resource){ render_with_scope :new }
+      respond_with(resource)
     end
   end
 
@@ -28,7 +24,7 @@ class Devise::ConfirmationsController < ApplicationController
       sign_in(resource_name, resource)
       respond_with_navigational(resource){ redirect_to after_confirmation_path_for(resource_name, resource) }
     else
-      respond_with_navigational(resource.errors, :status => :unprocessable_entity){ render_with_scope :new }
+      respond_with_navigational(resource.errors, :status => :unprocessable_entity){ render :new }
     end
   end
 
@@ -41,7 +37,7 @@ class Devise::ConfirmationsController < ApplicationController
 
     # The path used after confirmation.
     def after_confirmation_path_for(resource_name, resource)
-      redirect_location(resource_name, resource)
+      after_sign_in_path_for(resource)
     end
 
 end

app/controllers/devise/omniauth_callbacks_controller.rb

@@ -1,6 +1,4 @@
-class Devise::OmniauthCallbacksController < ApplicationController
-  include Devise::Controllers::InternalHelpers
-
+class Devise::OmniauthCallbacksController < DeviseController
   def failure
     set_flash_message :alert, :failure, :kind => failed_strategy.name.to_s.humanize, :reason => failure_message
     redirect_to after_omniauth_failure_path_for(resource_name)

app/controllers/devise/passwords_controller.rb

@@ -1,22 +1,19 @@
-class Devise::PasswordsController < ApplicationController
+class Devise::PasswordsController < DeviseController
   prepend_before_filter :require_no_authentication
-  include Devise::Controllers::InternalHelpers
 
   # GET /resource/password/new
   def new
     build_resource({})
-    render_with_scope :new
   end
 
   # POST /resource/password
   def create
     self.resource = resource_class.send_reset_password_instructions(params[resource_name])
 
-    if successful_and_sane?(resource)
-      set_flash_message(:notice, :send_instructions) if is_navigational_format?
+    if successfully_sent?(resource)
       respond_with({}, :location => after_sending_reset_password_instructions_path_for(resource_name))
     else
-      respond_with_navigational(resource){ render_with_scope :new }
+      respond_with(resource)
     end
   end
 
@@ -24,7 +21,6 @@ class Devise::PasswordsController < ApplicationController
   def edit
     self.resource = resource_class.new
     resource.reset_password_token = params[:reset_password_token]
-    render_with_scope :edit
   end
 
   # PUT /resource/password
@@ -35,9 +31,9 @@ class Devise::PasswordsController < ApplicationController
       flash_message = resource.active_for_authentication? ? :updated : :updated_not_active
       set_flash_message(:notice, flash_message) if is_navigational_format?
       sign_in(resource_name, resource)
-      respond_with resource, :location => redirect_location(resource_name, resource)
+      respond_with resource, :location => after_sign_in_path_for(resource)
     else
-      respond_with_navigational(resource){ render_with_scope :edit }
+      respond_with resource
     end
   end
 

app/controllers/devise/registrations_controller.rb

@@ -1,12 +1,11 @@
-class Devise::RegistrationsController < ApplicationController
+class Devise::RegistrationsController < DeviseController
   prepend_before_filter :require_no_authentication, :only => [ :new, :create, :cancel ]
   prepend_before_filter :authenticate_scope!, :only => [:edit, :update, :destroy]
-  include Devise::Controllers::InternalHelpers
 
   # GET /resource/sign_up
   def new
     resource = build_resource({})
-    respond_with_navigational(resource){ render_with_scope :new }
+    respond_with resource
   end
 
   # POST /resource
@@ -17,21 +16,21 @@ class Devise::RegistrationsController < ApplicationController
       if resource.active_for_authentication?
         set_flash_message :notice, :signed_up if is_navigational_format?
         sign_in(resource_name, resource)
-        respond_with resource, :location => redirect_location(resource_name, resource)
+        respond_with resource, :location => after_sign_up_path_for(resource)
       else
-        set_flash_message :notice, :inactive_signed_up, :reason => inactive_reason(resource) if is_navigational_format?
+        set_flash_message :notice, :"signed_up_but_#{resource.inactive_message}" if is_navigational_format?
         expire_session_data_after_sign_in!
         respond_with resource, :location => after_inactive_sign_up_path_for(resource)
       end
     else
-      clean_up_passwords(resource)
-      respond_with_navigational(resource) { render_with_scope :new }
+      clean_up_passwords resource
+      respond_with resource
     end
   end
 
   # GET /resource/edit
   def edit
-    render_with_scope :edit
+    render :edit
   end
 
   # PUT /resource
@@ -41,12 +40,17 @@ class Devise::RegistrationsController < ApplicationController
     self.resource = resource_class.to_adapter.get!(send(:"current_#{resource_name}").to_key)
 
     if resource.update_with_password(params[resource_name])
-      set_flash_message :notice, :updated if is_navigational_format?
+      if is_navigational_format?
+        if resource.respond_to?(:pending_reconfirmation?) && resource.pending_reconfirmation?
+          flash_key = :update_needs_confirmation
+        end
+        set_flash_message :notice, flash_key || :updated
+      end
       sign_in resource_name, resource, :bypass => true
       respond_with resource, :location => after_update_path_for(resource)
     else
-      clean_up_passwords(resource)
-      respond_with_navigational(resource){ render_with_scope :edit }
+      clean_up_passwords resource
+      respond_with resource
     end
   end
 
@@ -70,51 +74,34 @@ class Devise::RegistrationsController < ApplicationController
 
   protected
 
-    # Build a devise resource passing in the session. Useful to move
-    # temporary session data to the newly created user.
-    def build_resource(hash=nil)
-      hash ||= params[resource_name] || {}
-      self.resource = resource_class.new_with_session(hash, session)
-    end
+  # Build a devise resource passing in the session. Useful to move
+  # temporary session data to the newly created user.
+  def build_resource(hash=nil)
+    hash ||= params[resource_name] || {}
+    self.resource = resource_class.new_with_session(hash, session)
+  end
 
-    # The path used after sign up. You need to overwrite this method
-    # in your own RegistrationsController.
-    def after_sign_up_path_for(resource)
-      after_sign_in_path_for(resource)
-    end
+  # The path used after sign up. You need to overwrite this method
+  # in your own RegistrationsController.
+  def after_sign_up_path_for(resource)
+    after_sign_in_path_for(resource)
+  end
 
-    # Overwrite redirect_for_sign_in so it takes uses after_sign_up_path_for.
-    def redirect_location(scope, resource)
-      stored_location_for(scope) || after_sign_up_path_for(resource)
-    end
+  # The path used after sign up for inactive accounts. You need to overwrite
+  # this method in your own RegistrationsController.
+  def after_inactive_sign_up_path_for(resource)
+    respond_to?(:root_path) ? root_path : "/"
+  end
 
-    # Returns the inactive reason translated.
-    def inactive_reason(resource)
-      reason = resource.inactive_message.to_s
-      I18n.t("devise.registrations.reasons.#{reason}", :default => reason)
-    end
+  # The default url to be used after updating a resource. You need to overwrite
+  # this method in your own RegistrationsController.
+  def after_update_path_for(resource)
+    signed_in_root_path(resource)
+  end
 
-    # The path used after sign up for inactive accounts. You need to overwrite
-    # this method in your own RegistrationsController.
-    def after_inactive_sign_up_path_for(resource)
-      root_path
-    end
-
-    # The default url to be used after updating a resource. You need to overwrite
-    # this method in your own RegistrationsController.
-    def after_update_path_for(resource)
-      if defined?(super)
-        ActiveSupport::Deprecation.warn "Defining after_update_path_for in ApplicationController " <<
-          "is deprecated. Please add a RegistrationsController to your application and define it there."
-        super
-      else
-        after_sign_in_path_for(resource)
-      end
-    end
-
-    # Authenticates the current scope and gets the current resource from the session.
-    def authenticate_scope!
-      send(:"authenticate_#{resource_name}!", :force => true)
-      self.resource = send(:"current_#{resource_name}")
-    end
+  # Authenticates the current scope and gets the current resource from the session.
+  def authenticate_scope!
+    send(:"authenticate_#{resource_name}!", :force => true)
+    self.resource = send(:"current_#{resource_name}")
+  end
 end

app/controllers/devise/sessions_controller.rb

@@ -1,13 +1,12 @@
-class Devise::SessionsController < ApplicationController
+class Devise::SessionsController < DeviseController
   prepend_before_filter :require_no_authentication, :only => [ :new, :create ]
   prepend_before_filter :allow_params_authentication!, :only => :create
-  include Devise::Controllers::InternalHelpers
 
   # GET /resource/sign_in
   def new
     resource = build_resource
     clean_up_passwords(resource)
-    respond_with_navigational(resource, stub_options(resource)){ render_with_scope :new }
+    respond_with(resource, stub_options(resource))
   end
 
   # POST /resource/sign_in
@@ -15,19 +14,20 @@ class Devise::SessionsController < ApplicationController
     resource = warden.authenticate!(:scope => resource_name, :recall => "#{controller_path}#new")
     set_flash_message(:notice, :signed_in) if is_navigational_format?
     sign_in(resource_name, resource)
-    respond_with resource, :location => redirect_location(resource_name, resource)
+    respond_with resource, :location => after_sign_in_path_for(resource)
   end
 
-  # GET /resource/sign_out
+  # DELETE /resource/sign_out
   def destroy
     signed_in = signed_in?(resource_name)
+    redirect_path = after_sign_out_path_for(resource_name)
     Devise.sign_out_all_scopes ? sign_out : sign_out(resource_name)
     set_flash_message :notice, :signed_out if signed_in
 
-    # We actually need to hardcode this, as Rails default responder doesn't
+    # We actually need to hardcode this as Rails default responder doesn't
     # support returning empty response on GET request
     respond_to do |format|
-      format.any(*navigational_formats) { redirect_to after_sign_out_path_for(resource_name) }
+      format.any(*navigational_formats) { redirect_to redirect_path }
       format.all do
         method = "to_#{request_format}"
         text = {}.respond_to?(method) ? {}.send(method) : ""

app/controllers/devise/unlocks_controller.rb

@@ -1,22 +1,19 @@
-class Devise::UnlocksController < ApplicationController
+class Devise::UnlocksController < DeviseController
   prepend_before_filter :require_no_authentication
-  include Devise::Controllers::InternalHelpers
 
   # GET /resource/unlock/new
   def new
     build_resource({})
-    render_with_scope :new
   end
 
   # POST /resource/unlock
   def create
     self.resource = resource_class.send_unlock_instructions(params[resource_name])
 
-    if successful_and_sane?(resource)
-      set_flash_message :notice, :send_instructions if is_navigational_format?
+    if successfully_sent?(resource)
       respond_with({}, :location => new_session_path(resource_name))
     else
-      respond_with_navigational(resource){ render_with_scope :new }
+      respond_with(resource)
     end
   end
 
@@ -26,10 +23,9 @@ class Devise::UnlocksController < ApplicationController
 
     if resource.errors.empty?
       set_flash_message :notice, :unlocked if is_navigational_format?
-      sign_in(resource_name, resource)
-      respond_with_navigational(resource){ redirect_to redirect_location(resource_name, resource) }
+      respond_with_navigational(resource){ redirect_to new_session_path(resource) }
     else
-      respond_with_navigational(resource.errors, :status => :unprocessable_entity){ render_with_scope :new }
+      respond_with_navigational(resource.errors, :status => :unprocessable_entity){ render :new }
     end
   end
 end

app/controllers/devise_controller.rb

@@ -0,0 +1,169 @@
+# All Devise controllers are inherited from here.
+class DeviseController < Devise.parent_controller.constantize
+  include Devise::Controllers::ScopedViews
+
+  helper DeviseHelper
+
+  helpers = %w(resource scope_name resource_name signed_in_resource
+               resource_class devise_mapping devise_controller?)
+  hide_action *helpers
+  helper_method *helpers
+
+  prepend_before_filter :assert_is_devise_resource!
+  respond_to *Mime::SET.map(&:to_sym) if mimes_for_respond_to.empty?
+
+  # Gets the actual resource stored in the instance variable
+  def resource
+    instance_variable_get(:"@#{resource_name}")
+  end
+
+  # Proxy to devise map name
+  def resource_name
+    devise_mapping.name
+  end
+  alias :scope_name :resource_name
+
+  # Proxy to devise map class
+  def resource_class
+    devise_mapping.to
+  end
+
+  # Returns a signed in resource from session (if one exists)
+  def signed_in_resource
+    warden.authenticate(:scope => resource_name)
+  end
+
+  # Attempt to find the mapped route for devise based on request path
+  def devise_mapping
+    @devise_mapping ||= request.env["devise.mapping"]
+  end
+
+  # Overwrites devise_controller? to return true
+  def devise_controller?
+    true
+  end
+
+  protected
+
+  # Checks whether it's a devise mapped resource or not.
+  def assert_is_devise_resource! #:nodoc:
+    unknown_action! <<-MESSAGE unless devise_mapping
+Could not find devise mapping for path #{request.fullpath.inspect}.
+Maybe you forgot to wrap your route inside the scope block? For example:
+
+devise_scope :user do
+  match "/some/route" => "some_devise_controller"
+end
+MESSAGE
+  end
+
+  # Returns real navigational formats which are supported by Rails
+  def navigational_formats
+    @navigational_formats ||= Devise.navigational_formats.select { |format| Mime::EXTENSION_LOOKUP[format.to_s] }
+  end
+
+  def unknown_action!(msg)
+    logger.debug "[Devise] #{msg}" if logger
+    raise AbstractController::ActionNotFound, msg
+  end
+
+  # Sets the resource creating an instance variable
+  def resource=(new_resource)
+    instance_variable_set(:"@#{resource_name}", new_resource)
+  end
+
+  # Build a devise resource.
+  def build_resource(hash=nil)
+    hash ||= params[resource_name] || {}
+    self.resource = resource_class.new(hash)
+  end
+
+  # Helper for use in before_filters where no authentication is required.
+  #
+  # Example:
+  #   before_filter :require_no_authentication, :only => :new
+  def require_no_authentication
+    assert_is_devise_resource!
+    return unless is_navigational_format?
+    no_input = devise_mapping.no_input_strategies
+
+    authenticated = if no_input.present?
+      args = no_input.dup.push :scope => resource_name
+      warden.authenticate?(*args)
+    else
+      warden.authenticated?(resource_name)
+    end
+
+    if authenticated
+      resource = warden.user(resource_name)
+      flash[:alert] = I18n.t("devise.failure.already_authenticated")
+      redirect_to after_sign_in_path_for(resource)
+    end
+  end
+
+  # Helper for use after calling send_*_instructions methods on a resource.
+  # If we are in paranoid mode, we always act as if the resource was valid
+  # and instructions were sent.
+  def successfully_sent?(resource)
+    notice = if Devise.paranoid
+      resource.errors.clear
+      :send_paranoid_instructions
+    elsif resource.errors.empty?
+      :send_instructions
+    end
+
+    if notice
+      set_flash_message :notice, notice if is_navigational_format?
+      true
+    end
+  end
+
+  # Sets the flash message with :key, using I18n. By default you are able
+  # to setup your messages using specific resource scope, and if no one is
+  # found we look to default scope.
+  # Example (i18n locale file):
+  #
+  #   en:
+  #     devise:
+  #       passwords:
+  #         #default_scope_messages - only if resource_scope is not found
+  #         user:
+  #           #resource_scope_messages
+  #
+  # Please refer to README or en.yml locale file to check what messages are
+  # available.
+  def set_flash_message(key, kind, options={})
+    options[:scope] = "devise.#{controller_name}"
+    options[:default] = Array(options[:default]).unshift(kind.to_sym)
+    options[:resource_name] = resource_name
+    message = I18n.t("#{resource_name}.#{kind}", options)
+    flash[key] = message if message.present?
+  end
+
+  def clean_up_passwords(object)
+    object.clean_up_passwords if object.respond_to?(:clean_up_passwords)
+  end
+
+  def respond_with_navigational(*args, &block)
+    respond_with(*args) do |format|
+      format.any(*navigational_formats, &block)
+    end
+  end
+
+  def request_format
+    @request_format ||= request.format.try(:ref)
+  end
+
+  def is_navigational_format?
+    Devise.navigational_formats.include?(request.format.try(:ref))
+  end
+
+  # Override prefixes to consider the scoped view.
+  def _prefixes #:nodoc:
+    @_prefixes ||= if self.class.scoped_views?
+      super.unshift("#{devise_mapping.scoped_path}/#{controller_name}")
+    else
+      super
+    end
+  end
+end

app/views/devise/_links.erb

@@ -0,0 +1,25 @@
+<%- if controller_name != 'sessions' %>
+  <%= link_to "Sign in", new_session_path(resource_name) %><br />
+<% end -%>
+
+<%- if devise_mapping.registerable? && controller_name != 'registrations' %>
+  <%= link_to "Sign up", new_registration_path(resource_name) %><br />
+<% end -%>
+
+<%- if devise_mapping.recoverable? && controller_name != 'passwords' %>
+  <%= link_to "Forgot your password?", new_password_path(resource_name) %><br />
+<% end -%>
+
+<%- if devise_mapping.confirmable? && controller_name != 'confirmations' %>
+  <%= link_to "Didn't receive confirmation instructions?", new_confirmation_path(resource_name) %><br />
+<% end -%>
+
+<%- if devise_mapping.lockable? && resource_class.unlock_strategy_enabled?(:email) && controller_name != 'unlocks' %>
+  <%= link_to "Didn't receive unlock instructions?", new_unlock_path(resource_name) %><br />
+<% end -%>
+
+<%- if devise_mapping.omniauthable? %>
+  <%- resource_class.omniauth_providers.each do |provider| %>
+    <%= link_to "Sign in with #{provider.to_s.titleize}", omniauth_authorize_path(resource_name, provider) %><br />
+  <% end -%>
+<% end -%>

app/views/devise/confirmations/new.html.erb

@@ -9,4 +9,4 @@
   <div><%= f.submit "Resend confirmation instructions" %></div>
 <% end %>
 
-<%= render :partial => "devise/shared/links" %>
+<%= render "links" %>

app/views/devise/mailer/confirmation_instructions.html.erb

@@ -1,5 +1,5 @@
 <p>Welcome <%= @resource.email %>!</p>
 
-<p>You can confirm your account through the link below:</p>
+<p>You can confirm your account email through the link below:</p>
 
 <p><%= link_to 'Confirm my account', confirmation_url(@resource, :confirmation_token => @resource.confirmation_token) %></p>

app/views/devise/passwords/edit.html.erb

@@ -13,4 +13,4 @@
   <div><%= f.submit "Change my password" %></div>
 <% end %>
 
-<%= render :partial => "devise/shared/links" %>
+<%= render "links" %>

app/views/devise/passwords/new.html.erb

@@ -9,4 +9,4 @@
   <div><%= f.submit "Send me reset password instructions" %></div>
 <% end %>
 
-<%= render :partial => "devise/shared/links" %>
+<%= render "links" %>

app/views/devise/registrations/new.html.erb

@@ -15,4 +15,4 @@
   <div><%= f.submit "Sign up" %></div>
 <% end %>
 
-<%= render :partial => "devise/shared/links" %>
+<%= render "links" %>

app/views/devise/sessions/new.html.erb

@@ -14,4 +14,4 @@
   <div><%= f.submit "Sign in" %></div>
 <% end %>
 
-<%= render :partial => "devise/shared/links" %>
+<%= render "links" %>

app/views/devise/shared/_links.erb

@@ -1,25 +1,3 @@
-<%- if controller_name != 'sessions' %>
-  <%= link_to "Sign in", new_session_path(resource_name) %><br />
-<% end -%>
-
-<%- if devise_mapping.registerable? && controller_name != 'registrations' %>
-  <%= link_to "Sign up", new_registration_path(resource_name) %><br />
-<% end -%>
-
-<%- if devise_mapping.recoverable? && controller_name != 'passwords' %>
-  <%= link_to "Forgot your password?", new_password_path(resource_name) %><br />
-<% end -%>
-
-<%- if devise_mapping.confirmable? && controller_name != 'confirmations' %>
-  <%= link_to "Didn't receive confirmation instructions?", new_confirmation_path(resource_name) %><br />
-<% end -%>
-
-<%- if devise_mapping.lockable? && resource_class.unlock_strategy_enabled?(:email) && controller_name != 'unlocks' %>
-  <%= link_to "Didn't receive unlock instructions?", new_unlock_path(resource_name) %><br />
-<% end -%>
-
-<%- if devise_mapping.omniauthable? %>
-  <%- resource_class.omniauth_providers.each do |provider| %>
-    <%= link_to "Sign in with #{provider.to_s.titleize}", omniauth_authorize_path(resource_name, provider) %><br />
-  <% end -%>
-<% end -%>
+<% ActiveSupport::Deprecation.warn "Rendering partials devise/shared/_links.erb is deprecated" \
+  "please use devise/_links.erb instead." %>
+<%= render "links" %>

app/views/devise/unlocks/new.html.erb

@@ -9,4 +9,4 @@
   <div><%= f.submit "Resend unlock instructions" %></div>
 <% end %>
 
-<%= render :partial => "devise/shared/links" %>
+<%= render "links" %>

config/locales/en.yml

@@ -1,4 +1,4 @@
-# Additional translations at http://github.com/plataformatec/devise/wiki/I18n
+# Additional translations at https://github.com/plataformatec/devise/wiki/I18n
 
 en:
   errors:
@@ -35,16 +35,15 @@ en:
       confirmed: 'Your account was successfully confirmed. You are now signed in.'
     registrations:
       signed_up: 'Welcome! You have signed up successfully.'
-      inactive_signed_up: 'You have signed up successfully. However, we could not sign you in because your account is %{reason}.'
+      signed_up_but_unconfirmed: 'A message with a confirmation link has been sent to your email address. Please open the link to activate your account.'
+      signed_up_but_inactive: 'You have signed up successfully. However, we could not sign you in because your account is not yet activated.'
+      signed_up_but_locked: 'You have signed up successfully. However, we could not sign you in because your account is locked.'
       updated: 'You updated your account successfully.'
+      update_needs_confirmation: "You updated your account successfully, but we need to verify your new email address. Please check your email and click on the confirm link to finalize confirming your new email address."
       destroyed: 'Bye! Your account was successfully cancelled. We hope to see you again soon.'
-      reasons:
-        inactive: 'inactive'
-        unconfirmed: 'unconfirmed'
-        locked: 'locked'
     unlocks:
       send_instructions: 'You will receive an email with instructions about how to unlock your account in a few minutes.'
-      unlocked: 'Your account was successfully unlocked. You are now signed in.'
+      unlocked: 'Your account has been unlocked successfully. Please sign in to continue.'
       send_paranoid_instructions: 'If your account exists, you will receive an email with instructions about how to unlock it in a few minutes.'
     omniauth_callbacks:
       success: 'Successfully authorized from %{kind} account.'

devise.gemspec

@@ -5,7 +5,7 @@ require "devise/version"
 Gem::Specification.new do |s|
   s.name        = "devise"
   s.version     = Devise::VERSION.dup
-  s.platform    = Gem::Platform::RUBY  
+  s.platform    = Gem::Platform::RUBY
   s.summary     = "Flexible authentication solution for Rails with Warden"
   s.email       = "contact@plataformatec.com.br"
   s.homepage    = "http://github.com/plataformatec/devise"
@@ -14,12 +14,12 @@ Gem::Specification.new do |s|
 
   s.rubyforge_project = "devise"
 
-  s.files         = `git ls-files`.split("\n")
-  s.test_files    = `git ls-files -- {test,spec,features}/*`.split("\n")
-  s.executables   = `git ls-files -- bin/*`.split("\n").map{ |f| File.basename(f) }
+  s.files         = Dir["CHANGELOG.rdoc", "MIT-LICENSE", "README.rdoc", "app/**/*", "config/**/*", "lib/**/*"]
+  s.test_files    = Dir["test/**/*"]
   s.require_paths = ["lib"]
 
-  s.add_dependency("warden", "~> 1.0.3")
+  s.add_dependency("warden", "~> 1.1")
   s.add_dependency("orm_adapter", "~> 0.0.3")
   s.add_dependency("bcrypt-ruby", "~> 3.0")
-end
+  s.add_dependency("railties", "~> 3.1")
+end

gemfiles/Gemfile.rails-3.1.x

@@ -0,0 +1,35 @@
+source "http://rubygems.org"
+
+gem "devise", :path => ".."
+
+gem "rails", "~> 3.1.0"
+gem "omniauth", "~> 1.0.0"
+gem "omniauth-oauth2", "~> 1.0.0"
+gem "rdoc"
+
+group :test do
+  gem "omniauth-facebook"
+  gem "omniauth-openid", "~> 1.0.1"
+  gem "webrat", "0.7.2", :require => false
+  gem "mocha", :require => false
+
+  platforms :mri_18 do
+    gem "ruby-debug", ">= 0.10.3"
+  end
+end
+
+platforms :jruby do
+  gem "activerecord-jdbc-adapter"
+  gem "activerecord-jdbcsqlite3-adapter"
+  gem "jruby-openssl"
+end
+
+platforms :ruby do
+  gem "sqlite3-ruby"
+
+  group :mongoid do
+    gem "mongo", "~> 1.3.0"
+    gem "mongoid", "~> 2.0"
+    gem "bson_ext", "~> 1.3.0"
+  end
+end

lib/devise.rb

@@ -6,18 +6,18 @@ require 'set'
 require 'securerandom'
 
 module Devise
-  autoload :FailureApp, 'devise/failure_app'
-  autoload :OmniAuth, 'devise/omniauth'
+  autoload :Delegator,   'devise/delegator'
+  autoload :FailureApp,  'devise/failure_app'
+  autoload :OmniAuth,    'devise/omniauth'
+  autoload :ParamFilter, 'devise/param_filter'
   autoload :PathChecker, 'devise/path_checker'
-  autoload :Schema, 'devise/schema'
+  autoload :Schema,      'devise/schema'
   autoload :TestHelpers, 'devise/test_helpers'
 
   module Controllers
     autoload :Helpers, 'devise/controllers/helpers'
-    autoload :InternalHelpers, 'devise/controllers/internal_helpers'
     autoload :Rememberable, 'devise/controllers/rememberable'
     autoload :ScopedViews, 'devise/controllers/scoped_views'
-    autoload :SharedHelpers, 'devise/controllers/shared_helpers'
     autoload :UrlHelpers, 'devise/controllers/url_helpers'
   end
 
@@ -82,7 +82,7 @@ module Devise
   # False by default for backwards compatibility.
   mattr_accessor :case_insensitive_keys
   @@case_insensitive_keys = false
-  
+
   # Keys that should have whitespace stripped.
   # False by default for backwards compatibility.
   mattr_accessor :strip_whitespace_keys
@@ -118,27 +118,23 @@ module Devise
   mattr_accessor :remember_for
   @@remember_for = 2.weeks
 
-  # If true, a valid remember token can be re-used between multiple browsers.
-  mattr_accessor :remember_across_browsers
-  @@remember_across_browsers = true
-
   # If true, extends the user's remember period when remembered via cookie.
   mattr_accessor :extend_remember_period
   @@extend_remember_period = false
 
-  # If true, uses salt as remember token and does not create it in the database.
-  # By default is false for backwards compatibility.
-  mattr_accessor :use_salt_as_remember_token
-  @@use_salt_as_remember_token = false
-
   # Time interval you can access your account before confirming your account.
-  mattr_accessor :confirm_within
-  @@confirm_within = 0.days
+  mattr_accessor :allow_unconfirmed_access_for
+  @@allow_unconfirmed_access_for = 0.days
 
-  # Defines which key will be used when confirming an account
+  # Defines which key will be used when confirming an account.
   mattr_accessor :confirmation_keys
   @@confirmation_keys = [ :email ]
 
+  # Defines if email should be reconfirmable.
+  # False by default for backwards compatibility.
+  mattr_accessor :reconfirmable
+  @@reconfirmable = false
+
   # Time interval to timeout the user session without activity.
   mattr_accessor :timeout_in
   @@timeout_in = 30.minutes
@@ -151,11 +147,6 @@ module Devise
   mattr_accessor :encryptor
   @@encryptor = nil
 
-  # Tells if devise should apply the schema in ORMs where devise declaration
-  # and schema belongs to the same class (as Datamapper and Mongoid).
-  mattr_accessor :apply_schema
-  @@apply_schema = true
-
   # Scoped views. Since it relies on fallbacks to render default views, it's
   # turned off by default.
   mattr_accessor :scoped_views
@@ -188,6 +179,7 @@ module Devise
   @@reset_password_keys = [ :email ]
 
   # Time interval you can reset your password with a reset password key
+  # Nil by default for backwards compatibility.
   mattr_accessor :reset_password_within
   @@reset_password_within = nil
 
@@ -203,14 +195,13 @@ module Devise
   mattr_accessor :token_authentication_key
   @@token_authentication_key = :auth_token
 
-  # If true, authentication through token does not store user in session
-  mattr_accessor :stateless_token
-  @@stateless_token = false
+  # Skip session storage for the following strategies
+  mattr_accessor :skip_session_storage
+  @@skip_session_storage = []
 
   # Which formats should be treated as navigational.
-  # We need both :"*/*" and "*/*" to work on different Rails versions.
   mattr_accessor :navigational_formats
-  @@navigational_formats = [:"*/*", "*/*", :html]
+  @@navigational_formats = ["*/*", :html]
 
   # When set to true, signing out a user signs out all other scopes.
   mattr_accessor :sign_out_all_scopes
@@ -220,6 +211,45 @@ module Devise
   mattr_accessor :sign_out_via
   @@sign_out_via = :get
 
+  # The parent controller all Devise controllers inherits from.
+  # Defaults to ApplicationController. This should be set early
+  # in the initialization process and should be set to a string.
+  mattr_accessor :parent_controller
+  @@parent_controller = "ApplicationController"
+
+  # The router Devise should use to generate routes. Defaults
+  # to :main_app. Should be overriden by engines in order
+  # to provide custom routes.
+  mattr_accessor :router_name
+  @@router_name = :main_app
+
+  # DEPRECATED CONFIG
+
+  # If true, uses salt as remember token and does not create it in the database.
+  # By default is false for backwards compatibility.
+  mattr_accessor :use_salt_as_remember_token
+  @@use_salt_as_remember_token = false
+
+  # Tells if devise should apply the schema in ORMs where devise declaration
+  # and schema belongs to the same class (as Datamapper and Mongoid).
+  mattr_accessor :apply_schema
+  @@apply_schema = true
+
+  def self.remember_across_browsers=(value)
+    warn "\n[DEVISE] Devise.remember_across_browsers is deprecated and has no effect. Please remove it.\n"
+  end
+
+  def self.confirm_within=(value)
+    warn "\n[DEVISE] Devise.confirm_within= is deprecated. Please set Devise.allow_unconfirmed_access_for= instead.\n"
+    Devise.allow_unconfirmed_access_for = value
+  end
+
+  def self.stateless_token=(value)
+    warn "\n[DEVISE] Devise.stateless_token= is deprecated. Please append :token_auth to Devise.skip_session_storage " \
+      "instead, for example: Devise.skip_session_storage << :token_auth\n"
+    Devise.skip_session_storage << :token_auth
+  end
+
   # PRIVATE CONFIGURATION
 
   # Store scopes mappings.
@@ -313,7 +343,7 @@ module Devise
   #
   def self.add_module(module_name, options = {})
     ALL << module_name
-    options.assert_valid_keys(:strategy, :model, :controller, :route)
+    options.assert_valid_keys(:strategy, :model, :controller, :route, :no_input)
 
     if strategy = options[:strategy]
       strategy = (strategy == true ? module_name : strategy)
@@ -325,7 +355,7 @@ module Devise
       CONTROLLERS[module_name] = controller
     end
 
-    NO_INPUT << strategy if strategy && controller != :sessions
+    NO_INPUT << strategy if options[:no_input]
 
     if route = options[:route]
       case route
@@ -359,7 +389,7 @@ module Devise
   # initialization.
   #
   #  Devise.initialize do |config|
-  #    config.confirm_within = 2.days
+  #    config.allow_unconfirmed_access_for = 2.days
   #
   #    config.warden do |manager|
   #      # Configure warden to use other strategies, like oauth.
@@ -392,11 +422,6 @@ module Devise
     end
   end
 
-  # Returns true if Rails version is bigger than 3.0.x
-  def self.rack_session?
-    Rails::VERSION::STRING[0,3] != "3.0"
-  end
-
   # Regenerates url helpers considering Devise.mapping
   def self.regenerate_helpers!
     Devise::Controllers::UrlHelpers.remove_helpers!
@@ -407,7 +432,7 @@ module Devise
   # block.
   def self.configure_warden! #:nodoc:
     @@warden_configured ||= begin
-      warden_config.failure_app   = Devise::FailureApp
+      warden_config.failure_app   = Devise::Delegator.new
       warden_config.default_scope = Devise.default_scope
       warden_config.intercept_401 = false
 

lib/devise/controllers/helpers.rb

@@ -8,6 +8,13 @@ module Devise
         helper_method :warden, :signed_in?, :devise_controller?
       end
 
+      module ClassMethods
+        def log_process_action(payload)
+          payload[:status] ||= 401 unless payload[:exception]
+          super
+        end
+      end
+
       # Define authentication filters and accessor helpers based on mappings.
       # These filters should be used inside the controllers as before_filters,
       # so you can control the scope of the user who should be signed in to
@@ -37,11 +44,6 @@ module Devise
 
         class_eval <<-METHODS, __FILE__, __LINE__ + 1
           def authenticate_#{mapping}!(opts={})
-            if !opts.is_a?(Hash)
-              opts = { :force => opts }
-              ActiveSupport::Deprecation.warn "Passing a boolean to authenticate_#{mapping}! " \
-                "is deprecated, please use :force => \#{opts[:force]} instead", caller
-            end
             opts[:scope] = :#{mapping}
             warden.authenticate!(opts) if !devise_controller? || opts.delete(:force)
           end
@@ -86,7 +88,7 @@ module Devise
       # Return true if the given scope is signed in session. If no scope given, return
       # true if any scope is signed in. Does not run authentication hooks.
       def signed_in?(scope=nil)
-        [ scope || Devise.mappings.keys ].flatten.any? do |scope| 
+        [ scope || Devise.mappings.keys ].flatten.any? do |scope|
           warden.authenticate?(:scope => scope)
         end
       end
@@ -105,7 +107,7 @@ module Devise
       #   sign_in @user                             # sign_in(resource)
       #   sign_in @user, :event => :authentication  # sign_in(resource, options)
       #   sign_in @user, :bypass => true            # sign_in(resource, options)
-      # 
+      #
       def sign_in(resource_or_scope, *args)
         options  = args.extract_options!
         scope    = Devise::Mapping.find_scope!(resource_or_scope)
@@ -137,6 +139,7 @@ module Devise
         warden.user(scope) # Without loading user here, before_logout hook is not called
         warden.raw_session.inspect # Without this inspect here. The session does not clear.
         warden.logout(scope)
+        instance_variable_set(:"@current_#{scope}", nil)
       end
 
       # Sign out all active users or scopes. This helper is useful for signing out all roles
@@ -145,6 +148,7 @@ module Devise
         Devise.mappings.keys.each { |s| warden.user(s) }
         warden.raw_session.inspect
         warden.logout
+        expire_devise_cached_variables!
       end
 
       # Returns and delete the url stored in the session for the given scope. Useful
@@ -159,12 +163,27 @@ module Devise
         session.delete("#{scope}_return_to")
       end
 
+      # The scope root url to be used when he's signed in. By default, it first
+      # tries to find a resource_root_path, otherwise it uses the root_path.
+      def signed_in_root_path(resource_or_scope)
+        scope = Devise::Mapping.find_scope!(resource_or_scope)
+        home_path = "#{scope}_root_path"
+        if respond_to?(home_path, true)
+          send(home_path)
+        elsif respond_to?(:root_path)
+          root_path
+        else
+          "/"
+        end
+      end
+
       # The default url to be used after signing in. This is used by all Devise
       # controllers and you can overwrite it in your ApplicationController to
       # provide a custom hook for a custom resource.
       #
-      # By default, it first tries to find a resource_root_path, otherwise it
-      # uses the root path. For a user scope, you can define the default url in
+      # By default, it first tries to find a valid resource_return_to key in the
+      # session, then it fallbacks to resource_root_path, otherwise it uses the
+      # root path. For a user scope, you can define the default url in
       # the following way:
       #
       #   map.user_root '/users', :controller => 'users' # creates user_root_path
@@ -173,22 +192,20 @@ module Devise
       #     user.root :controller => 'users' # creates user_root_path
       #   end
       #
-      #
       # If the resource root path is not defined, root_path is used. However,
       # if this default is not enough, you can customize it, for example:
       #
       #   def after_sign_in_path_for(resource)
-      #     if resource.is_a?(User) && resource.can_publish?
-      #       publisher_url
-      #     else
-      #       super
-      #     end
+      #     stored_location_for(resource) ||
+      #       if resource.is_a?(User) && resource.can_publish?
+      #         publisher_url
+      #       else
+      #         signed_in_root_path(resource)
+      #       end
       #   end
       #
       def after_sign_in_path_for(resource_or_scope)
-        scope = Devise::Mapping.find_scope!(resource_or_scope)
-        home_path = "#{scope}_root_path"
-        respond_to?(home_path, true) ? send(home_path) : root_path
+        stored_location_for(resource_or_scope) || signed_in_root_path(resource_or_scope)
       end
 
       # Method used by sessions controller to sign out a user. You can overwrite
@@ -196,9 +213,9 @@ module Devise
       # scope. Notice that differently from +after_sign_in_path_for+ this method
       # receives a symbol with the scope, and not the resource.
       #
-      # By default is the root_path.
+      # By default it is the root_path.
       def after_sign_out_path_for(resource_or_scope)
-        root_path
+        respond_to?(:root_path) ? root_path : "/"
       end
 
       # Sign in a user and tries to redirect first to the stored location and
@@ -209,25 +226,25 @@ module Devise
         scope    = Devise::Mapping.find_scope!(resource_or_scope)
         resource = args.last || resource_or_scope
         sign_in(scope, resource, options)
-        redirect_to redirect_location(scope, resource)
+        redirect_to after_sign_in_path_for(resource)
       end
 
       def redirect_location(scope, resource) #:nodoc:
-        stored_location_for(scope) || after_sign_in_path_for(resource)
+        ActiveSupport::Deprecation.warn "redirect_location in Devise is deprecated. Please use after_sign_in_path_for instead.", caller
+        after_sign_in_path_for(resource)
+      end
+
+      def expire_session_data_after_sign_in!
+        session.keys.grep(/^devise\./).each { |k| session.delete(k) }
       end
 
       # Sign out a user and tries to redirect to the url specified by
       # after_sign_out_path_for.
       def sign_out_and_redirect(resource_or_scope)
         scope = Devise::Mapping.find_scope!(resource_or_scope)
+        redirect_path = after_sign_out_path_for(scope)
         Devise.sign_out_all_scopes ? sign_out : sign_out(scope)
-        redirect_to after_sign_out_path_for(scope)
-      end
-
-      # A hook called to expire session data after sign up/in. All keys
-      # stored under "devise." namespace are removed after sign in.
-      def expire_session_data_after_sign_in!
-        session.keys.grep(/^devise\./).each { |k| session.delete(k) }
+        redirect_to redirect_path
       end
 
       # Overwrite Rails' handle unverified request to sign out all scopes,
@@ -235,9 +252,15 @@ module Devise
       def handle_unverified_request
         sign_out_all_scopes
         warden.clear_strategies_cache!
-        Devise.mappings.each { |_,m| instance_variable_set("@current_#{m.name}", nil) }
+        expire_devise_cached_variables!
         super # call the default behaviour which resets the session
       end
+
+      private
+
+      def expire_devise_cached_variables!
+        Devise.mappings.each { |_,m| instance_variable_set("@current_#{m.name}", nil) }
+      end
     end
   end
 end

lib/devise/controllers/internal_helpers.rb

@@ -1,148 +0,0 @@
-module Devise
-  module Controllers
-    # Those helpers are used only inside Devise controllers and should not be
-    # included in ApplicationController since they all depend on the url being
-    # accessed.
-    module InternalHelpers #:nodoc:
-      extend ActiveSupport::Concern
-      include Devise::Controllers::ScopedViews
-      include Devise::Controllers::SharedHelpers
-
-      included do
-        helper DeviseHelper
-
-        helpers = %w(resource scope_name resource_name signed_in_resource
-                     resource_class devise_mapping devise_controller?)
-        hide_action *helpers
-        helper_method *helpers
-
-        prepend_before_filter :is_devise_resource?
-        respond_to *Mime::SET.map(&:to_sym) if mimes_for_respond_to.empty?
-      end
-
-      # Gets the actual resource stored in the instance variable
-      def resource
-        instance_variable_get(:"@#{resource_name}")
-      end
-
-      # Proxy to devise map name
-      def resource_name
-        devise_mapping.name
-      end
-      alias :scope_name :resource_name
-
-      # Proxy to devise map class
-      def resource_class
-        devise_mapping.to
-      end
-
-      # Returns a signed in resource from session (if one exists)
-      def signed_in_resource
-        warden.authenticate(:scope => resource_name)
-      end
-
-      # Attempt to find the mapped route for devise based on request path
-      def devise_mapping
-        @devise_mapping ||= request.env["devise.mapping"]
-      end
-
-      # Overwrites devise_controller? to return true
-      def devise_controller?
-        true
-      end
-
-    protected
-
-      # Checks whether it's a devise mapped resource or not.
-      def is_devise_resource? #:nodoc:
-        unknown_action! <<-MESSAGE unless devise_mapping
-Could not find devise mapping for path #{request.fullpath.inspect}.
-Maybe you forgot to wrap your route inside the scope block? For example:
-
-    devise_scope :user do
-      match "/some/route" => "some_devise_controller"
-    end
-MESSAGE
-      end
-
-      # Returns real navigational formats which are supported by Rails
-      def navigational_formats
-        @navigational_formats ||= Devise.navigational_formats.select{ |format| Mime::EXTENSION_LOOKUP[format.to_s] }
-      end
-
-      def unknown_action!(msg)
-        logger.debug "[Devise] #{msg}" if logger
-        raise ActionController::UnknownAction, msg
-      end
-
-      # Sets the resource creating an instance variable
-      def resource=(new_resource)
-        instance_variable_set(:"@#{resource_name}", new_resource)
-      end
-
-      # Build a devise resource.
-      def build_resource(hash=nil)
-        hash ||= params[resource_name] || {}
-        self.resource = resource_class.new(hash)
-      end
-
-      # Helper for use in before_filters where no authentication is required.
-      #
-      # Example:
-      #   before_filter :require_no_authentication, :only => :new
-      def require_no_authentication
-        no_input = devise_mapping.no_input_strategies
-        args = no_input.dup.push :scope => resource_name
-        if no_input.present? && warden.authenticate?(*args)
-          resource = warden.user(resource_name)
-          flash[:alert] = I18n.t("devise.failure.already_authenticated")
-          redirect_to after_sign_in_path_for(resource)
-        end
-      end
-
-      # Helper for use to validate if an resource is errorless. If we are on paranoid mode, we always should assume it is
-      # and return false.
-      def successful_and_sane?(resource)
-        if Devise.paranoid
-          set_flash_message :notice, :send_paranoid_instructions if is_navigational_format?
-          resource.errors.clear
-          false
-        else
-          resource.errors.empty?
-        end
-      end
-
-      # Sets the flash message with :key, using I18n. By default you are able
-      # to setup your messages using specific resource scope, and if no one is
-      # found we look to default scope.
-      # Example (i18n locale file):
-      #
-      #   en:
-      #     devise:
-      #       passwords:
-      #         #default_scope_messages - only if resource_scope is not found
-      #         user:
-      #           #resource_scope_messages
-      #
-      # Please refer to README or en.yml locale file to check what messages are
-      # available.
-      def set_flash_message(key, kind, options={}) #:nodoc:
-        options[:scope] = "devise.#{controller_name}"
-        options[:default] = Array(options[:default]).unshift(kind.to_sym)
-        options[:resource_name] = resource_name
-        message = I18n.t("#{resource_name}.#{kind}", options)
-        flash[key] = message if message.present?
-      end
-
-      def clean_up_passwords(object) #:nodoc:
-        object.clean_up_passwords if object.respond_to?(:clean_up_passwords)
-      end
-
-      def respond_with_navigational(*args, &block)
-        respond_with(*args) do |format|
-          format.any(*navigational_formats, &block)
-        end
-      end
-    end
-  end
-end

lib/devise/controllers/scoped_views.rb

@@ -12,22 +12,6 @@ module Devise
           @scoped_views = value
         end
       end
-
-    protected
-
-      # Render a view for the specified scope. Turned off by default.
-      # Accepts just :controller as option.
-      def render_with_scope(action, path=self.controller_path)
-        if self.class.scoped_views?
-          begin
-            render :template => "#{devise_mapping.scoped_path}/#{path.split("/").last}/#{action}"
-          rescue ActionView::MissingTemplate
-            render :template => "#{path}/#{action}"
-          end
-        else
-          render :template => "#{path}/#{action}"
-        end
-      end
     end
   end
 end

lib/devise/controllers/shared_helpers.rb

@@ -1,26 +0,0 @@
-module Devise
-  module Controllers
-    # Helpers used in both FailureApp and Devise controllers.
-    module SharedHelpers
-      MIME_REFERENCES = Mime::HTML.respond_to?(:ref)
-
-      protected
-
-      # Helper used by FailureApp and Devise controllers to retrieve proper formats.
-      def request_format
-        @request_format ||= if request.format.respond_to?(:ref)
-          request.format.ref
-        elsif MIME_REFERENCES
-          request.format
-        elsif request.format # Rails < 3.0.4
-          request.format.to_sym
-        end
-      end
-
-      # Check whether it's navigational format, such as :html or :iphone, or not.
-      def is_navigational_format?
-        Devise.navigational_formats.include?(request_format)
-      end
-    end
-  end
-end

lib/devise/controllers/url_helpers.rb

@@ -16,7 +16,15 @@ module Devise
     #   new_confirmation_path(:user) => new_user_confirmation_path
     #   confirmation_path(:user)     => user_confirmation_path
     #
-    # Those helpers are added to your ApplicationController.
+    # Those helpers are included by default to ActionController::Base.
+    #
+    # In case you want to add such helpers to another class, you can do
+    # that as long as this new class includes both url_helpers and
+    # mounted_helpers. Example:
+    #
+    #     include Rails.application.routes.url_helpers
+    #     include Rails.application.routes.mounted_helpers
+    #
     module UrlHelpers
       def self.remove_helpers!
         self.instance_methods.map(&:to_s).grep(/_(url|path)$/).each do |method|
@@ -24,25 +32,36 @@ module Devise
         end
       end
 
-      def self.generate_helpers!
-        mappings = Devise.mappings.values.map(&:used_helpers).flatten.uniq
-        routes = Devise::URL_HELPERS.slice(*mappings)
+      def self.generate_helpers!(routes=nil)
+        routes ||= begin
+          mappings = Devise.mappings.values.map(&:used_helpers).flatten.uniq
+          Devise::URL_HELPERS.slice(*mappings)
+        end
 
         routes.each do |module_name, actions|
           [:path, :url].each do |path_or_url|
             actions.each do |action|
               action = action ? "#{action}_" : ""
+              method = "#{action}#{module_name}_#{path_or_url}"
 
               class_eval <<-URL_HELPERS, __FILE__, __LINE__ + 1
-                def #{action}#{module_name}_#{path_or_url}(resource_or_scope, *args)
+                def #{method}(resource_or_scope, *args)
                   scope = Devise::Mapping.find_scope!(resource_or_scope)
-                  send("#{action}\#{scope}_#{module_name}_#{path_or_url}", *args)
+                  _devise_route_context.send("#{action}\#{scope}_#{module_name}_#{path_or_url}", *args)
                 end
               URL_HELPERS
             end
           end
         end
       end
+
+      generate_helpers!(Devise::URL_HELPERS)
+
+      private
+
+      def _devise_route_context
+        @_devise_route_context ||= send(Devise.router_name)
+      end
     end
   end
 end

lib/devise/delegator.rb

@@ -0,0 +1,16 @@
+module Devise
+  # Checks the scope in the given environment and returns the associated failure app.
+  class Delegator
+    def call(env)
+      failure_app(env).call(env)
+    end
+
+    def failure_app(env)
+      app = env["warden.options"] &&
+        (scope = env["warden.options"][:scope]) &&
+        Devise.mappings[scope.to_sym].failure_app
+
+      app || Devise::FailureApp
+    end
+  end
+end

lib/devise/encryptors/authlogic_sha512.rb

@@ -7,7 +7,7 @@ module Devise
     # Warning: it uses Devise's stretches configuration to port Authlogic's one. Should be set to 20 in the initializer to simulate
     #  the default behavior.
     class AuthlogicSha512 < Base
-      # Gererates a default password digest based on salt, pepper and the
+      # Generates a default password digest based on salt, pepper and the
       # incoming password.
       def self.digest(password, stretches, salt, pepper)
         digest = [password, salt].flatten.join('')

lib/devise/encryptors/clearance_sha1.rb

@@ -7,7 +7,7 @@ module Devise
     # Warning: it uses Devise's pepper to port the concept of REST_AUTH_SITE_KEY
     # Warning: it uses Devise's stretches configuration to port the concept of REST_AUTH_DIGEST_STRETCHES
     class ClearanceSha1 < Base
-      # Gererates a default password digest based on salt, pepper and the
+      # Generates a default password digest based on salt, pepper and the
       # incoming password.
       def self.digest(password, stretches, salt, pepper)
         Digest::SHA1.hexdigest("--#{salt}--#{password}--")

lib/devise/encryptors/restful_authentication_sha1.rb

@@ -9,7 +9,7 @@ module Devise
     # the initializer to simulate the default behavior.
     class RestfulAuthenticationSha1 < Base
 
-      # Gererates a default password digest based on salt, pepper and the
+      # Generates a default password digest based on salt, pepper and the
       # incoming password.
       def self.digest(password, stretches, salt, pepper)
         digest = pepper

lib/devise/encryptors/sha1.rb

@@ -5,7 +5,7 @@ module Devise
     # = Sha1
     # Uses the Sha1 hash algorithm to encrypt passwords.
     class Sha1 < Base
-      # Gererates a default password digest based on stretches, salt, pepper and the
+      # Generates a default password digest based on stretches, salt, pepper and the
       # incoming password.
       def self.digest(password, stretches, salt, pepper)
         digest = pepper

lib/devise/encryptors/sha512.rb

@@ -5,7 +5,7 @@ module Devise
     # = Sha512
     # Uses the Sha512 hash algorithm to encrypt passwords.
     class Sha512 < Base
-      # Gererates a default password digest based on salt, pepper and the
+      # Generates a default password digest based on salt, pepper and the
       # incoming password.
       def self.digest(password, stretches, salt, pepper)
         digest = pepper

lib/devise/failure_app.rb

@@ -9,17 +9,23 @@ module Devise
     include ActionController::RackDelegation
     include ActionController::UrlFor
     include ActionController::Redirecting
+
     include Rails.application.routes.url_helpers
-    include Devise::Controllers::SharedHelpers
+    include Rails.application.routes.mounted_helpers
 
     delegate :flash, :to => :request
 
     def self.call(env)
-      action(:respond).call(env)
+      @respond ||= action(:respond)
+      @respond.call(env)
     end
 
     def self.default_url_options(*args)
-      ApplicationController.default_url_options(*args)
+      if defined?(ApplicationController)
+        ApplicationController.default_url_options(*args)
+      else
+        {}
+      end
     end
 
     def respond
@@ -47,32 +53,50 @@ module Devise
 
     def redirect
       store_location!
-      flash[:alert] = i18n_message
+      if flash[:timedout] && flash[:alert]
+        flash.keep(:timedout)
+        flash.keep(:alert)
+      else
+        flash[:alert] = i18n_message
+      end
       redirect_to redirect_url
     end
 
   protected
 
     def i18n_message(default = nil)
-      message = warden.message || warden_options[:message] || default || :unauthenticated
+      message = warden_message || default || :unauthenticated
 
       if message.is_a?(Symbol)
         I18n.t(:"#{scope}.#{message}", :resource_name => scope,
-               :scope => "devise.failure", :default => [message, message.to_s])
+               :scope => "devise.failure", :default => [message])
       else
         message.to_s
       end
     end
 
     def redirect_url
+      if warden_message == :timeout
+        flash[:timedout] = true
+        attempted_path || scope_path
+      else
+        scope_path
+      end
+    end
+
+    def scope_path
       opts  = {}
       route = :"new_#{scope}_session_path"
       opts[:format] = request_format unless skip_format?
 
-      if respond_to?(route)
-        send(route, opts)
-      else
+      context = send(Devise.router_name)
+
+      if context.respond_to?(route)
+        context.send(route, opts)
+      elsif respond_to?(:root_path)
         root_path(opts)
+      else
+        "/"
       end
     end
 
@@ -129,6 +153,10 @@ module Devise
       env['warden.options']
     end
 
+    def warden_message
+      @message ||= warden.message || warden_options[:message]
+    end
+
     def scope
       @scope ||= warden_options[:scope] || Devise.default_scope
     end
@@ -144,5 +172,13 @@ module Devise
     def store_location!
       session["#{scope}_return_to"] = attempted_path if request.get? && !http_auth?
     end
+
+    def is_navigational_format?
+      Devise.navigational_formats.include?(request_format)
+    end
+
+    def request_format
+      @request_format ||= request.format.try(:ref)
+    end
   end
 end

lib/devise/hooks/timeoutable.rb

@@ -17,6 +17,8 @@ Warden::Manager.after_set_user do |record, warden, options|
       end
     end
 
-    warden.session(scope)['last_request_at'] = Time.now.utc
+    unless warden.request.env['devise.skip_trackable']
+      warden.session(scope)['last_request_at'] = Time.now.utc
+    end
   end
 end

lib/devise/mailers/helpers.rb

@@ -10,11 +10,6 @@ module Devise
 
       protected
 
-      def setup_mail(*args)
-        ActiveSupport::Deprecation.warn "setup_mail is deprecated, please use devise_mail instead", caller
-        devise_mail(*args)
-      end
-
       # Configure default email options
       def devise_mail(record, action)
         initialize_from_record(record)

lib/devise/mapping.rb

@@ -23,7 +23,8 @@ module Devise
   #
   class Mapping #:nodoc:
     attr_reader :singular, :scoped_path, :path, :controllers, :path_names,
-                :class_name, :sign_out_via, :format, :used_routes, :used_helpers
+                :class_name, :sign_out_via, :format, :used_routes, :used_helpers, :failure_app
+
     alias :name :singular
 
     # Receives an object and find a scope for it. If a scope cannot be found,
@@ -51,46 +52,19 @@ module Devise
       @singular = (options[:singular] || @scoped_path.tr('/', '_').singularize).to_sym
 
       @class_name = (options[:class_name] || name.to_s.classify).to_s
-      @ref = Devise.ref(@class_name)
+      @klass = Devise.ref(@class_name)
 
       @path = (options[:path] || name).to_s
       @path_prefix = options[:path_prefix]
 
-      mod = options[:module] || "devise"
-      @controllers = Hash.new { |h,k| h[k] = "#{mod}/#{k}" }
-      @controllers.merge!(options[:controllers] || {})
-      @controllers.each { |k,v| @controllers[k] = v.to_s }
-
-      @path_names = Hash.new { |h,k| h[k] = k.to_s }
-      @path_names.merge!(:registration => "")
-      @path_names.merge!(options[:path_names] || {})
-      
-      @constraints = Hash.new { |h,k| h[k] = k.to_s }
-      @constraints.merge!(options[:constraints] || {})
-
-      @defaults = Hash.new { |h,k| h[k] = k.to_s }
-      @defaults.merge!(options[:defaults] || {})
-
       @sign_out_via = options[:sign_out_via] || Devise.sign_out_via
       @format = options[:format]
 
-      singularizer = lambda { |s| s.to_s.singularize.to_sym }
-
-      if options.has_key?(:only)
-        @used_routes = self.routes & Array(options[:only]).map(&singularizer)
-      elsif options[:skip] == :all
-        @used_routes = []
-      else
-        @used_routes = self.routes - Array(options[:skip]).map(&singularizer)
-      end
-
-      if options[:skip_helpers] == true
-        @used_helpers = @used_routes
-      elsif skip = options[:skip_helpers]
-        @used_helpers = self.routes - Array(skip).map(&singularizer)
-      else
-        @used_helpers = self.routes
-      end
+      default_failure_app(options)
+      default_controllers(options)
+      default_path_names(options)
+      default_used_route(options)
+      default_used_helpers(options)
     end
 
     # Return modules for the mapping.
@@ -100,7 +74,7 @@ module Devise
 
     # Gives the class the mapping points to.
     def to
-      @ref.get
+      @klass.get
     end
 
     def strategies
@@ -122,15 +96,7 @@ module Devise
     def fullpath
       "/#{@path_prefix}/#{@path}".squeeze("/")
     end
-    
-    def constraints
-      @constraints
-    end
-    
-    def defaults
-      @defaults
-    end
-    
+
     # Create magic predicates for verifying what module is activated by this map.
     # Example:
     #
@@ -145,5 +111,62 @@ module Devise
         end
       METHOD
     end
+
+    private
+
+    def default_failure_app(options)
+      @failure_app = options[:failure_app] || Devise::FailureApp
+      if @failure_app.is_a?(String)
+        ref = Devise.ref(@failure_app)
+        @failure_app = lambda { |env| ref.get.call(env) }
+      end
+    end
+
+    def default_controllers(options)
+      mod = options[:module] || "devise"
+      @controllers = Hash.new { |h,k| h[k] = "#{mod}/#{k}" }
+      @controllers.merge!(options[:controllers]) if options[:controllers]
+      @controllers.each { |k,v| @controllers[k] = v.to_s }
+    end
+
+    def default_path_names(options)
+      @path_names = Hash.new { |h,k| h[k] = k.to_s }
+      @path_names[:registration] = ""
+      @path_names.merge!(options[:path_names]) if options[:path_names]
+    end
+
+    def default_constraints(options)
+      @constraints = Hash.new
+      @constraints.merge!(options[:constraints]) if options[:constraints]
+    end
+
+    def default_defaults(options)
+      @defaults = Hash.new
+      @defaults.merge!(options[:defaults]) if options[:defaults]
+    end
+
+    def default_used_route(options)
+      singularizer = lambda { |s| s.to_s.singularize.to_sym }
+
+      if options.has_key?(:only)
+        @used_routes = self.routes & Array(options[:only]).map(&singularizer)
+      elsif options[:skip] == :all
+        @used_routes = []
+      else
+        @used_routes = self.routes - Array(options[:skip]).map(&singularizer)
+      end
+    end
+
+    def default_used_helpers(options)
+      singularizer = lambda { |s| s.to_s.singularize.to_sym }
+
+      if options[:skip_helpers] == true
+        @used_helpers = @used_routes
+      elsif skip = options[:skip_helpers]
+        @used_helpers = self.routes - Array(skip).map(&singularizer)
+      else
+        @used_helpers = self.routes
+      end
+    end
   end
 end

lib/devise/models.rb

@@ -48,7 +48,6 @@ module Devise
     # for a complete description on those values.
     #
     def devise(*modules)
-      include Devise::Models::Authenticatable
       options = modules.extract_options!.dup
 
       selected_modules = modules.map(&:to_sym).uniq.sort_by do |s|
@@ -56,6 +55,7 @@ module Devise
       end
 
       devise_modules_hook! do
+        include Devise::Models::Authenticatable
         selected_modules.each do |m|
           mod = Devise::Models.const_get(m.to_s.classify)
 

lib/devise/models/authenticatable.rb

@@ -25,9 +25,14 @@ module Devise
     #   * +params_authenticatable+: if this model allows authentication through request params. By default true.
     #     It also accepts an array specifying the strategies that should allow params authentication.
     #
+    #   * +skip_session_storage+: By default Devise will store the user in session.
+    #     You can skip storage for http and token auth by appending values to array:
+    #     :skip_session_storage => [:token_auth] or :skip_session_storage => [:http_auth, :token_auth],
+    #     by default is set to :skip_session_storage => [:http_auth].
+    #
     # == active_for_authentication?
     #
-    # Before authenticating a user and in each request, Devise checks if your model is active by
+    # After authenticating a user and in each request, Devise checks if your model is active by
     # calling model.active_for_authentication?. This method is overwriten by other devise modules. For instance,
     # :confirmable overwrites .active_for_authentication? to only return true if your model was confirmed.
     #
@@ -52,6 +57,9 @@ module Devise
       included do
         class_attribute :devise_modules, :instance_writer => false
         self.devise_modules ||= []
+
+        before_validation :downcase_keys
+        before_validation :strip_whitespace
       end
 
       # Check if the current object is valid for authentication. This method and
@@ -61,11 +69,7 @@ module Devise
       # However, you should not overwrite this method, you should overwrite active_for_authentication?
       # and inactive_message instead.
       def valid_for_authentication?
-        if active_for_authentication?
-          block_given? ? yield : true
-        else
-          inactive_message
-        end
+        block_given? ? yield : true
       end
 
       def active_for_authentication?
@@ -79,8 +83,25 @@ module Devise
       def authenticatable_salt
       end
 
+      def devise_mailer
+        Devise.mailer
+      end
+
+      def headers_for(name)
+        {}
+      end
+
+      def downcase_keys
+        (self.class.case_insensitive_keys || []).each { |k| self[k].try(:downcase!) }
+      end
+
+      def strip_whitespace
+        (self.class.strip_whitespace_keys || []).each { |k| self[k].try(:strip!) }
+      end
+
       module ClassMethods
-        Devise::Models.config(self, :authentication_keys, :request_keys, :strip_whitespace_keys, :case_insensitive_keys, :http_authenticatable, :params_authenticatable)
+        Devise::Models.config(self, :authentication_keys, :request_keys, :strip_whitespace_keys,
+          :case_insensitive_keys, :http_authenticatable, :params_authenticatable, :skip_session_storage)
 
         def serialize_into_session(record)
           [record.to_key, record.authenticatable_salt]
@@ -112,10 +133,11 @@ module Devise
         #   end
         #
         def find_for_authentication(conditions)
-          conditions = filter_auth_params(conditions.dup)
-          (case_insensitive_keys || []).each { |k| conditions[k].try(:downcase!) }
-          (strip_whitespace_keys || []).each { |k| conditions[k].try(:strip!) }
-          to_adapter.find_first(conditions)
+          find_first_by_auth_conditions(conditions)
+        end
+
+        def find_first_by_auth_conditions(conditions)
+          to_adapter.find_first devise_param_filter.filter(conditions)
         end
 
         # Find an initialize a record setting an error if it can't be found.
@@ -125,14 +147,11 @@ module Devise
 
         # Find an initialize a group of attributes based on a list of required attributes.
         def find_or_initialize_with_errors(required_attributes, attributes, error=:invalid) #:nodoc:
-          (case_insensitive_keys || []).each { |k| attributes[k].try(:downcase!) }
-          (strip_whitespace_keys || []).each { |k| attributes[k].try(:strip!) }
-
           attributes = attributes.slice(*required_attributes)
           attributes.delete_if { |key, value| value.blank? }
 
           if attributes.size == required_attributes.size
-            record = to_adapter.find_first(filter_auth_params(attributes))
+            record = find_first_by_auth_conditions(attributes)
           end
 
           unless record
@@ -150,16 +169,8 @@ module Devise
 
         protected
 
-        # Force keys to be string to avoid injection on mongoid related database.
-        def filter_auth_params(conditions)
-          conditions.each do |k, v|
-            conditions[k] = v.to_s if auth_param_requires_string_conversion?(v)
-          end if conditions.is_a?(Hash)
-        end
-        
-        # Determine which values should be transformed to string or passed as-is to the query builder underneath
-        def auth_param_requires_string_conversion?(value)
-          true unless value.is_a?(TrueClass) || value.is_a?(FalseClass) || value.is_a?(Fixnum)
+        def devise_param_filter
+          @devise_param_filter ||= Devise::ParamFilter.new(case_insensitive_keys, strip_whitespace_keys)
         end
 
         # Generate a token by looping and ensuring does not already exist.

lib/devise/models/confirmable.rb

@@ -9,11 +9,16 @@ module Devise
     #
     # Confirmable adds the following options to devise_for:
     #
-    #   * +confirm_within+: the time you want to allow the user to access his account
+    #   * +allow_unconfirmed_access_for+: the time you want to allow the user to access his account
     #     before confirming it. After this period, the user access is denied. You can
     #     use this to let your user access some features of your application without
     #     confirming the account, but blocking it after a certain period (ie 7 days).
-    #     By default confirm_within is zero, it means users always have to confirm to sign in.
+    #     By default allow_unconfirmed_access_for is zero, it means users always have to confirm to sign in.
+    #   * +reconfirmable+: requires any email changes to be confirmed (exactly the same way as
+    #     initial account confirmation) to be applied. Requires additional unconfirmed_email
+    #     db field to be setup (t.reconfirmable in migrations). Until confirmed new email is
+    #     stored in unconfirmed email column, and copied to email column on successful
+    #     confirmation.
     #
     # == Examples
     #
@@ -27,15 +32,28 @@ module Devise
       included do
         before_create :generate_confirmation_token, :if => :confirmation_required?
         after_create  :send_confirmation_instructions, :if => :confirmation_required?
+        before_update :postpone_email_change_until_confirmation, :if => :postpone_email_change?
+        after_update :send_confirmation_instructions, :if => :reconfirmation_required?
       end
 
-      # Confirm a user by setting its confirmed_at to actual time. If the user
-      # is already confirmed, add en error to email field
+      # Confirm a user by setting it's confirmed_at to actual time. If the user
+      # is already confirmed, add an error to email field. If the user is invalid
+      # add errors
       def confirm!
-        unless_confirmed do
+        pending_any_confirmation do
           self.confirmation_token = nil
-          self.confirmed_at = Time.now
-          save(:validate => false)
+          self.confirmed_at = Time.now.utc
+
+          if self.class.reconfirmable && unconfirmed_email.present?
+            @bypass_postpone = true
+            self.email = unconfirmed_email
+            self.unconfirmed_email = nil
+
+            # We need to validate in such cases to enforce e-mail uniqueness
+            save(:validate => true)
+          else
+            save(:validate => false)
+          end
         end
       end
 
@@ -44,15 +62,22 @@ module Devise
         !!confirmed_at
       end
 
+      def pending_reconfirmation?
+        self.class.reconfirmable && unconfirmed_email.present?
+      end
+
       # Send confirmation instructions by email
       def send_confirmation_instructions
-        generate_confirmation_token! if self.confirmation_token.nil?
-        ::Devise.mailer.confirmation_instructions(self).deliver
+        self.confirmation_token = nil if reconfirmation_required?
+        @reconfirmation_required = false
+
+        generate_confirmation_token! if self.confirmation_token.blank?
+        self.devise_mailer.confirmation_instructions(self).deliver
       end
 
       # Resend confirmation token. This method does not need to generate a new token.
       def resend_confirmation_token
-        unless_confirmed { send_confirmation_instructions }
+        pending_any_confirmation { send_confirmation_instructions }
       end
 
       # Overwrites active_for_authentication? for confirmation
@@ -71,7 +96,15 @@ module Devise
       # If you don't want confirmation to be sent on create, neither a code
       # to be generated, call skip_confirmation!
       def skip_confirmation!
-        self.confirmed_at = Time.now
+        self.confirmed_at = Time.now.utc
+      end
+
+      def headers_for(action)
+        headers = super
+        if action == :confirmation_instructions && pending_reconfirmation?
+          headers[:to] = unconfirmed_email
+        end
+        headers
       end
 
       protected
@@ -88,26 +121,25 @@ module Devise
         #
         # Example:
         #
-        #   # confirm_within = 1.day and confirmation_sent_at = today
+        #   # allow_unconfirmed_access_for = 1.day and confirmation_sent_at = today
         #   confirmation_period_valid?   # returns true
         #
-        #   # confirm_within = 5.days and confirmation_sent_at = 4.days.ago
+        #   # allow_unconfirmed_access_for = 5.days and confirmation_sent_at = 4.days.ago
         #   confirmation_period_valid?   # returns true
         #
-        #   # confirm_within = 5.days and confirmation_sent_at = 5.days.ago
+        #   # allow_unconfirmed_access_for = 5.days and confirmation_sent_at = 5.days.ago
         #   confirmation_period_valid?   # returns false
         #
-        #   # confirm_within = 0.days
+        #   # allow_unconfirmed_access_for = 0.days
         #   confirmation_period_valid?   # will always return false
         #
         def confirmation_period_valid?
-          confirmation_sent_at && confirmation_sent_at.utc >= self.class.confirm_within.ago
+          confirmation_sent_at && confirmation_sent_at.utc >= self.class.allow_unconfirmed_access_for.ago
         end
 
-        # Checks whether the record is confirmed or not, yielding to the block
-        # if it's already confirmed, otherwise adds an error to email.
-        def unless_confirmed
-          unless confirmed?
+        # Checks whether the record requires any confirmation.
+        def pending_any_confirmation
+          if !confirmed? || pending_reconfirmation?
             yield
           else
             self.errors.add(:email, :already_confirmed)
@@ -118,7 +150,6 @@ module Devise
         # Generates a new random token for confirmation, and stores the time
         # this token is being generated
         def generate_confirmation_token
-          self.confirmed_at = nil
           self.confirmation_token = self.class.confirmation_token
           self.confirmation_sent_at = Time.now.utc
         end
@@ -132,13 +163,32 @@ module Devise
           confirm! unless confirmed?
         end
 
+        def postpone_email_change_until_confirmation
+          @reconfirmation_required = true
+          self.unconfirmed_email = self.email
+          self.email = self.email_was
+        end
+
+        def postpone_email_change?
+          postpone = self.class.reconfirmable && email_changed? && !@bypass_postpone
+          @bypass_postpone = nil
+          postpone
+        end
+
+        def reconfirmation_required?
+          self.class.reconfirmable && @reconfirmation_required
+        end
+
       module ClassMethods
         # Attempt to find a user by its email. If a record is found, send new
-        # confirmation instructions to it. If not user is found, returns a new user
-        # with an email not found error.
+        # confirmation instructions to it. If not, try searching for a user by unconfirmed_email
+        # field. If no user is found, returns a new user with an email not found error.
         # Options must contain the user email
         def send_confirmation_instructions(attributes={})
-          confirmable = find_or_initialize_with_errors(confirmation_keys, attributes, :not_found)
+          confirmable = find_by_unconfirmed_email_with_errors(attributes) if reconfirmable
+          unless confirmable.try(:persisted?)
+            confirmable = find_or_initialize_with_errors(confirmation_keys, attributes, :not_found)
+          end
           confirmable.resend_confirmation_token if confirmable.persisted?
           confirmable
         end
@@ -158,7 +208,15 @@ module Devise
           generate_token(:confirmation_token)
         end
 
-        Devise::Models.config(self, :confirm_within, :confirmation_keys)
+        # Find a record for confirmation by unconfirmed email field
+        def find_by_unconfirmed_email_with_errors(attributes = {})
+          unconfirmed_required_attributes = confirmation_keys.map { |k| k == :email ? :unconfirmed_email : k }
+          unconfirmed_attributes = attributes.symbolize_keys
+          unconfirmed_attributes[:unconfirmed_email] = unconfirmed_attributes.delete(:email)
+          find_or_initialize_with_errors(unconfirmed_required_attributes, unconfirmed_attributes, :not_found)
+        end
+
+        Devise::Models.config(self, :allow_unconfirmed_access_for, :confirmation_keys, :reconfirmable)
       end
     end
   end

lib/devise/models/database_authenticatable.rb

@@ -25,8 +25,6 @@ module Devise
       included do
         attr_reader :password, :current_password
         attr_accessor :password_confirmation
-        before_validation :downcase_keys
-        before_validation :strip_whitespace
       end
 
       # Generates password encryption based on the given value.
@@ -51,7 +49,7 @@ module Devise
       # Update record attributes when :current_password matches, otherwise returns
       # error on :current_password. It also automatically rejects :password and
       # :password_confirmation if they are blank.
-      def update_with_password(params={})
+      def update_with_password(params, *options)
         current_password = params.delete(:current_password)
 
         if params[:password].blank?
@@ -60,7 +58,7 @@ module Devise
         end
 
         result = if valid_password?(current_password)
-          update_attributes(params)
+          update_attributes(params, *options)
         else
           self.attributes = params
           self.valid?
@@ -73,16 +71,26 @@ module Devise
       end
 
       # Updates record attributes without asking for the current password.
-      # Never allows to change the current password
-      def update_without_password(params={})
+      # Never allows to change the current password. If you are using this
+      # method, you should probably override this method to protect other
+      # attributes you would not like to be updated without a password.
+      #
+      # Example:
+      #
+      #   def update_without_password(params={})
+      #     params.delete(:email)
+      #     super(params)
+      #   end
+      #
+      def update_without_password(params, *options)
         params.delete(:password)
         params.delete(:password_confirmation)
 
-        result = update_attributes(params)
+        result = update_attributes(params, *options)
         clean_up_passwords
         result
       end
-      
+
       def after_database_authentication
       end
 
@@ -93,15 +101,6 @@ module Devise
 
     protected
 
-      # Downcase case-insensitive keys
-      def downcase_keys
-        (self.class.case_insensitive_keys || []).each { |k| self[k].try(:downcase!) }
-      end
-      
-      def strip_whitespace
-        (self.class.strip_whitespace_keys || []).each { |k| self[k].try(:strip!) }
-      end
-
       # Digests the password using bcrypt.
       def password_digest(password)
         ::BCrypt::Password.create("#{password}#{self.class.pepper}", :cost => self.class.stretches).to_s

lib/devise/models/lockable.rb

@@ -24,7 +24,7 @@ module Devise
 
       # Lock a user setting its locked_at to actual time.
       def lock_access!
-        self.locked_at = Time.now
+        self.locked_at = Time.now.utc
 
         if unlock_strategy_enabled?(:email)
           generate_unlock_token
@@ -49,7 +49,7 @@ module Devise
 
       # Send unlock instructions by email
       def send_unlock_instructions
-        ::Devise.mailer.unlock_instructions(self).deliver
+        self.devise_mailer.unlock_instructions(self).deliver
       end
 
       # Resend the unlock instructions if the user is locked.
@@ -79,25 +79,21 @@ module Devise
         # if the user can login or not (wrong password, etc)
         unlock_access! if lock_expired?
 
-        case (result = super)
-        when Symbol
-          return result
-        when TrueClass
+        if super && !access_locked?
           self.failed_attempts = 0
           save(:validate => false)
-        when FalseClass
-          # PostgreSQL uses nil as the default value for integer columns set to 0
+          true
+        else
           self.failed_attempts ||= 0
           self.failed_attempts += 1
           if attempts_exceeded?
-            lock_access!
+            lock_access! unless access_locked?
             return :locked
           else
             save(:validate => false)
           end
+          false
         end
-
-        result
       end
 
       protected

lib/devise/models/recoverable.rb

@@ -29,6 +29,7 @@ module Devise
       def reset_password!(new_password, new_password_confirmation)
         self.password = new_password
         self.password_confirmation = new_password_confirmation
+
         if valid?
           clear_reset_password_token
           after_password_reset
@@ -39,8 +40,8 @@ module Devise
 
       # Resets reset password token and send reset password instructions by email
       def send_reset_password_instructions
-        generate_reset_password_token! if should_generate_token?
-        ::Devise.mailer.reset_password_instructions(self).deliver
+        generate_reset_password_token! if should_generate_reset_token?
+        self.devise_mailer.reset_password_instructions(self).deliver
       end
 
       # Checks if the reset password token sent is within the limit time.
@@ -64,20 +65,19 @@ module Devise
       #   reset_password_period_valid?   # will always return false
       #
       def reset_password_period_valid?
-        return true unless respond_to?(:reset_password_sent_at) 
         reset_password_sent_at && reset_password_sent_at.utc >= self.class.reset_password_within.ago
       end
 
       protected
 
-        def should_generate_token?
+        def should_generate_reset_token?
           reset_password_token.nil? || !reset_password_period_valid?
         end
 
         # Generates a new random token for reset password
         def generate_reset_password_token
           self.reset_password_token = self.class.reset_password_token
-          self.reset_password_sent_at = Time.now.utc if respond_to?(:reset_password_sent_at=)
+          self.reset_password_sent_at = Time.now.utc
           self.reset_password_token
         end
 
@@ -90,7 +90,7 @@ module Devise
         # Removes reset_password token
         def clear_reset_password_token
           self.reset_password_token = nil
-          self.reset_password_sent_at = nil if respond_to?(:reset_password_sent_at=)
+          self.reset_password_sent_at = nil
         end
 
         def after_password_reset
@@ -121,7 +121,7 @@ module Devise
           recoverable = find_or_initialize_with_error_by(:reset_password_token, attributes[:reset_password_token])
           if recoverable.persisted?
             if recoverable.reset_password_period_valid?
-              recoverable.reset_password!(attributes[:password], attributes[:password_confirmation]) 
+              recoverable.reset_password!(attributes[:password], attributes[:password_confirmation])
             else
               recoverable.errors.add(:reset_password_token, :expired)
             end

lib/devise/models/rememberable.rb

@@ -21,11 +21,6 @@ module Devise
     #     used to calculate the expires time for the cookie created to remember
     #     the user. By default remember_for is 2.weeks.
     #
-    #   * +remember_across_browsers+: if a valid remember token can be re-used
-    #     between multiple browsers. By default remember_across_browsers is true
-    #     and cannot be turned off if you are using password salt instead of remember
-    #     token.
-    #
     #   * +extend_remember_period+: if true, extends the user's remember period
     #     when remembered via cookie. False by default.
     #
@@ -49,7 +44,6 @@ module Devise
       # Generate a new remember token and save the record without validations
       # unless remember_across_browsers is true and the user already has a valid token.
       def remember_me!(extend_period=false)
-        self.remember_token = self.class.remember_token if respond_to?(:remember_token) && generate_remember_token?
         self.remember_created_at = Time.now.utc if generate_remember_timestamp?(extend_period)
         save(:validate => false)
       end
@@ -75,14 +69,12 @@ module Devise
       end
 
       def rememberable_value
-        if respond_to?(:remember_token)
-          remember_token
-        elsif respond_to?(:authenticatable_salt) && (salt = authenticatable_salt)
+        if salt = authenticatable_salt
           salt
         else
-          raise "The #{self.class.name} class does not respond to remember_token and " <<
-            "authenticatable_salt returns nil. In order to use rememberable, you must " <<
-            "add a remember_token field to your model or ensure a password is always set."
+          raise "authenticable_salt returned nil for the #{self.class.name} model. " \
+            "In order to use rememberable, you must ensure a password is always set " \
+            "or implement rememberable_value in your model with your own logic."
         end
       end
 
@@ -92,12 +84,6 @@ module Devise
 
     protected
 
-      # Generate a token unless remember_across_browsers is true and there is
-      # an existing remember_token or the existing remember_token has expried.
-      def generate_remember_token? #:nodoc:
-        !(self.class.remember_across_browsers && remember_token) || remember_expired?
-      end
-
       # Generate a timestamp if extend_remember_period is true, if no remember_token
       # exists, or if an existing remember token has expired.
       def generate_remember_timestamp?(extend_period) #:nodoc:
@@ -121,8 +107,7 @@ module Devise
           generate_token(:remember_token)
         end
 
-        Devise::Models.config(self, :remember_for, :remember_across_browsers,
-          :extend_remember_period, :cookie_options)
+        Devise::Models.config(self, :remember_for, :extend_remember_period, :cookie_options)
       end
     end
   end

lib/devise/models/serializable.rb

@@ -9,8 +9,11 @@ module Devise
     module Serializable
       extend ActiveSupport::Concern
 
-      # TODO: to_xml does not call serializable_hash. Hopefully someone will fix this in AR.
-      %w(to_xml serializable_hash).each do |method|
+      array = %w(serializable_hash)
+      # to_xml does not call serializable_hash on 3.1
+      array << "to_xml" if Rails::VERSION::STRING[0,3] == "3.1"
+
+      array.each do |method|
         class_eval <<-RUBY, __FILE__, __LINE__
           def #{method}(options=nil)
             options ||= {}

lib/devise/models/timeoutable.rb

@@ -23,18 +23,20 @@ module Devise
       # Checks whether the user session has expired based on configured time.
       def timedout?(last_access)
         return false if remember_exists_and_not_expired?
-        
-        last_access && last_access <= self.class.timeout_in.ago
+        !timeout_in.nil? && last_access && last_access <= timeout_in.ago
       end
-      
+
+      def timeout_in
+        self.class.timeout_in
+      end
+
       private
-      
+
       def remember_exists_and_not_expired?
-        return false unless respond_to?(:remember_expired?)
-        
+        return false unless respond_to?(:remember_created_at)
         remember_created_at && !remember_expired?
       end
-      
+
       module ClassMethods
         Devise::Models.config(self, :timeout_in)
       end

lib/devise/models/token_authenticatable.rb

@@ -24,9 +24,6 @@ module Devise
     #
     #   * +token_authentication_key+: Defines name of the authentication token params key. E.g. /users/sign_in?some_key=...
     #
-    #   * +stateless_token+: By default, when you sign up with a token, Devise will store the user in session
-    #     as any other authentication strategy. You can set stateless_token to true to avoid this.
-    #
     module TokenAuthenticatable
       extend ActiveSupport::Concern
 
@@ -65,7 +62,7 @@ module Devise
           generate_token(:authentication_token)
         end
 
-        ::Devise::Models.config(self, :token_authentication_key, :stateless_token)
+        ::Devise::Models.config(self, :token_authentication_key)
       end
     end
   end

lib/devise/models/trackable.rb

@@ -12,11 +12,11 @@ module Devise
     #
     module Trackable
       def update_tracked_fields!(request)
-        old_current, new_current = self.current_sign_in_at, Time.now
+        old_current, new_current = self.current_sign_in_at, Time.now.utc
         self.last_sign_in_at     = old_current || new_current
         self.current_sign_in_at  = new_current
 
-        old_current, new_current = self.current_sign_in_ip, request.remote_ip
+        old_current, new_current = self.current_sign_in_ip, request.ip
         self.last_sign_in_ip     = old_current || new_current
         self.current_sign_in_ip  = new_current
 

lib/devise/models/validatable.rb

@@ -23,7 +23,7 @@ module Devise
 
         base.class_eval do
           validates_presence_of   :email, :if => :email_required?
-          validates_uniqueness_of :email, :case_sensitive => (case_insensitive_keys != false), :allow_blank => true, :if => :email_changed?
+          validates_uniqueness_of :email, :allow_blank => true, :if => :email_changed?
           validates_format_of     :email, :with  => email_regexp, :allow_blank => true, :if => :email_changed?
 
           validates_presence_of     :password, :if => :password_required?

lib/devise/modules.rb

@@ -5,8 +5,8 @@ Devise.with_options :model => true do |d|
   d.with_options :strategy => true do |s|
     routes = [nil, :new, :destroy]
     s.add_module :database_authenticatable, :controller => :sessions, :route => { :session => routes }
-    s.add_module :token_authenticatable
-    s.add_module :rememberable
+    s.add_module :token_authenticatable,    :controller => :sessions, :route => { :session => routes }, :no_input => true
+    s.add_module :rememberable, :no_input => true
   end
 
   # Other authentications

lib/devise/omniauth.rb

@@ -1,12 +1,13 @@
 begin
-  require "omniauth/core"
+  require "omniauth"
+  require "omniauth/version"
 rescue LoadError => e
-  warn "Could not load 'omniauth/core'. Please ensure you have the oa-core gem installed and listed in your Gemfile."
+  warn "Could not load 'omniauth'. Please ensure you have the omniauth gem >= 1.0.0 installed and listed in your Gemfile."
   raise
 end
 
-unless OmniAuth.config.respond_to? :test_mode
-  raise "You are using an old OmniAuth version, please ensure you have 0.2.0.beta version or later installed."
+unless OmniAuth::VERSION =~ /^1\./
+  raise "You are using an old OmniAuth version, please ensure you have 1.0.0.pr2 version or later installed."
 end
 
 # Clean up the default path_prefix. It will be automatically set by Devise.

lib/devise/omniauth/config.rb

@@ -1,24 +1,45 @@
 module Devise
   module OmniAuth
+    class StrategyNotFound < NameError
+      def initialize(strategy)
+        @strategy = strategy
+        super("Could not find a strategy with name `#{strategy}'. " \
+          "Please ensure it is required or explicitly set it using the :strategy_class option.")
+      end
+    end
+
     class Config
       attr_accessor :strategy
-      attr_reader :args
+      attr_reader :args, :options, :provider, :strategy_name
 
       def initialize(provider, args)
-        @provider = provider
-        @args     = args
-        @strategy = nil
-      end
-
-      # open_id strategy can have configurable name
-      def strategy_name
-        options = @args.last.is_a?(Hash) && @args.last
-        options && options[:name] ? options[:name] : @provider
+        @provider       = provider
+        @args           = args
+        @options        = @args.last.is_a?(Hash) ? @args.last : {}
+        @strategy       = nil
+        @strategy_name  = options[:name] || @provider
+        @strategy_class = options.delete(:strategy_class)
       end
 
       def strategy_class
-        ::OmniAuth::Strategies.const_get("#{::OmniAuth::Utils.camelize(@provider.to_s)}")
+        @strategy_class ||= find_strategy || autoload_strategy
+      end
+
+      def find_strategy
+        ::OmniAuth.strategies.find do |strategy_class|
+          strategy_class.to_s =~ /#{::OmniAuth::Utils.camelize(strategy_name)}$/ ||
+            strategy_class.default_options[:name] == strategy_name
+        end
+      end
+
+      def autoload_strategy
+        name = ::OmniAuth::Utils.camelize(provider.to_s)
+        if ::OmniAuth::Strategies.const_defined?(name)
+          ::OmniAuth::Strategies.const_get(name)
+        else
+          raise StrategyNotFound, name
+        end
       end
     end
   end
-end     
+end

lib/devise/orm/active_record.rb

@@ -26,6 +26,12 @@ module Devise
 
         # Tell how to apply schema methods.
         def apply_devise_schema(name, type, options={})
+          @__devise_warning_raised ||= begin
+            $stderr.puts "\n[DEVISE] You are using t.database_authenticatable and others in your migration " \
+              "and this feature is deprecated. Please simply use Rails helpers instead as mentioned here:\n" \
+              "https://github.com/plataformatec/devise/wiki/How-To:-Upgrade-to-Devise-2.0-migration-schema-style\n\n"
+            true
+          end
           column name, type.to_s.downcase.to_sym, options
         end
       end

lib/devise/param_filter.rb

@@ -0,0 +1,41 @@
+module Devise
+  class ParamFilter
+    def initialize(case_insensitive_keys, strip_whitespace_keys)
+      @case_insensitive_keys = case_insensitive_keys || []
+      @strip_whitespace_keys = strip_whitespace_keys || []
+    end
+
+    def filter(conditions)
+      conditions = stringify_params(conditions.dup)
+
+      @case_insensitive_keys.each do |k|
+        value = conditions[k]
+        next unless value.respond_to?(:downcase)
+        conditions[k] = value.downcase
+      end
+
+      @strip_whitespace_keys.each do |k|
+        value = conditions[k]
+        next unless value.respond_to?(:strip)
+        conditions[k] = value.strip
+      end
+
+      conditions
+    end
+
+    # Force keys to be string to avoid injection on mongoid related database.
+    def stringify_params(conditions)
+      return conditions unless conditions.is_a?(Hash)
+      conditions.each do |k, v|
+        conditions[k] = v.to_s if param_requires_string_conversion?(v)
+      end
+    end
+
+    private
+
+    # Determine which values should be transformed to string or passed as-is to the query builder underneath
+    def param_requires_string_conversion?(value)
+      [Fixnum, TrueClass, FalseClass, Regexp].none? {|clz| value.is_a? clz }
+    end
+  end
+end

lib/devise/path_checker.rb

@@ -3,7 +3,11 @@ module Devise
     include Rails.application.routes.url_helpers
 
     def self.default_url_options(*args)
-      ApplicationController.default_url_options(*args)
+      if defined?(ApplicationController)
+        ApplicationController.default_url_options(*args)
+      else
+        {}
+      end
     end
 
     def initialize(env, scope)
@@ -12,7 +16,8 @@ module Devise
     end
 
     def signing_out?
-      @current_path == send("destroy_#{@scope}_session_path")
+      route = "destroy_#{@scope}_session_path"
+      respond_to?(route) && @current_path == send(route)
     end
   end
 end

lib/devise/rails.rb

@@ -17,17 +17,6 @@ module Devise
       Devise.include_helpers(Devise::Controllers)
     end
 
-    initializer "devise.auth_keys" do
-      if Devise.authentication_keys.size > 1
-        puts "[DEVISE] You are configuring Devise to use more than one authentication key. " \
-          "In previous versions, we automatically added #{Devise.authentication_keys[1..-1].inspect} " \
-          "as scope to your e-mail validation, but this was changed now. If you were relying in such " \
-          "behavior, you should remove :validatable from your models and add the validations manually. " \
-          "To get rid of this warning, you can comment config.authentication_keys in your initializer " \
-          "and pass the current values as key to the devise call in your model."
-      end
-    end
-
     initializer "devise.omniauth" do |app|
       Devise.omniauth_configs.each do |provider, config|
         app.middleware.use config.strategy_class, *config.args do |strategy|
@@ -52,5 +41,57 @@ module Devise
         end
       end
     end
+
+    initializer "devise.fix_routes_proxy_missing_respond_to_bug" do
+      # We can get rid of this once we support Rails > 3.2
+      ActionDispatch::Routing::RoutesProxy.class_eval do
+        def respond_to?(method, include_private = false)
+          super || routes.url_helpers.respond_to?(method)
+        end
+      end
+    end
+
+    initializer "devise.deprecations" do
+      unless defined?(Rails::Generators)
+        if Devise.case_insensitive_keys == false
+          warn "\n[DEVISE] Devise.case_insensitive_keys is false which is no longer " \
+            "supported. If you want to continue running on this mode, please ensure " \
+            "you are not using validatable (you can copy the validations directly to your model) " \
+            "and set case_insensitive_keys to an empty array.\n"
+        end
+
+        if Devise.apply_schema && defined?(Mongoid)
+          warn "\n[DEVISE] Devise.apply_schema is true. This means Devise was " \
+            "automatically configuring your DB. This no longer happens. You should " \
+            "set Devise.apply_schema to false and manually set the fields used by Devise as shown here: " \
+            "https://github.com/plataformatec/devise/wiki/How-To:-Upgrade-to-Devise-2.0-migration-schema-style\n"
+        end
+
+        # TODO: Deprecate the true value of this option as well
+        if Devise.use_salt_as_remember_token == false
+          warn "\n[DEVISE] Devise.use_salt_as_remember_token is false which is no longer " \
+            "supported. Devise now only uses the salt as remember token and the remember_token " \
+            "column can be removed from your models.\n"
+        end
+
+        if Devise.reset_password_within.nil?
+          warn "\n[DEVISE] Devise.reset_password_within is nil. Please set this value to " \
+            "an interval (for example, 6.hours) and add a reset_password_sent_at field to " \
+            "your Devise models (if they don't have one already).\n"
+        end
+      end
+
+      config.after_initialize do
+        if I18n.t(:"devise.registrations.reasons", :default => {}).present?
+          warn "\n[DEVISE] devise.registrations.reasons in yml files is deprecated, " \
+            "please use devise.registrations.signed_up_but_REASON instead.\n"
+        end
+
+        if I18n.t(:"devise.registrations.inactive_signed_up", :default => "").present?
+          warn "\n[DEVISE] devise.registrations.inactive_signed_up in yml files is deprecated, " \
+            "please use devise.registrations.signed_up_but_inactive instead.\n"
+        end
+      end
+    end
   end
 end

lib/devise/rails/routes.rb

@@ -49,23 +49,23 @@ module ActionDispatch::Routing
     #
     # You can configure your routes with some options:
     #
-    #  * :class_name => setup a different class to be looked up by devise,
-    #                   if it cannot be correctly find by the route name.
+    #  * :class_name => setup a different class to be looked up by devise, if it cannot be
+    #    properly found by the route name.
     #
     #      devise_for :users, :class_name => 'Account'
     #
     #  * :path => allows you to setup path name that will be used, as rails routes does.
-    #             The following route configuration would setup your route as /accounts instead of /users:
+    #    The following route configuration would setup your route as /accounts instead of /users:
     #
     #      devise_for :users, :path => 'accounts'
     #
-    #  * :singular => setup the singular name for the given resource. This is used as the instance variable name in
-    #                 controller, as the name in routes and the scope given to warden.
+    #  * :singular => setup the singular name for the given resource. This is used as the instance variable
+    #    name in controller, as the name in routes and the scope given to warden.
     #
     #      devise_for :users, :singular => :user
     #
     #  * :path_names => configure different path names to overwrite defaults :sign_in, :sign_out, :sign_up,
-    #                   :password, :confirmation, :unlock.
+    #    :password, :confirmation, :unlock.
     #
     #      devise_for :users, :path_names => { :sign_in => 'login', :sign_out => 'logout', :password => 'secret', :confirmation => 'verification' }
     #
@@ -74,6 +74,9 @@ module ActionDispatch::Routing
     #
     #      devise_for :users, :controllers => { :sessions => "users/sessions" }
     #
+    #  * :failure_app => a rack app which is invoked whenever there is a failure. Strings representing a given
+    #    are also allowed as parameter.
+    #
     #  * :sign_out_via => the HTTP method(s) accepted for the :sign_out action (default: :get),
     #    if you wish to restrict this to accept only :post or :delete requests you should do:
     #
@@ -81,15 +84,16 @@ module ActionDispatch::Routing
     #
     #    You need to make sure that your sign_out controls trigger a request with a matching HTTP method.
     #
-    #  * :module => the namespace to find controlers. By default, devise will access devise/sessions,
-    #    devise/registrations and so on. If you want to namespace all at once, use module:
+    #  * :module => the namespace to find controllers (default: "devise", thus
+    #    accessing devise/sessions, devise/registrations, and so on). If you want
+    #    to namespace all at once, use module:
     #
     #      devise_for :users, :module => "users"
     #
     #    Notice that whenever you use namespace in the router DSL, it automatically sets the module.
     #    So the following setup:
     #
-    #      namespace :publisher
+    #      namespace :publisher do
     #        devise_for :account
     #      end
     #
@@ -132,15 +136,15 @@ module ActionDispatch::Routing
     #     devise_for :users
     #   end
     #
-    # However, since Devise uses the request path to retrieve the current user, it has one caveats.
-    # If you are using a dynamic segment, as below:
+    # However, since Devise uses the request path to retrieve the current user,
+    # this has one caveat: If you are using a dynamic segment, like so ...
     #
     #   scope ":locale" do
     #     devise_for :users
     #   end
     #
-    # You are required to configure default_url_options in your ApplicationController class level, so
-    # Devise can pick it:
+    # you are required to configure default_url_options in your
+    # ApplicationController class, so Devise can pick it:
     #
     #   class ApplicationController < ActionController::Base
     #     def self.default_url_options
@@ -182,7 +186,7 @@ module ActionDispatch::Routing
       options[:path_names]    = (@scope[:path_names] || {}).merge(options[:path_names] || {})
       options[:constraints]   = (@scope[:constraints] || {}).merge(options[:constraints] || {})
       options[:defaults]      = (@scope[:defaults] || {}).merge(options[:defaults] || {})
-      @scope[:options]        = (@scope[:options] || {}).merge({:format => false}) if options[:format] == false
+      options[:options]       = (@scope[:options] || {}).merge({:format => false}) if options[:format] == false
 
       resources.map!(&:to_sym)
 
@@ -204,8 +208,13 @@ module ActionDispatch::Routing
         routes  = mapping.used_routes
 
         devise_scope mapping.name do
-          yield if block_given?
-          with_devise_exclusive_scope mapping.fullpath, mapping.name, mapping.constraints, mapping.defaults do
+          if block_given?
+            ActiveSupport::Deprecation.warn "Passing a block to devise_for is deprecated. " \
+              "Please call devise_scope :#{mapping.name} do ... end with the block instead", caller
+            yield
+          end
+
+          with_devise_exclusive_scope mapping.fullpath, mapping.name, options do
             routes.each { |mod| send("devise_#{mod}", mapping, mapping.controllers) }
           end
         end
@@ -354,7 +363,7 @@ module ActionDispatch::Routing
         path_prefix = "/#{mapping.path}/auth".squeeze("/")
 
         if ::OmniAuth.config.path_prefix && ::OmniAuth.config.path_prefix != path_prefix
-          warn "[DEVISE] You can only add :omniauthable behavior to one model."
+          raise "You can only add :omniauthable behavior to one Devise model"
         else
           ::OmniAuth.config.path_prefix = path_prefix
         end
@@ -365,12 +374,15 @@ module ActionDispatch::Routing
         @scope[:path] = path
       end
 
-      def with_devise_exclusive_scope(new_path, new_as, new_constraints, new_defaults) #:nodoc:
-        old_as, old_path, old_module, old_constraints, old_defaults = @scope[:as], @scope[:path], @scope[:module], @scope[:constraints], @scope[:defaults]
-        @scope[:as], @scope[:path], @scope[:module], @scope[:constraints], @scope[:defaults] = new_as, new_path, nil, new_constraints, new_defaults
+      def with_devise_exclusive_scope(new_path, new_as, options) #:nodoc:
+        old_as, old_path, old_module, old_constraints, old_defaults, old_options =
+          *@scope.values_at(:as, :path, :module, :constraints, :defaults, :options)
+        @scope[:as], @scope[:path], @scope[:module], @scope[:constraints], @scope[:defaults], @scope[:options] =
+          new_as, new_path, nil, *options.values_at(:constraints, :defaults, :options)
         yield
       ensure
-        @scope[:as], @scope[:path], @scope[:module], @scope[:constraints], @scope[:defaults] = old_as, old_path, old_module, old_constraints, old_defaults
+        @scope[:as], @scope[:path], @scope[:module], @scope[:constraints], @scope[:defaults], @scope[:options] =
+          old_as, old_path, old_module, old_constraints, old_defaults, old_options
       end
 
       def raise_no_devise_method_error!(klass) #:nodoc:

lib/devise/rails/warden_compat.rb

@@ -34,87 +34,4 @@ class Warden::SessionSerializer
       end
     end
   end
-end
-
-unless Devise.rack_session?
-  # We cannot use Rails Indifferent Hash because it messes up the flash object.
-  class Devise::IndifferentHash < Hash
-    alias_method :regular_writer, :[]= unless method_defined?(:regular_writer)
-    alias_method :regular_update, :update unless method_defined?(:regular_update)
-
-    def [](key)
-      super(convert_key(key))
-    end
-
-    def []=(key, value)
-      regular_writer(convert_key(key), value)
-    end
-
-    alias_method :store, :[]=
-
-    def update(other_hash)
-      other_hash.each_pair { |key, value| regular_writer(convert_key(key), value) }
-      self
-    end
-
-    alias_method :merge!, :update
-
-    def key?(key)
-      super(convert_key(key))
-    end
-
-    alias_method :include?, :key?
-    alias_method :has_key?, :key?
-    alias_method :member?, :key?
-
-    def fetch(key, *extras)
-      super(convert_key(key), *extras)
-    end
-
-    def values_at(*indices)
-      indices.collect {|key| self[convert_key(key)]}
-    end
-
-    def merge(hash)
-      self.dup.update(hash)
-    end
-
-    def delete(key)
-      super(convert_key(key))
-    end
-
-    def stringify_keys!; self end
-    def stringify_keys; dup end
-
-    undef :symbolize_keys!
-    def symbolize_keys; to_hash.symbolize_keys end
-
-    def to_options!; self end
-    def to_hash; Hash.new.update(self) end
-
-    protected
-
-    def convert_key(key)
-      key.kind_of?(Symbol) ? key.to_s : key
-    end
-  end
-
-  class ActionDispatch::Request
-    def reset_session
-      session.destroy if session && session.respond_to?(:destroy)
-      self.session = {}
-      @env['action_dispatch.request.flash_hash'] = nil
-    end
-  end
-
-  Warden::Manager.after_set_user :event => [:set_user, :authentication] do |record, warden, options|
-    if options[:scope] && warden.authenticated?(options[:scope])
-      request, flash = warden.request, warden.env['action_dispatch.request.flash_hash']
-      backup = request.session.to_hash
-      backup.delete("session_id")
-      request.reset_session
-      warden.env['action_dispatch.request.flash_hash'] = flash
-      request.session = Devise::IndifferentHash.new.update(backup)
-    end
-  end
 end

lib/devise/schema.rb

@@ -40,6 +40,11 @@ module Devise
       apply_devise_schema :confirmation_sent_at, DateTime
     end
 
+    # Creates unconfirmed_email
+    def reconfirmable
+      apply_devise_schema :unconfirmed_email,    String
+    end
+
     # Creates reset_password_token and reset_password_sent_at.
     #
     # == Options

lib/devise/strategies/authenticatable.rb

@@ -6,7 +6,11 @@ module Devise
     # parameters both from params or from http authorization headers. See database_authenticatable
     # for an example.
     class Authenticatable < Base
-      attr_accessor :authentication_hash, :password
+      attr_accessor :authentication_hash, :authentication_type, :password
+
+      def store?
+        !mapping.to.skip_session_storage.include?(authentication_type)
+      end
 
       def valid?
         valid_for_params_auth? || valid_for_http_auth?
@@ -47,7 +51,7 @@ module Devise
       #   * If all authentication keys are present;
       #
       def valid_for_http_auth?
-        http_authenticatable? && request.authorization && with_authentication_hash(http_auth_hash)
+        http_authenticatable? && request.authorization && with_authentication_hash(:http_auth, http_auth_hash)
       end
 
       # Check if this is strategy is valid for params authentication by:
@@ -58,8 +62,8 @@ module Devise
       #   * If all authentication keys are present;
       #
       def valid_for_params_auth?
-        params_authenticatable? && valid_request? &&
-          valid_params? && with_authentication_hash(params_auth_hash)
+        params_authenticatable? && valid_params_request? &&
+          valid_params? && with_authentication_hash(:params_auth, params_auth_hash)
       end
 
       # Check if the model accepts this strategy as http authenticatable.
@@ -83,19 +87,9 @@ module Devise
         Hash[*keys.zip(decode_credentials).flatten]
       end
 
-      # By default, a request is valid  if the controller is allowed and the VERB is POST.
-      def valid_request?
-        if env["devise.allow_params_authentication"]
-          true
-        elsif request.post? && mapping.controllers[:sessions] == params[:controller]
-          ActiveSupport::Deprecation.warn "It seems that you are using a custom SessionsController. " \
-            "In order for it to work from Devise 1.4.6 forward, you need to add the following:" \
-            "\n\n  prepend_before_filter :allow_params_authentication!, :only => :create\n\n" \
-            "This will ensure your controller can authenticate from params for the create action.", caller
-          true
-        else
-          false
-        end
+      # By default, a request is valid if the controller set the proper env variable.
+      def valid_params_request?
+        !!env["devise.allow_params_authentication"]
       end
 
       # If the request is valid, finally check if params_auth_hash returns a hash.
@@ -111,12 +105,12 @@ module Devise
       # Helper to decode credentials from HTTP.
       def decode_credentials
         return [] unless request.authorization && request.authorization =~ /^Basic (.*)/m
-        ActiveSupport::Base64.decode64($1).split(/:/, 2)
+        Base64.decode64($1).split(/:/, 2)
       end
 
       # Sets the authentication hash and the password from params_auth_hash or http_auth_hash.
-      def with_authentication_hash(auth_values)
-        self.authentication_hash = {}
+      def with_authentication_hash(auth_type, auth_values)
+        self.authentication_hash, self.authentication_type = {}, auth_type
         self.password = auth_values[:password]
 
         parse_authentication_key_values(auth_values, authentication_keys) &&
@@ -162,4 +156,4 @@ module Devise
       end
     end
   end
-end
+end

lib/devise/strategies/token_authenticatable.rb

@@ -11,7 +11,7 @@ module Devise
     # a password, you can pass "X" as password and it will simply be ignored.
     class TokenAuthenticatable < Authenticatable
       def store?
-        !mapping.to.stateless_token
+        super && !mapping.to.skip_session_storage.include?(:token_auth)
       end
 
       def authenticate!
@@ -27,8 +27,8 @@ module Devise
 
     private
 
-      # TokenAuthenticatable request is valid for any controller and any verb.
-      def valid_request?
+      # Token Authenticatable can be authenticated with params in any controller and any verb.
+      def valid_params_request?
         true
       end
 

lib/devise/version.rb

@@ -1,3 +1,3 @@
 module Devise
-  VERSION = "1.4.7".freeze
+  VERSION = "2.0.0.rc2".freeze
 end

lib/generators/active_record/devise_generator.rb

@@ -1,7 +1,6 @@
 require 'rails/generators/active_record'
 require 'generators/devise/orm_helpers'
 
-
 module ActiveRecord
   module Generators
     class DeviseGenerator < ActiveRecord::Generators::Base
@@ -21,13 +20,52 @@ module ActiveRecord
       def generate_model
         invoke "active_record:model", [name], :migration => false unless model_exists? && behavior == :invoke
       end
-      
+
       def inject_devise_content
         inject_into_class(model_path, class_name, model_contents + <<CONTENT) if model_exists?
   # Setup accessible (or protected) attributes for your model
   attr_accessible :email, :password, :password_confirmation, :remember_me
 CONTENT
       end
+
+      def migration_data
+<<RUBY
+      ## Database authenticatable
+      t.string :email,              :null => false, :default => ""
+      t.string :encrypted_password, :null => false, :default => ""
+
+      ## Recoverable
+      t.string   :reset_password_token
+      t.datetime :reset_password_sent_at
+
+      ## Rememberable
+      t.datetime :remember_created_at
+
+      ## Trackable
+      t.integer  :sign_in_count, :default => 0
+      t.datetime :current_sign_in_at
+      t.datetime :last_sign_in_at
+      t.string   :current_sign_in_ip
+      t.string   :last_sign_in_ip
+
+      ## Encryptable
+      # t.string :password_salt
+
+      ## Confirmable
+      # t.string   :confirmation_token
+      # t.datetime :confirmed_at
+      # t.datetime :confirmation_sent_at
+      # t.string   :unconfirmed_email # Only if using reconfirmable
+
+      ## Lockable
+      # t.integer  :failed_attempts, :default => 0 # Only if lock strategy is :failed_attempts
+      # t.string   :unlock_token # Only if unlock strategy is :email or :both
+      # t.datetime :locked_at
+
+      ## Token authenticatable
+      # t.string :authentication_token
+RUBY
+      end
     end
   end
 end

lib/generators/active_record/templates/migration.rb

@@ -1,17 +1,9 @@
 class DeviseCreate<%= table_name.camelize %> < ActiveRecord::Migration
-  def self.up
+  def change
     create_table(:<%= table_name %>) do |t|
-      t.database_authenticatable :null => false
-      t.recoverable
-      t.rememberable
-      t.trackable
+<%= migration_data -%>
 
-      # t.encryptable
-      # t.confirmable
-      # t.lockable :lock_strategy => :<%= Devise.lock_strategy %>, :unlock_strategy => :<%= Devise.unlock_strategy %>
-      # t.token_authenticatable
-
-<% for  attribute in attributes -%>
+<% attributes.each  do |attribute| -%>
       t.<%= attribute.type %> :<%= attribute.name %>
 <% end -%>
 
@@ -24,8 +16,4 @@ class DeviseCreate<%= table_name.camelize %> < ActiveRecord::Migration
     # add_index :<%= table_name %>, :unlock_token,         :unique => true
     # add_index :<%= table_name %>, :authentication_token, :unique => true
   end
-
-  def self.down
-    drop_table :<%= table_name %>
-  end
 end

lib/generators/active_record/templates/migration_existing.rb

@@ -1,17 +1,9 @@
 class AddDeviseTo<%= table_name.camelize %> < ActiveRecord::Migration
   def self.up
     change_table(:<%= table_name %>) do |t|
-      t.database_authenticatable :null => false
-      t.recoverable
-      t.rememberable
-      t.trackable
-    
-      # t.encryptable
-      # t.confirmable
-      # t.lockable :lock_strategy => :<%= Devise.lock_strategy %>, :unlock_strategy => :<%= Devise.unlock_strategy %>
-      # t.token_authenticatable
+<%= migration_data -%>
 
-<% for  attribute in attributes -%>
+<% attributes.each  do |attribute| -%>
       t.<%= attribute.type %> :<%= attribute.name %>
 <% end -%>
 
@@ -29,6 +21,6 @@ class AddDeviseTo<%= table_name.camelize %> < ActiveRecord::Migration
   def self.down
     # By default, we don't want to make any assumption about how to roll back a migration when your
     # model already existed. Please edit below which fields you would like to remove in this migration.
-    raise ActiveRecord::IrreversibleMigration   
+    raise ActiveRecord::IrreversibleMigration
   end
 end

lib/generators/devise/views_generator.rb

@@ -23,8 +23,8 @@ module Devise
 
       protected
 
-      def view_directory(name)
-        directory name.to_s, "#{target_path}/#{name}"
+      def view_directory(name, _target_path = nil)
+        directory name.to_s, _target_path || "#{target_path}/#{name}"
       end
 
       def target_path
@@ -32,18 +32,6 @@ module Devise
       end
     end
 
-    class SharedViewsGenerator < Rails::Generators::Base #:nodoc:
-      include ViewPathTemplates
-      source_root File.expand_path("../../../../app/views/devise", __FILE__)
-      desc "Copies shared Devise views to your application."
-
-      # Override copy_views to just copy mailer and shared.
-      def copy_views
-        view_directory :mailer
-        view_directory :shared
-      end
-    end
-
     class FormForGenerator < Rails::Generators::Base #:nodoc:
       include ViewPathTemplates
       source_root File.expand_path("../../../../app/views/devise", __FILE__)
@@ -56,17 +44,47 @@ module Devise
       desc "Copies simple form enabled views to your application."
     end
 
+    class ErbGenerator < Rails::Generators::Base #:nodoc:
+      include ViewPathTemplates
+      source_root File.expand_path("../../../../app/views/devise", __FILE__)
+      desc "Copies Devise mail erb views to your application."
+
+      def copy_views
+        view_directory :mailer
+      end
+    end
+
+    class MarkerbGenerator < Rails::Generators::Base #:nodoc:
+      include ViewPathTemplates
+      source_root File.expand_path("../../templates", __FILE__)
+      desc "Copies Devise mail markerb views to your application."
+
+      def copy_views
+        view_directory :markerb, target_path
+      end
+
+      def target_path
+        "app/views/#{scope || :devise}/mailer"
+      end
+    end
+
     class ViewsGenerator < Rails::Generators::Base
+      include ViewPathTemplates
+
+      source_root File.expand_path("../../../../app/views/devise", __FILE__)
       desc "Copies Devise views to your application."
 
-      argument :scope, :required => false, :default => nil,
-                       :desc => "The scope to copy views to"
-
-      invoke SharedViewsGenerator
+      def copy_views
+        copy_file "_links.erb", "#{target_path}/_links.erb"
+      end
 
       hook_for :form_builder, :aliases => "-b",
                               :desc => "Form builder to be used",
                               :default => defined?(SimpleForm) ? "simple_form_for" : "form_for"
+
+      hook_for :markerb,  :desc => "Generate markerb instead of erb mail views",
+                          :default => defined?(Markerb) ? :markerb : :erb,
+                          :type => :boolean
     end
   end
 end

lib/generators/mongoid/devise_generator.rb

@@ -9,9 +9,52 @@ module Mongoid
         invoke "mongoid:model", [name] unless model_exists? && behavior == :invoke
       end
 
+      def inject_field_types
+        inject_into_file model_path, migration_data, :after => "include Mongoid::Document\n" if model_exists?
+      end
+
       def inject_devise_content
         inject_into_file model_path, model_contents, :after => "include Mongoid::Document\n" if model_exists?
       end
+
+      def migration_data
+<<RUBY
+  ## Database authenticatable
+  field :email,              :type => String, :null => false, :default => ""
+  field :encrypted_password, :type => String, :null => false, :default => ""
+
+  ## Recoverable
+  field :reset_password_token,   :type => String
+  field :reset_password_sent_at, :type => Time
+
+  ## Rememberable
+  field :remember_created_at, :type => Time
+
+  ## Trackable
+  field :sign_in_count,      :type => Integer, :default => 0
+  field :current_sign_in_at, :type => Time
+  field :last_sign_in_at,    :type => Time
+  field :current_sign_in_ip, :type => String
+  field :last_sign_in_ip,    :type => String
+
+  ## Encryptable
+  # field :password_salt, :type => String
+
+  ## Confirmable
+  # field :confirmation_token,   :type => String
+  # field :confirmed_at,         :type => Time
+  # field :confirmation_sent_at, :type => Time
+  # field :unconfirmed_email,    :type => String # Only if using reconfirmable
+
+  ## Lockable
+  # field :failed_attempts, :type => Integer, :default => 0 # Only if lock strategy is :failed_attempts
+  # field :unlock_token,    :type => String # Only if unlock strategy is :email or :both
+  # field :locked_at,       :type => Time
+
+  ## Token authenticatable
+  # field :authentication_token, :type => String
+RUBY
+      end
     end
   end
 end

lib/generators/templates/README

@@ -22,4 +22,11 @@ Some setup you must do manually if you haven't yet:
        <p class="notice"><%= notice %></p>
        <p class="alert"><%= alert %></p>
 
+  4. If you are deploying Rails 3.1 on Heroku, you may want to set:
+
+       config.assets.initialize_on_precompile = false
+
+     On config/application.rb forcing your application to not access the DB
+     or load models when precompiling your assets.
+
 ===============================================================================

lib/generators/templates/devise.rb

@@ -1,5 +1,5 @@
-# Use this hook to configure devise mailer, warden hooks and so forth. The first
-# four configuration values can also be set straight in your models.
+# Use this hook to configure devise mailer, warden hooks and so forth.
+# Many of these configuration options can be set straight in your model.
 Devise.setup do |config|
   # ==> Mailer Configuration
   # Configure the e-mail address which will be shown in Devise::Mailer,
@@ -9,6 +9,9 @@ Devise.setup do |config|
   # Configure the class responsible to send e-mails.
   # config.mailer = "Devise::Mailer"
 
+  # Automatically apply schema changes in tableless databases
+  config.apply_schema = false
+
   # ==> ORM configuration
   # Load and configure the ORM. Supports :active_record (default) and
   # :mongoid (bson_ext recommended) by default. Other ORMs may be
@@ -43,9 +46,15 @@ Devise.setup do |config|
   config.strip_whitespace_keys = [ :email ]
 
   # Tell if authentication through request.params is enabled. True by default.
+  # It can be set to an array that will enable params authentication only for the
+  # given strategies, for example, `config.params_authenticatable = [:database]` will
+  # enable it only for database (email + password) authentication.
   # config.params_authenticatable = true
 
   # Tell if authentication through HTTP Basic Auth is enabled. False by default.
+  # It can be set to an array that will enable http authentication only for the
+  # given strategies, for example, `config.http_authenticatable = [:token]` will
+  # enable it only for token authentication.
   # config.http_authenticatable = false
 
   # If http headers should be returned for AJAX requests. True by default.
@@ -59,6 +68,13 @@ Devise.setup do |config|
   # Does not affect registerable.
   # config.paranoid = true
 
+  # By default Devise will store the user in session. You can skip storage for
+  # :http_auth and :token_auth by adding those symbols to the array below.
+  # Notice that if you are skipping storage for all authentication paths, you
+  # may want to disable generating routes to Devise's sessions controller by
+  # passing :skip => :sessions to `devise_for` in your config/routes.rb
+  config.skip_session_storage = [:http_auth]
+
   # ==> Configuration for :database_authenticatable
   # For bcrypt, this is the cost for hashing the password and defaults to 10. If
   # using other encryptors, it sets how many times you want the password re-encrypted.
@@ -77,7 +93,13 @@ Devise.setup do |config|
   # able to access the website for two days without confirming his account,
   # access will be blocked just in the third day. Default is 0.days, meaning
   # the user cannot access the website without confirming his account.
-  # config.confirm_within = 2.days
+  # config.allow_unconfirmed_access_for = 2.days
+
+  # If true, requires any email changes to be confirmed (exctly the same way as
+  # initial account confirmation) to be applied. Requires additional unconfirmed_email
+  # db field (see migrations). Until confirmed new email is stored in
+  # unconfirmed email column, and copied to email column on successful confirmation.
+  config.reconfirmable = true
 
   # Defines which key will be used when confirming an account
   # config.confirmation_keys = [ :email ]
@@ -86,9 +108,6 @@ Devise.setup do |config|
   # The time the user will be remembered without asking for credentials again.
   # config.remember_for = 2.weeks
 
-  # If true, a valid remember token can be re-used between multiple browsers.
-  # config.remember_across_browsers = true
-
   # If true, extends the user's remember period when remembered via cookie.
   # config.extend_remember_period = false
 
@@ -145,7 +164,7 @@ Devise.setup do |config|
   # Time interval you can reset your password with a reset password key.
   # Don't put a too small interval or your users won't have the time to
   # change their passwords.
-  config.reset_password_within = 2.hours
+  config.reset_password_within = 6.hours
 
   # ==> Configuration for :encryptable
   # Allow you to use another encryption algorithm besides bcrypt (default). You can use
@@ -159,10 +178,6 @@ Devise.setup do |config|
   # Defines name of the authentication token params key
   # config.token_authentication_key = :auth_token
 
-  # If true, authentication through token does not store user in session and needs
-  # to be supplied on each request. Useful if you are using the token as API token.
-  # config.stateless_token = false
-
   # ==> Scopes configuration
   # Turn scoped views on. Before rendering "sessions/new", it will first check for
   # "users/sessions/new". It's turned off by default because it's slower if you
@@ -186,9 +201,8 @@ Devise.setup do |config|
   # If you have any extra navigational formats, like :iphone or :mobile, you
   # should add them to the navigational formats lists.
   #
-  # The :"*/*" and "*/*" formats below is required to match Internet
-  # Explorer requests.
-  # config.navigational_formats = [:"*/*", "*/*", :html]
+  # The "*/*" below is required to match Internet Explorer requests.
+  # config.navigational_formats = ["*/*", :html]
 
   # The default HTTP method used to sign out a resource. Default is :delete.
   config.sign_out_via = :delete
@@ -203,7 +217,6 @@ Devise.setup do |config|
   # change the failure app, you can configure them inside the config.warden block.
   #
   # config.warden do |manager|
-  #   manager.failure_app   = AnotherApp
   #   manager.intercept_401 = false
   #   manager.default_strategies(:scope => :user).unshift :some_external_strategy
   # end

lib/generators/templates/markerb/confirmation_instructions.markerb

@@ -0,0 +1,5 @@
+Welcome <%= @resource.email %>!
+
+You can confirm your account through the link below:
+
+<%= link_to 'Confirm my account', confirmation_url(@resource, :confirmation_token => @resource.confirmation_token) %>

lib/generators/templates/markerb/reset_password_instructions.markerb

@@ -0,0 +1,8 @@
+Hello <%= @resource.email %>!
+
+Someone has requested a link to change your password, and you can do this through the link below.
+
+<%= link_to 'Change my password', edit_password_url(@resource, :reset_password_token => @resource.reset_password_token) %>
+
+If you didn't request this, please ignore this email.
+Your password won't change until you access the link above and create a new one.

lib/generators/templates/markerb/unlock_instructions.markerb

@@ -0,0 +1,7 @@
+Hello <%= @resource.email %>!
+
+Your account has been locked due to an excessive amount of unsuccessful sign in attempts.
+
+Click the link below to unlock your account:
+
+<%= link_to 'Unlock my account', unlock_url(@resource, :unlock_token => @resource.unlock_token) %>

lib/generators/templates/simple_form_for/confirmations/new.html.erb

@@ -12,4 +12,4 @@
   </div>
 <% end %>
 
-<%= render :partial => "devise/shared/links" %>
+<%= render "links" %>

lib/generators/templates/simple_form_for/passwords/edit.html.erb

@@ -16,4 +16,4 @@
   </div>
 <% end %>
 
-<%= render :partial => "devise/shared/links" %>
+<%= render "links" %>

lib/generators/templates/simple_form_for/passwords/new.html.erb

@@ -12,4 +12,4 @@
   </div>
 <% end %>
 
-<%= render :partial => "devise/shared/links" %>
+<%= render "links" %>

lib/generators/templates/simple_form_for/registrations/new.html.erb

@@ -14,4 +14,4 @@
   </div>
 <% end %>
 
-<%= render :partial => "devise/shared/links" %>
+<%= render "links" %>

lib/generators/templates/simple_form_for/sessions/new.html.erb

@@ -12,4 +12,4 @@
   </div>
 <% end %>
 
-<%= render :partial => "devise/shared/links" %>
+<%= render "links" %>

lib/generators/templates/simple_form_for/unlocks/new.html.erb

@@ -12,4 +12,4 @@
   </div>
 <% end %>
 
-<%= render :partial => "devise/shared/links" %>
+<%= render "links" %>

test/controllers/helpers_test.rb

@@ -128,6 +128,26 @@ class ControllerAuthenticatableTest < ActionController::TestCase
     @controller.sign_in(user, :bypass => true)
   end
 
+  test 'sign out clears up any signed in user from all scopes' do
+    user = User.new
+    @mock_warden.expects(:user).times(Devise.mappings.size)
+    @mock_warden.expects(:logout).with().returns(true)
+    @controller.instance_variable_set(:@current_user, user)
+    @controller.instance_variable_set(:@current_admin, user)
+    @controller.sign_out
+    assert_equal nil, @controller.instance_variable_get(:@current_user)
+    assert_equal nil, @controller.instance_variable_get(:@current_admin)
+  end
+
+  test 'sign out clears up any signed in user by scope' do
+    user = User.new
+    @mock_warden.expects(:user).with(:user).returns(user)
+    @mock_warden.expects(:logout).with(:user).returns(true)
+    @controller.instance_variable_set(:@current_user, user)
+    @controller.sign_out(:user)
+    assert_equal nil, @controller.instance_variable_get(:@current_user)
+  end
+  
   test 'sign out proxy to logout on warden' do
     @mock_warden.expects(:user).with(:user).returns(true)
     @mock_warden.expects(:logout).with(:user).returns(true)
@@ -208,17 +228,6 @@ class ControllerAuthenticatableTest < ActionController::TestCase
     @controller.sign_in_and_redirect(admin)
   end
 
-  test 'redirect_location returns the stored location if set' do
-    user = User.new
-    @controller.session[:"user_return_to"] = "/foo.bar"
-    assert_equal '/foo.bar', @controller.redirect_location('user', user)
-  end
-
-  test 'redirect_location returns the after sign in path by default' do
-    user = User.new
-    assert_equal @controller.after_sign_in_path_for(:user), @controller.redirect_location('user', user)
-  end
-
   test 'sign out and redirect uses the configured after sign out path when signing out only the current scope' do
     swap Devise, :sign_out_all_scopes => false do
       @mock_warden.expects(:user).with(:admin).returns(true)

test/controllers/internal_helpers_test.rb

@@ -1,7 +1,6 @@
 require 'test_helper'
 
-class MyController < ApplicationController
-  include Devise::Controllers::InternalHelpers
+class MyController < DeviseController
 end
 
 class HelpersTest < ActionController::TestCase
@@ -45,10 +44,12 @@ class HelpersTest < ActionController::TestCase
     @controller.send :require_no_authentication
   end
 
-  test 'require no authentication skips if no inputs are available' do
+  test 'require no authentication only checks if already authenticated if no inputs strategies are available' do
     Devise.mappings[:user].expects(:no_input_strategies).returns([])
     @mock_warden.expects(:authenticate?).never
-    @controller.expects(:redirect_to).never
+    @mock_warden.expects(:authenticated?).with(:user).once.returns(true)
+    @mock_warden.expects(:user).with(:user).returns(User.new)
+    @controller.expects(:redirect_to).with(root_path)
     @controller.send :require_no_authentication
   end
 

test/delegator_test.rb

@@ -0,0 +1,19 @@
+require 'test_helper'
+
+class DelegatorTest < ActiveSupport::TestCase
+  def delegator
+    Devise::Delegator.new
+  end
+
+  test 'failure_app returns default failure app if no warden options in env' do
+    assert_equal Devise::FailureApp, delegator.failure_app({})
+  end
+
+  test 'failure_app returns default failure app if no scope in warden options' do
+    assert_equal Devise::FailureApp, delegator.failure_app({"warden.options" => {}})
+  end
+
+  test 'failure_app returns associated failure app by scope in the given environment' do
+    assert_kind_of Proc, delegator.failure_app({"warden.options" => {:scope => "manager"}})
+  end
+end

test/devise_test.rb

@@ -12,8 +12,8 @@ end
 
 class DeviseTest < ActiveSupport::TestCase
   test 'model options can be configured through Devise' do
-    swap Devise, :confirm_within => 113, :pepper => "foo" do
-      assert_equal 113, Devise.confirm_within
+    swap Devise, :allow_unconfirmed_access_for => 113, :pepper => "foo" do
+      assert_equal 113, Devise.allow_unconfirmed_access_for
       assert_equal "foo", Devise.pepper
     end
   end
@@ -25,7 +25,7 @@ class DeviseTest < ActiveSupport::TestCase
   end
 
   test 'stores warden configuration' do
-    assert_equal Devise::FailureApp, Devise.warden_config.failure_app
+    assert_kind_of Devise::Delegator, Devise.warden_config.failure_app
     assert_equal :user, Devise.warden_config.default_scope
   end
 

test/failure_app_test.rb

@@ -3,7 +3,9 @@ require 'ostruct'
 
 class FailureTest < ActiveSupport::TestCase
   class RootFailureApp < Devise::FailureApp
-    undef_method :new_user_session_path
+    def fake_app
+      Object.new
+    end
   end
 
   def self.context(name, &block)
@@ -41,15 +43,17 @@ class FailureTest < ActiveSupport::TestCase
     end
 
     test 'return to the root path if no session path is available' do
-      call_failure :app => RootFailureApp
-      assert_equal 302, @response.first
-      assert_equal 'You need to sign in or sign up before continuing.', @request.flash[:alert]
-      assert_equal 'http://test.host/', @response.second['Location']
+      swap Devise, :router_name => :fake_app do
+        call_failure :app => RootFailureApp
+        assert_equal 302, @response.first
+        assert_equal 'You need to sign in or sign up before continuing.', @request.flash[:alert]
+        assert_equal 'http://test.host/', @response.second['Location']
+      end
     end
 
     test 'uses the proxy failure message as symbol' do
-      call_failure('warden' => OpenStruct.new(:message => :test))
-      assert_equal 'test', @request.flash[:alert]
+      call_failure('warden' => OpenStruct.new(:message => :invalid))
+      assert_equal 'Invalid email or password.', @request.flash[:alert]
       assert_equal 'http://test.host/users/sign_in', @response.second["Location"]
     end
 
@@ -73,14 +77,14 @@ class FailureTest < ActiveSupport::TestCase
 
     test 'works for any navigational format' do
       swap Devise, :navigational_formats => [:xml] do
-        call_failure('formats' => :xml)
+        call_failure('formats' => Mime::XML)
         assert_equal 302, @response.first
       end
     end
 
     test 'redirects the correct format if it is a non-html format request' do
       swap Devise, :navigational_formats => [:js] do
-        call_failure('formats' => :js)
+        call_failure('formats' => Mime::JS)
         assert_equal 'http://test.host/users/sign_in.js', @response.second["Location"]
       end
     end
@@ -88,18 +92,18 @@ class FailureTest < ActiveSupport::TestCase
 
   context 'For HTTP request' do
     test 'return 401 status' do
-      call_failure('formats' => :xml)
+      call_failure('formats' => Mime::XML)
       assert_equal 401, @response.first
     end
 
     test 'return appropriate body for xml' do
-      call_failure('formats' => :xml)
+      call_failure('formats' => Mime::XML)
       result = %(<?xml version="1.0" encoding="UTF-8"?>\n<errors>\n  <error>You need to sign in or sign up before continuing.</error>\n</errors>\n)
       assert_equal result, @response.last.body
     end
 
     test 'return appropriate body for json' do
-      call_failure('formats' => :json)
+      call_failure('formats' => Mime::JSON)
       result = %({"error":"You need to sign in or sign up before continuing."})
       assert_equal result, @response.last.body
     end
@@ -110,26 +114,26 @@ class FailureTest < ActiveSupport::TestCase
     end
 
     test 'return WWW-authenticate headers if model allows' do
-      call_failure('formats' => :xml)
+      call_failure('formats' => Mime::XML)
       assert_equal 'Basic realm="Application"', @response.second["WWW-Authenticate"]
     end
 
     test 'does not return WWW-authenticate headers if model does not allow' do
       swap Devise, :http_authenticatable => false do
-        call_failure('formats' => :xml)
+        call_failure('formats' => Mime::XML)
         assert_nil @response.second["WWW-Authenticate"]
       end
     end
 
     test 'works for any non navigational format' do
       swap Devise, :navigational_formats => [] do
-        call_failure('formats' => :html)
+        call_failure('formats' => Mime::HTML)
         assert_equal 401, @response.first
       end
     end
 
     test 'uses the failure message as response body' do
-      call_failure('formats' => :xml, 'warden' => OpenStruct.new(:message => :invalid))
+      call_failure('formats' => Mime::XML, 'warden' => OpenStruct.new(:message => :invalid))
       assert_match '<error>Invalid email or password.</error>', @response.third.body
     end
 
@@ -137,7 +141,7 @@ class FailureTest < ActiveSupport::TestCase
       context 'when http_authenticatable_on_xhr is false' do
         test 'dont return 401 with navigational formats' do
           swap Devise, :http_authenticatable_on_xhr => false do
-            call_failure('formats' => :html, 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest')
+            call_failure('formats' => Mime::HTML, 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest')
             assert_equal 302, @response.first
             assert_equal 'http://test.host/users/sign_in', @response.second["Location"]
           end
@@ -145,7 +149,7 @@ class FailureTest < ActiveSupport::TestCase
 
         test 'dont return 401 with non navigational formats' do
           swap Devise, :http_authenticatable_on_xhr => false do
-            call_failure('formats' => :json, 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest')
+            call_failure('formats' => Mime::JSON, 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest')
             assert_equal 302, @response.first
             assert_equal 'http://test.host/users/sign_in.json', @response.second["Location"]
           end
@@ -155,14 +159,14 @@ class FailureTest < ActiveSupport::TestCase
       context 'when http_authenticatable_on_xhr is true' do
         test 'return 401' do
           swap Devise, :http_authenticatable_on_xhr => true do
-            call_failure('formats' => :html, 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest')
+            call_failure('formats' => Mime::HTML, 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest')
             assert_equal 401, @response.first
           end
         end
 
         test 'skip WWW-Authenticate header' do
           swap Devise, :http_authenticatable_on_xhr => true do
-            call_failure('formats' => :html, 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest')
+            call_failure('formats' => Mime::HTML, 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest')
             assert_nil @response.second['WWW-Authenticate']
           end
         end

test/generators/active_record_generator_test.rb

@@ -7,20 +7,20 @@ if DEVISE_ORM == :active_record
     tests ActiveRecord::Generators::DeviseGenerator
     destination File.expand_path("../../tmp", __FILE__)
     setup :prepare_destination
-  
-    test "all files are properly created" do
+
+    test "all files are properly created with rails31 migration syntax" do
       run_generator %w(monster)
       assert_file "app/models/monster.rb", /devise/, /attr_accessible (:[a-z_]+(, )?)+/
-      assert_migration "db/migrate/devise_create_monsters.rb"
+      assert_migration "db/migrate/devise_create_monsters.rb", /def change/
     end
-    
+
     test "update model migration when model exists" do
       run_generator %w(monster)
       assert_file "app/models/monster.rb"
       run_generator %w(monster)
       assert_migration "db/migrate/add_devise_to_monsters.rb"
     end
-  
+
     test "all files are properly deleted" do
       run_generator %w(monster)
       run_generator %w(monster)

test/generators/views_generator_test.rb

@@ -28,18 +28,25 @@ class ViewsGeneratorTest < Rails::Generators::TestCase
     assert_file "app/views/users/confirmations/new.html.erb", /simple_form_for/
   end
 
-  def assert_files(scope = nil, template_engine = nil)
+  test "Assert views with markerb" do
+    run_generator %w(--markerb)
+    assert_files nil, :mail_template_engine => "markerb"
+  end
+
+  def assert_files(scope = nil, options={})
     scope = "devise" if scope.nil?
+    mail_template_engine = options[:mail_template_engine] || "html.erb"
+
     assert_file "app/views/#{scope}/confirmations/new.html.erb"
-    assert_file "app/views/#{scope}/mailer/confirmation_instructions.html.erb"
-    assert_file "app/views/#{scope}/mailer/reset_password_instructions.html.erb"
-    assert_file "app/views/#{scope}/mailer/unlock_instructions.html.erb"
+    assert_file "app/views/#{scope}/mailer/confirmation_instructions.#{mail_template_engine}"
+    assert_file "app/views/#{scope}/mailer/reset_password_instructions.#{mail_template_engine}"
+    assert_file "app/views/#{scope}/mailer/unlock_instructions.#{mail_template_engine}"
     assert_file "app/views/#{scope}/passwords/edit.html.erb"
     assert_file "app/views/#{scope}/passwords/new.html.erb"
     assert_file "app/views/#{scope}/registrations/new.html.erb"
     assert_file "app/views/#{scope}/registrations/edit.html.erb"
     assert_file "app/views/#{scope}/sessions/new.html.erb"
-    assert_file "app/views/#{scope}/shared/_links.erb"
     assert_file "app/views/#{scope}/unlocks/new.html.erb"
+    assert_file "app/views/#{scope}/_links.erb"
   end
 end

test/integration/authenticatable_test.rb

@@ -131,7 +131,7 @@ class AuthenticationSanityTest < ActionController::IntegrationTest
     end
   end
 
-  test 'signed in user should not see join page' do
+  test 'signed in user should not see unauthenticated page' do
     sign_in_as_user
     assert warden.authenticated?(:user)
     assert_not warden.authenticated?(:admin)
@@ -141,7 +141,7 @@ class AuthenticationSanityTest < ActionController::IntegrationTest
     end
   end
 
-  test 'not signed in should see join page' do
+  test 'not signed in users should see unautheticated page' do
     get join_path
 
     assert_response :success
@@ -200,6 +200,12 @@ class AuthenticationSanityTest < ActionController::IntegrationTest
     get root_path
     assert_not_contain 'Signed out successfully'
   end
+
+  test 'scope uses custom failure app' do
+    put "/en/accounts/management"
+    assert_equal "Oops, not found", response.body
+    assert_equal 404, response.status
+  end
 end
 
 class AuthenticationRedirectTest < ActionController::IntegrationTest
@@ -312,7 +318,7 @@ class AuthenticationSessionTest < ActionController::IntegrationTest
   end
 end
 
-class AuthenticationWithScopesTest < ActionController::IntegrationTest
+class AuthenticationWithScopedViewsTest < ActionController::IntegrationTest
   test 'renders the scoped view if turned on and view is available' do
     swap Devise, :scoped_views => true do
       assert_raise Webrat::NotFoundError do
@@ -401,7 +407,10 @@ class AuthenticationOthersTest < ActionController::IntegrationTest
 
   test 'sign in stub in xml format' do
     get new_user_session_path(:format => 'xml')
-    assert_equal "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<user>\n  <email></email>\n  <password nil=\"true\"></password>\n</user>\n", response.body
+    assert_match '<?xml version="1.0" encoding="UTF-8"?>', response.body
+    assert_match /<user>.*<\/user>/m, response.body
+    assert_match '<email></email>', response.body
+    assert_match '<password nil="true"></password>', response.body
   end
 
   test 'sign in stub in json format' do
@@ -426,12 +435,6 @@ class AuthenticationOthersTest < ActionController::IntegrationTest
     assert_not warden.authenticated?(:admin)
   end
 
-  test 'uses the mapping from nested devise_for call' do
-    sign_in_as_user :visit => "/devise_for/sign_in"
-    assert warden.authenticated?(:user)
-    assert_not warden.authenticated?(:admin)
-  end
-
   test 'sign in with xml format returns xml response' do
     create_user
     post user_session_path(:format => 'xml'), :user => {:email => "user@test.com", :password => '123456'}
@@ -439,6 +442,22 @@ class AuthenticationOthersTest < ActionController::IntegrationTest
     assert response.body.include? %(<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<user>)
   end
 
+  test 'sign in with xml format is idempotent' do
+    get new_user_session_path(:format => 'xml')
+    assert_response :success
+
+    create_user
+    post user_session_path(:format => 'xml'), :user => {:email => "user@test.com", :password => '123456'}
+    assert_response :success
+
+    get new_user_session_path(:format => 'xml')
+    assert_response :success
+
+    post user_session_path(:format => 'xml'), :user => {:email => "user@test.com", :password => '123456'}
+    assert_response :success
+    assert response.body.include? %(<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<user>)
+  end
+
   test 'sign out with xml format returns ok response' do
     sign_in_as_user
     get destroy_user_session_path(:format => 'xml')

test/integration/confirmable_test.rb

@@ -6,7 +6,7 @@ class ConfirmationTest < ActionController::IntegrationTest
     visit user_confirmation_path(:confirmation_token => confirmation_token)
   end
 
-  test 'user should be able to request a new confirmation' do
+  def resend_confirmation
     user = create_user(:confirm => false)
     ActionMailer::Base.deliveries.clear
 
@@ -15,10 +15,23 @@ class ConfirmationTest < ActionController::IntegrationTest
 
     fill_in 'email', :with => user.email
     click_button 'Resend confirmation instructions'
+  end
+
+  test 'user should be able to request a new confirmation' do
+    resend_confirmation
 
     assert_current_url '/users/sign_in'
     assert_contain 'You will receive an email with instructions about how to confirm your account in a few minutes'
     assert_equal 1, ActionMailer::Base.deliveries.size
+    assert_equal ['please-change-me@config-initializers-devise.com'], ActionMailer::Base.deliveries.first.from
+  end
+
+  test 'user should receive a confirmation from a custom mailer' do
+    User.any_instance.stubs(:devise_mailer).returns(Users::Mailer)
+
+    resend_confirmation
+
+    assert_equal ['custom@example.com'], ActionMailer::Base.deliveries.first.from
   end
 
   test 'user with invalid confirmation token should not be able to confirm an account' do
@@ -85,7 +98,7 @@ class ConfirmationTest < ActionController::IntegrationTest
   end
 
   test 'not confirmed user with setup to block without confirmation should not be able to sign in' do
-    swap Devise, :confirm_within => 0.days do
+    swap Devise, :allow_unconfirmed_access_for => 0.days do
       sign_in_as_user(:confirm => false)
 
       assert_contain 'You have to confirm your account before continuing'
@@ -93,8 +106,19 @@ class ConfirmationTest < ActionController::IntegrationTest
     end
   end
 
+  test 'not confirmed user should not see confirmation message if invalid credentials are given' do
+    swap Devise, :allow_unconfirmed_access_for => 0.days do
+      sign_in_as_user(:confirm => false) do
+        fill_in 'password', :with => 'invalid'
+      end
+
+      assert_contain 'Invalid email or password'
+      assert_not warden.authenticated?(:user)
+    end
+  end
+
   test 'not confirmed user but configured with some days to confirm should be able to sign in' do
-    swap Devise, :confirm_within => 1.day do
+    swap Devise, :allow_unconfirmed_access_for => 1.day do
       sign_in_as_user(:confirm => false)
 
       assert_response :success
@@ -157,7 +181,7 @@ class ConfirmationTest < ActionController::IntegrationTest
       click_button 'Resend confirmation instructions'
 
       assert_contain "If your e-mail exists on our database, you will receive an email with instructions about how to confirm your account in a few minutes."
-      assert_current_url "/users/confirmation"
+      assert_current_url "/users/sign_in"
     end
   end
 
@@ -173,7 +197,59 @@ class ConfirmationTest < ActionController::IntegrationTest
       assert_not_contain "Email not found"
 
       assert_contain "If your e-mail exists on our database, you will receive an email with instructions about how to confirm your account in a few minutes."
-      assert_current_url "/users/confirmation"
+      assert_current_url "/users/sign_in"
     end
   end
 end
+
+class ConfirmationOnChangeTest < ActionController::IntegrationTest
+  def create_second_admin(options={})
+    @admin = nil
+    create_admin(options)
+  end
+
+  def visit_admin_confirmation_with_token(confirmation_token)
+    visit admin_confirmation_path(:confirmation_token => confirmation_token)
+  end
+
+  test 'admin should be able to request a new confirmation after email changed' do
+    admin = create_admin
+    admin.update_attributes(:email => 'new_test@example.com')
+
+    visit new_admin_session_path
+    click_link "Didn't receive confirmation instructions?"
+
+    fill_in 'email', :with => admin.unconfirmed_email
+    assert_difference "ActionMailer::Base.deliveries.size" do
+      click_button 'Resend confirmation instructions'
+    end
+
+    assert_current_url '/admin_area/sign_in'
+    assert_contain 'You will receive an email with instructions about how to confirm your account in a few minutes'
+  end
+
+  test 'admin with valid confirmation token should be able to confirm email after email changed' do
+    admin = create_admin
+    admin.update_attributes(:email => 'new_test@example.com')
+    assert_equal 'new_test@example.com', admin.unconfirmed_email
+    visit_admin_confirmation_with_token(admin.confirmation_token)
+
+    assert_contain 'Your account was successfully confirmed.'
+    assert_current_url '/admin_area/home'
+    assert admin.reload.confirmed?
+    assert_not admin.reload.pending_reconfirmation?
+  end
+
+  test 'admin email should be unique also within unconfirmed_email' do
+    admin = create_admin
+    admin.update_attributes(:email => 'new_admin_test@example.com')
+    assert_equal 'new_admin_test@example.com', admin.unconfirmed_email
+
+    create_second_admin(:email => "new_admin_test@example.com")
+
+    visit_admin_confirmation_with_token(admin.confirmation_token)
+    assert_have_selector '#error_explanation'
+    assert_contain /Email.*already.*taken/
+    assert admin.reload.pending_reconfirmation?
+  end
+end

test/integration/http_authenticatable_test.rb

@@ -4,7 +4,7 @@ class HttpAuthenticationTest < ActionController::IntegrationTest
   test 'handles unverified requests gets rid of caches but continues signed in' do
     swap UsersController, :allow_forgery_protection => true do
       create_user
-      post exhibit_user_url(1), {}, "HTTP_AUTHORIZATION" => "Basic #{ActiveSupport::Base64.encode64("user@test.com:123456")}"
+      post exhibit_user_url(1), {}, "HTTP_AUTHORIZATION" => "Basic #{Base64.encode64("user@test.com:123456")}"
       assert warden.authenticated?(:user)
       assert_equal "User is authenticated", response.body
     end
@@ -12,9 +12,24 @@ class HttpAuthenticationTest < ActionController::IntegrationTest
 
   test 'sign in should authenticate with http' do
     sign_in_as_new_user_with_http
-    assert_response :success
+    assert_response 200
     assert_match '<email>user@test.com</email>', response.body
     assert warden.authenticated?(:user)
+
+    get users_path(:format => :xml)
+    assert_response 200
+  end
+
+  test 'sign in should authenticate with http but not emit a cookie if skipping session storage' do
+    swap Devise, :skip_session_storage => [:http_auth] do
+      sign_in_as_new_user_with_http
+      assert_response 200
+      assert_match '<email>user@test.com</email>', response.body
+      assert warden.authenticated?(:user)
+
+      get users_path(:format => :xml)
+      assert_response 401
+    end
   end
 
   test 'returns a custom response with www-authenticate header on failures' do
@@ -59,7 +74,7 @@ class HttpAuthenticationTest < ActionController::IntegrationTest
     token = "token_containing_so_many_characters_that_the_base64_encoding_will_wrap"
     user = create_user
     user.update_attribute :authentication_token, token
-    get users_path(:format => :xml), {}, "HTTP_AUTHORIZATION" => "Basic #{ActiveSupport::Base64.encode64("#{token}:x")}"
+    get users_path(:format => :xml), {}, "HTTP_AUTHORIZATION" => "Basic #{Base64.encode64("#{token}:x")}"
     assert_response :success
     assert_match "<email>user@test.com</email>", response.body
     assert warden.authenticated?(:user)
@@ -69,14 +84,14 @@ class HttpAuthenticationTest < ActionController::IntegrationTest
 
     def sign_in_as_new_user_with_http(username="user@test.com", password="123456")
       user = create_user
-      get users_path(:format => :xml), {}, "HTTP_AUTHORIZATION" => "Basic #{ActiveSupport::Base64.encode64("#{username}:#{password}")}"
+      get users_path(:format => :xml), {}, "HTTP_AUTHORIZATION" => "Basic #{Base64.encode64("#{username}:#{password}")}"
       user
     end
 
     # Sign in with oauth2 token. This is just to test that it isn't misinterpreted as basic authentication
     def add_oauth2_header
       user = create_user
-      get users_path(:format => :xml), {}, "HTTP_AUTHORIZATION" => "OAuth #{ActiveSupport::Base64.encode64("#{user.email}:123456")}"
+      get users_path(:format => :xml), {}, "HTTP_AUTHORIZATION" => "OAuth #{Base64.encode64("#{user.email}:123456")}"
     end
 
 end

test/integration/lockable_test.rb

@@ -6,7 +6,7 @@ class LockTest < ActionController::IntegrationTest
     visit user_unlock_path(:unlock_token => unlock_token)
   end
 
-  test 'user should be able to request a new unlock token' do
+  def send_unlock_request
     user = create_user(:locked => true)
     ActionMailer::Base.deliveries.clear
 
@@ -15,10 +15,23 @@ class LockTest < ActionController::IntegrationTest
 
     fill_in 'email', :with => user.email
     click_button 'Resend unlock instructions'
+  end
+
+  test 'user should be able to request a new unlock token' do
+    send_unlock_request
 
     assert_template 'sessions/new'
     assert_contain 'You will receive an email with instructions about how to unlock your account in a few minutes'
     assert_equal 1, ActionMailer::Base.deliveries.size
+    assert_equal ['please-change-me@config-initializers-devise.com'], ActionMailer::Base.deliveries.first.from
+  end
+
+  test 'user should receive the instructions from a custom mailer' do
+    User.any_instance.stubs(:devise_mailer).returns(Users::Mailer)
+
+    send_unlock_request
+
+    assert_equal ['custom@example.com'], ActionMailer::Base.deliveries.first.from
   end
 
   test 'unlocked user should not be able to request a unlock token' do
@@ -67,22 +80,15 @@ class LockTest < ActionController::IntegrationTest
 
     visit_user_unlock_with_token(user.unlock_token)
 
-    assert_current_url '/'
-    assert_contain 'Your account was successfully unlocked.'
+    assert_current_url "/users/sign_in"
+    assert_contain 'Your account has been unlocked successfully. Please sign in to continue.'
 
     assert_not user.reload.access_locked?
   end
 
-  test "sign in user automatically after unlocking its account" do
+  test "redirect user to sign in page after unlocking its account" do
     user = create_user(:locked => true)
     visit_user_unlock_with_token(user.unlock_token)
-    assert warden.authenticated?(:user)
-  end
-
-  test "user should not be able to sign in when locked" do
-    user = sign_in_as_user(:locked => true)
-    assert_template 'sessions/new'
-    assert_contain 'Your account is locked.'
     assert_not warden.authenticated?(:user)
   end
 
@@ -100,10 +106,29 @@ class LockTest < ActionController::IntegrationTest
 
   test 'error message is configurable by resource name' do
     store_translations :en, :devise => {
-      :failure => { :user => { :locked => "You are locked!" } }
+        :failure => {:user => {:locked => "You are locked!"}}
     } do
-      user = sign_in_as_user(:locked => true)
-      assert_contain 'You are locked!'
+
+      user = create_user(:locked => true)
+      user.failed_attempts = User.maximum_attempts + 1
+      user.save!
+
+      sign_in_as_user(:password => "invalid")
+      assert_contain "You are locked!"
+    end
+  end
+
+  test "user should not be able to sign in when locked" do
+    store_translations :en, :devise => {
+        :failure => {:user => {:locked => "You are locked!"}}
+    } do
+
+      user = create_user(:locked => true)
+      user.failed_attempts = User.maximum_attempts + 1
+      user.save!
+
+      sign_in_as_user(:password => "123456")
+      assert_contain "You are locked!"
     end
   end
 
@@ -144,7 +169,7 @@ class LockTest < ActionController::IntegrationTest
 
   test "when using json to ask a unlock request, should not return the user" do
     user = create_user(:locked => true)
-    post  user_unlock_path(:format => "json", :user => {:email => user.email})
+    post user_unlock_path(:format => "json", :user => {:email => user.email})
     assert_response :success
     assert_equal response.body, {}.to_json
   end
@@ -159,8 +184,7 @@ class LockTest < ActionController::IntegrationTest
       fill_in 'email', :with => user.email
       click_button 'Resend unlock instructions'
 
-      assert_current_url "/users/unlock"
-
+      assert_current_url "/users/sign_in"
       assert_contain "If your account exists, you will receive an email with instructions about how to unlock it in a few minutes."
     end
   end
@@ -175,8 +199,7 @@ class LockTest < ActionController::IntegrationTest
       fill_in 'email', :with => user.email
       click_button 'Resend unlock instructions'
 
-      assert_current_url "/users/unlock"
-
+      assert_current_url "/users/sign_in"
       assert_contain "If your account exists, you will receive an email with instructions about how to unlock it in a few minutes."
     end
   end
@@ -191,7 +214,7 @@ class LockTest < ActionController::IntegrationTest
 
       assert_not_contain "1 error prohibited this user from being saved:"
       assert_not_contain "Email not found"
-      assert_current_url "/users/unlock"
+      assert_current_url "/users/sign_in"
 
       assert_contain "If your account exists, you will receive an email with instructions about how to unlock it in a few minutes."
 

test/integration/omniauthable_test.rb

@@ -1,5 +1,6 @@
 require 'test_helper'
 
+
 class OmniauthableIntegrationTest < ActionController::IntegrationTest
   FACEBOOK_INFO = {
     "id" => '12345',
@@ -12,14 +13,6 @@ class OmniauthableIntegrationTest < ActionController::IntegrationTest
 
   setup do
     OmniAuth.config.test_mode = true
-    stub_facebook!
-  end
-
-  teardown do
-    OmniAuth.config.test_mode = false
-  end
-
-  def stub_facebook!
     OmniAuth.config.mock_auth[:facebook] = {
       "uid" => '12345',
       "provider" => 'facebook',
@@ -29,6 +22,10 @@ class OmniauthableIntegrationTest < ActionController::IntegrationTest
     }
   end
 
+  teardown do
+    OmniAuth.config.test_mode = false
+  end
+
   def stub_action!(name)
     Users::OmniauthCallbacksController.class_eval do
       alias_method :__old_facebook, :facebook
@@ -128,7 +125,7 @@ class OmniauthableIntegrationTest < ActionController::IntegrationTest
     OmniAuth.config.mock_auth[:facebook] = :invalid_credentials
 
     visit "/users/sign_in"
-    click_link "Sign in with facebook"
+    click_link "Sign in with Facebook"
 
     assert_current_url "/users/sign_in"
     assert_contain 'Could not authorize you from Facebook because "Invalid credentials".'

test/integration/recoverable_test.rb

@@ -38,6 +38,16 @@ class PasswordTest < ActionController::IntegrationTest
     assert_contain 'You will receive an email with instructions about how to reset your password in a few minutes.'
   end
 
+  test 'reset password with email should send an email from a custom mailer' do
+    create_user(:email => 'Foo@Bar.com')
+
+    User.any_instance.stubs(:devise_mailer).returns(Users::Mailer)
+    request_forgot_password do
+      fill_in 'email', :with => 'foo@bar.com'
+    end
+    assert_equal ['custom@example.com'], ActionMailer::Base.deliveries.last.from
+  end
+
   test 'reset password with email of different case should fail when email is NOT the list of case insensitive keys' do
     swap Devise, :case_insensitive_keys => [] do
       create_user(:email => 'Foo@Bar.com')
@@ -208,6 +218,15 @@ class PasswordTest < ActionController::IntegrationTest
     assert response.body.include? %(<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<errors>)
   end
 
+  test 'reset password request with invalid E-Mail in XML format should return empty and valid response' do
+    swap Devise, :paranoid => true do
+      create_user
+      post user_password_path(:format => 'xml'), :user => {:email => "invalid@test.com"}
+      assert_response :success
+      assert_equal response.body, { }.to_xml
+    end
+  end
+
   test 'change password with valid parameters in XML format should return valid response' do
     user = create_user
     request_forgot_password
@@ -250,7 +269,7 @@ class PasswordTest < ActionController::IntegrationTest
       assert_not_contain "1 error prohibited this user from being saved:"
       assert_not_contain "Email not found"
       assert_contain "If your e-mail exists on our database, you will receive a password recovery link on your e-mail"
-      assert_current_url "/users/password"
+      assert_current_url "/users/sign_in"
     end
   end
 
@@ -262,7 +281,7 @@ class PasswordTest < ActionController::IntegrationTest
       click_button 'Send me reset password instructions'
 
       assert_contain "If your e-mail exists on our database, you will receive a password recovery link on your e-mail"
-      assert_current_url "/users/password"
+      assert_current_url "/users/sign_in"
     end
   end
 end

test/integration/registerable_test.rb

@@ -13,7 +13,7 @@ class RegistrationTest < ActionController::IntegrationTest
     fill_in 'password confirmation', :with => 'new_user123'
     click_button 'Sign up'
 
-    assert_contain 'Welcome! You have signed up successfully.'
+    assert_contain 'You have signed up successfully'
     assert warden.authenticated?(:admin)
     assert_current_url "/admin_area/home"
 
@@ -36,15 +36,21 @@ class RegistrationTest < ActionController::IntegrationTest
     assert_current_url "/?custom=1"
   end
 
-  test 'a guest user should be able to sign up successfully and be blocked by confirmation' do
+  def user_sign_up
+    ActionMailer::Base.deliveries.clear
+
     get new_user_registration_path
 
     fill_in 'email', :with => 'new_user@test.com'
     fill_in 'password', :with => 'new_user123'
     fill_in 'password confirmation', :with => 'new_user123'
     click_button 'Sign up'
+  end
 
-    assert_contain 'You have signed up successfully. However, we could not sign you in because your account is unconfirmed.'
+  test 'a guest user should be able to sign up successfully and be blocked by confirmation' do
+    user_sign_up
+
+    assert_contain 'A message with a confirmation link has been sent to your email address. Please open the link to activate your account.'
     assert_not_contain 'You have to confirm your account before continuing'
     assert_current_url "/"
 
@@ -55,6 +61,17 @@ class RegistrationTest < ActionController::IntegrationTest
     assert_not user.confirmed?
   end
 
+  test 'a guest user should receive the confirmation instructions from the default mailer' do
+    user_sign_up
+    assert_equal ['please-change-me@config-initializers-devise.com'], ActionMailer::Base.deliveries.first.from
+  end
+
+  test 'a guest user should receive the confirmation instructions from a custom mailer' do
+    User.any_instance.stubs(:devise_mailer).returns(Users::Mailer)
+    user_sign_up
+    assert_equal ['custom@example.com'], ActionMailer::Base.deliveries.first.from
+  end
+
   test 'a guest user should be blocked by confirmation and redirected to a custom path' do
     Devise::RegistrationsController.any_instance.stubs(:after_inactive_sign_up_path_for).returns("/?custom=1")
     get new_user_registration_path
@@ -274,3 +291,34 @@ class RegistrationTest < ActionController::IntegrationTest
     assert_equal User.count, 0
   end
 end
+
+class ReconfirmableRegistrationTest < ActionController::IntegrationTest
+  test 'a signed in admin should see a more appropriate flash message when editing his account if reconfirmable is enabled' do
+    sign_in_as_admin
+    get edit_admin_registration_path
+
+    fill_in 'email', :with => 'admin.new@example.com'
+    fill_in 'current password', :with => '123456'
+    click_button 'Update'
+
+    assert_current_url '/admin_area/home'
+    assert_contain 'but we need to verify your new email address'
+
+    assert_equal "admin.new@example.com", Admin.first.unconfirmed_email
+  end
+
+  test 'a signed in admin should not see a reconfirmation message if they did not change their password' do
+    sign_in_as_admin
+    get edit_admin_registration_path
+
+    fill_in 'password', :with => 'pas123'
+    fill_in 'password confirmation', :with => 'pas123'
+    fill_in 'current password', :with => '123456'
+    click_button 'Update'
+
+    assert_current_url '/admin_area/home'
+    assert_contain 'You updated your account successfully.'
+
+    assert Admin.first.valid_password?('pas123')
+  end
+end

test/integration/rememberable_test.rb

@@ -9,14 +9,6 @@ class RememberMeTest < ActionController::IntegrationTest
     user
   end
 
-  def create_admin_and_remember
-    admin = create_admin
-    admin.remember_me!
-    raw_cookie = Admin.serialize_into_cookie(admin)
-    cookies['remember_admin_token'] = generate_signed_cookie(raw_cookie)
-    admin
-  end
-
   def generate_signed_cookie(raw_cookie)
     request = ActionDispatch::TestRequest.new
     request.cookie_jar.signed['raw_cookie'] = raw_cookie
@@ -117,34 +109,6 @@ class RememberMeTest < ActionController::IntegrationTest
     end
   end
 
-  test 'if both extend_remember_period and remember_across_browsers are true, sends the same token with a new expire date' do
-    swap Devise, :remember_across_browsers => true, :extend_remember_period => true, :remember_for => 1.year do
-      admin = create_admin_and_remember
-      token = admin.remember_token
-
-      admin.remember_created_at = old = 10.minutes.ago
-      admin.save!
-
-      get root_path
-      assert (cookie_expires("remember_admin_token") - 1.year) > (old + 5.minutes)
-      assert_equal token, signed_cookie("remember_admin_token").last
-    end
-  end
-
-  test 'if both extend_remember_period and remember_across_browsers are false, sends a new token with old expire date' do
-    swap Devise, :remember_across_browsers => false, :extend_remember_period => false, :remember_for => 1.year do
-      admin = create_admin_and_remember
-      token = admin.remember_token
-
-      admin.remember_created_at = old = 10.minutes.ago
-      admin.save!
-
-      get root_path
-      assert (cookie_expires("remember_admin_token") - 1.year) < (old + 5.minutes)
-      assert_not_equal token, signed_cookie("remember_admin_token").last
-    end
-  end
-
   test 'do not remember other scopes' do
     user = create_user_and_remember
     get root_path
@@ -182,20 +146,6 @@ class RememberMeTest < ActionController::IntegrationTest
     assert_not warden.authenticated?(:user)
   end
 
-  test 'do not remember the admin anymore after forget' do
-    admin = create_admin_and_remember
-    get root_path
-    assert warden.authenticated?(:admin)
-
-    get destroy_admin_session_path
-    assert_not warden.authenticated?(:admin)
-    assert_nil admin.reload.remember_token
-    assert_nil warden.cookies['remember_admin_token']
-
-    get root_path
-    assert_not warden.authenticated?(:admin)
-  end
-
   test 'changing user password expires remember me token' do
     user = create_user_and_remember
     user.password = "another_password"

test/integration/timeoutable_test.rb

@@ -16,6 +16,15 @@ class SessionTimeoutTest < ActionController::IntegrationTest
     assert_not_equal old_last_request, last_request_at
   end
 
+  test 'set last request at in user session after each request is skipped if tracking is disabled' do
+    sign_in_as_user
+    old_last_request = last_request_at
+    assert_not_nil last_request_at
+
+    get users_path, {}, 'devise.skip_trackable' => true
+    assert_equal old_last_request, last_request_at
+  end
+
   test 'not time out user session before default limit time' do
     sign_in_as_user
     assert_response :success
@@ -32,7 +41,7 @@ class SessionTimeoutTest < ActionController::IntegrationTest
     assert_not_nil last_request_at
 
     get users_path
-    assert_redirected_to new_user_session_path
+    assert_redirected_to users_path
     assert_not warden.authenticated?(:user)
   end
 
@@ -59,7 +68,7 @@ class SessionTimeoutTest < ActionController::IntegrationTest
 
       get expire_user_path(user)
       get users_path
-      assert_redirected_to new_user_session_path
+      assert_redirected_to users_path
       assert_not warden.authenticated?(:user)
     end
   end
@@ -71,17 +80,31 @@ class SessionTimeoutTest < ActionController::IntegrationTest
       user = sign_in_as_user
 
       get expire_user_path(user)
-      get users_path
+      get root_path
       follow_redirect!
       assert_contain 'Session expired!'
     end
   end
-  
+
+  test 'error message with i18n with double redirect' do
+    store_translations :en, :devise => {
+      :failure => { :user => { :timeout => 'Session expired!' } }
+    } do
+      user = sign_in_as_user
+
+      get expire_user_path(user)
+      get users_path
+      follow_redirect!
+      follow_redirect!
+      assert_contain 'Session expired!'
+    end
+  end
+
   test 'time out not triggered if remembered' do
     user = sign_in_as_user :remember_me => true
     get expire_user_path(user)
     assert_not_nil last_request_at
-    
+
     get users_path
     assert_response :success
     assert warden.authenticated?(:user)

test/integration/token_authenticatable_test.rb

@@ -25,7 +25,7 @@ class TokenAuthenticationTest < ActionController::IntegrationTest
   end
 
   test 'authenticate with valid authentication token key but does not store if stateless' do
-    swap Devise, :token_authentication_key => :secret_token, :stateless_token => true do
+    swap Devise, :token_authentication_key => :secret_token, :skip_session_storage => [:token_auth] do
       sign_in_as_new_user_with_token
       assert warden.authenticated?(:user)
 
@@ -88,7 +88,7 @@ class TokenAuthenticationTest < ActionController::IntegrationTest
   end
 
   test 'authenticate with valid authentication token key and do not store if stateless and timeoutable are enabled' do
-    swap Devise, :token_authentication_key => :secret_token, :stateless_token => true, :timeout_in => (0.1).second do
+    swap Devise, :token_authentication_key => :secret_token, :skip_session_storage => [:token_auth], :timeout_in => (0.1).second do
       user = sign_in_as_new_user_with_token
       assert warden.authenticated?(:user)
 
@@ -112,7 +112,7 @@ class TokenAuthenticationTest < ActionController::IntegrationTest
 
       assert_not_equal user1, user2
       visit users_path(Devise.token_authentication_key.to_s + '[$ne]' => user1.authentication_token)
-      assert_nil warden.user(:user) 
+      assert_nil warden.user(:user)
     end
   end
 
@@ -125,7 +125,7 @@ class TokenAuthenticationTest < ActionController::IntegrationTest
       options[:auth_token]     ||= user.authentication_token
 
       if options[:http_auth]
-        header = "Basic #{ActiveSupport::Base64.encode64("#{VALID_AUTHENTICATION_TOKEN}:X")}"
+        header = "Basic #{Base64.encode64("#{VALID_AUTHENTICATION_TOKEN}:X")}"
         get users_path(:format => :xml), {}, "HTTP_AUTHORIZATION" => header
       else
         visit users_path(options[:auth_token_key].to_sym => options[:auth_token])
@@ -145,4 +145,4 @@ class TokenAuthenticationTest < ActionController::IntegrationTest
       sign_in_as_new_user_with_token(:user => user)
     end
 
-end
+end

test/integration/trackable_test.rb

@@ -37,6 +37,17 @@ class TrackableHooksTest < ActionController::IntegrationTest
     assert_equal "127.0.0.1", user.last_sign_in_ip
   end
 
+  test "current remote ip returns original ip behind a non transparent proxy" do
+    user = create_user
+
+    arbitrary_ip = '200.121.1.69'
+    sign_in_as_user do
+      header 'HTTP_X_FORWARDED_FOR', arbitrary_ip
+    end
+    user.reload
+    assert_equal arbitrary_ip, user.current_sign_in_ip
+  end
+
   test "increase sign in count" do
     user = create_user
     assert_equal 0, user.sign_in_count
@@ -52,7 +63,7 @@ class TrackableHooksTest < ActionController::IntegrationTest
   end
 
   test "does not update anything if user has signed out along the way" do
-    swap Devise, :confirm_within => 0 do
+    swap Devise, :allow_unconfirmed_access_for => 0 do
       user = create_user(:confirm => false)
       sign_in_as_user
 
@@ -61,7 +72,7 @@ class TrackableHooksTest < ActionController::IntegrationTest
       assert_nil user.last_sign_in_at
     end
   end
-  
+
   test "do not track if devise.skip_trackable is set" do
     user = create_user
     sign_in_as_user do
@@ -70,7 +81,7 @@ class TrackableHooksTest < ActionController::IntegrationTest
     user.reload
     assert_equal 0, user.sign_in_count
     visit destroy_user_session_path
-    
+
     sign_in_as_user do
       header 'devise.skip_trackable', false
     end