Use the Ruby 1.8 hash syntax.

Yes we still support Ruby 1.8 😢

Conflicts:
	Gemfile.lock

.gitignore

@@ -8,3 +8,5 @@ rdoc/*
 pkg
 log
 test/tmp/*
+Gemfile.lock
+

.travis.yml

@@ -1,13 +1,10 @@
 script: "bundle exec rake test"
-before_install: gem update --system
 rvm:
   - 1.8.7
   - 1.9.2
-  - 1.9.3
   - ree
-gemfile:
-  - gemfiles/Gemfile.rails-3.1.x
-  - Gemfile
+  - rbx
+  - rbx-2.0
 notifications:
   recipients:
     - jose.valim@plataformatec.com.br

CHANGELOG.rdoc

@@ -1,42 +1,22 @@
-== 2.0.0
+== 1.5.4
 
-Notes: https://github.com/plataformatec/devise/wiki/How-To:-Upgrade-to-Devise-2.0
-
-* enhancements
-  * Add support for e-mail reconfirmation on change (by @Mandaryn and @heimidal)
-  * Redirect users to sign in page after unlock (by @nashby)
-  * Redirect to the previous URL on timeout
-  * Inherit from the same Devise parent controller (by @sj26)
-  * Allow parent_controller to be customizable via Devise.parent_controller, useful for engines
-  * Allow router_name to be customizable via Devise.router_name, useful for engines
-  * Allow alternate ORMs to run compatibility setup code before Authenticatable is included (by @jm81)
-
-* deprecation
-  * Devise now only supports Rails 3.1 forward
-  * Devise.confirm_within was deprecated in favor Devise.allow_unconfirmed_access_for
-  * Devise.stateless_token= is deprecated in favor of appending :token_auth to Devise.skip_session_storage
-  * Usage of Devise.apply_schema is deprecated
-  * Usage of Devise migration helpers are deprecated
-  * Usage of Devise.remember_across_browsers was deprecated
-  * Usage of rememberable with remember_token was removed
-  * Usage of recoverable without reset_password_sent_at was removed
-  * Usage of Devise.case_insensitive_keys equals to false was removed
-  * Move devise/shared/_links.erb to devise/_links.erb
-  * Deprecated support of nested devise_for blocks
-  * Deprecated support to devise.registrations.reasons and devise.registrations.inactive_signed_up in favor of devise.registrations.signed_up_but_*
+* bug fix
+  * Require string conversion for all values
 
 == 1.5.3
 
 * bug fix
-  * Ensure delegator converts scope to symbol (by @dmitriy-kiriyenko)
+  * Ensure delegator converts scope to symbol (by github.com/dmitriy-kiriyenko)
   * Ensure passing :format => false to devise_for is not permanent
   * Ensure path checker does not check invalid routes
 
+* warden regression
+  * using warden 1.2.1 with Devise 1.5.3 introduces a regression for some types of functional tests (see github.com/plataformatec/devise/issues/1928).  Can peg warden to 1.2.0 in your Gemfile to fix this.
 == 1.5.2
 
 * enhancements
-  * Add support for Rails 3.1 new mass assignment conventions (by @kirs)
-  * Add timeout_in method to Timeoutable, it can be overridden in a model (by @lest)
+  * Add support for rails 3.1 new mass assignment conventions (by github.com/kirs)
+  * Add timeout_in method to Timeoutable, it can be overriden in a model (by github.com/lest)
 
 * bug fix
   * OmniAuth error message now shows the proper option (:strategy_class instead of :klass)
@@ -51,10 +31,10 @@ Notes: https://github.com/plataformatec/devise/wiki/How-To:-Upgrade-to-Devise-2.
 * enhancements
   * Timeoutable also skips tracking if skip_trackable is given
   * devise_for now accepts :failure_app as an option
-  * Models can select the proper mailer via devise_mailer method (by @locomotivecms)
-  * Migration generator now uses the change method (by @nashby)
-  * Support to markerb templates on the mailer generator (by @sbounmy)
-  * Support for Omniauth 1.0 (older versions are no longer supported) (by @TamiasSibiricus)
+  * Models can select the proper mailer via devise_mailer method (by github.com/locomotivecms)
+  * Migration generator now uses the change method (by github.com/nashby)
+  * Support to markerb templates on the mailer generator (by github.com/sbounmy)
+  * Support for Omniauth 1.0 (older versions are no longer supported) (by github.com/TamiasSibiricus)
 
 * bug fix
   * Allow idempotent API requests
@@ -97,7 +77,7 @@ Notes: https://github.com/plataformatec/devise/wiki/How-To:-Upgrade-to-Devise-2.
 
 * bug fix
   * Failure app tries the root path if a session one does not exist
-  * No need to finalize Devise helpers all the time (by @bradleypriest)
+  * No need to finalize Devise helpers all the time (by github.com/bradleypriest)
   * Reset password shows proper message if user is not active
   * `clean_up_passwords` sets the accessors to nil to skip validations
 
@@ -132,7 +112,7 @@ Notes: https://github.com/plataformatec/devise/wiki/How-To:-Upgrade-to-Devise-2.
 * enhancements
   * Add :defaults and :format support on router
   * Add simple form generators
-  * Better localization for devise_error_messages! (by @zedtux)
+  * Better localization for devise_error_messages! (by github.com/zedtux)
 
 * bug fix
   * Ensure to_xml is properly white listened
@@ -141,20 +121,20 @@ Notes: https://github.com/plataformatec/devise/wiki/How-To:-Upgrade-to-Devise-2.
 == 1.4.0
 
 * enhancements
-  * Added authenticated and unauthenticated to the router to route the used based on his status (by @sj26)
-  * Improve e-mail regexp (by @rodrigoflores)
-  * Add strip_whitespace_keys and default to e-mail (by @swrobel)
-  * Do not run format and uniqueness validations on e-mail if it hasn't changed (by @Thibaut)
-  * Added update_without_password to update models but not allowing the password to change (by @fschwahn)
-  * Added config.paranoid, check the generator for more information (by @rodrigoflores)
+  * Added authenticated and unauthenticated to the router to route the used based on his status (by github.com/sj26)
+  * Improve e-mail regexp (by github.com/rodrigoflores)
+  * Add strip_whitespace_keys and default to e-mail (by github.com/swrobel)
+  * Do not run format and uniqueness validations on e-mail if it hasn't changed (by github.com/Thibaut)
+  * Added update_without_password to update models but not allowing the password to change (by github.com/fschwahn)
+  * Added config.paranoid, check the generator for more information (by github.com/rodrigoflores)
 
 * bug fix
   * password_required? should not affect length validation
   * User cannot access sign up and similar pages if he is already signed in through a cookie or token
-  * Do not convert booleans to strings on finders (by @xavier)
-  * Run validations even if current_password fails (by @crx)
-  * Devise now honors routes constraints (by @macmartine)
-  * Do not return the user resource when requesting instructions (by @rodrigoflores)
+  * Do not convert booleans to strings on finders (by github.com/xavier)
+  * Run validations even if current_password fails (by github.com/crx)
+  * Devise now honors routes constraints (by github.com/macmartine)
+  * Do not return the user resource when requesting instructions (by github.com/rodrigoflores)
 
 == 1.3.4
 
@@ -169,31 +149,31 @@ Notes: https://github.com/plataformatec/devise/wiki/How-To:-Upgrade-to-Devise-2.
 == 1.3.2
 
 * bug fix
-  * Fix another regression related to reset_password_sent_at (by @alexdreher)
+  * Fix another regression related to reset_password_sent_at (by github.com/alexdreher)
 
 == 1.3.1
 
 * enhancements
-  * Improve failure_app responses (by @indirect)
+  * Improve failure_app responses (by github.com/indirect)
   * sessions/new and registrations/new also respond to xml and json now
 
 * bug fix
-  * Fix a regression that occurred if reset_password_sent_at is not present (by @stevehodgkiss)
+  * Fix a regression that occurred if reset_password_sent_at is not present (by github.com/stevehodgkiss)
 
 == 1.3.0
 
 * enhancements
-  * All controllers can now handle different mime types than html using Responders (by @sikachu)
-  * Added reset_password_within as configuration option to send the token for recovery (by @jdguyot)
-  * Bump password length to 128 characters (by @k33l0r)
-  * Add :only as option to devise_for (by @timoschilling)
-  * Allow to override path after sending password instructions (by @irohiroki)
-  * require_no_authentication has its own flash message (by @jackdempsey)
+  * All controllers can now handle different mime types than html using Responders (by github.com/sikachu)
+  * Added reset_password_within as configuration option to send the token for recovery (by github.com/jdguyot)
+  * Bump password length to 128 characters (by github.com/k33l0r)
+  * Add :only as option to devise_for (by github.com/timoschilling)
+  * Allow to override path after sending password instructions (by github.com/irohiroki)
+  * require_no_authentication has its own flash message (by github.com/jackdempsey)
 
 * bug fix
   * Fix a bug where configuration options were being included too late
-  * Ensure Devise::TestHelpers can be used to tests Devise internal controllers (by @jwilger)
-  * valid_password? should not choke on empty passwords (by @mikel)
+  * Ensure Devise::TestHelpers can be used to tests Devise internal controllers (by github.com/jwilger)
+  * valid_password? should not choke on empty passwords (by github.com/mikel)
   * Calling devise more than once does not include previously added modules anymore
   * downcase_keys before validation
 
@@ -220,16 +200,16 @@ Notes: https://github.com/plataformatec/devise/wiki/How-To:-Upgrade-to-Devise-2.
 
 * bug fix
   * Fix an issue causing infinite redirects in production
-  * rails g destroy works properly with devise generators (by @andmej)
-  * before_failure callbacks should work on test helpers (by @twinge)
-  * rememberable cookie now is httponly by default (by @JamesFerguson)
-  * Add missing confirmation_keys (by @JohnPlummer)
+  * rails g destroy works properly with devise generators (by github.com/andmej)
+  * before_failure callbacks should work on test helpers (by github.com/twinge)
+  * rememberable cookie now is httponly by default (by github.com/JamesFerguson)
+  * Add missing confirmation_keys (by github.com/JohnPlummer)
   * Ensure after_* hooks are called on RegistrationsController
   * When using database_authenticatable Devise will now only create an email field when appropriate (if using default authentication_keys or custom authentication_keys with email included)
-  * Ensure stateless token does not trigger timeout (by @pixelauthority)
+  * Ensure stateless token does not trigger timeout (by github.com/pixelauthority)
   * Implement handle_unverified_request for Rails 3.0.4 compatibility and improve FailureApp reliance on symbols
   * Consider namespaces while generating routes
-  * Custom failure apps no longer ignored in test mode (by @jaghion)
+  * Custom failure apps no longer ignored in test mode (by github.com/jaghion)
   * Do not depend on ActiveModel::Dirty
   * Manual sign_in now triggers remember token
   * Be sure to halt strategies on failures
@@ -238,7 +218,7 @@ Notes: https://github.com/plataformatec/devise/wiki/How-To:-Upgrade-to-Devise-2.
   * Ensure there is no Mongoid injection
 
 * deprecations
-  * Deprecated anybody_signed_in? in favor of signed_in? (by @gavinhughes)
+  * Deprecated anybody_signed_in? in favor of signed_in? (by github.com/gavinhughes)
   * Removed --haml and --slim view templates
   * Devise::OmniAuth helpers were deprecated and removed in favor of Omniauth.config.test_mode
 
@@ -251,11 +231,11 @@ Notes: https://github.com/plataformatec/devise/wiki/How-To:-Upgrade-to-Devise-2.
 * enhancements
   * Added OmniAuth support
   * Added ORM adapter to abstract ORM iteraction
-  * sign_out_via is available in the router to configure the method used for sign out (by @martinrehfeld)
-  * Improved Ajax requests handling in failure app (by @spastorino)
+  * sign_out_via is available in the router to configure the method used for sign out (by github.com/martinrehfeld)
+  * Improved Ajax requests handling in failure app (by github.com/spastorino)
   * Added request_keys to easily use request specific values (like subdomain) in authentication
   * Increased the size of friendly_token to 60 characters (reduces the chances of a successful brute attack)
-  * Ensure the friendly token does not include "_" or "-" since some e-mails may not autolink it properly (by @rymai)
+  * Ensure the friendly token does not include "_" or "-" since some e-mails may not autolink it properly (by github.com/rymai)
   * Extracted encryptors into :encryptable for better bcrypt support
   * :rememberable is now able to use salt as token if no remember_token is provided
   * Store the salt in session and expire the session if the user changes his password
@@ -264,7 +244,7 @@ Notes: https://github.com/plataformatec/devise/wiki/How-To:-Upgrade-to-Devise-2.
   * Sign up now check if the user is active or not and redirect him accordingly setting the inactive_signed_up message
   * Use ActiveModel#to_key instead of #id
   * sign_out_all_scopes now destroys the whole session
-  * Added case_insensitive_keys that automatically downcases the given keys, by default downcases only e-mail (by @adahl)
+  * Added case_insensitive_keys that automatically downcases the given keys, by default downcases only e-mail (by github.com/adahl)
 
 * default behavior changes
   * sign_out_all_scopes defaults to true as security measure
@@ -273,12 +253,12 @@ Notes: https://github.com/plataformatec/devise/wiki/How-To:-Upgrade-to-Devise-2.
 
 * bugfix
   * after_sign_in_path_for always receives a resource
-  * Do not execute Warden::Callbacks on Devise::TestHelpers (by @sgronblo)
-  * Allow password recovery and account unlocking to change used keys (by @RStankov)
+  * Do not execute Warden::Callbacks on Devise::TestHelpers (by github.com/sgronblo)
+  * Allow password recovery and account unlocking to change used keys (by github.com/RStankov)
   * FailureApp now properly handles nil request.format
   * Fix a bug causing FailureApp to return with HTTP Auth Headers for IE7
   * Ensure namespaces has proper scoped views
-  * Ensure Devise does not set empty flash messages (by @sxross)
+  * Ensure Devise does not set empty flash messages (by github.com/sxross)
 
 == 1.1.6
 
@@ -303,11 +283,11 @@ Notes: https://github.com/plataformatec/devise/wiki/How-To:-Upgrade-to-Devise-2.
 
 * bugfix
   * Add reply-to to e-mail headers by default
-  * Updated the views generator to respect the rails :template_engine option (by @fredwu)
+  * Updated the views generator to respect the rails :template_engine option (by github.com/fredwu)
   * Check the type of HTTP Authentication before using Basic headers
-  * Avoid invalid_salt errors by checking salt presence (by @thibaudgg)
-  * Forget user deletes the right cookie before logout, not remembering the user anymore (by @emtrane)
-  * Fix for failed first-ever logins on PostgreSQL where column default is nil (by @bensie)
+  * Avoid invalid_salt errors by checking salt presence (by github.com/thibaudgg)
+  * Forget user deletes the right cookie before logout, not remembering the user anymore (by github.com/emtrane)
+  * Fix for failed first-ever logins on PostgreSQL where column default is nil (by github.com/bensie)
   * :default options is now honored in migrations
 
 == 1.1.2
@@ -323,16 +303,16 @@ Notes: https://github.com/plataformatec/devise/wiki/How-To:-Upgrade-to-Devise-2.
 == 1.1.0
 
 * enhancements
-  * Rememberable module allows user to be remembered across browsers and is enabled by default (by @trevorturk)
-  * Rememberable module allows you to activate the period the remember me token is extended (by @trevorturk)
+  * Rememberable module allows user to be remembered across browsers and is enabled by default (by github.com/trevorturk)
+  * Rememberable module allows you to activate the period the remember me token is extended (by github.com/trevorturk)
   * devise_for can now be used together with scope method in routes but with a few limitations (check the documentation)
   * Support `as` or `devise_scope` in the router to specify controller access scope
-  * HTTP Basic Auth can now be disabled/enabled for xhr(ajax) requests using http_authenticatable_on_xhr option (by @pellja)
+  * HTTP Basic Auth can now be disabled/enabled for xhr(ajax) requests using http_authenticatable_on_xhr option (by github.com/pellja)
 
 * bug fix
   * Fix a bug in Devise::TestHelpers where current_user was returning a Response object for non active accounts
   * Devise should respect script_name and path_info contracts
-  * Fix a bug when accessing a path with (.:format) (by @klacointe)
+  * Fix a bug when accessing a path with (.:format) (by github.com/klacointe)
   * Do not add unlock routes unless unlock strategy is email or both
   * Email should be case insensitive
   * Store classes as string in session, to avoid serialization and stale data issues
@@ -343,10 +323,10 @@ Notes: https://github.com/plataformatec/devise/wiki/How-To:-Upgrade-to-Devise-2.
 == 1.1.rc2
 
 * enhancements
-  * Allow to set cookie domain for the remember token. (by @mantas)
+  * Allow to set cookie domain for the remember token. (by github.com/mantas)
   * Added navigational formats to specify when it should return a 302 and when a 401.
-  * Added authenticate(scope) support in routes (by @wildchild)
-  * Added after_update_path_for to registrations controller (by @thedelchop)
+  * Added authenticate(scope) support in routes (by github.com/wildchild)
+  * Added after_update_path_for to registrations controller (by github.com/thedelchop)
   * Allow the mailer object to be replaced through config.mailer = "MyOwnMailer"
 
 * bug fix
@@ -394,10 +374,10 @@ Notes: https://github.com/plataformatec/devise/wiki/How-To:-Upgrade-to-Devise-2.
 
 * enhancements
   * Support for latest MongoMapper
-  * Added anybody_signed_in? helper (by @SSDany)
+  * Added anybody_signed_in? helper (by github.com/SSDany)
 
 * bug fix
-  * confirmation_required? is properly honored on active? calls. (by @paulrosania)
+  * confirmation_required? is properly honored on active? calls. (by github.com/paulrosania)
 
 == 1.0.7
 
@@ -438,7 +418,7 @@ Notes: https://github.com/plataformatec/devise/wiki/How-To:-Upgrade-to-Devise-2.
 == 1.0.2
 
 * enhancements
-  * Allows you set mailer content type (by @glennr)
+  * Allows you set mailer content type (by github.com/glennr)
 
 * bug fix
   * Uses the same content type as request on http authenticatable 401 responses
@@ -471,12 +451,12 @@ Notes: https://github.com/plataformatec/devise/wiki/How-To:-Upgrade-to-Devise-2.
 
 * enhancements
   * Added gemspec to repo
-  * Added token authenticatable (by @grimen)
+  * Added token authenticatable (by github.com/grimen)
 
 == 0.9.1
 
 * bug fix
-  * Allow bigger salt size (by @jgeiger)
+  * Allow bigger salt size (by github.com/jgeiger)
   * Fix relative url root
 
 == 0.9.0
@@ -486,11 +466,11 @@ Notes: https://github.com/plataformatec/devise/wiki/How-To:-Upgrade-to-Devise-2.
   * :success and :failure flash messages are now :notice and :alert
 
 * enhancements
-  * Added devise lockable (by @mhfs)
+  * Added devise lockable (by github.com/mhfs)
   * Warden 0.9.0 compatibility
   * Mongomapper 0.6.10 compatibility
-  * Added Devise.add_module as hooks for extensions (by @grimen)
-  * Ruby 1.9.1 compatibility (by @grimen)
+  * Added Devise.add_module as hooks for extensions (by github.com/grimen)
+  * Ruby 1.9.1 compatibility (by github.com/grimen)
 
 * bug fix
   * Accept path prefix not starting with slash
@@ -499,10 +479,10 @@ Notes: https://github.com/plataformatec/devise/wiki/How-To:-Upgrade-to-Devise-2.
 == 0.8.2
 
 * enhancements
-  * Allow Devise.mailer_sender to be a proc (by @grimen)
+  * Allow Devise.mailer_sender to be a proc (by github.com/grimen)
 
 * bug fix
-  * Fix bug with passenger, update is required to anyone deploying on passenger (by @dvdpalm)
+  * Fix bug with passenger, update is required to anyone deploying on passenger (by github.com/dvdpalm)
 
 == 0.8.1
 
@@ -519,11 +499,11 @@ Notes: https://github.com/plataformatec/devise/wiki/How-To:-Upgrade-to-Devise-2.
 * enhancements
   * Warden 0.8.0 compatibility
   * Add an easy for map.connect "sign_in", :controller => "sessions", :action => "new" to work
-  * Added :bcrypt encryptor (by @capotej)
+  * Added :bcrypt encryptor (by github.com/capotej)
 
 * bug fix
   * sign_in_count is also increased when user signs in via password change, confirmation, etc..
-  * More DataMapper compatibility (by @lancecarlson)
+  * More DataMapper compatibility (by github.com/lancecarlson)
 
 * deprecation
   * Removed DeviseMailer.sender
@@ -563,7 +543,7 @@ Notes: https://github.com/plataformatec/devise/wiki/How-To:-Upgrade-to-Devise-2.
 == 0.7.1
 
 * enhancements
-  * Small enhancements for other plugins compatibility (by @grimen)
+  * Small enhancements for other plugins compatibility (by github.com/grimen)
 
 == 0.7.0
 
@@ -657,9 +637,9 @@ Notes: https://github.com/plataformatec/devise/wiki/How-To:-Upgrade-to-Devise-2.
   * Fixed a bug where remember me module was not working properly
 
 * enhancements
-  * Moved encryption strategy into the Encryptors module to allow several algorithms (by @mhfs)
-  * Implemented encryptors for Clearance, Authlogic and Restful-Authentication (by @mhfs)
-  * Added support for MongoMapper (by @shingara)
+  * Moved encryption strategy into the Encryptors module to allow several algorithms (by github.com/mhfs)
+  * Implemented encryptors for Clearance, Authlogic and Restful-Authentication (by github.com/mhfs)
+  * Added support for MongoMapper (by github.com/shingara)
 
 == 0.4.3
 

Gemfile

@@ -2,7 +2,7 @@ source "http://rubygems.org"
 
 gemspec
 
-gem "rails", "~> 3.2.0"
+gem "rails", "~> 3.1.0"
 gem "omniauth", "~> 1.0.0"
 gem "omniauth-oauth2", "~> 1.0.0"
 gem "rdoc"
@@ -11,7 +11,7 @@ group :test do
   gem "omniauth-facebook"
   gem "omniauth-openid", "~> 1.0.1"
   gem "webrat", "0.7.2", :require => false
-  gem "mocha", :require => false
+  gem "mocha", "~> 0.10.0", :require => false
 
   platforms :mri_18 do
     gem "ruby-debug", ">= 0.10.3"

Gemfile.lock

@@ -1,167 +0,0 @@
-PATH
-  remote: .
-  specs:
-    devise (2.0.0.rc2)
-      bcrypt-ruby (~> 3.0)
-      orm_adapter (~> 0.0.3)
-      railties (~> 3.1)
-      warden (~> 1.1)
-
-GEM
-  remote: http://rubygems.org/
-  specs:
-    actionmailer (3.2.0)
-      actionpack (= 3.2.0)
-      mail (~> 2.4.0)
-    actionpack (3.2.0)
-      activemodel (= 3.2.0)
-      activesupport (= 3.2.0)
-      builder (~> 3.0.0)
-      erubis (~> 2.7.0)
-      journey (~> 1.0.0)
-      rack (~> 1.4.0)
-      rack-cache (~> 1.1)
-      rack-test (~> 0.6.1)
-      sprockets (~> 2.1.2)
-    activemodel (3.2.0)
-      activesupport (= 3.2.0)
-      builder (~> 3.0.0)
-    activerecord (3.2.0)
-      activemodel (= 3.2.0)
-      activesupport (= 3.2.0)
-      arel (~> 3.0.0)
-      tzinfo (~> 0.3.29)
-    activeresource (3.2.0)
-      activemodel (= 3.2.0)
-      activesupport (= 3.2.0)
-    activesupport (3.2.0)
-      i18n (~> 0.6)
-      multi_json (~> 1.0)
-    addressable (2.2.6)
-    arel (3.0.0)
-    bcrypt-ruby (3.0.1)
-    bson (1.5.1)
-    bson_ext (1.3.1)
-    builder (3.0.0)
-    columnize (0.3.5)
-    erubis (2.7.0)
-    faraday (0.7.5)
-      addressable (~> 2.2.6)
-      multipart-post (~> 1.1.3)
-      rack (>= 1.1.0, < 2)
-    hashie (1.2.0)
-    hike (1.2.1)
-    i18n (0.6.0)
-    journey (1.0.0)
-    json (1.6.5)
-    linecache (0.46)
-      rbx-require-relative (> 0.0.4)
-    mail (2.4.1)
-      i18n (>= 0.4.0)
-      mime-types (~> 1.16)
-      treetop (~> 1.4.8)
-    metaclass (0.0.1)
-    mime-types (1.17.2)
-    mocha (0.10.0)
-      metaclass (~> 0.0.1)
-    mongo (1.3.1)
-      bson (>= 1.3.1)
-    mongoid (2.3.4)
-      activemodel (~> 3.1)
-      mongo (~> 1.3)
-      tzinfo (~> 0.3.22)
-    multi_json (1.0.4)
-    multipart-post (1.1.4)
-    nokogiri (1.5.0)
-    oauth2 (0.5.1)
-      faraday (~> 0.7.4)
-      multi_json (~> 1.0.3)
-    omniauth (1.0.1)
-      hashie (~> 1.2)
-      rack
-    omniauth-facebook (1.0.0)
-      omniauth-oauth2 (~> 1.0.0)
-    omniauth-oauth2 (1.0.0)
-      oauth2 (~> 0.5.0)
-      omniauth (~> 1.0)
-    omniauth-openid (1.0.1)
-      omniauth (~> 1.0)
-      rack-openid (~> 1.3.1)
-    orm_adapter (0.0.6)
-    polyglot (0.3.3)
-    rack (1.4.1)
-    rack-cache (1.1)
-      rack (>= 0.4)
-    rack-openid (1.3.1)
-      rack (>= 1.1.0)
-      ruby-openid (>= 2.1.8)
-    rack-ssl (1.3.2)
-      rack
-    rack-test (0.6.1)
-      rack (>= 1.0)
-    rails (3.2.0)
-      actionmailer (= 3.2.0)
-      actionpack (= 3.2.0)
-      activerecord (= 3.2.0)
-      activeresource (= 3.2.0)
-      activesupport (= 3.2.0)
-      bundler (~> 1.0)
-      railties (= 3.2.0)
-    railties (3.2.0)
-      actionpack (= 3.2.0)
-      activesupport (= 3.2.0)
-      rack-ssl (~> 1.3.2)
-      rake (>= 0.8.7)
-      rdoc (~> 3.4)
-      thor (~> 0.14.6)
-    rake (0.9.2.2)
-    rbx-require-relative (0.0.5)
-    rdoc (3.12)
-      json (~> 1.4)
-    ruby-debug (0.10.4)
-      columnize (>= 0.1)
-      ruby-debug-base (~> 0.10.4.0)
-    ruby-debug-base (0.10.4)
-      linecache (>= 0.3)
-    ruby-openid (2.1.8)
-    sprockets (2.1.2)
-      hike (~> 1.2)
-      rack (~> 1.0)
-      tilt (~> 1.1, != 1.3.0)
-    sqlite3 (1.3.5)
-    sqlite3-ruby (1.3.3)
-      sqlite3 (>= 1.3.3)
-    thor (0.14.6)
-    tilt (1.3.3)
-    treetop (1.4.10)
-      polyglot
-      polyglot (>= 0.3.1)
-    tzinfo (0.3.31)
-    warden (1.1.0)
-      rack (>= 1.0)
-    webrat (0.7.2)
-      nokogiri (>= 1.2.0)
-      rack (>= 1.0)
-      rack-test (>= 0.5.3)
-
-PLATFORMS
-  ruby
-
-DEPENDENCIES
-  activerecord-jdbc-adapter
-  activerecord-jdbcsqlite3-adapter
-  bson_ext (~> 1.3.0)
-  devise!
-  jruby-openssl
-  mocha
-  mongo (~> 1.3.0)
-  mongoid (~> 2.0)
-  omniauth (~> 1.0.0)
-  omniauth-facebook
-  omniauth-oauth2 (~> 1.0.0)
-  omniauth-openid (~> 1.0.1)
-  rails (~> 3.2.0)
-  rdoc
-  ruby-debug (>= 0.10.3)
-  sqlite3-ruby
-  webrat (= 0.7.2)

MIT-LICENSE

@@ -1,4 +1,4 @@
-Copyright 2009-2012 Plataforma Tecnologia. http://blog.plataformatec.com.br
+Copyright 2009-2011 Plataforma Tecnologia. http://blog.plataformatec.com.br
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the

README.rdoc

@@ -1,5 +1,3 @@
-*IMPORTANT:* Devise 2.0.0 is out. If you are upgrading, please read: https://github.com/plataformatec/devise/wiki/How-To:-Upgrade-to-Devise-2.0
-
 == Devise
 
 {<img src="https://secure.travis-ci.org/plataformatec/devise.png" />}[http://travis-ci.org/plataformatec/devise]
@@ -212,7 +210,7 @@ Devise allows you to set up as many roles as you want. For example, you may have
 
 We built Devise to help you quickly develop an application that uses authentication. However, we don't want to be in your way when you need to customize it.
 
-Since Devise is an engine, all its views are packaged inside the gem. These views will help you get started, but after some time you may want to change them. If this is the case, you just need to invoke the following generator, and it will copy all views to your application:
+Since Devise is an engine, all its views are packaged inside the gem. These views will help you get started, but after sometime you may want to change them. If this is the case, you just need to invoke the following generator, and it will copy all views to your application:
 
   rails generate devise:views
 
@@ -365,4 +363,4 @@ https://github.com/plataformatec/devise/contributors
 
 == License
 
-MIT License. Copyright 2012 Plataforma Tecnologia. http://blog.plataformatec.com.br
+MIT License. Copyright 2011 Plataforma Tecnologia. http://blog.plataformatec.com.br

app/controllers/devise/confirmations_controller.rb

@@ -1,7 +1,10 @@
-class Devise::ConfirmationsController < DeviseController
+class Devise::ConfirmationsController < ApplicationController
+  include Devise::Controllers::InternalHelpers
+
   # GET /resource/confirmation/new
   def new
     build_resource({})
+    render_with_scope :new
   end
 
   # POST /resource/confirmation
@@ -11,7 +14,7 @@ class Devise::ConfirmationsController < DeviseController
     if successfully_sent?(resource)
       respond_with({}, :location => after_resending_confirmation_instructions_path_for(resource_name))
     else
-      respond_with(resource)
+      respond_with_navigational(resource){ render_with_scope :new }
     end
   end
 
@@ -24,7 +27,7 @@ class Devise::ConfirmationsController < DeviseController
       sign_in(resource_name, resource)
       respond_with_navigational(resource){ redirect_to after_confirmation_path_for(resource_name, resource) }
     else
-      respond_with_navigational(resource.errors, :status => :unprocessable_entity){ render :new }
+      respond_with_navigational(resource.errors, :status => :unprocessable_entity){ render_with_scope :new }
     end
   end
 

app/controllers/devise/omniauth_callbacks_controller.rb

@@ -1,4 +1,6 @@
-class Devise::OmniauthCallbacksController < DeviseController
+class Devise::OmniauthCallbacksController < ApplicationController
+  include Devise::Controllers::InternalHelpers
+
   def failure
     set_flash_message :alert, :failure, :kind => failed_strategy.name.to_s.humanize, :reason => failure_message
     redirect_to after_omniauth_failure_path_for(resource_name)

app/controllers/devise/passwords_controller.rb

@@ -1,9 +1,11 @@
-class Devise::PasswordsController < DeviseController
+class Devise::PasswordsController < ApplicationController
   prepend_before_filter :require_no_authentication
+  include Devise::Controllers::InternalHelpers
 
   # GET /resource/password/new
   def new
     build_resource({})
+    render_with_scope :new
   end
 
   # POST /resource/password
@@ -13,7 +15,7 @@ class Devise::PasswordsController < DeviseController
     if successfully_sent?(resource)
       respond_with({}, :location => after_sending_reset_password_instructions_path_for(resource_name))
     else
-      respond_with(resource)
+      respond_with_navigational(resource){ render_with_scope :new }
     end
   end
 
@@ -21,6 +23,7 @@ class Devise::PasswordsController < DeviseController
   def edit
     self.resource = resource_class.new
     resource.reset_password_token = params[:reset_password_token]
+    render_with_scope :edit
   end
 
   # PUT /resource/password
@@ -33,7 +36,7 @@ class Devise::PasswordsController < DeviseController
       sign_in(resource_name, resource)
       respond_with resource, :location => after_sign_in_path_for(resource)
     else
-      respond_with resource
+      respond_with_navigational(resource){ render_with_scope :edit }
     end
   end
 

app/controllers/devise/registrations_controller.rb

@@ -1,11 +1,12 @@
-class Devise::RegistrationsController < DeviseController
+class Devise::RegistrationsController < ApplicationController
   prepend_before_filter :require_no_authentication, :only => [ :new, :create, :cancel ]
   prepend_before_filter :authenticate_scope!, :only => [:edit, :update, :destroy]
+  include Devise::Controllers::InternalHelpers
 
   # GET /resource/sign_up
   def new
     resource = build_resource({})
-    respond_with resource
+    respond_with_navigational(resource){ render_with_scope :new }
   end
 
   # POST /resource
@@ -18,19 +19,19 @@ class Devise::RegistrationsController < DeviseController
         sign_in(resource_name, resource)
         respond_with resource, :location => after_sign_up_path_for(resource)
       else
-        set_flash_message :notice, :"signed_up_but_#{resource.inactive_message}" if is_navigational_format?
+        set_flash_message :notice, :inactive_signed_up, :reason => inactive_reason(resource) if is_navigational_format?
         expire_session_data_after_sign_in!
         respond_with resource, :location => after_inactive_sign_up_path_for(resource)
       end
     else
-      clean_up_passwords resource
-      respond_with resource
+      clean_up_passwords(resource)
+      respond_with_navigational(resource) { render_with_scope :new }
     end
   end
 
   # GET /resource/edit
   def edit
-    render :edit
+    render_with_scope :edit
   end
 
   # PUT /resource
@@ -40,17 +41,12 @@ class Devise::RegistrationsController < DeviseController
     self.resource = resource_class.to_adapter.get!(send(:"current_#{resource_name}").to_key)
 
     if resource.update_with_password(params[resource_name])
-      if is_navigational_format?
-        if resource.respond_to?(:pending_reconfirmation?) && resource.pending_reconfirmation?
-          flash_key = :update_needs_confirmation
-        end
-        set_flash_message :notice, flash_key || :updated
-      end
+      set_flash_message :notice, :updated if is_navigational_format?
       sign_in resource_name, resource, :bypass => true
       respond_with resource, :location => after_update_path_for(resource)
     else
-      clean_up_passwords resource
-      respond_with resource
+      clean_up_passwords(resource)
+      respond_with_navigational(resource){ render_with_scope :edit }
     end
   end
 
@@ -74,34 +70,40 @@ class Devise::RegistrationsController < DeviseController
 
   protected
 
-  # Build a devise resource passing in the session. Useful to move
-  # temporary session data to the newly created user.
-  def build_resource(hash=nil)
-    hash ||= params[resource_name] || {}
-    self.resource = resource_class.new_with_session(hash, session)
-  end
+    # Build a devise resource passing in the session. Useful to move
+    # temporary session data to the newly created user.
+    def build_resource(hash=nil)
+      hash ||= params[resource_name] || {}
+      self.resource = resource_class.new_with_session(hash, session)
+    end
 
-  # The path used after sign up. You need to overwrite this method
-  # in your own RegistrationsController.
-  def after_sign_up_path_for(resource)
-    after_sign_in_path_for(resource)
-  end
+    # The path used after sign up. You need to overwrite this method
+    # in your own RegistrationsController.
+    def after_sign_up_path_for(resource)
+      after_sign_in_path_for(resource)
+    end
 
-  # The path used after sign up for inactive accounts. You need to overwrite
-  # this method in your own RegistrationsController.
-  def after_inactive_sign_up_path_for(resource)
-    respond_to?(:root_path) ? root_path : "/"
-  end
+    # Returns the inactive reason translated.
+    def inactive_reason(resource)
+      reason = resource.inactive_message.to_s
+      I18n.t("devise.registrations.reasons.#{reason}", :default => reason)
+    end
 
-  # The default url to be used after updating a resource. You need to overwrite
-  # this method in your own RegistrationsController.
-  def after_update_path_for(resource)
-    signed_in_root_path(resource)
-  end
+    # The path used after sign up for inactive accounts. You need to overwrite
+    # this method in your own RegistrationsController.
+    def after_inactive_sign_up_path_for(resource)
+      root_path
+    end
 
-  # Authenticates the current scope and gets the current resource from the session.
-  def authenticate_scope!
-    send(:"authenticate_#{resource_name}!", :force => true)
-    self.resource = send(:"current_#{resource_name}")
-  end
+    # The default url to be used after updating a resource. You need to overwrite
+    # this method in your own RegistrationsController.
+    def after_update_path_for(resource)
+      signed_in_root_path(resource)
+    end
+
+    # Authenticates the current scope and gets the current resource from the session.
+    def authenticate_scope!
+      send(:"authenticate_#{resource_name}!", :force => true)
+      self.resource = send(:"current_#{resource_name}")
+    end
 end

app/controllers/devise/sessions_controller.rb

@@ -1,12 +1,13 @@
-class Devise::SessionsController < DeviseController
+class Devise::SessionsController < ApplicationController
   prepend_before_filter :require_no_authentication, :only => [ :new, :create ]
   prepend_before_filter :allow_params_authentication!, :only => :create
+  include Devise::Controllers::InternalHelpers
 
   # GET /resource/sign_in
   def new
     resource = build_resource
     clean_up_passwords(resource)
-    respond_with(resource, stub_options(resource))
+    respond_with_navigational(resource, stub_options(resource)){ render_with_scope :new }
   end
 
   # POST /resource/sign_in

app/controllers/devise/unlocks_controller.rb

@@ -1,9 +1,11 @@
-class Devise::UnlocksController < DeviseController
+class Devise::UnlocksController < ApplicationController
   prepend_before_filter :require_no_authentication
+  include Devise::Controllers::InternalHelpers
 
   # GET /resource/unlock/new
   def new
     build_resource({})
+    render_with_scope :new
   end
 
   # POST /resource/unlock
@@ -13,7 +15,7 @@ class Devise::UnlocksController < DeviseController
     if successfully_sent?(resource)
       respond_with({}, :location => new_session_path(resource_name))
     else
-      respond_with(resource)
+      respond_with_navigational(resource){ render_with_scope :new }
     end
   end
 
@@ -23,9 +25,10 @@ class Devise::UnlocksController < DeviseController
 
     if resource.errors.empty?
       set_flash_message :notice, :unlocked if is_navigational_format?
-      respond_with_navigational(resource){ redirect_to new_session_path(resource) }
+      sign_in(resource_name, resource)
+      respond_with_navigational(resource){ redirect_to after_sign_in_path_for(resource) }
     else
-      respond_with_navigational(resource.errors, :status => :unprocessable_entity){ render :new }
+      respond_with_navigational(resource.errors, :status => :unprocessable_entity){ render_with_scope :new }
     end
   end
 end

app/controllers/devise_controller.rb

@@ -1,169 +0,0 @@
-# All Devise controllers are inherited from here.
-class DeviseController < Devise.parent_controller.constantize
-  include Devise::Controllers::ScopedViews
-
-  helper DeviseHelper
-
-  helpers = %w(resource scope_name resource_name signed_in_resource
-               resource_class devise_mapping devise_controller?)
-  hide_action *helpers
-  helper_method *helpers
-
-  prepend_before_filter :assert_is_devise_resource!
-  respond_to *Mime::SET.map(&:to_sym) if mimes_for_respond_to.empty?
-
-  # Gets the actual resource stored in the instance variable
-  def resource
-    instance_variable_get(:"@#{resource_name}")
-  end
-
-  # Proxy to devise map name
-  def resource_name
-    devise_mapping.name
-  end
-  alias :scope_name :resource_name
-
-  # Proxy to devise map class
-  def resource_class
-    devise_mapping.to
-  end
-
-  # Returns a signed in resource from session (if one exists)
-  def signed_in_resource
-    warden.authenticate(:scope => resource_name)
-  end
-
-  # Attempt to find the mapped route for devise based on request path
-  def devise_mapping
-    @devise_mapping ||= request.env["devise.mapping"]
-  end
-
-  # Overwrites devise_controller? to return true
-  def devise_controller?
-    true
-  end
-
-  protected
-
-  # Checks whether it's a devise mapped resource or not.
-  def assert_is_devise_resource! #:nodoc:
-    unknown_action! <<-MESSAGE unless devise_mapping
-Could not find devise mapping for path #{request.fullpath.inspect}.
-Maybe you forgot to wrap your route inside the scope block? For example:
-
-devise_scope :user do
-  match "/some/route" => "some_devise_controller"
-end
-MESSAGE
-  end
-
-  # Returns real navigational formats which are supported by Rails
-  def navigational_formats
-    @navigational_formats ||= Devise.navigational_formats.select { |format| Mime::EXTENSION_LOOKUP[format.to_s] }
-  end
-
-  def unknown_action!(msg)
-    logger.debug "[Devise] #{msg}" if logger
-    raise AbstractController::ActionNotFound, msg
-  end
-
-  # Sets the resource creating an instance variable
-  def resource=(new_resource)
-    instance_variable_set(:"@#{resource_name}", new_resource)
-  end
-
-  # Build a devise resource.
-  def build_resource(hash=nil)
-    hash ||= params[resource_name] || {}
-    self.resource = resource_class.new(hash)
-  end
-
-  # Helper for use in before_filters where no authentication is required.
-  #
-  # Example:
-  #   before_filter :require_no_authentication, :only => :new
-  def require_no_authentication
-    assert_is_devise_resource!
-    return unless is_navigational_format?
-    no_input = devise_mapping.no_input_strategies
-
-    authenticated = if no_input.present?
-      args = no_input.dup.push :scope => resource_name
-      warden.authenticate?(*args)
-    else
-      warden.authenticated?(resource_name)
-    end
-
-    if authenticated
-      resource = warden.user(resource_name)
-      flash[:alert] = I18n.t("devise.failure.already_authenticated")
-      redirect_to after_sign_in_path_for(resource)
-    end
-  end
-
-  # Helper for use after calling send_*_instructions methods on a resource.
-  # If we are in paranoid mode, we always act as if the resource was valid
-  # and instructions were sent.
-  def successfully_sent?(resource)
-    notice = if Devise.paranoid
-      resource.errors.clear
-      :send_paranoid_instructions
-    elsif resource.errors.empty?
-      :send_instructions
-    end
-
-    if notice
-      set_flash_message :notice, notice if is_navigational_format?
-      true
-    end
-  end
-
-  # Sets the flash message with :key, using I18n. By default you are able
-  # to setup your messages using specific resource scope, and if no one is
-  # found we look to default scope.
-  # Example (i18n locale file):
-  #
-  #   en:
-  #     devise:
-  #       passwords:
-  #         #default_scope_messages - only if resource_scope is not found
-  #         user:
-  #           #resource_scope_messages
-  #
-  # Please refer to README or en.yml locale file to check what messages are
-  # available.
-  def set_flash_message(key, kind, options={})
-    options[:scope] = "devise.#{controller_name}"
-    options[:default] = Array(options[:default]).unshift(kind.to_sym)
-    options[:resource_name] = resource_name
-    message = I18n.t("#{resource_name}.#{kind}", options)
-    flash[key] = message if message.present?
-  end
-
-  def clean_up_passwords(object)
-    object.clean_up_passwords if object.respond_to?(:clean_up_passwords)
-  end
-
-  def respond_with_navigational(*args, &block)
-    respond_with(*args) do |format|
-      format.any(*navigational_formats, &block)
-    end
-  end
-
-  def request_format
-    @request_format ||= request.format.try(:ref)
-  end
-
-  def is_navigational_format?
-    Devise.navigational_formats.include?(request.format.try(:ref))
-  end
-
-  # Override prefixes to consider the scoped view.
-  def _prefixes #:nodoc:
-    @_prefixes ||= if self.class.scoped_views?
-      super.unshift("#{devise_mapping.scoped_path}/#{controller_name}")
-    else
-      super
-    end
-  end
-end

app/views/devise/_links.erb

@@ -1,25 +0,0 @@
-<%- if controller_name != 'sessions' %>
-  <%= link_to "Sign in", new_session_path(resource_name) %><br />
-<% end -%>
-
-<%- if devise_mapping.registerable? && controller_name != 'registrations' %>
-  <%= link_to "Sign up", new_registration_path(resource_name) %><br />
-<% end -%>
-
-<%- if devise_mapping.recoverable? && controller_name != 'passwords' %>
-  <%= link_to "Forgot your password?", new_password_path(resource_name) %><br />
-<% end -%>
-
-<%- if devise_mapping.confirmable? && controller_name != 'confirmations' %>
-  <%= link_to "Didn't receive confirmation instructions?", new_confirmation_path(resource_name) %><br />
-<% end -%>
-
-<%- if devise_mapping.lockable? && resource_class.unlock_strategy_enabled?(:email) && controller_name != 'unlocks' %>
-  <%= link_to "Didn't receive unlock instructions?", new_unlock_path(resource_name) %><br />
-<% end -%>
-
-<%- if devise_mapping.omniauthable? %>
-  <%- resource_class.omniauth_providers.each do |provider| %>
-    <%= link_to "Sign in with #{provider.to_s.titleize}", omniauth_authorize_path(resource_name, provider) %><br />
-  <% end -%>
-<% end -%>

app/views/devise/confirmations/new.html.erb

@@ -9,4 +9,4 @@
   <div><%= f.submit "Resend confirmation instructions" %></div>
 <% end %>
 
-<%= render "links" %>
+<%= render :partial => "devise/shared/links" %>

app/views/devise/mailer/confirmation_instructions.html.erb

@@ -1,5 +1,5 @@
 <p>Welcome <%= @resource.email %>!</p>
 
-<p>You can confirm your account email through the link below:</p>
+<p>You can confirm your account through the link below:</p>
 
 <p><%= link_to 'Confirm my account', confirmation_url(@resource, :confirmation_token => @resource.confirmation_token) %></p>

app/views/devise/passwords/edit.html.erb

@@ -13,4 +13,4 @@
   <div><%= f.submit "Change my password" %></div>
 <% end %>
 
-<%= render "links" %>
+<%= render :partial => "devise/shared/links" %>

app/views/devise/passwords/new.html.erb

@@ -9,4 +9,4 @@
   <div><%= f.submit "Send me reset password instructions" %></div>
 <% end %>
 
-<%= render "links" %>
+<%= render :partial => "devise/shared/links" %>

app/views/devise/registrations/new.html.erb

@@ -15,4 +15,4 @@
   <div><%= f.submit "Sign up" %></div>
 <% end %>
 
-<%= render "links" %>
+<%= render :partial => "devise/shared/links" %>

app/views/devise/sessions/new.html.erb

@@ -14,4 +14,4 @@
   <div><%= f.submit "Sign in" %></div>
 <% end %>
 
-<%= render "links" %>
+<%= render :partial => "devise/shared/links" %>

app/views/devise/shared/_links.erb

@@ -1,3 +1,25 @@
-<% ActiveSupport::Deprecation.warn "Rendering partials devise/shared/_links.erb is deprecated" \
-  "please use devise/_links.erb instead." %>
-<%= render "links" %>
+<%- if controller_name != 'sessions' %>
+  <%= link_to "Sign in", new_session_path(resource_name) %><br />
+<% end -%>
+
+<%- if devise_mapping.registerable? && controller_name != 'registrations' %>
+  <%= link_to "Sign up", new_registration_path(resource_name) %><br />
+<% end -%>
+
+<%- if devise_mapping.recoverable? && controller_name != 'passwords' %>
+  <%= link_to "Forgot your password?", new_password_path(resource_name) %><br />
+<% end -%>
+
+<%- if devise_mapping.confirmable? && controller_name != 'confirmations' %>
+  <%= link_to "Didn't receive confirmation instructions?", new_confirmation_path(resource_name) %><br />
+<% end -%>
+
+<%- if devise_mapping.lockable? && resource_class.unlock_strategy_enabled?(:email) && controller_name != 'unlocks' %>
+  <%= link_to "Didn't receive unlock instructions?", new_unlock_path(resource_name) %><br />
+<% end -%>
+
+<%- if devise_mapping.omniauthable? %>
+  <%- resource_class.omniauth_providers.each do |provider| %>
+    <%= link_to "Sign in with #{provider.to_s.titleize}", omniauth_authorize_path(resource_name, provider) %><br />
+  <% end -%>
+<% end -%>

app/views/devise/unlocks/new.html.erb

@@ -9,4 +9,4 @@
   <div><%= f.submit "Resend unlock instructions" %></div>
 <% end %>
 
-<%= render "links" %>
+<%= render :partial => "devise/shared/links" %>

config/locales/en.yml

@@ -35,15 +35,16 @@ en:
       confirmed: 'Your account was successfully confirmed. You are now signed in.'
     registrations:
       signed_up: 'Welcome! You have signed up successfully.'
-      signed_up_but_unconfirmed: 'A message with a confirmation link has been sent to your email address. Please open the link to activate your account.'
-      signed_up_but_inactive: 'You have signed up successfully. However, we could not sign you in because your account is not yet activated.'
-      signed_up_but_locked: 'You have signed up successfully. However, we could not sign you in because your account is locked.'
+      inactive_signed_up: 'You have signed up successfully. However, we could not sign you in because your account is %{reason}.'
       updated: 'You updated your account successfully.'
-      update_needs_confirmation: "You updated your account successfully, but we need to verify your new email address. Please check your email and click on the confirm link to finalize confirming your new email address."
       destroyed: 'Bye! Your account was successfully cancelled. We hope to see you again soon.'
+      reasons:
+        inactive: 'inactive'
+        unconfirmed: 'unconfirmed'
+        locked: 'locked'
     unlocks:
       send_instructions: 'You will receive an email with instructions about how to unlock your account in a few minutes.'
-      unlocked: 'Your account has been unlocked successfully. Please sign in to continue.'
+      unlocked: 'Your account was successfully unlocked. You are now signed in.'
       send_paranoid_instructions: 'If your account exists, you will receive an email with instructions about how to unlock it in a few minutes.'
     omniauth_callbacks:
       success: 'Successfully authorized from %{kind} account.'

devise.gemspec

@@ -5,7 +5,7 @@ require "devise/version"
 Gem::Specification.new do |s|
   s.name        = "devise"
   s.version     = Devise::VERSION.dup
-  s.platform    = Gem::Platform::RUBY
+  s.platform    = Gem::Platform::RUBY  
   s.summary     = "Flexible authentication solution for Rails with Warden"
   s.email       = "contact@plataformatec.com.br"
   s.homepage    = "http://github.com/plataformatec/devise"
@@ -14,12 +14,12 @@ Gem::Specification.new do |s|
 
   s.rubyforge_project = "devise"
 
-  s.files         = Dir["CHANGELOG.rdoc", "MIT-LICENSE", "README.rdoc", "app/**/*", "config/**/*", "lib/**/*"]
-  s.test_files    = Dir["test/**/*"]
+  s.files         = `git ls-files`.split("\n")
+  s.test_files    = `git ls-files -- {test,spec,features}/*`.split("\n")
+  s.executables   = `git ls-files -- bin/*`.split("\n").map{ |f| File.basename(f) }
   s.require_paths = ["lib"]
 
   s.add_dependency("warden", "~> 1.1")
   s.add_dependency("orm_adapter", "~> 0.0.3")
   s.add_dependency("bcrypt-ruby", "~> 3.0")
-  s.add_dependency("railties", "~> 3.1")
-end
+end

gemfiles/Gemfile.rails-3.1.x

@@ -1,35 +0,0 @@
-source "http://rubygems.org"
-
-gem "devise", :path => ".."
-
-gem "rails", "~> 3.1.0"
-gem "omniauth", "~> 1.0.0"
-gem "omniauth-oauth2", "~> 1.0.0"
-gem "rdoc"
-
-group :test do
-  gem "omniauth-facebook"
-  gem "omniauth-openid", "~> 1.0.1"
-  gem "webrat", "0.7.2", :require => false
-  gem "mocha", :require => false
-
-  platforms :mri_18 do
-    gem "ruby-debug", ">= 0.10.3"
-  end
-end
-
-platforms :jruby do
-  gem "activerecord-jdbc-adapter"
-  gem "activerecord-jdbcsqlite3-adapter"
-  gem "jruby-openssl"
-end
-
-platforms :ruby do
-  gem "sqlite3-ruby"
-
-  group :mongoid do
-    gem "mongo", "~> 1.3.0"
-    gem "mongoid", "~> 2.0"
-    gem "bson_ext", "~> 1.3.0"
-  end
-end

lib/devise.rb

@@ -16,8 +16,10 @@ module Devise
 
   module Controllers
     autoload :Helpers, 'devise/controllers/helpers'
+    autoload :InternalHelpers, 'devise/controllers/internal_helpers'
     autoload :Rememberable, 'devise/controllers/rememberable'
     autoload :ScopedViews, 'devise/controllers/scoped_views'
+    autoload :SharedHelpers, 'devise/controllers/shared_helpers'
     autoload :UrlHelpers, 'devise/controllers/url_helpers'
   end
 
@@ -82,7 +84,7 @@ module Devise
   # False by default for backwards compatibility.
   mattr_accessor :case_insensitive_keys
   @@case_insensitive_keys = false
-
+  
   # Keys that should have whitespace stripped.
   # False by default for backwards compatibility.
   mattr_accessor :strip_whitespace_keys
@@ -118,23 +120,27 @@ module Devise
   mattr_accessor :remember_for
   @@remember_for = 2.weeks
 
+  # If true, a valid remember token can be re-used between multiple browsers.
+  mattr_accessor :remember_across_browsers
+  @@remember_across_browsers = true
+
   # If true, extends the user's remember period when remembered via cookie.
   mattr_accessor :extend_remember_period
   @@extend_remember_period = false
 
-  # Time interval you can access your account before confirming your account.
-  mattr_accessor :allow_unconfirmed_access_for
-  @@allow_unconfirmed_access_for = 0.days
+  # If true, uses salt as remember token and does not create it in the database.
+  # By default is false for backwards compatibility.
+  mattr_accessor :use_salt_as_remember_token
+  @@use_salt_as_remember_token = false
 
-  # Defines which key will be used when confirming an account.
+  # Time interval you can access your account before confirming your account.
+  mattr_accessor :confirm_within
+  @@confirm_within = 0.days
+
+  # Defines which key will be used when confirming an account
   mattr_accessor :confirmation_keys
   @@confirmation_keys = [ :email ]
 
-  # Defines if email should be reconfirmable.
-  # False by default for backwards compatibility.
-  mattr_accessor :reconfirmable
-  @@reconfirmable = false
-
   # Time interval to timeout the user session without activity.
   mattr_accessor :timeout_in
   @@timeout_in = 30.minutes
@@ -147,6 +153,11 @@ module Devise
   mattr_accessor :encryptor
   @@encryptor = nil
 
+  # Tells if devise should apply the schema in ORMs where devise declaration
+  # and schema belongs to the same class (as Datamapper and Mongoid).
+  mattr_accessor :apply_schema
+  @@apply_schema = true
+
   # Scoped views. Since it relies on fallbacks to render default views, it's
   # turned off by default.
   mattr_accessor :scoped_views
@@ -179,7 +190,6 @@ module Devise
   @@reset_password_keys = [ :email ]
 
   # Time interval you can reset your password with a reset password key
-  # Nil by default for backwards compatibility.
   mattr_accessor :reset_password_within
   @@reset_password_within = nil
 
@@ -195,13 +205,14 @@ module Devise
   mattr_accessor :token_authentication_key
   @@token_authentication_key = :auth_token
 
-  # Skip session storage for the following strategies
-  mattr_accessor :skip_session_storage
-  @@skip_session_storage = []
+  # If true, authentication through token does not store user in session
+  mattr_accessor :stateless_token
+  @@stateless_token = false
 
   # Which formats should be treated as navigational.
+  # We need both :"*/*" and "*/*" to work on different Rails versions.
   mattr_accessor :navigational_formats
-  @@navigational_formats = ["*/*", :html]
+  @@navigational_formats = [:"*/*", "*/*", :html]
 
   # When set to true, signing out a user signs out all other scopes.
   mattr_accessor :sign_out_all_scopes
@@ -211,45 +222,6 @@ module Devise
   mattr_accessor :sign_out_via
   @@sign_out_via = :get
 
-  # The parent controller all Devise controllers inherits from.
-  # Defaults to ApplicationController. This should be set early
-  # in the initialization process and should be set to a string.
-  mattr_accessor :parent_controller
-  @@parent_controller = "ApplicationController"
-
-  # The router Devise should use to generate routes. Defaults
-  # to :main_app. Should be overriden by engines in order
-  # to provide custom routes.
-  mattr_accessor :router_name
-  @@router_name = :main_app
-
-  # DEPRECATED CONFIG
-
-  # If true, uses salt as remember token and does not create it in the database.
-  # By default is false for backwards compatibility.
-  mattr_accessor :use_salt_as_remember_token
-  @@use_salt_as_remember_token = false
-
-  # Tells if devise should apply the schema in ORMs where devise declaration
-  # and schema belongs to the same class (as Datamapper and Mongoid).
-  mattr_accessor :apply_schema
-  @@apply_schema = true
-
-  def self.remember_across_browsers=(value)
-    warn "\n[DEVISE] Devise.remember_across_browsers is deprecated and has no effect. Please remove it.\n"
-  end
-
-  def self.confirm_within=(value)
-    warn "\n[DEVISE] Devise.confirm_within= is deprecated. Please set Devise.allow_unconfirmed_access_for= instead.\n"
-    Devise.allow_unconfirmed_access_for = value
-  end
-
-  def self.stateless_token=(value)
-    warn "\n[DEVISE] Devise.stateless_token= is deprecated. Please append :token_auth to Devise.skip_session_storage " \
-      "instead, for example: Devise.skip_session_storage << :token_auth\n"
-    Devise.skip_session_storage << :token_auth
-  end
-
   # PRIVATE CONFIGURATION
 
   # Store scopes mappings.
@@ -343,7 +315,7 @@ module Devise
   #
   def self.add_module(module_name, options = {})
     ALL << module_name
-    options.assert_valid_keys(:strategy, :model, :controller, :route, :no_input)
+    options.assert_valid_keys(:strategy, :model, :controller, :route)
 
     if strategy = options[:strategy]
       strategy = (strategy == true ? module_name : strategy)
@@ -355,7 +327,7 @@ module Devise
       CONTROLLERS[module_name] = controller
     end
 
-    NO_INPUT << strategy if options[:no_input]
+    NO_INPUT << strategy if strategy && controller != :sessions
 
     if route = options[:route]
       case route
@@ -389,7 +361,7 @@ module Devise
   # initialization.
   #
   #  Devise.initialize do |config|
-  #    config.allow_unconfirmed_access_for = 2.days
+  #    config.confirm_within = 2.days
   #
   #    config.warden do |manager|
   #      # Configure warden to use other strategies, like oauth.
@@ -422,6 +394,11 @@ module Devise
     end
   end
 
+  # Returns true if Rails version is bigger than 3.0.x
+  def self.rack_session?
+    Rails::VERSION::STRING[0,3] != "3.0"
+  end
+
   # Regenerates url helpers considering Devise.mapping
   def self.regenerate_helpers!
     Devise::Controllers::UrlHelpers.remove_helpers!

lib/devise/controllers/helpers.rb

@@ -168,13 +168,7 @@ module Devise
       def signed_in_root_path(resource_or_scope)
         scope = Devise::Mapping.find_scope!(resource_or_scope)
         home_path = "#{scope}_root_path"
-        if respond_to?(home_path, true)
-          send(home_path)
-        elsif respond_to?(:root_path)
-          root_path
-        else
-          "/"
-        end
+        respond_to?(home_path, true) ? send(home_path) : root_path
       end
 
       # The default url to be used after signing in. This is used by all Devise
@@ -215,7 +209,7 @@ module Devise
       #
       # By default it is the root_path.
       def after_sign_out_path_for(resource_or_scope)
-        respond_to?(:root_path) ? root_path : "/"
+        root_path
       end
 
       # Sign in a user and tries to redirect first to the stored location and

lib/devise/controllers/internal_helpers.rb

@@ -0,0 +1,154 @@
+module Devise
+  module Controllers
+    # Those helpers are used only inside Devise controllers and should not be
+    # included in ApplicationController since they all depend on the url being
+    # accessed.
+    module InternalHelpers #:nodoc:
+      extend ActiveSupport::Concern
+      include Devise::Controllers::ScopedViews
+      include Devise::Controllers::SharedHelpers
+
+      included do
+        helper DeviseHelper
+
+        helpers = %w(resource scope_name resource_name signed_in_resource
+                     resource_class devise_mapping devise_controller?)
+        hide_action *helpers
+        helper_method *helpers
+
+        prepend_before_filter :is_devise_resource?
+        respond_to *Mime::SET.map(&:to_sym) if mimes_for_respond_to.empty?
+      end
+
+      # Gets the actual resource stored in the instance variable
+      def resource
+        instance_variable_get(:"@#{resource_name}")
+      end
+
+      # Proxy to devise map name
+      def resource_name
+        devise_mapping.name
+      end
+      alias :scope_name :resource_name
+
+      # Proxy to devise map class
+      def resource_class
+        devise_mapping.to
+      end
+
+      # Returns a signed in resource from session (if one exists)
+      def signed_in_resource
+        warden.authenticate(:scope => resource_name)
+      end
+
+      # Attempt to find the mapped route for devise based on request path
+      def devise_mapping
+        @devise_mapping ||= request.env["devise.mapping"]
+      end
+
+      # Overwrites devise_controller? to return true
+      def devise_controller?
+        true
+      end
+
+    protected
+
+      # Checks whether it's a devise mapped resource or not.
+      def is_devise_resource? #:nodoc:
+        unknown_action! <<-MESSAGE unless devise_mapping
+Could not find devise mapping for path #{request.fullpath.inspect}.
+Maybe you forgot to wrap your route inside the scope block? For example:
+
+    devise_scope :user do
+      match "/some/route" => "some_devise_controller"
+    end
+MESSAGE
+      end
+
+      # Returns real navigational formats which are supported by Rails
+      def navigational_formats
+        @navigational_formats ||= Devise.navigational_formats.select{ |format| Mime::EXTENSION_LOOKUP[format.to_s] }
+      end
+
+      def unknown_action!(msg)
+        logger.debug "[Devise] #{msg}" if logger
+        raise ActionController::UnknownAction, msg
+      end
+
+      # Sets the resource creating an instance variable
+      def resource=(new_resource)
+        instance_variable_set(:"@#{resource_name}", new_resource)
+      end
+
+      # Build a devise resource.
+      def build_resource(hash=nil)
+        hash ||= params[resource_name] || {}
+        self.resource = resource_class.new(hash)
+      end
+
+      # Helper for use in before_filters where no authentication is required.
+      #
+      # Example:
+      #   before_filter :require_no_authentication, :only => :new
+      def require_no_authentication
+        return unless is_navigational_format?
+        no_input = devise_mapping.no_input_strategies
+        args = no_input.dup.push :scope => resource_name
+        if no_input.present? && warden.authenticate?(*args)
+          resource = warden.user(resource_name)
+          flash[:alert] = I18n.t("devise.failure.already_authenticated")
+          redirect_to after_sign_in_path_for(resource)
+        end
+      end
+
+      # Helper for use after calling send_*_instructions methods on a resource.
+      # If we are in paranoid mode, we always act as if the resource was valid
+      # and instructions were sent.
+      def successfully_sent?(resource)
+        notice = if Devise.paranoid
+          resource.errors.clear
+          :send_paranoid_instructions
+        elsif resource.errors.empty?
+          :send_instructions
+        end
+
+        if notice
+          set_flash_message :notice, notice if is_navigational_format?
+          true
+        end
+      end
+
+      # Sets the flash message with :key, using I18n. By default you are able
+      # to setup your messages using specific resource scope, and if no one is
+      # found we look to default scope.
+      # Example (i18n locale file):
+      #
+      #   en:
+      #     devise:
+      #       passwords:
+      #         #default_scope_messages - only if resource_scope is not found
+      #         user:
+      #           #resource_scope_messages
+      #
+      # Please refer to README or en.yml locale file to check what messages are
+      # available.
+      def set_flash_message(key, kind, options={}) #:nodoc:
+        options[:scope] = "devise.#{controller_name}"
+        options[:default] = Array(options[:default]).unshift(kind.to_sym)
+        options[:resource_name] = resource_name
+        message = I18n.t("#{resource_name}.#{kind}", options)
+        flash[key] = message if message.present?
+      end
+
+      def clean_up_passwords(object) #:nodoc:
+        object.clean_up_passwords if object.respond_to?(:clean_up_passwords)
+      end
+
+      def respond_with_navigational(*args, &block)
+        respond_with(*args) do |format|
+          format.any(*navigational_formats, &block)
+        end
+      end
+    end
+  end
+end

lib/devise/controllers/scoped_views.rb

@@ -12,6 +12,22 @@ module Devise
           @scoped_views = value
         end
       end
+
+    protected
+
+      # Render a view for the specified scope. Turned off by default.
+      # Accepts just :controller as option.
+      def render_with_scope(action, path=self.controller_path)
+        if self.class.scoped_views?
+          begin
+            render :template => "#{devise_mapping.scoped_path}/#{path.split("/").last}/#{action}"
+          rescue ActionView::MissingTemplate
+            render :template => "#{path}/#{action}"
+          end
+        else
+          render :template => "#{path}/#{action}"
+        end
+      end
     end
   end
 end

lib/devise/controllers/shared_helpers.rb

@@ -0,0 +1,26 @@
+module Devise
+  module Controllers
+    # Helpers used in both FailureApp and Devise controllers.
+    module SharedHelpers
+      MIME_REFERENCES = Mime::HTML.respond_to?(:ref)
+
+      protected
+
+      # Helper used by FailureApp and Devise controllers to retrieve proper formats.
+      def request_format
+        @request_format ||= if request.format.respond_to?(:ref)
+          request.format.ref
+        elsif MIME_REFERENCES
+          request.format
+        elsif request.format # Rails < 3.0.4
+          request.format.to_sym
+        end
+      end
+
+      # Check whether it's navigational format, such as :html or :iphone, or not.
+      def is_navigational_format?
+        Devise.navigational_formats.include?(request_format)
+      end
+    end
+  end
+end

lib/devise/controllers/url_helpers.rb

@@ -16,15 +16,7 @@ module Devise
     #   new_confirmation_path(:user) => new_user_confirmation_path
     #   confirmation_path(:user)     => user_confirmation_path
     #
-    # Those helpers are included by default to ActionController::Base.
-    #
-    # In case you want to add such helpers to another class, you can do
-    # that as long as this new class includes both url_helpers and
-    # mounted_helpers. Example:
-    #
-    #     include Rails.application.routes.url_helpers
-    #     include Rails.application.routes.mounted_helpers
-    #
+    # Those helpers are added to your ApplicationController.
     module UrlHelpers
       def self.remove_helpers!
         self.instance_methods.map(&:to_s).grep(/_(url|path)$/).each do |method|
@@ -47,7 +39,7 @@ module Devise
               class_eval <<-URL_HELPERS, __FILE__, __LINE__ + 1
                 def #{method}(resource_or_scope, *args)
                   scope = Devise::Mapping.find_scope!(resource_or_scope)
-                  _devise_route_context.send("#{action}\#{scope}_#{module_name}_#{path_or_url}", *args)
+                  send("#{action}\#{scope}_#{module_name}_#{path_or_url}", *args)
                 end
               URL_HELPERS
             end
@@ -56,12 +48,6 @@ module Devise
       end
 
       generate_helpers!(Devise::URL_HELPERS)
-
-      private
-
-      def _devise_route_context
-        @_devise_route_context ||= send(Devise.router_name)
-      end
     end
   end
 end

lib/devise/failure_app.rb

@@ -9,9 +9,8 @@ module Devise
     include ActionController::RackDelegation
     include ActionController::UrlFor
     include ActionController::Redirecting
-
     include Rails.application.routes.url_helpers
-    include Rails.application.routes.mounted_helpers
+    include Devise::Controllers::SharedHelpers
 
     delegate :flash, :to => :request
 
@@ -21,11 +20,7 @@ module Devise
     end
 
     def self.default_url_options(*args)
-      if defined?(ApplicationController)
-        ApplicationController.default_url_options(*args)
-      else
-        {}
-      end
+      ApplicationController.default_url_options(*args)
     end
 
     def respond
@@ -53,50 +48,32 @@ module Devise
 
     def redirect
       store_location!
-      if flash[:timedout] && flash[:alert]
-        flash.keep(:timedout)
-        flash.keep(:alert)
-      else
-        flash[:alert] = i18n_message
-      end
+      flash[:alert] = i18n_message
       redirect_to redirect_url
     end
 
   protected
 
     def i18n_message(default = nil)
-      message = warden_message || default || :unauthenticated
+      message = warden.message || warden_options[:message] || default || :unauthenticated
 
       if message.is_a?(Symbol)
         I18n.t(:"#{scope}.#{message}", :resource_name => scope,
-               :scope => "devise.failure", :default => [message])
+               :scope => "devise.failure", :default => [message, message.to_s])
       else
         message.to_s
       end
     end
 
     def redirect_url
-      if warden_message == :timeout
-        flash[:timedout] = true
-        attempted_path || scope_path
-      else
-        scope_path
-      end
-    end
-
-    def scope_path
       opts  = {}
       route = :"new_#{scope}_session_path"
       opts[:format] = request_format unless skip_format?
 
-      context = send(Devise.router_name)
-
-      if context.respond_to?(route)
-        context.send(route, opts)
-      elsif respond_to?(:root_path)
-        root_path(opts)
+      if respond_to?(route)
+        send(route, opts)
       else
-        "/"
+        root_path(opts)
       end
     end
 
@@ -153,10 +130,6 @@ module Devise
       env['warden.options']
     end
 
-    def warden_message
-      @message ||= warden.message || warden_options[:message]
-    end
-
     def scope
       @scope ||= warden_options[:scope] || Devise.default_scope
     end
@@ -172,13 +145,5 @@ module Devise
     def store_location!
       session["#{scope}_return_to"] = attempted_path if request.get? && !http_auth?
     end
-
-    def is_navigational_format?
-      Devise.navigational_formats.include?(request_format)
-    end
-
-    def request_format
-      @request_format ||= request.format.try(:ref)
-    end
   end
 end

lib/devise/models.rb

@@ -48,6 +48,7 @@ module Devise
     # for a complete description on those values.
     #
     def devise(*modules)
+      include Devise::Models::Authenticatable
       options = modules.extract_options!.dup
 
       selected_modules = modules.map(&:to_sym).uniq.sort_by do |s|
@@ -55,7 +56,6 @@ module Devise
       end
 
       devise_modules_hook! do
-        include Devise::Models::Authenticatable
         selected_modules.each do |m|
           mod = Devise::Models.const_get(m.to_s.classify)
 

lib/devise/models/authenticatable.rb

@@ -25,11 +25,6 @@ module Devise
     #   * +params_authenticatable+: if this model allows authentication through request params. By default true.
     #     It also accepts an array specifying the strategies that should allow params authentication.
     #
-    #   * +skip_session_storage+: By default Devise will store the user in session.
-    #     You can skip storage for http and token auth by appending values to array:
-    #     :skip_session_storage => [:token_auth] or :skip_session_storage => [:http_auth, :token_auth],
-    #     by default is set to :skip_session_storage => [:http_auth].
-    #
     # == active_for_authentication?
     #
     # After authenticating a user and in each request, Devise checks if your model is active by
@@ -57,9 +52,6 @@ module Devise
       included do
         class_attribute :devise_modules, :instance_writer => false
         self.devise_modules ||= []
-
-        before_validation :downcase_keys
-        before_validation :strip_whitespace
       end
 
       # Check if the current object is valid for authentication. This method and
@@ -87,21 +79,8 @@ module Devise
         Devise.mailer
       end
 
-      def headers_for(name)
-        {}
-      end
-
-      def downcase_keys
-        (self.class.case_insensitive_keys || []).each { |k| self[k].try(:downcase!) }
-      end
-
-      def strip_whitespace
-        (self.class.strip_whitespace_keys || []).each { |k| self[k].try(:strip!) }
-      end
-
       module ClassMethods
-        Devise::Models.config(self, :authentication_keys, :request_keys, :strip_whitespace_keys,
-          :case_insensitive_keys, :http_authenticatable, :params_authenticatable, :skip_session_storage)
+        Devise::Models.config(self, :authentication_keys, :request_keys, :strip_whitespace_keys, :case_insensitive_keys, :http_authenticatable, :params_authenticatable)
 
         def serialize_into_session(record)
           [record.to_key, record.authenticatable_salt]
@@ -127,17 +106,20 @@ module Devise
         # namedscope to filter records while authenticating.
         # Example:
         #
-        #   def self.find_for_authentication(conditions={})
-        #     conditions[:active] = true
-        #     super
+        #   def self.find_for_authentication(tainted_conditions)
+        #     find_first_by_auth_conditions(tainted_conditions, :active => true)
         #   end
         #
-        def find_for_authentication(conditions)
-          find_first_by_auth_conditions(conditions)
+        # Finally, notice that Devise also queries for users in other scenarios
+        # besides authentication, for example when retrieving an user to send
+        # an e-mail for password reset. In such cases, find_for_authentication
+        # is not called.
+        def find_for_authentication(tainted_conditions)
+          find_first_by_auth_conditions(tainted_conditions)
         end
 
-        def find_first_by_auth_conditions(conditions)
-          to_adapter.find_first devise_param_filter.filter(conditions)
+        def find_first_by_auth_conditions(tainted_conditions, opts={})
+          to_adapter.find_first(devise_param_filter.filter(tainted_conditions).merge(opts))
         end
 
         # Find an initialize a record setting an error if it can't be found.
@@ -183,4 +165,4 @@ module Devise
       end
     end
   end
-end
+end

lib/devise/models/confirmable.rb

@@ -9,16 +9,11 @@ module Devise
     #
     # Confirmable adds the following options to devise_for:
     #
-    #   * +allow_unconfirmed_access_for+: the time you want to allow the user to access his account
+    #   * +confirm_within+: the time you want to allow the user to access his account
     #     before confirming it. After this period, the user access is denied. You can
     #     use this to let your user access some features of your application without
     #     confirming the account, but blocking it after a certain period (ie 7 days).
-    #     By default allow_unconfirmed_access_for is zero, it means users always have to confirm to sign in.
-    #   * +reconfirmable+: requires any email changes to be confirmed (exactly the same way as
-    #     initial account confirmation) to be applied. Requires additional unconfirmed_email
-    #     db field to be setup (t.reconfirmable in migrations). Until confirmed new email is
-    #     stored in unconfirmed email column, and copied to email column on successful
-    #     confirmation.
+    #     By default confirm_within is zero, it means users always have to confirm to sign in.
     #
     # == Examples
     #
@@ -32,28 +27,15 @@ module Devise
       included do
         before_create :generate_confirmation_token, :if => :confirmation_required?
         after_create  :send_confirmation_instructions, :if => :confirmation_required?
-        before_update :postpone_email_change_until_confirmation, :if => :postpone_email_change?
-        after_update :send_confirmation_instructions, :if => :reconfirmation_required?
       end
 
-      # Confirm a user by setting it's confirmed_at to actual time. If the user
-      # is already confirmed, add an error to email field. If the user is invalid
-      # add errors
+      # Confirm a user by setting its confirmed_at to actual time. If the user
+      # is already confirmed, add en error to email field
       def confirm!
-        pending_any_confirmation do
+        unless_confirmed do
           self.confirmation_token = nil
           self.confirmed_at = Time.now.utc
-
-          if self.class.reconfirmable && unconfirmed_email.present?
-            @bypass_postpone = true
-            self.email = unconfirmed_email
-            self.unconfirmed_email = nil
-
-            # We need to validate in such cases to enforce e-mail uniqueness
-            save(:validate => true)
-          else
-            save(:validate => false)
-          end
+          save(:validate => false)
         end
       end
 
@@ -62,22 +44,15 @@ module Devise
         !!confirmed_at
       end
 
-      def pending_reconfirmation?
-        self.class.reconfirmable && unconfirmed_email.present?
-      end
-
       # Send confirmation instructions by email
       def send_confirmation_instructions
-        self.confirmation_token = nil if reconfirmation_required?
-        @reconfirmation_required = false
-
-        generate_confirmation_token! if self.confirmation_token.blank?
+        generate_confirmation_token! if self.confirmation_token.nil?
         self.devise_mailer.confirmation_instructions(self).deliver
       end
 
       # Resend confirmation token. This method does not need to generate a new token.
       def resend_confirmation_token
-        pending_any_confirmation { send_confirmation_instructions }
+        unless_confirmed { send_confirmation_instructions }
       end
 
       # Overwrites active_for_authentication? for confirmation
@@ -99,14 +74,6 @@ module Devise
         self.confirmed_at = Time.now.utc
       end
 
-      def headers_for(action)
-        headers = super
-        if action == :confirmation_instructions && pending_reconfirmation?
-          headers[:to] = unconfirmed_email
-        end
-        headers
-      end
-
       protected
 
         # Callback to overwrite if confirmation is required or not.
@@ -121,25 +88,26 @@ module Devise
         #
         # Example:
         #
-        #   # allow_unconfirmed_access_for = 1.day and confirmation_sent_at = today
+        #   # confirm_within = 1.day and confirmation_sent_at = today
         #   confirmation_period_valid?   # returns true
         #
-        #   # allow_unconfirmed_access_for = 5.days and confirmation_sent_at = 4.days.ago
+        #   # confirm_within = 5.days and confirmation_sent_at = 4.days.ago
         #   confirmation_period_valid?   # returns true
         #
-        #   # allow_unconfirmed_access_for = 5.days and confirmation_sent_at = 5.days.ago
+        #   # confirm_within = 5.days and confirmation_sent_at = 5.days.ago
         #   confirmation_period_valid?   # returns false
         #
-        #   # allow_unconfirmed_access_for = 0.days
+        #   # confirm_within = 0.days
         #   confirmation_period_valid?   # will always return false
         #
         def confirmation_period_valid?
-          confirmation_sent_at && confirmation_sent_at.utc >= self.class.allow_unconfirmed_access_for.ago
+          confirmation_sent_at && confirmation_sent_at.utc >= self.class.confirm_within.ago
         end
 
-        # Checks whether the record requires any confirmation.
-        def pending_any_confirmation
-          if !confirmed? || pending_reconfirmation?
+        # Checks whether the record is confirmed or not, yielding to the block
+        # if it's already confirmed, otherwise adds an error to email.
+        def unless_confirmed
+          unless confirmed?
             yield
           else
             self.errors.add(:email, :already_confirmed)
@@ -150,6 +118,7 @@ module Devise
         # Generates a new random token for confirmation, and stores the time
         # this token is being generated
         def generate_confirmation_token
+          self.confirmed_at = nil
           self.confirmation_token = self.class.confirmation_token
           self.confirmation_sent_at = Time.now.utc
         end
@@ -163,32 +132,13 @@ module Devise
           confirm! unless confirmed?
         end
 
-        def postpone_email_change_until_confirmation
-          @reconfirmation_required = true
-          self.unconfirmed_email = self.email
-          self.email = self.email_was
-        end
-
-        def postpone_email_change?
-          postpone = self.class.reconfirmable && email_changed? && !@bypass_postpone
-          @bypass_postpone = nil
-          postpone
-        end
-
-        def reconfirmation_required?
-          self.class.reconfirmable && @reconfirmation_required
-        end
-
       module ClassMethods
         # Attempt to find a user by its email. If a record is found, send new
-        # confirmation instructions to it. If not, try searching for a user by unconfirmed_email
-        # field. If no user is found, returns a new user with an email not found error.
+        # confirmation instructions to it. If not user is found, returns a new user
+        # with an email not found error.
         # Options must contain the user email
         def send_confirmation_instructions(attributes={})
-          confirmable = find_by_unconfirmed_email_with_errors(attributes) if reconfirmable
-          unless confirmable.try(:persisted?)
-            confirmable = find_or_initialize_with_errors(confirmation_keys, attributes, :not_found)
-          end
+          confirmable = find_or_initialize_with_errors(confirmation_keys, attributes, :not_found)
           confirmable.resend_confirmation_token if confirmable.persisted?
           confirmable
         end
@@ -208,15 +158,7 @@ module Devise
           generate_token(:confirmation_token)
         end
 
-        # Find a record for confirmation by unconfirmed email field
-        def find_by_unconfirmed_email_with_errors(attributes = {})
-          unconfirmed_required_attributes = confirmation_keys.map { |k| k == :email ? :unconfirmed_email : k }
-          unconfirmed_attributes = attributes.symbolize_keys
-          unconfirmed_attributes[:unconfirmed_email] = unconfirmed_attributes.delete(:email)
-          find_or_initialize_with_errors(unconfirmed_required_attributes, unconfirmed_attributes, :not_found)
-        end
-
-        Devise::Models.config(self, :allow_unconfirmed_access_for, :confirmation_keys, :reconfirmable)
+        Devise::Models.config(self, :confirm_within, :confirmation_keys)
       end
     end
   end

lib/devise/models/database_authenticatable.rb

@@ -25,6 +25,8 @@ module Devise
       included do
         attr_reader :password, :current_password
         attr_accessor :password_confirmation
+        before_validation :downcase_keys
+        before_validation :strip_whitespace
       end
 
       # Generates password encryption based on the given value.
@@ -101,6 +103,15 @@ module Devise
 
     protected
 
+      # Downcase case-insensitive keys
+      def downcase_keys
+        (self.class.case_insensitive_keys || []).each { |k| self[k].try(:downcase!) }
+      end
+
+      def strip_whitespace
+        (self.class.strip_whitespace_keys || []).each { |k| self[k].try(:strip!) }
+      end
+
       # Digests the password using bcrypt.
       def password_digest(password)
         ::BCrypt::Password.create("#{password}#{self.class.pepper}", :cost => self.class.stretches).to_s

lib/devise/models/lockable.rb

@@ -79,7 +79,7 @@ module Devise
         # if the user can login or not (wrong password, etc)
         unlock_access! if lock_expired?
 
-        if super && !access_locked?
+        if super
           self.failed_attempts = 0
           save(:validate => false)
           true

lib/devise/models/recoverable.rb

@@ -29,7 +29,6 @@ module Devise
       def reset_password!(new_password, new_password_confirmation)
         self.password = new_password
         self.password_confirmation = new_password_confirmation
-
         if valid?
           clear_reset_password_token
           after_password_reset
@@ -40,7 +39,7 @@ module Devise
 
       # Resets reset password token and send reset password instructions by email
       def send_reset_password_instructions
-        generate_reset_password_token! if should_generate_reset_token?
+        generate_reset_password_token! if should_generate_token?
         self.devise_mailer.reset_password_instructions(self).deliver
       end
 
@@ -65,19 +64,20 @@ module Devise
       #   reset_password_period_valid?   # will always return false
       #
       def reset_password_period_valid?
+        return true unless respond_to?(:reset_password_sent_at)
         reset_password_sent_at && reset_password_sent_at.utc >= self.class.reset_password_within.ago
       end
 
       protected
 
-        def should_generate_reset_token?
+        def should_generate_token?
           reset_password_token.nil? || !reset_password_period_valid?
         end
 
         # Generates a new random token for reset password
         def generate_reset_password_token
           self.reset_password_token = self.class.reset_password_token
-          self.reset_password_sent_at = Time.now.utc
+          self.reset_password_sent_at = Time.now.utc if respond_to?(:reset_password_sent_at=)
           self.reset_password_token
         end
 
@@ -90,7 +90,7 @@ module Devise
         # Removes reset_password token
         def clear_reset_password_token
           self.reset_password_token = nil
-          self.reset_password_sent_at = nil
+          self.reset_password_sent_at = nil if respond_to?(:reset_password_sent_at=)
         end
 
         def after_password_reset

lib/devise/models/rememberable.rb

@@ -21,6 +21,11 @@ module Devise
     #     used to calculate the expires time for the cookie created to remember
     #     the user. By default remember_for is 2.weeks.
     #
+    #   * +remember_across_browsers+: if a valid remember token can be re-used
+    #     between multiple browsers. By default remember_across_browsers is true
+    #     and cannot be turned off if you are using password salt instead of remember
+    #     token.
+    #
     #   * +extend_remember_period+: if true, extends the user's remember period
     #     when remembered via cookie. False by default.
     #
@@ -44,6 +49,7 @@ module Devise
       # Generate a new remember token and save the record without validations
       # unless remember_across_browsers is true and the user already has a valid token.
       def remember_me!(extend_period=false)
+        self.remember_token = self.class.remember_token if respond_to?(:remember_token) && generate_remember_token?
         self.remember_created_at = Time.now.utc if generate_remember_timestamp?(extend_period)
         save(:validate => false)
       end
@@ -69,12 +75,14 @@ module Devise
       end
 
       def rememberable_value
-        if salt = authenticatable_salt
+        if respond_to?(:remember_token)
+          remember_token
+        elsif respond_to?(:authenticatable_salt) && (salt = authenticatable_salt)
           salt
         else
-          raise "authenticable_salt returned nil for the #{self.class.name} model. " \
-            "In order to use rememberable, you must ensure a password is always set " \
-            "or implement rememberable_value in your model with your own logic."
+          raise "The #{self.class.name} class does not respond to remember_token and " <<
+            "authenticatable_salt returns nil. In order to use rememberable, you must " <<
+            "add a remember_token field to your model or ensure a password is always set."
         end
       end
 
@@ -84,6 +92,12 @@ module Devise
 
     protected
 
+      # Generate a token unless remember_across_browsers is true and there is
+      # an existing remember_token or the existing remember_token has expried.
+      def generate_remember_token? #:nodoc:
+        !(self.class.remember_across_browsers && remember_token) || remember_expired?
+      end
+
       # Generate a timestamp if extend_remember_period is true, if no remember_token
       # exists, or if an existing remember token has expired.
       def generate_remember_timestamp?(extend_period) #:nodoc:
@@ -107,7 +121,8 @@ module Devise
           generate_token(:remember_token)
         end
 
-        Devise::Models.config(self, :remember_for, :extend_remember_period, :cookie_options)
+        Devise::Models.config(self, :remember_for, :remember_across_browsers,
+          :extend_remember_period, :cookie_options)
       end
     end
   end

lib/devise/models/serializable.rb

@@ -9,11 +9,8 @@ module Devise
     module Serializable
       extend ActiveSupport::Concern
 
-      array = %w(serializable_hash)
-      # to_xml does not call serializable_hash on 3.1
-      array << "to_xml" if Rails::VERSION::STRING[0,3] == "3.1"
-
-      array.each do |method|
+      # TODO: to_xml does not call serializable_hash. Hopefully someone will fix this in AR.
+      %w(to_xml serializable_hash).each do |method|
         class_eval <<-RUBY, __FILE__, __LINE__
           def #{method}(options=nil)
             options ||= {}

lib/devise/models/timeoutable.rb

@@ -23,6 +23,7 @@ module Devise
       # Checks whether the user session has expired based on configured time.
       def timedout?(last_access)
         return false if remember_exists_and_not_expired?
+
         !timeout_in.nil? && last_access && last_access <= timeout_in.ago
       end
 
@@ -33,7 +34,8 @@ module Devise
       private
 
       def remember_exists_and_not_expired?
-        return false unless respond_to?(:remember_created_at)
+        return false unless respond_to?(:remember_expired?)
+
         remember_created_at && !remember_expired?
       end
 

lib/devise/models/token_authenticatable.rb

@@ -24,6 +24,9 @@ module Devise
     #
     #   * +token_authentication_key+: Defines name of the authentication token params key. E.g. /users/sign_in?some_key=...
     #
+    #   * +stateless_token+: By default, when you sign up with a token, Devise will store the user in session
+    #     as any other authentication strategy. You can set stateless_token to true to avoid this.
+    #
     module TokenAuthenticatable
       extend ActiveSupport::Concern
 
@@ -62,7 +65,7 @@ module Devise
           generate_token(:authentication_token)
         end
 
-        ::Devise::Models.config(self, :token_authentication_key)
+        ::Devise::Models.config(self, :token_authentication_key, :stateless_token)
       end
     end
   end

lib/devise/models/validatable.rb

@@ -23,7 +23,7 @@ module Devise
 
         base.class_eval do
           validates_presence_of   :email, :if => :email_required?
-          validates_uniqueness_of :email, :allow_blank => true, :if => :email_changed?
+          validates_uniqueness_of :email, :case_sensitive => (case_insensitive_keys != false), :allow_blank => true, :if => :email_changed?
           validates_format_of     :email, :with  => email_regexp, :allow_blank => true, :if => :email_changed?
 
           validates_presence_of     :password, :if => :password_required?

lib/devise/modules.rb

@@ -5,8 +5,8 @@ Devise.with_options :model => true do |d|
   d.with_options :strategy => true do |s|
     routes = [nil, :new, :destroy]
     s.add_module :database_authenticatable, :controller => :sessions, :route => { :session => routes }
-    s.add_module :token_authenticatable,    :controller => :sessions, :route => { :session => routes }, :no_input => true
-    s.add_module :rememberable, :no_input => true
+    s.add_module :token_authenticatable
+    s.add_module :rememberable
   end
 
   # Other authentications

lib/devise/orm/active_record.rb

@@ -26,12 +26,6 @@ module Devise
 
         # Tell how to apply schema methods.
         def apply_devise_schema(name, type, options={})
-          @__devise_warning_raised ||= begin
-            $stderr.puts "\n[DEVISE] You are using t.database_authenticatable and others in your migration " \
-              "and this feature is deprecated. Please simply use Rails helpers instead as mentioned here:\n" \
-              "https://github.com/plataformatec/devise/wiki/How-To:-Upgrade-to-Devise-2.0-migration-schema-style\n\n"
-            true
-          end
           column name, type.to_s.downcase.to_sym, options
         end
       end

lib/devise/param_filter.rb

@@ -33,9 +33,8 @@ module Devise
 
     private
 
-    # Determine which values should be transformed to string or passed as-is to the query builder underneath
     def param_requires_string_conversion?(value)
-      [Fixnum, TrueClass, FalseClass, Regexp].none? {|clz| value.is_a? clz }
+      true
     end
   end
 end

lib/devise/path_checker.rb

@@ -3,11 +3,7 @@ module Devise
     include Rails.application.routes.url_helpers
 
     def self.default_url_options(*args)
-      if defined?(ApplicationController)
-        ApplicationController.default_url_options(*args)
-      else
-        {}
-      end
+      ApplicationController.default_url_options(*args)
     end
 
     def initialize(env, scope)

lib/devise/rails.rb

@@ -41,66 +41,5 @@ module Devise
         end
       end
     end
-
-    initializer "devise.fix_routes_proxy_missing_respond_to_bug" do
-      # We can get rid of this once we support Rails > 3.2
-      ActionDispatch::Routing::RoutesProxy.class_eval do
-        def respond_to?(method, include_private = false)
-          super || routes.url_helpers.respond_to?(method)
-        end
-      end
-    end
-
-    initializer "devise.deprecations" do
-      unless defined?(Rails::Generators)
-        if Devise.case_insensitive_keys == false
-          warn "\n[DEVISE] Devise.case_insensitive_keys is false which is no longer " \
-            "supported. If you want to continue running on this mode, please ensure " \
-            "you are not using validatable (you can copy the validations directly to your model) " \
-            "and set case_insensitive_keys to an empty array.\n"
-        end
-
-        if Devise.apply_schema && defined?(Mongoid)
-          warn "\n[DEVISE] Devise.apply_schema is true. This means Devise was " \
-            "automatically configuring your DB. This no longer happens. You should " \
-            "set Devise.apply_schema to false and manually set the fields used by Devise as shown here: " \
-            "https://github.com/plataformatec/devise/wiki/How-To:-Upgrade-to-Devise-2.0-migration-schema-style\n"
-        end
-
-        # TODO: Deprecate the true value of this option as well
-        if Devise.use_salt_as_remember_token == false
-          warn "\n[DEVISE] Devise.use_salt_as_remember_token is false which is no longer " \
-            "supported. Devise now only uses the salt as remember token and the remember_token " \
-            "column can be removed from your models.\n"
-        end
-
-        if Devise.reset_password_within.nil?
-          warn "\n[DEVISE] Devise.reset_password_within is nil. Please set this value to " \
-            "an interval (for example, 6.hours) and add a reset_password_sent_at field to " \
-            "your Devise models (if they don't have one already).\n"
-        end
-      end
-
-      config.after_initialize do
-        example = <<-YAML
-en:
-  devise:
-    registrations:
-      signed_up_but_unconfirmed: 'A message with a confirmation link has been sent to your email address. Please open the link to activate your account.'
-      signed_up_but_inactive: 'You have signed up successfully. However, we could not sign you in because your account is not yet activated.'
-      signed_up_but_locked: 'You have signed up successfully. However, we could not sign you in because your account is locked.'
-        YAML
-
-        if I18n.t(:"devise.registrations.reasons", :default => {}).present?
-          warn "\n[DEVISE] devise.registrations.reasons in yml files is deprecated, " \
-            "please use devise.registrations.signed_up_but_REASON instead. The default values are:\n\n#{example}\n"
-        end
-
-        if I18n.t(:"devise.registrations.inactive_signed_up", :default => "").present?
-          warn "\n[DEVISE] devise.registrations.inactive_signed_up in yml files is deprecated, " \
-            "please use devise.registrations.signed_up_but_REASON instead. The default values are:\n\n#{example}\n"
-        end
-      end
-    end
   end
 end

lib/devise/rails/routes.rb

@@ -84,16 +84,15 @@ module ActionDispatch::Routing
     #
     #    You need to make sure that your sign_out controls trigger a request with a matching HTTP method.
     #
-    #  * :module => the namespace to find controllers (default: "devise", thus
-    #    accessing devise/sessions, devise/registrations, and so on). If you want
-    #    to namespace all at once, use module:
+    #  * :module => the namespace to find controlers. By default, devise will access devise/sessions,
+    #    devise/registrations and so on. If you want to namespace all at once, use module:
     #
     #      devise_for :users, :module => "users"
     #
     #    Notice that whenever you use namespace in the router DSL, it automatically sets the module.
     #    So the following setup:
     #
-    #      namespace :publisher do
+    #      namespace :publisher
     #        devise_for :account
     #      end
     #
@@ -136,15 +135,15 @@ module ActionDispatch::Routing
     #     devise_for :users
     #   end
     #
-    # However, since Devise uses the request path to retrieve the current user,
-    # this has one caveat: If you are using a dynamic segment, like so ...
+    # However, since Devise uses the request path to retrieve the current user, it has one caveats.
+    # If you are using a dynamic segment, as below:
     #
     #   scope ":locale" do
     #     devise_for :users
     #   end
     #
-    # you are required to configure default_url_options in your
-    # ApplicationController class, so Devise can pick it:
+    # You are required to configure default_url_options in your ApplicationController class level, so
+    # Devise can pick it:
     #
     #   class ApplicationController < ActionController::Base
     #     def self.default_url_options
@@ -208,12 +207,7 @@ module ActionDispatch::Routing
         routes  = mapping.used_routes
 
         devise_scope mapping.name do
-          if block_given?
-            ActiveSupport::Deprecation.warn "Passing a block to devise_for is deprecated. " \
-              "Please call devise_scope :#{mapping.name} do ... end with the block instead", caller
-            yield
-          end
-
+          yield if block_given?
           with_devise_exclusive_scope mapping.fullpath, mapping.name, options do
             routes.each { |mod| send("devise_#{mod}", mapping, mapping.controllers) }
           end
@@ -375,13 +369,13 @@ module ActionDispatch::Routing
       end
 
       def with_devise_exclusive_scope(new_path, new_as, options) #:nodoc:
-        old_as, old_path, old_module, old_constraints, old_defaults, old_options =
+        old_as, old_path, old_module, old_constraints, old_defaults, old_options = 
           *@scope.values_at(:as, :path, :module, :constraints, :defaults, :options)
         @scope[:as], @scope[:path], @scope[:module], @scope[:constraints], @scope[:defaults], @scope[:options] =
           new_as, new_path, nil, *options.values_at(:constraints, :defaults, :options)
         yield
       ensure
-        @scope[:as], @scope[:path], @scope[:module], @scope[:constraints], @scope[:defaults], @scope[:options] =
+        @scope[:as], @scope[:path], @scope[:module], @scope[:constraints], @scope[:defaults], @scope[:options] = 
           old_as, old_path, old_module, old_constraints, old_defaults, old_options
       end
 

lib/devise/rails/warden_compat.rb

@@ -34,4 +34,87 @@ class Warden::SessionSerializer
       end
     end
   end
+end
+
+unless Devise.rack_session?
+  # We cannot use Rails Indifferent Hash because it messes up the flash object.
+  class Devise::IndifferentHash < Hash
+    alias_method :regular_writer, :[]= unless method_defined?(:regular_writer)
+    alias_method :regular_update, :update unless method_defined?(:regular_update)
+
+    def [](key)
+      super(convert_key(key))
+    end
+
+    def []=(key, value)
+      regular_writer(convert_key(key), value)
+    end
+
+    alias_method :store, :[]=
+
+    def update(other_hash)
+      other_hash.each_pair { |key, value| regular_writer(convert_key(key), value) }
+      self
+    end
+
+    alias_method :merge!, :update
+
+    def key?(key)
+      super(convert_key(key))
+    end
+
+    alias_method :include?, :key?
+    alias_method :has_key?, :key?
+    alias_method :member?, :key?
+
+    def fetch(key, *extras)
+      super(convert_key(key), *extras)
+    end
+
+    def values_at(*indices)
+      indices.collect {|key| self[convert_key(key)]}
+    end
+
+    def merge(hash)
+      self.dup.update(hash)
+    end
+
+    def delete(key)
+      super(convert_key(key))
+    end
+
+    def stringify_keys!; self end
+    def stringify_keys; dup end
+
+    undef :symbolize_keys!
+    def symbolize_keys; to_hash.symbolize_keys end
+
+    def to_options!; self end
+    def to_hash; Hash.new.update(self) end
+
+    protected
+
+    def convert_key(key)
+      key.kind_of?(Symbol) ? key.to_s : key
+    end
+  end
+
+  class ActionDispatch::Request
+    def reset_session
+      session.destroy if session && session.respond_to?(:destroy)
+      self.session = {}
+      @env['action_dispatch.request.flash_hash'] = nil
+    end
+  end
+
+  Warden::Manager.after_set_user :event => [:set_user, :authentication] do |record, warden, options|
+    if options[:scope] && warden.authenticated?(options[:scope])
+      request, flash = warden.request, warden.env['action_dispatch.request.flash_hash']
+      backup = request.session.to_hash
+      backup.delete("session_id")
+      request.reset_session
+      warden.env['action_dispatch.request.flash_hash'] = flash
+      request.session = Devise::IndifferentHash.new.update(backup)
+    end
+  end
 end

lib/devise/schema.rb

@@ -40,11 +40,6 @@ module Devise
       apply_devise_schema :confirmation_sent_at, DateTime
     end
 
-    # Creates unconfirmed_email
-    def reconfirmable
-      apply_devise_schema :unconfirmed_email,    String
-    end
-
     # Creates reset_password_token and reset_password_sent_at.
     #
     # == Options

lib/devise/strategies/authenticatable.rb

@@ -6,11 +6,7 @@ module Devise
     # parameters both from params or from http authorization headers. See database_authenticatable
     # for an example.
     class Authenticatable < Base
-      attr_accessor :authentication_hash, :authentication_type, :password
-
-      def store?
-        !mapping.to.skip_session_storage.include?(authentication_type)
-      end
+      attr_accessor :authentication_hash, :password
 
       def valid?
         valid_for_params_auth? || valid_for_http_auth?
@@ -51,7 +47,7 @@ module Devise
       #   * If all authentication keys are present;
       #
       def valid_for_http_auth?
-        http_authenticatable? && request.authorization && with_authentication_hash(:http_auth, http_auth_hash)
+        http_authenticatable? && request.authorization && with_authentication_hash(http_auth_hash)
       end
 
       # Check if this is strategy is valid for params authentication by:
@@ -62,8 +58,8 @@ module Devise
       #   * If all authentication keys are present;
       #
       def valid_for_params_auth?
-        params_authenticatable? && valid_params_request? &&
-          valid_params? && with_authentication_hash(:params_auth, params_auth_hash)
+        params_authenticatable? && valid_request? &&
+          valid_params? && with_authentication_hash(params_auth_hash)
       end
 
       # Check if the model accepts this strategy as http authenticatable.
@@ -87,8 +83,8 @@ module Devise
         Hash[*keys.zip(decode_credentials).flatten]
       end
 
-      # By default, a request is valid if the controller set the proper env variable.
-      def valid_params_request?
+      # By default, a request is valid  if the controller is allowed and the VERB is POST.
+      def valid_request?
         !!env["devise.allow_params_authentication"]
       end
 
@@ -105,12 +101,12 @@ module Devise
       # Helper to decode credentials from HTTP.
       def decode_credentials
         return [] unless request.authorization && request.authorization =~ /^Basic (.*)/m
-        Base64.decode64($1).split(/:/, 2)
+        ActiveSupport::Base64.decode64($1).split(/:/, 2)
       end
 
       # Sets the authentication hash and the password from params_auth_hash or http_auth_hash.
-      def with_authentication_hash(auth_type, auth_values)
-        self.authentication_hash, self.authentication_type = {}, auth_type
+      def with_authentication_hash(auth_values)
+        self.authentication_hash = {}
         self.password = auth_values[:password]
 
         parse_authentication_key_values(auth_values, authentication_keys) &&
@@ -156,4 +152,4 @@ module Devise
       end
     end
   end
-end
+end

lib/devise/strategies/token_authenticatable.rb

@@ -11,7 +11,7 @@ module Devise
     # a password, you can pass "X" as password and it will simply be ignored.
     class TokenAuthenticatable < Authenticatable
       def store?
-        super && !mapping.to.skip_session_storage.include?(:token_auth)
+        !mapping.to.stateless_token
       end
 
       def authenticate!
@@ -27,8 +27,8 @@ module Devise
 
     private
 
-      # Token Authenticatable can be authenticated with params in any controller and any verb.
-      def valid_params_request?
+      # TokenAuthenticatable request is valid for any controller and any verb.
+      def valid_request?
         true
       end
 

lib/devise/version.rb

@@ -1,3 +1,3 @@
 module Devise
-  VERSION = "2.0.0".freeze
+  VERSION = "1.5.4".freeze
 end

lib/generators/active_record/devise_generator.rb

@@ -1,6 +1,7 @@
 require 'rails/generators/active_record'
 require 'generators/devise/orm_helpers'
 
+
 module ActiveRecord
   module Generators
     class DeviseGenerator < ActiveRecord::Generators::Base
@@ -20,52 +21,13 @@ module ActiveRecord
       def generate_model
         invoke "active_record:model", [name], :migration => false unless model_exists? && behavior == :invoke
       end
-
+      
       def inject_devise_content
         inject_into_class(model_path, class_name, model_contents + <<CONTENT) if model_exists?
   # Setup accessible (or protected) attributes for your model
   attr_accessible :email, :password, :password_confirmation, :remember_me
 CONTENT
       end
-
-      def migration_data
-<<RUBY
-      ## Database authenticatable
-      t.string :email,              :null => false, :default => ""
-      t.string :encrypted_password, :null => false, :default => ""
-
-      ## Recoverable
-      t.string   :reset_password_token
-      t.datetime :reset_password_sent_at
-
-      ## Rememberable
-      t.datetime :remember_created_at
-
-      ## Trackable
-      t.integer  :sign_in_count, :default => 0
-      t.datetime :current_sign_in_at
-      t.datetime :last_sign_in_at
-      t.string   :current_sign_in_ip
-      t.string   :last_sign_in_ip
-
-      ## Encryptable
-      # t.string :password_salt
-
-      ## Confirmable
-      # t.string   :confirmation_token
-      # t.datetime :confirmed_at
-      # t.datetime :confirmation_sent_at
-      # t.string   :unconfirmed_email # Only if using reconfirmable
-
-      ## Lockable
-      # t.integer  :failed_attempts, :default => 0 # Only if lock strategy is :failed_attempts
-      # t.string   :unlock_token # Only if unlock strategy is :email or :both
-      # t.datetime :locked_at
-
-      ## Token authenticatable
-      # t.string :authentication_token
-RUBY
-      end
     end
   end
 end

lib/generators/active_record/templates/migration.rb

@@ -1,7 +1,19 @@
 class DeviseCreate<%= table_name.camelize %> < ActiveRecord::Migration
+<% if ::Rails::VERSION::MAJOR == 3 && ::Rails::VERSION::MINOR >= 1 -%>
   def change
+<% else -%>
+  def self.up
+<% end  -%>
     create_table(:<%= table_name %>) do |t|
-<%= migration_data -%>
+      t.database_authenticatable :null => false
+      t.recoverable
+      t.rememberable
+      t.trackable
+
+      # t.encryptable
+      # t.confirmable
+      # t.lockable :lock_strategy => :<%= Devise.lock_strategy %>, :unlock_strategy => :<%= Devise.unlock_strategy %>
+      # t.token_authenticatable
 
 <% attributes.each  do |attribute| -%>
       t.<%= attribute.type %> :<%= attribute.name %>
@@ -16,4 +28,10 @@ class DeviseCreate<%= table_name.camelize %> < ActiveRecord::Migration
     # add_index :<%= table_name %>, :unlock_token,         :unique => true
     # add_index :<%= table_name %>, :authentication_token, :unique => true
   end
+
+<% unless  ::Rails::VERSION::MAJOR == 3 && ::Rails::VERSION::MINOR >= 1 -%>
+  def self.down
+    drop_table :<%= table_name %>
+  end
+<% end  -%>
 end

lib/generators/active_record/templates/migration_existing.rb

@@ -1,7 +1,15 @@
 class AddDeviseTo<%= table_name.camelize %> < ActiveRecord::Migration
   def self.up
     change_table(:<%= table_name %>) do |t|
-<%= migration_data -%>
+      t.database_authenticatable :null => false
+      t.recoverable
+      t.rememberable
+      t.trackable
+
+      # t.encryptable
+      # t.confirmable
+      # t.lockable :lock_strategy => :<%= Devise.lock_strategy %>, :unlock_strategy => :<%= Devise.unlock_strategy %>
+      # t.token_authenticatable
 
 <% attributes.each  do |attribute| -%>
       t.<%= attribute.type %> :<%= attribute.name %>

lib/generators/devise/views_generator.rb

@@ -32,6 +32,17 @@ module Devise
       end
     end
 
+    class SharedViewsGenerator < Rails::Generators::Base #:nodoc:
+      include ViewPathTemplates
+      source_root File.expand_path("../../../../app/views/devise", __FILE__)
+      desc "Copies shared Devise views to your application."
+
+      # Override copy_views to just copy mailer and shared.
+      def copy_views
+        view_directory :shared
+      end
+    end
+
     class FormForGenerator < Rails::Generators::Base #:nodoc:
       include ViewPathTemplates
       source_root File.expand_path("../../../../app/views/devise", __FILE__)
@@ -69,15 +80,12 @@ module Devise
     end
 
     class ViewsGenerator < Rails::Generators::Base
-      include ViewPathTemplates
-
-      source_root File.expand_path("../../../../app/views/devise", __FILE__)
       desc "Copies Devise views to your application."
 
-      def copy_views
-        copy_file "_links.erb", "#{target_path}/_links.erb"
-      end
+      argument :scope, :required => false, :default => nil,
+                       :desc => "The scope to copy views to"
 
+      invoke SharedViewsGenerator
       hook_for :form_builder, :aliases => "-b",
                               :desc => "Form builder to be used",
                               :default => defined?(SimpleForm) ? "simple_form_for" : "form_for"

lib/generators/mongoid/devise_generator.rb

@@ -9,52 +9,9 @@ module Mongoid
         invoke "mongoid:model", [name] unless model_exists? && behavior == :invoke
       end
 
-      def inject_field_types
-        inject_into_file model_path, migration_data, :after => "include Mongoid::Document\n" if model_exists?
-      end
-
       def inject_devise_content
         inject_into_file model_path, model_contents, :after => "include Mongoid::Document\n" if model_exists?
       end
-
-      def migration_data
-<<RUBY
-  ## Database authenticatable
-  field :email,              :type => String, :null => false, :default => ""
-  field :encrypted_password, :type => String, :null => false, :default => ""
-
-  ## Recoverable
-  field :reset_password_token,   :type => String
-  field :reset_password_sent_at, :type => Time
-
-  ## Rememberable
-  field :remember_created_at, :type => Time
-
-  ## Trackable
-  field :sign_in_count,      :type => Integer, :default => 0
-  field :current_sign_in_at, :type => Time
-  field :last_sign_in_at,    :type => Time
-  field :current_sign_in_ip, :type => String
-  field :last_sign_in_ip,    :type => String
-
-  ## Encryptable
-  # field :password_salt, :type => String
-
-  ## Confirmable
-  # field :confirmation_token,   :type => String
-  # field :confirmed_at,         :type => Time
-  # field :confirmation_sent_at, :type => Time
-  # field :unconfirmed_email,    :type => String # Only if using reconfirmable
-
-  ## Lockable
-  # field :failed_attempts, :type => Integer, :default => 0 # Only if lock strategy is :failed_attempts
-  # field :unlock_token,    :type => String # Only if unlock strategy is :email or :both
-  # field :locked_at,       :type => Time
-
-  ## Token authenticatable
-  # field :authentication_token, :type => String
-RUBY
-      end
     end
   end
 end

lib/generators/templates/devise.rb

@@ -9,9 +9,6 @@ Devise.setup do |config|
   # Configure the class responsible to send e-mails.
   # config.mailer = "Devise::Mailer"
 
-  # Automatically apply schema changes in tableless databases
-  config.apply_schema = false
-
   # ==> ORM configuration
   # Load and configure the ORM. Supports :active_record (default) and
   # :mongoid (bson_ext recommended) by default. Other ORMs may be
@@ -46,15 +43,9 @@ Devise.setup do |config|
   config.strip_whitespace_keys = [ :email ]
 
   # Tell if authentication through request.params is enabled. True by default.
-  # It can be set to an array that will enable params authentication only for the
-  # given strategies, for example, `config.params_authenticatable = [:database]` will
-  # enable it only for database (email + password) authentication.
   # config.params_authenticatable = true
 
   # Tell if authentication through HTTP Basic Auth is enabled. False by default.
-  # It can be set to an array that will enable http authentication only for the
-  # given strategies, for example, `config.http_authenticatable = [:token]` will
-  # enable it only for token authentication.
   # config.http_authenticatable = false
 
   # If http headers should be returned for AJAX requests. True by default.
@@ -68,13 +59,6 @@ Devise.setup do |config|
   # Does not affect registerable.
   # config.paranoid = true
 
-  # By default Devise will store the user in session. You can skip storage for
-  # :http_auth and :token_auth by adding those symbols to the array below.
-  # Notice that if you are skipping storage for all authentication paths, you
-  # may want to disable generating routes to Devise's sessions controller by
-  # passing :skip => :sessions to `devise_for` in your config/routes.rb
-  config.skip_session_storage = [:http_auth]
-
   # ==> Configuration for :database_authenticatable
   # For bcrypt, this is the cost for hashing the password and defaults to 10. If
   # using other encryptors, it sets how many times you want the password re-encrypted.
@@ -93,13 +77,7 @@ Devise.setup do |config|
   # able to access the website for two days without confirming his account,
   # access will be blocked just in the third day. Default is 0.days, meaning
   # the user cannot access the website without confirming his account.
-  # config.allow_unconfirmed_access_for = 2.days
-
-  # If true, requires any email changes to be confirmed (exctly the same way as
-  # initial account confirmation) to be applied. Requires additional unconfirmed_email
-  # db field (see migrations). Until confirmed new email is stored in
-  # unconfirmed email column, and copied to email column on successful confirmation.
-  config.reconfirmable = true
+  # config.confirm_within = 2.days
 
   # Defines which key will be used when confirming an account
   # config.confirmation_keys = [ :email ]
@@ -108,6 +86,9 @@ Devise.setup do |config|
   # The time the user will be remembered without asking for credentials again.
   # config.remember_for = 2.weeks
 
+  # If true, a valid remember token can be re-used between multiple browsers.
+  # config.remember_across_browsers = true
+
   # If true, extends the user's remember period when remembered via cookie.
   # config.extend_remember_period = false
 
@@ -164,7 +145,7 @@ Devise.setup do |config|
   # Time interval you can reset your password with a reset password key.
   # Don't put a too small interval or your users won't have the time to
   # change their passwords.
-  config.reset_password_within = 6.hours
+  config.reset_password_within = 2.hours
 
   # ==> Configuration for :encryptable
   # Allow you to use another encryption algorithm besides bcrypt (default). You can use
@@ -178,6 +159,10 @@ Devise.setup do |config|
   # Defines name of the authentication token params key
   # config.token_authentication_key = :auth_token
 
+  # If true, authentication through token does not store user in session and needs
+  # to be supplied on each request. Useful if you are using the token as API token.
+  # config.stateless_token = false
+
   # ==> Scopes configuration
   # Turn scoped views on. Before rendering "sessions/new", it will first check for
   # "users/sessions/new". It's turned off by default because it's slower if you
@@ -201,8 +186,9 @@ Devise.setup do |config|
   # If you have any extra navigational formats, like :iphone or :mobile, you
   # should add them to the navigational formats lists.
   #
-  # The "*/*" below is required to match Internet Explorer requests.
-  # config.navigational_formats = ["*/*", :html]
+  # The :"*/*" and "*/*" formats below is required to match Internet
+  # Explorer requests.
+  # config.navigational_formats = [:"*/*", "*/*", :html]
 
   # The default HTTP method used to sign out a resource. Default is :delete.
   config.sign_out_via = :delete

lib/generators/templates/simple_form_for/confirmations/new.html.erb

@@ -12,4 +12,4 @@
   </div>
 <% end %>
 
-<%= render "links" %>
+<%= render :partial => "devise/shared/links" %>

lib/generators/templates/simple_form_for/passwords/edit.html.erb

@@ -16,4 +16,4 @@
   </div>
 <% end %>
 
-<%= render "links" %>
+<%= render :partial => "devise/shared/links" %>

lib/generators/templates/simple_form_for/passwords/new.html.erb

@@ -12,4 +12,4 @@
   </div>
 <% end %>
 
-<%= render "links" %>
+<%= render :partial => "devise/shared/links" %>

lib/generators/templates/simple_form_for/registrations/new.html.erb

@@ -14,4 +14,4 @@
   </div>
 <% end %>
 
-<%= render "links" %>
+<%= render :partial => "devise/shared/links" %>

lib/generators/templates/simple_form_for/sessions/new.html.erb

@@ -12,4 +12,4 @@
   </div>
 <% end %>
 
-<%= render "links" %>
+<%= render :partial => "devise/shared/links" %>

lib/generators/templates/simple_form_for/unlocks/new.html.erb

@@ -12,4 +12,4 @@
   </div>
 <% end %>
 
-<%= render "links" %>
+<%= render :partial => "devise/shared/links" %>

test/controllers/internal_helpers_test.rb

@@ -1,6 +1,7 @@
 require 'test_helper'
 
-class MyController < DeviseController
+class MyController < ApplicationController
+  include Devise::Controllers::InternalHelpers
 end
 
 class HelpersTest < ActionController::TestCase
@@ -44,12 +45,10 @@ class HelpersTest < ActionController::TestCase
     @controller.send :require_no_authentication
   end
 
-  test 'require no authentication only checks if already authenticated if no inputs strategies are available' do
+  test 'require no authentication skips if no inputs are available' do
     Devise.mappings[:user].expects(:no_input_strategies).returns([])
     @mock_warden.expects(:authenticate?).never
-    @mock_warden.expects(:authenticated?).with(:user).once.returns(true)
-    @mock_warden.expects(:user).with(:user).returns(User.new)
-    @controller.expects(:redirect_to).with(root_path)
+    @controller.expects(:redirect_to).never
     @controller.send :require_no_authentication
   end
 

test/devise_test.rb

@@ -12,8 +12,8 @@ end
 
 class DeviseTest < ActiveSupport::TestCase
   test 'model options can be configured through Devise' do
-    swap Devise, :allow_unconfirmed_access_for => 113, :pepper => "foo" do
-      assert_equal 113, Devise.allow_unconfirmed_access_for
+    swap Devise, :confirm_within => 113, :pepper => "foo" do
+      assert_equal 113, Devise.confirm_within
       assert_equal "foo", Devise.pepper
     end
   end

test/failure_app_test.rb

@@ -3,9 +3,7 @@ require 'ostruct'
 
 class FailureTest < ActiveSupport::TestCase
   class RootFailureApp < Devise::FailureApp
-    def fake_app
-      Object.new
-    end
+    undef_method :new_user_session_path
   end
 
   def self.context(name, &block)
@@ -43,17 +41,15 @@ class FailureTest < ActiveSupport::TestCase
     end
 
     test 'return to the root path if no session path is available' do
-      swap Devise, :router_name => :fake_app do
-        call_failure :app => RootFailureApp
-        assert_equal 302, @response.first
-        assert_equal 'You need to sign in or sign up before continuing.', @request.flash[:alert]
-        assert_equal 'http://test.host/', @response.second['Location']
-      end
+      call_failure :app => RootFailureApp
+      assert_equal 302, @response.first
+      assert_equal 'You need to sign in or sign up before continuing.', @request.flash[:alert]
+      assert_equal 'http://test.host/', @response.second['Location']
     end
 
     test 'uses the proxy failure message as symbol' do
-      call_failure('warden' => OpenStruct.new(:message => :invalid))
-      assert_equal 'Invalid email or password.', @request.flash[:alert]
+      call_failure('warden' => OpenStruct.new(:message => :test))
+      assert_equal 'test', @request.flash[:alert]
       assert_equal 'http://test.host/users/sign_in', @response.second["Location"]
     end
 
@@ -77,14 +73,14 @@ class FailureTest < ActiveSupport::TestCase
 
     test 'works for any navigational format' do
       swap Devise, :navigational_formats => [:xml] do
-        call_failure('formats' => Mime::XML)
+        call_failure('formats' => :xml)
         assert_equal 302, @response.first
       end
     end
 
     test 'redirects the correct format if it is a non-html format request' do
       swap Devise, :navigational_formats => [:js] do
-        call_failure('formats' => Mime::JS)
+        call_failure('formats' => :js)
         assert_equal 'http://test.host/users/sign_in.js', @response.second["Location"]
       end
     end
@@ -92,18 +88,18 @@ class FailureTest < ActiveSupport::TestCase
 
   context 'For HTTP request' do
     test 'return 401 status' do
-      call_failure('formats' => Mime::XML)
+      call_failure('formats' => :xml)
       assert_equal 401, @response.first
     end
 
     test 'return appropriate body for xml' do
-      call_failure('formats' => Mime::XML)
+      call_failure('formats' => :xml)
       result = %(<?xml version="1.0" encoding="UTF-8"?>\n<errors>\n  <error>You need to sign in or sign up before continuing.</error>\n</errors>\n)
       assert_equal result, @response.last.body
     end
 
     test 'return appropriate body for json' do
-      call_failure('formats' => Mime::JSON)
+      call_failure('formats' => :json)
       result = %({"error":"You need to sign in or sign up before continuing."})
       assert_equal result, @response.last.body
     end
@@ -114,26 +110,26 @@ class FailureTest < ActiveSupport::TestCase
     end
 
     test 'return WWW-authenticate headers if model allows' do
-      call_failure('formats' => Mime::XML)
+      call_failure('formats' => :xml)
       assert_equal 'Basic realm="Application"', @response.second["WWW-Authenticate"]
     end
 
     test 'does not return WWW-authenticate headers if model does not allow' do
       swap Devise, :http_authenticatable => false do
-        call_failure('formats' => Mime::XML)
+        call_failure('formats' => :xml)
         assert_nil @response.second["WWW-Authenticate"]
       end
     end
 
     test 'works for any non navigational format' do
       swap Devise, :navigational_formats => [] do
-        call_failure('formats' => Mime::HTML)
+        call_failure('formats' => :html)
         assert_equal 401, @response.first
       end
     end
 
     test 'uses the failure message as response body' do
-      call_failure('formats' => Mime::XML, 'warden' => OpenStruct.new(:message => :invalid))
+      call_failure('formats' => :xml, 'warden' => OpenStruct.new(:message => :invalid))
       assert_match '<error>Invalid email or password.</error>', @response.third.body
     end
 
@@ -141,7 +137,7 @@ class FailureTest < ActiveSupport::TestCase
       context 'when http_authenticatable_on_xhr is false' do
         test 'dont return 401 with navigational formats' do
           swap Devise, :http_authenticatable_on_xhr => false do
-            call_failure('formats' => Mime::HTML, 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest')
+            call_failure('formats' => :html, 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest')
             assert_equal 302, @response.first
             assert_equal 'http://test.host/users/sign_in', @response.second["Location"]
           end
@@ -149,7 +145,7 @@ class FailureTest < ActiveSupport::TestCase
 
         test 'dont return 401 with non navigational formats' do
           swap Devise, :http_authenticatable_on_xhr => false do
-            call_failure('formats' => Mime::JSON, 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest')
+            call_failure('formats' => :json, 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest')
             assert_equal 302, @response.first
             assert_equal 'http://test.host/users/sign_in.json', @response.second["Location"]
           end
@@ -159,14 +155,14 @@ class FailureTest < ActiveSupport::TestCase
       context 'when http_authenticatable_on_xhr is true' do
         test 'return 401' do
           swap Devise, :http_authenticatable_on_xhr => true do
-            call_failure('formats' => Mime::HTML, 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest')
+            call_failure('formats' => :html, 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest')
             assert_equal 401, @response.first
           end
         end
 
         test 'skip WWW-Authenticate header' do
           swap Devise, :http_authenticatable_on_xhr => true do
-            call_failure('formats' => Mime::HTML, 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest')
+            call_failure('formats' => :html, 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest')
             assert_nil @response.second['WWW-Authenticate']
           end
         end

test/generators/active_record_generator_test.rb

@@ -8,10 +8,20 @@ if DEVISE_ORM == :active_record
     destination File.expand_path("../../tmp", __FILE__)
     setup :prepare_destination
 
+    test "all files are properly created" do
+      with_rails_version :MAJOR => 3, :MINOR => 0 do
+        run_generator %w(monster)
+        assert_file "app/models/monster.rb", /devise/, /attr_accessible (:[a-z_]+(, )?)+/
+        assert_migration "db/migrate/devise_create_monsters.rb", /def self\.up/
+      end
+    end
+
     test "all files are properly created with rails31 migration syntax" do
-      run_generator %w(monster)
-      assert_file "app/models/monster.rb", /devise/, /attr_accessible (:[a-z_]+(, )?)+/
-      assert_migration "db/migrate/devise_create_monsters.rb", /def change/
+      with_rails_version :MAJOR => 3, :MINOR => 1 do
+        run_generator %w(monster)
+        assert_file "app/models/monster.rb", /devise/, /attr_accessible (:[a-z_]+(, )?)+/
+        assert_migration "db/migrate/devise_create_monsters.rb", /def change/
+      end
     end
 
     test "update model migration when model exists" do

test/generators/views_generator_test.rb

@@ -46,7 +46,7 @@ class ViewsGeneratorTest < Rails::Generators::TestCase
     assert_file "app/views/#{scope}/registrations/new.html.erb"
     assert_file "app/views/#{scope}/registrations/edit.html.erb"
     assert_file "app/views/#{scope}/sessions/new.html.erb"
+    assert_file "app/views/#{scope}/shared/_links.erb"
     assert_file "app/views/#{scope}/unlocks/new.html.erb"
-    assert_file "app/views/#{scope}/_links.erb"
   end
 end

test/integration/authenticatable_test.rb

@@ -407,10 +407,7 @@ class AuthenticationOthersTest < ActionController::IntegrationTest
 
   test 'sign in stub in xml format' do
     get new_user_session_path(:format => 'xml')
-    assert_match '<?xml version="1.0" encoding="UTF-8"?>', response.body
-    assert_match /<user>.*<\/user>/m, response.body
-    assert_match '<email></email>', response.body
-    assert_match '<password nil="true"></password>', response.body
+    assert_equal "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<user>\n  <email></email>\n  <password nil=\"true\"/>\n</user>\n", response.body
   end
 
   test 'sign in stub in json format' do
@@ -435,6 +432,12 @@ class AuthenticationOthersTest < ActionController::IntegrationTest
     assert_not warden.authenticated?(:admin)
   end
 
+  test 'uses the mapping from nested devise_for call' do
+    sign_in_as_user :visit => "/devise_for/sign_in"
+    assert warden.authenticated?(:user)
+    assert_not warden.authenticated?(:admin)
+  end
+
   test 'sign in with xml format returns xml response' do
     create_user
     post user_session_path(:format => 'xml'), :user => {:email => "user@test.com", :password => '123456'}

test/integration/confirmable_test.rb

@@ -98,7 +98,7 @@ class ConfirmationTest < ActionController::IntegrationTest
   end
 
   test 'not confirmed user with setup to block without confirmation should not be able to sign in' do
-    swap Devise, :allow_unconfirmed_access_for => 0.days do
+    swap Devise, :confirm_within => 0.days do
       sign_in_as_user(:confirm => false)
 
       assert_contain 'You have to confirm your account before continuing'
@@ -107,7 +107,7 @@ class ConfirmationTest < ActionController::IntegrationTest
   end
 
   test 'not confirmed user should not see confirmation message if invalid credentials are given' do
-    swap Devise, :allow_unconfirmed_access_for => 0.days do
+    swap Devise, :confirm_within => 0.days do
       sign_in_as_user(:confirm => false) do
         fill_in 'password', :with => 'invalid'
       end
@@ -118,7 +118,7 @@ class ConfirmationTest < ActionController::IntegrationTest
   end
 
   test 'not confirmed user but configured with some days to confirm should be able to sign in' do
-    swap Devise, :allow_unconfirmed_access_for => 1.day do
+    swap Devise, :confirm_within => 1.day do
       sign_in_as_user(:confirm => false)
 
       assert_response :success
@@ -201,55 +201,3 @@ class ConfirmationTest < ActionController::IntegrationTest
     end
   end
 end
-
-class ConfirmationOnChangeTest < ActionController::IntegrationTest
-  def create_second_admin(options={})
-    @admin = nil
-    create_admin(options)
-  end
-
-  def visit_admin_confirmation_with_token(confirmation_token)
-    visit admin_confirmation_path(:confirmation_token => confirmation_token)
-  end
-
-  test 'admin should be able to request a new confirmation after email changed' do
-    admin = create_admin
-    admin.update_attributes(:email => 'new_test@example.com')
-
-    visit new_admin_session_path
-    click_link "Didn't receive confirmation instructions?"
-
-    fill_in 'email', :with => admin.unconfirmed_email
-    assert_difference "ActionMailer::Base.deliveries.size" do
-      click_button 'Resend confirmation instructions'
-    end
-
-    assert_current_url '/admin_area/sign_in'
-    assert_contain 'You will receive an email with instructions about how to confirm your account in a few minutes'
-  end
-
-  test 'admin with valid confirmation token should be able to confirm email after email changed' do
-    admin = create_admin
-    admin.update_attributes(:email => 'new_test@example.com')
-    assert_equal 'new_test@example.com', admin.unconfirmed_email
-    visit_admin_confirmation_with_token(admin.confirmation_token)
-
-    assert_contain 'Your account was successfully confirmed.'
-    assert_current_url '/admin_area/home'
-    assert admin.reload.confirmed?
-    assert_not admin.reload.pending_reconfirmation?
-  end
-
-  test 'admin email should be unique also within unconfirmed_email' do
-    admin = create_admin
-    admin.update_attributes(:email => 'new_admin_test@example.com')
-    assert_equal 'new_admin_test@example.com', admin.unconfirmed_email
-
-    create_second_admin(:email => "new_admin_test@example.com")
-
-    visit_admin_confirmation_with_token(admin.confirmation_token)
-    assert_have_selector '#error_explanation'
-    assert_contain /Email.*already.*taken/
-    assert admin.reload.pending_reconfirmation?
-  end
-end

test/integration/http_authenticatable_test.rb

@@ -4,7 +4,7 @@ class HttpAuthenticationTest < ActionController::IntegrationTest
   test 'handles unverified requests gets rid of caches but continues signed in' do
     swap UsersController, :allow_forgery_protection => true do
       create_user
-      post exhibit_user_url(1), {}, "HTTP_AUTHORIZATION" => "Basic #{Base64.encode64("user@test.com:123456")}"
+      post exhibit_user_url(1), {}, "HTTP_AUTHORIZATION" => "Basic #{ActiveSupport::Base64.encode64("user@test.com:123456")}"
       assert warden.authenticated?(:user)
       assert_equal "User is authenticated", response.body
     end
@@ -12,24 +12,9 @@ class HttpAuthenticationTest < ActionController::IntegrationTest
 
   test 'sign in should authenticate with http' do
     sign_in_as_new_user_with_http
-    assert_response 200
+    assert_response :success
     assert_match '<email>user@test.com</email>', response.body
     assert warden.authenticated?(:user)
-
-    get users_path(:format => :xml)
-    assert_response 200
-  end
-
-  test 'sign in should authenticate with http but not emit a cookie if skipping session storage' do
-    swap Devise, :skip_session_storage => [:http_auth] do
-      sign_in_as_new_user_with_http
-      assert_response 200
-      assert_match '<email>user@test.com</email>', response.body
-      assert warden.authenticated?(:user)
-
-      get users_path(:format => :xml)
-      assert_response 401
-    end
   end
 
   test 'returns a custom response with www-authenticate header on failures' do
@@ -74,7 +59,7 @@ class HttpAuthenticationTest < ActionController::IntegrationTest
     token = "token_containing_so_many_characters_that_the_base64_encoding_will_wrap"
     user = create_user
     user.update_attribute :authentication_token, token
-    get users_path(:format => :xml), {}, "HTTP_AUTHORIZATION" => "Basic #{Base64.encode64("#{token}:x")}"
+    get users_path(:format => :xml), {}, "HTTP_AUTHORIZATION" => "Basic #{ActiveSupport::Base64.encode64("#{token}:x")}"
     assert_response :success
     assert_match "<email>user@test.com</email>", response.body
     assert warden.authenticated?(:user)
@@ -84,14 +69,14 @@ class HttpAuthenticationTest < ActionController::IntegrationTest
 
     def sign_in_as_new_user_with_http(username="user@test.com", password="123456")
       user = create_user
-      get users_path(:format => :xml), {}, "HTTP_AUTHORIZATION" => "Basic #{Base64.encode64("#{username}:#{password}")}"
+      get users_path(:format => :xml), {}, "HTTP_AUTHORIZATION" => "Basic #{ActiveSupport::Base64.encode64("#{username}:#{password}")}"
       user
     end
 
     # Sign in with oauth2 token. This is just to test that it isn't misinterpreted as basic authentication
     def add_oauth2_header
       user = create_user
-      get users_path(:format => :xml), {}, "HTTP_AUTHORIZATION" => "OAuth #{Base64.encode64("#{user.email}:123456")}"
+      get users_path(:format => :xml), {}, "HTTP_AUTHORIZATION" => "OAuth #{ActiveSupport::Base64.encode64("#{user.email}:123456")}"
     end
 
 end

test/integration/lockable_test.rb

@@ -80,15 +80,22 @@ class LockTest < ActionController::IntegrationTest
 
     visit_user_unlock_with_token(user.unlock_token)
 
-    assert_current_url "/users/sign_in"
-    assert_contain 'Your account has been unlocked successfully. Please sign in to continue.'
+    assert_current_url '/'
+    assert_contain 'Your account was successfully unlocked.'
 
     assert_not user.reload.access_locked?
   end
 
-  test "redirect user to sign in page after unlocking its account" do
+  test "sign in user automatically after unlocking its account" do
     user = create_user(:locked => true)
     visit_user_unlock_with_token(user.unlock_token)
+    assert warden.authenticated?(:user)
+  end
+
+  test "user should not be able to sign in when locked" do
+    user = sign_in_as_user(:locked => true)
+    assert_template 'sessions/new'
+    assert_contain 'Your account is locked.'
     assert_not warden.authenticated?(:user)
   end
 
@@ -106,29 +113,10 @@ class LockTest < ActionController::IntegrationTest
 
   test 'error message is configurable by resource name' do
     store_translations :en, :devise => {
-        :failure => {:user => {:locked => "You are locked!"}}
+      :failure => { :user => { :locked => "You are locked!" } }
     } do
-
-      user = create_user(:locked => true)
-      user.failed_attempts = User.maximum_attempts + 1
-      user.save!
-
-      sign_in_as_user(:password => "invalid")
-      assert_contain "You are locked!"
-    end
-  end
-
-  test "user should not be able to sign in when locked" do
-    store_translations :en, :devise => {
-        :failure => {:user => {:locked => "You are locked!"}}
-    } do
-
-      user = create_user(:locked => true)
-      user.failed_attempts = User.maximum_attempts + 1
-      user.save!
-
-      sign_in_as_user(:password => "123456")
-      assert_contain "You are locked!"
+      user = sign_in_as_user(:locked => true)
+      assert_contain 'You are locked!'
     end
   end
 
@@ -169,7 +157,7 @@ class LockTest < ActionController::IntegrationTest
 
   test "when using json to ask a unlock request, should not return the user" do
     user = create_user(:locked => true)
-    post user_unlock_path(:format => "json", :user => {:email => user.email})
+    post  user_unlock_path(:format => "json", :user => {:email => user.email})
     assert_response :success
     assert_equal response.body, {}.to_json
   end

test/integration/registerable_test.rb

@@ -13,7 +13,7 @@ class RegistrationTest < ActionController::IntegrationTest
     fill_in 'password confirmation', :with => 'new_user123'
     click_button 'Sign up'
 
-    assert_contain 'You have signed up successfully'
+    assert_contain 'Welcome! You have signed up successfully.'
     assert warden.authenticated?(:admin)
     assert_current_url "/admin_area/home"
 
@@ -50,7 +50,7 @@ class RegistrationTest < ActionController::IntegrationTest
   test 'a guest user should be able to sign up successfully and be blocked by confirmation' do
     user_sign_up
 
-    assert_contain 'A message with a confirmation link has been sent to your email address. Please open the link to activate your account.'
+    assert_contain 'You have signed up successfully. However, we could not sign you in because your account is unconfirmed.'
     assert_not_contain 'You have to confirm your account before continuing'
     assert_current_url "/"
 
@@ -291,34 +291,3 @@ class RegistrationTest < ActionController::IntegrationTest
     assert_equal User.count, 0
   end
 end
-
-class ReconfirmableRegistrationTest < ActionController::IntegrationTest
-  test 'a signed in admin should see a more appropriate flash message when editing his account if reconfirmable is enabled' do
-    sign_in_as_admin
-    get edit_admin_registration_path
-
-    fill_in 'email', :with => 'admin.new@example.com'
-    fill_in 'current password', :with => '123456'
-    click_button 'Update'
-
-    assert_current_url '/admin_area/home'
-    assert_contain 'but we need to verify your new email address'
-
-    assert_equal "admin.new@example.com", Admin.first.unconfirmed_email
-  end
-
-  test 'a signed in admin should not see a reconfirmation message if they did not change their password' do
-    sign_in_as_admin
-    get edit_admin_registration_path
-
-    fill_in 'password', :with => 'pas123'
-    fill_in 'password confirmation', :with => 'pas123'
-    fill_in 'current password', :with => '123456'
-    click_button 'Update'
-
-    assert_current_url '/admin_area/home'
-    assert_contain 'You updated your account successfully.'
-
-    assert Admin.first.valid_password?('pas123')
-  end
-end

test/integration/rememberable_test.rb

@@ -9,6 +9,14 @@ class RememberMeTest < ActionController::IntegrationTest
     user
   end
 
+  def create_admin_and_remember
+    admin = create_admin
+    admin.remember_me!
+    raw_cookie = Admin.serialize_into_cookie(admin)
+    cookies['remember_admin_token'] = generate_signed_cookie(raw_cookie)
+    admin
+  end
+
   def generate_signed_cookie(raw_cookie)
     request = ActionDispatch::TestRequest.new
     request.cookie_jar.signed['raw_cookie'] = raw_cookie
@@ -109,6 +117,34 @@ class RememberMeTest < ActionController::IntegrationTest
     end
   end
 
+  test 'if both extend_remember_period and remember_across_browsers are true, sends the same token with a new expire date' do
+    swap Devise, :remember_across_browsers => true, :extend_remember_period => true, :remember_for => 1.year do
+      admin = create_admin_and_remember
+      token = admin.remember_token
+
+      admin.remember_created_at = old = 10.minutes.ago
+      admin.save!
+
+      get root_path
+      assert (cookie_expires("remember_admin_token") - 1.year) > (old + 5.minutes)
+      assert_equal token, signed_cookie("remember_admin_token").last
+    end
+  end
+
+  test 'if both extend_remember_period and remember_across_browsers are false, sends a new token with old expire date' do
+    swap Devise, :remember_across_browsers => false, :extend_remember_period => false, :remember_for => 1.year do
+      admin = create_admin_and_remember
+      token = admin.remember_token
+
+      admin.remember_created_at = old = 10.minutes.ago
+      admin.save!
+
+      get root_path
+      assert (cookie_expires("remember_admin_token") - 1.year) < (old + 5.minutes)
+      assert_not_equal token, signed_cookie("remember_admin_token").last
+    end
+  end
+
   test 'do not remember other scopes' do
     user = create_user_and_remember
     get root_path
@@ -146,6 +182,20 @@ class RememberMeTest < ActionController::IntegrationTest
     assert_not warden.authenticated?(:user)
   end
 
+  test 'do not remember the admin anymore after forget' do
+    admin = create_admin_and_remember
+    get root_path
+    assert warden.authenticated?(:admin)
+
+    get destroy_admin_session_path
+    assert_not warden.authenticated?(:admin)
+    assert_nil admin.reload.remember_token
+    assert_nil warden.cookies['remember_admin_token']
+
+    get root_path
+    assert_not warden.authenticated?(:admin)
+  end
+
   test 'changing user password expires remember me token' do
     user = create_user_and_remember
     user.password = "another_password"

test/integration/timeoutable_test.rb

@@ -41,7 +41,7 @@ class SessionTimeoutTest < ActionController::IntegrationTest
     assert_not_nil last_request_at
 
     get users_path
-    assert_redirected_to users_path
+    assert_redirected_to new_user_session_path
     assert_not warden.authenticated?(:user)
   end
 
@@ -68,25 +68,12 @@ class SessionTimeoutTest < ActionController::IntegrationTest
 
       get expire_user_path(user)
       get users_path
-      assert_redirected_to users_path
+      assert_redirected_to new_user_session_path
       assert_not warden.authenticated?(:user)
     end
   end
 
   test 'error message with i18n' do
-    store_translations :en, :devise => {
-      :failure => { :user => { :timeout => 'Session expired!' } }
-    } do
-      user = sign_in_as_user
-
-      get expire_user_path(user)
-      get root_path
-      follow_redirect!
-      assert_contain 'Session expired!'
-    end
-  end
-
-  test 'error message with i18n with double redirect' do
     store_translations :en, :devise => {
       :failure => { :user => { :timeout => 'Session expired!' } }
     } do
@@ -95,16 +82,15 @@ class SessionTimeoutTest < ActionController::IntegrationTest
       get expire_user_path(user)
       get users_path
       follow_redirect!
-      follow_redirect!
       assert_contain 'Session expired!'
     end
   end
-
+  
   test 'time out not triggered if remembered' do
     user = sign_in_as_user :remember_me => true
     get expire_user_path(user)
     assert_not_nil last_request_at
-
+    
     get users_path
     assert_response :success
     assert warden.authenticated?(:user)

test/integration/token_authenticatable_test.rb

@@ -25,7 +25,7 @@ class TokenAuthenticationTest < ActionController::IntegrationTest
   end
 
   test 'authenticate with valid authentication token key but does not store if stateless' do
-    swap Devise, :token_authentication_key => :secret_token, :skip_session_storage => [:token_auth] do
+    swap Devise, :token_authentication_key => :secret_token, :stateless_token => true do
       sign_in_as_new_user_with_token
       assert warden.authenticated?(:user)
 
@@ -88,7 +88,7 @@ class TokenAuthenticationTest < ActionController::IntegrationTest
   end
 
   test 'authenticate with valid authentication token key and do not store if stateless and timeoutable are enabled' do
-    swap Devise, :token_authentication_key => :secret_token, :skip_session_storage => [:token_auth], :timeout_in => (0.1).second do
+    swap Devise, :token_authentication_key => :secret_token, :stateless_token => true, :timeout_in => (0.1).second do
       user = sign_in_as_new_user_with_token
       assert warden.authenticated?(:user)
 
@@ -112,7 +112,7 @@ class TokenAuthenticationTest < ActionController::IntegrationTest
 
       assert_not_equal user1, user2
       visit users_path(Devise.token_authentication_key.to_s + '[$ne]' => user1.authentication_token)
-      assert_nil warden.user(:user)
+      assert_nil warden.user(:user) 
     end
   end
 
@@ -125,7 +125,7 @@ class TokenAuthenticationTest < ActionController::IntegrationTest
       options[:auth_token]     ||= user.authentication_token
 
       if options[:http_auth]
-        header = "Basic #{Base64.encode64("#{VALID_AUTHENTICATION_TOKEN}:X")}"
+        header = "Basic #{ActiveSupport::Base64.encode64("#{VALID_AUTHENTICATION_TOKEN}:X")}"
         get users_path(:format => :xml), {}, "HTTP_AUTHORIZATION" => header
       else
         visit users_path(options[:auth_token_key].to_sym => options[:auth_token])
@@ -145,4 +145,4 @@ class TokenAuthenticationTest < ActionController::IntegrationTest
       sign_in_as_new_user_with_token(:user => user)
     end
 
-end
+end

test/integration/trackable_test.rb

@@ -36,11 +36,11 @@ class TrackableHooksTest < ActionController::IntegrationTest
     assert_equal "127.0.0.1", user.current_sign_in_ip
     assert_equal "127.0.0.1", user.last_sign_in_ip
   end
-
+  
   test "current remote ip returns original ip behind a non transparent proxy" do
     user = create_user
-
-    arbitrary_ip = '200.121.1.69'
+    
+    arbitrary_ip = '192.168.1.69'
     sign_in_as_user do
       header 'HTTP_X_FORWARDED_FOR', arbitrary_ip
     end
@@ -63,7 +63,7 @@ class TrackableHooksTest < ActionController::IntegrationTest
   end
 
   test "does not update anything if user has signed out along the way" do
-    swap Devise, :allow_unconfirmed_access_for => 0 do
+    swap Devise, :confirm_within => 0 do
       user = create_user(:confirm => false)
       sign_in_as_user
 
@@ -72,7 +72,7 @@ class TrackableHooksTest < ActionController::IntegrationTest
       assert_nil user.last_sign_in_at
     end
   end
-
+  
   test "do not track if devise.skip_trackable is set" do
     user = create_user
     sign_in_as_user do
@@ -81,7 +81,7 @@ class TrackableHooksTest < ActionController::IntegrationTest
     user.reload
     assert_equal 0, user.sign_in_count
     visit destroy_user_session_path
-
+    
     sign_in_as_user do
       header 'devise.skip_trackable', false
     end

test/mapping_test.rb

@@ -51,12 +51,12 @@ class MappingTest < ActiveSupport::TestCase
 
   test 'has strategies depending on the model declaration' do
     assert_equal [:rememberable, :token_authenticatable, :database_authenticatable], Devise.mappings[:user].strategies
-    assert_equal [:database_authenticatable], Devise.mappings[:admin].strategies
+    assert_equal [:rememberable, :database_authenticatable], Devise.mappings[:admin].strategies
   end
 
   test 'has no input strategies depending on the model declaration' do
     assert_equal [:rememberable, :token_authenticatable], Devise.mappings[:user].no_input_strategies
-    assert_equal [], Devise.mappings[:admin].no_input_strategies
+    assert_equal [:rememberable], Devise.mappings[:admin].no_input_strategies
   end
 
   test 'find scope for a given object' do
@@ -108,6 +108,7 @@ class MappingTest < ActiveSupport::TestCase
     assert mapping.authenticatable?
     assert mapping.recoverable?
     assert mapping.lockable?
+    assert_not mapping.confirmable?
     assert_not mapping.omniauthable?
   end
   

test/models/authenticatable_test.rb

@@ -0,0 +1,9 @@
+require 'test_helper'
+
+class AuthenticatableTest < ActiveSupport::TestCase
+  test 'find_first_by_auth_conditions allows custom filtering parameters' do
+    user = User.create!(:email => "example@example.com", :password => "123456")
+    assert_equal User.find_first_by_auth_conditions({ :email => "example@example.com" }), user
+    assert_equal User.find_first_by_auth_conditions({ :email => "example@example.com" }, :id => user.id + 1), nil
+  end
+end

test/models/confirmable_test.rb

@@ -80,8 +80,8 @@ class ConfirmableTest < ActiveSupport::TestCase
   end
 
   test 'should send confirmation instructions by email' do
-    assert_email_sent "mynewuser@example.com" do
-      create_user :email => "mynewuser@example.com"
+    assert_email_sent do
+      create_user
     end
   end
 
@@ -123,7 +123,7 @@ class ConfirmableTest < ActiveSupport::TestCase
 
   test 'should send email instructions for the user confirm its email' do
     user = create_user
-    assert_email_sent user.email do
+    assert_email_sent do
       User.send_confirmation_instructions(:email => user.email)
     end
   end
@@ -164,19 +164,19 @@ class ConfirmableTest < ActiveSupport::TestCase
   end
 
   test 'confirm time should fallback to devise confirm in default configuration' do
-    swap Devise, :allow_unconfirmed_access_for => 1.day do
+    swap Devise, :confirm_within => 1.day do
       user = new_user
       user.confirmation_sent_at = 2.days.ago
       assert_not user.active_for_authentication?
 
-      Devise.allow_unconfirmed_access_for = 3.days
+      Devise.confirm_within = 3.days
       assert user.active_for_authentication?
     end
   end
 
   test 'should be active when confirmation sent at is not overpast' do
-    swap Devise, :allow_unconfirmed_access_for => 5.days do
-      Devise.allow_unconfirmed_access_for = 5.days
+    swap Devise, :confirm_within => 5.days do
+      Devise.confirm_within = 5.days
       user = create_user
 
       user.confirmation_sent_at = 4.days.ago
@@ -198,7 +198,7 @@ class ConfirmableTest < ActiveSupport::TestCase
   end
 
   test 'should not be active when confirm in is zero' do
-    Devise.allow_unconfirmed_access_for = 0.days
+    Devise.confirm_within = 0.days
     user = create_user
     user.confirmation_sent_at = Date.today
     assert_not user.active_for_authentication?
@@ -236,96 +236,3 @@ class ConfirmableTest < ActiveSupport::TestCase
     end
   end
 end
-
-class ReconfirmableTest < ActiveSupport::TestCase
-  test 'should not worry about validations on confirm even with reconfirmable' do
-    admin = create_admin
-    admin.reset_password_token = "a"
-    assert admin.confirm!
-  end
-
-  test 'should generate confirmation token after changing email' do
-    admin = create_admin
-    assert admin.confirm!
-    assert_nil admin.confirmation_token
-    assert admin.update_attributes(:email => 'new_test@example.com')
-    assert_not_nil admin.confirmation_token
-  end
-
-  test 'should regenerate confirmation token after changing email' do
-    admin = create_admin
-    assert admin.confirm!
-    assert admin.update_attributes(:email => 'old_test@example.com')
-    token = admin.confirmation_token
-    assert admin.update_attributes(:email => 'new_test@example.com')
-    assert_not_equal token, admin.confirmation_token
-  end
-
-  test 'should send confirmation instructions by email after changing email' do
-    admin = create_admin
-    assert admin.confirm!
-    assert_email_sent "new_test@example.com" do
-      assert admin.update_attributes(:email => 'new_test@example.com')
-    end
-  end
-
-  test 'should not send confirmation by email after changing password' do
-    admin = create_admin
-    assert admin.confirm!
-    assert_email_not_sent do
-      assert admin.update_attributes(:password => 'newpass', :password_confirmation => 'newpass')
-    end
-  end
-
-  test 'should stay confirmed when email is changed' do
-    admin = create_admin
-    assert admin.confirm!
-    assert admin.update_attributes(:email => 'new_test@example.com')
-    assert admin.confirmed?
-  end
-
-  test 'should update email only when it is confirmed' do
-    admin = create_admin
-    assert admin.confirm!
-    assert admin.update_attributes(:email => 'new_test@example.com')
-    assert_not_equal 'new_test@example.com', admin.email
-    assert admin.confirm!
-    assert_equal 'new_test@example.com', admin.email
-  end
-
-  test 'should not allow admin to get past confirmation email by resubmitting their new address' do
-    admin = create_admin
-    assert admin.confirm!
-    assert admin.update_attributes(:email => 'new_test@example.com')
-    assert_not_equal 'new_test@example.com', admin.email
-    assert admin.update_attributes(:email => 'new_test@example.com')
-    assert_not_equal 'new_test@example.com', admin.email
-  end
-
-  test 'should find a admin by send confirmation instructions with unconfirmed_email' do
-    admin = create_admin
-    assert admin.confirm!
-    assert admin.update_attributes(:email => 'new_test@example.com')
-    confirmation_admin = Admin.send_confirmation_instructions(:email => admin.unconfirmed_email)
-    assert_equal confirmation_admin, admin
-  end
-
-  test 'should return a new admin if no email or unconfirmed_email was found' do
-    confirmation_admin = Admin.send_confirmation_instructions(:email => "invalid@email.com")
-    assert_not confirmation_admin.persisted?
-  end
-
-  test 'should add error to new admin email if no email or unconfirmed_email was found' do
-    confirmation_admin = Admin.send_confirmation_instructions(:email => "invalid@email.com")
-    assert confirmation_admin.errors[:email]
-    assert_equal "not found", confirmation_admin.errors[:email].join
-  end
-
-  test 'should find admin with email in unconfirmed_emails' do
-    admin = create_admin
-    admin.unconfirmed_email = "new_test@email.com"
-    assert admin.save
-    admin = Admin.find_by_unconfirmed_email_with_errors(:email => "new_test@email.com")
-    assert admin.persisted?
-  end
-end

test/models/database_authenticatable_test.rb

@@ -11,7 +11,7 @@ class DatabaseAuthenticatableTest < ActiveSupport::TestCase
     user.save!
     assert_equal email.downcase, user.email
   end
-  
+
   test 'should remove whitespace from strip whitespace keys when saving' do
     # strip_whitespace_keys is set to :email by default.
     email = ' foo@bar.com '
@@ -23,15 +23,9 @@ class DatabaseAuthenticatableTest < ActiveSupport::TestCase
   end
 
   test "param filter should not convert booleans and integer to strings" do
-    conditions = { 'login' => 'foo@bar.com', "bool1" => true, "bool2" => false, "fixnum" => 123, "will_be_converted" => (1..10) }
+    conditions = { "login" => "foo@bar.com", "bool1" => true, "bool2" => false, "fixnum" => 123, "will_be_converted" => (1..10) }
     conditions = Devise::ParamFilter.new([], []).filter(conditions)
-    assert_equal( { 'login' => 'foo@bar.com', "bool1" => true, "bool2" => false, "fixnum" => 123, "will_be_converted" => "1..10" }, conditions)
-  end
-
-  test "param filter should not convert regular expressions to strings" do
-    conditions = { "regexp" => /expression/ }
-    conditions = Devise::ParamFilter.new([], []).filter(conditions)
-    assert_equal( { "regexp" => /expression/ }, conditions)
+    assert_equal( { "login" => "foo@bar.com", "bool1" => "true", "bool2" => "false", "fixnum" => "123", "will_be_converted" => "1..10" }, conditions)
   end
 
   test 'should respond to password and password confirmation' do
@@ -92,14 +86,14 @@ class DatabaseAuthenticatableTest < ActiveSupport::TestCase
       :password => 'pass321', :password_confirmation => 'pass321')
     assert user.reload.valid_password?('pass321')
   end
-  
+
   test 'should update password with valid current password and :as option' do
     user = create_user
     assert user.update_with_password(:current_password => '123456',
       :password => 'pass321', :password_confirmation => 'pass321', :as => :admin)
     assert user.reload.valid_password?('pass321')
   end
-  
+
   test 'should add an error to current password when it is invalid' do
     user = create_user
     assert_not user.update_with_password(:current_password => 'other',
@@ -151,7 +145,7 @@ class DatabaseAuthenticatableTest < ActiveSupport::TestCase
     user.update_without_password(:email => 'new@example.com')
     assert_equal 'new@example.com', user.email
   end
-  
+
   test 'should update the user without password with :as option' do
     user = create_user
     user.update_without_password(:email => 'new@example.com', :as => :admin)

test/models/encryptable_test.rb

@@ -31,7 +31,7 @@ class EncryptableTest < ActiveSupport::TestCase
 
   test 'should generate a base64 hash using SecureRandom for password salt' do
     swap_with_encryptor Admin, :sha1 do
-      SecureRandom.expects(:base64).with(15).returns('01lI').twice
+      SecureRandom.expects(:base64).with(15).returns('01lI')
       salt = create_admin.password_salt
       assert_not_equal '01lI', salt
       assert_equal 4, salt.size

test/models/lockable_test.rb

@@ -23,19 +23,6 @@ class LockableTest < ActiveSupport::TestCase
     assert_equal 0, user.reload.failed_attempts
   end
 
-  test "should increment failed_attempts on successfull validation if the user is already locked" do
-    user = create_user
-    user.confirm!
-
-    swap Devise, :maximum_attempts => 2 do
-      3.times { user.valid_for_authentication?{ false } }
-      assert user.reload.access_locked?
-    end
-
-    user.valid_for_authentication?{ true }
-    assert_equal 4, user.reload.failed_attempts
-  end
-
   test "should not touch failed_attempts if lock_strategy is none" do
     user = create_user
     user.confirm!

test/models/recoverable_test.rb

@@ -195,4 +195,31 @@ class RecoverableTest < ActiveSupport::TestCase
       assert_equal "has expired, please request a new one", reset_password_user.errors[:reset_password_token].join
     end
   end
+
+  test 'should save the model when the reset_password_sent_at doesnt exist' do
+    user = create_user
+    def user.respond_to?(meth, *)
+      if meth == :reset_password_sent_at=
+        false
+      else
+        super
+      end
+    end
+    user.send_reset_password_instructions
+    user.reload
+    assert_not_nil user.reset_password_token
+  end
+
+  test 'should have valid period if does not respond to reset_password_sent_at' do
+    user = create_user
+    def user.respond_to?(meth, *)
+      if meth == :reset_password_sent_at
+        false
+      else
+        super
+      end
+    end
+    assert user.reset_password_period_valid?
+  end
+
 end

test/models/rememberable_test.rb

@@ -1,46 +1,7 @@
 require 'test_helper'
 
-class RememberableTest < ActiveSupport::TestCase
-  def resource_class
-    User
-  end
-
-  def create_resource
-    create_user
-  end
-
-  test 'remember_me should not generate a new token if using salt' do
-    user = create_user
-    user.expects(:valid?).never
-    user.remember_me!
-  end
-
-  test 'forget_me should not clear remember token if using salt' do
-    user = create_user
-    user.remember_me!
-    user.expects(:valid?).never
-    user.forget_me!
-  end
-
-  test 'serialize into cookie' do
-    user = create_user
-    user.remember_me!
-    assert_equal [user.to_key, user.authenticatable_salt], User.serialize_into_cookie(user)
-  end
-
-  test 'serialize from cookie' do
-    user = create_user
-    user.remember_me!
-    assert_equal user, User.serialize_from_cookie(user.to_key, user.authenticatable_salt)
-  end
-
-  test 'raises a RuntimeError if authenticatable_salt is nil' do
-    user = User.new
-    user.encrypted_password = nil
-    assert_raise RuntimeError do
-      user.rememberable_value
-    end
-  end
+module SharedRememberableTest
+  extend ActiveSupport::Testing::Declarative
 
   test 'should respond to remember_me attribute' do
     assert resource_class.new.respond_to?(:remember_me)
@@ -166,3 +127,161 @@ class RememberableTest < ActiveSupport::TestCase
     end
   end
 end
+
+class RememberableTest < ActiveSupport::TestCase
+  include SharedRememberableTest
+
+  def resource_class
+    Admin
+  end
+
+  def create_resource
+    create_admin
+  end
+
+  test 'remember_me should generate a new token and save the record without validating' do
+    admin = create_admin
+    admin.expects(:valid?).never
+    token = admin.remember_token
+    admin.remember_me!
+    assert_not_equal token, admin.remember_token
+    assert_not admin.changed?
+  end
+
+  test 'forget_me should clear remember token and save the record without validating' do
+    admin = create_admin
+    admin.remember_me!
+    assert_not admin.remember_token.nil?
+    admin.expects(:valid?).never
+    admin.forget_me!
+    assert admin.remember_token.nil?
+    assert_not admin.changed?
+  end
+
+  test 'serialize into cookie' do
+    admin = create_admin
+    admin.remember_me!
+    assert_equal [admin.to_key, admin.remember_token], Admin.serialize_into_cookie(admin)
+  end
+
+  test 'serialize from cookie' do
+    admin = create_admin
+    admin.remember_me!
+    assert_equal admin, Admin.serialize_from_cookie(admin.to_key, admin.remember_token)
+  end
+
+  test 'if remember_across_browsers is true, remember_me! should create a new token if no token exists' do
+    swap Devise, :remember_across_browsers => true, :remember_for => 1.year do
+      admin = create_admin
+      assert_equal nil, admin.remember_token
+      admin.remember_me!
+      assert_not_equal nil, admin.remember_token
+    end
+  end
+
+  test 'if remember_across_browsers is true, remember_me! should create a new token if a token exists but has expired' do
+    swap Devise, :remember_across_browsers => true, :remember_for => 1.day do
+      admin = create_admin
+      admin.remember_me!
+      admin.remember_created_at = 2.days.ago
+      admin.save
+      token = admin.remember_token
+      admin.remember_me!
+      assert_not_equal token, admin.remember_token
+    end
+  end
+
+  test 'if remember_across_browsers is true, remember_me! should not create a new token if a token exists and has not expired' do
+    swap Devise, :remember_across_browsers => true, :remember_for => 2.days do
+      admin = create_admin
+      admin.remember_me!
+      admin.remember_created_at = 1.day.ago
+      admin.save
+      token = admin.remember_token
+      admin.remember_me!
+      assert_equal token, admin.remember_token
+    end
+  end
+
+  test 'if remember_across_browsers is false, remember_me! should create a new token if no token exists' do
+    swap Devise, :remember_across_browsers => false do
+      admin = create_admin
+      assert_equal nil, admin.remember_token
+      admin.remember_me!
+      assert_not_equal nil, admin.remember_token
+    end
+  end
+
+  test 'if remember_across_browsers is false, remember_me! should create a new token if a token exists but has expired' do
+    swap Devise, :remember_across_browsers => false, :remember_for => 1.day do
+      admin = create_admin
+      admin.remember_me!
+      admin.remember_created_at = 2.days.ago
+      admin.save
+      token = admin.remember_token
+      admin.remember_me!
+      assert_not_equal token, admin.remember_token
+    end
+  end
+
+  test 'if remember_across_browsers is false, remember_me! should create a new token if a token exists and has not expired' do
+    swap Devise, :remember_across_browsers => false, :remember_for => 2.days do
+      admin = create_admin
+      admin.remember_me!
+      admin.remember_created_at = 1.day.ago
+      admin.save
+      token = admin.remember_token
+      admin.remember_me!
+      assert_not_equal token, admin.remember_token
+    end
+  end
+end
+
+class WithSaltRememberableTest < ActiveSupport::TestCase
+  include SharedRememberableTest
+
+  setup do
+    assert_not User.new.respond_to?(:remember_token)
+  end
+
+  def resource_class
+    User
+  end
+
+  def create_resource
+    create_user
+  end
+
+  test 'remember_me should not generate a new token if using salt' do
+    user = create_user
+    user.expects(:valid?).never
+    user.remember_me!
+  end
+
+  test 'forget_me should not clear remember token if using salt' do
+    user = create_user
+    user.remember_me!
+    user.expects(:valid?).never
+    user.forget_me!
+  end
+
+  test 'serialize into cookie' do
+    user = create_user
+    user.remember_me!
+    assert_equal [user.to_key, user.authenticatable_salt], User.serialize_into_cookie(user)
+  end
+
+  test 'serialize from cookie' do
+    user = create_user
+    user.remember_me!
+    assert_equal user, User.serialize_from_cookie(user.to_key, user.authenticatable_salt)
+  end
+
+  test 'raises a RuntimeError if authenticatable_salt is nil' do
+    user = User.new
+    user.encrypted_password = nil
+    assert_raise RuntimeError do
+      user.rememberable_value
+    end
+  end
+end

test/models/serializable_test.rb

@@ -16,7 +16,7 @@ class SerializableTest < ActiveSupport::TestCase
   end
 
   test 'should include unsafe keys on XML if a force_except is provided' do
-    assert_no_match /<email/, @user.to_xml(:force_except => :email)
+    assert_no_match /email/, @user.to_xml(:force_except => :email)
     assert_match /confirmation-token/, @user.to_xml(:force_except => :email)
   end
 

test/models_test.rb

@@ -2,7 +2,7 @@ require 'test_helper'
 
 class Configurable < User
   devise :database_authenticatable, :encryptable, :confirmable, :rememberable, :timeoutable, :lockable,
-         :stretches => 15, :pepper => 'abcdef', :allow_unconfirmed_access_for => 5.days,
+         :stretches => 15, :pepper => 'abcdef', :confirm_within => 5.days,
          :remember_for => 7.days, :timeout_in => 15.minutes, :unlock_in => 10.days
 end
 
@@ -39,7 +39,7 @@ class ActiveRecordTest < ActiveSupport::TestCase
   end
 
   test 'can cherry pick modules' do
-    assert_include_modules Admin, :database_authenticatable, :registerable, :timeoutable, :recoverable, :lockable, :encryptable, :confirmable
+    assert_include_modules Admin, :database_authenticatable, :registerable, :timeoutable, :recoverable, :lockable, :rememberable, :encryptable
   end
 
   test 'validations options are not applied too late' do
@@ -55,12 +55,12 @@ class ActiveRecordTest < ActiveSupport::TestCase
   end
 
   test 'chosen modules are inheritable' do
-    assert_include_modules Inheritable, :database_authenticatable, :registerable, :timeoutable, :recoverable, :lockable, :encryptable, :confirmable
+    assert_include_modules Inheritable, :database_authenticatable, :registerable, :timeoutable, :recoverable, :lockable, :rememberable, :encryptable
   end
 
   test 'order of module inclusion' do
-    correct_module_order   = [:database_authenticatable, :encryptable, :recoverable, :registerable, :confirmable, :lockable, :timeoutable]
-    incorrect_module_order = [:database_authenticatable, :timeoutable, :registerable, :recoverable, :lockable, :encryptable, :confirmable]
+    correct_module_order   = [:database_authenticatable, :rememberable, :encryptable, :recoverable, :registerable, :lockable, :timeoutable]
+    incorrect_module_order = [:database_authenticatable, :timeoutable, :registerable, :recoverable, :lockable, :encryptable, :rememberable]
 
     assert_include_modules Admin, *incorrect_module_order
 
@@ -87,8 +87,8 @@ class ActiveRecordTest < ActiveSupport::TestCase
     assert_equal 'abcdef', Configurable.pepper
   end
 
-  test 'set a default value for allow_unconfirmed_access_for' do
-    assert_equal 5.days, Configurable.allow_unconfirmed_access_for
+  test 'set a default value for confirm_within' do
+    assert_equal 5.days, Configurable.confirm_within
   end
 
   test 'set a default value for remember_for' do

test/rails_app/app/mongoid/admin.rb

@@ -5,26 +5,5 @@ class Admin
   include Shim
   include SharedAdmin
 
-  ## Database authenticatable
-  field :email,              :type => String, :null => true
-  field :encrypted_password, :type => String, :null => true
-
-  ## Recoverable
-  field :reset_password_token,   :type => String
-  field :reset_password_sent_at, :type => Time
-
-  ## Rememberable
-  field :remember_created_at, :type => Time
-
-  ## Confirmable
-  field :confirmation_token,   :type => String
-  field :confirmed_at,         :type => Time
-  field :confirmation_sent_at, :type => Time
-  field :unconfirmed_email,    :type => String # Only if using reconfirmable
-
-  ## Encryptable
-  field :password_salt, :type => String
-
-  ## Lockable
-  field :locked_at, :type => Time
+  field :remember_token, :type => String
 end

test/rails_app/app/mongoid/user.rb

@@ -7,39 +7,4 @@ class User
 
   field :username, :type => String
   field :facebook_token, :type => String
-
-  ## Database authenticatable
-  field :email,              :type => String, :null => false, :default => ""
-  field :encrypted_password, :type => String, :null => false, :default => ""
-
-  ## Recoverable
-  field :reset_password_token,   :type => String
-  field :reset_password_sent_at, :type => Time
-
-  ## Rememberable
-  field :remember_created_at, :type => Time
-
-  ## Trackable
-  field :sign_in_count,      :type => Integer, :default => 0
-  field :current_sign_in_at, :type => Time
-  field :last_sign_in_at,    :type => Time
-  field :current_sign_in_ip, :type => String
-  field :last_sign_in_ip,    :type => String
-
-  ## Encryptable
-  # field :password_salt, :type => String
-
-  ## Confirmable
-  field :confirmation_token,   :type => String
-  field :confirmed_at,         :type => Time
-  field :confirmation_sent_at, :type => Time
-  # field :unconfirmed_email,    :type => String # Only if using reconfirmable
-
-  ## Lockable
-  field :failed_attempts, :type => Integer, :default => 0 # Only if lock strategy is :failed_attempts
-  field :unlock_token,    :type => String # Only if unlock strategy is :email or :both
-  field :locked_at,       :type => Time
-
-  ## Token authenticatable
-  field :authentication_token, :type => String
 end

test/rails_app/config/initializers/devise.rb

@@ -12,9 +12,6 @@ Devise.setup do |config|
   # Configure the class responsible to send e-mails.
   # config.mailer = "Devise::Mailer"
 
-  # Disable apply schema
-  config.apply_schema = false
-
   # ==> ORM configuration
   # Load and configure the ORM. Supports :active_record (default) and
   # :mongoid (bson_ext recommended) by default. Other ORMs may be
@@ -63,16 +60,16 @@ Devise.setup do |config|
   # ==> Configuration for :database_authenticatable
   # For bcrypt, this is the cost for hashing the password and defaults to 10. If
   # using other encryptors, it sets how many times you want the password re-encrypted.
-  config.stretches = Rails.env.test? ? 1 : 10
+  config.stretches = 10
 
   # ==> Configuration for :confirmable
   # The time you want to give your user to confirm his account. During this time
   # he will be able to access your application without confirming. Default is nil.
-  # When allow_unconfirmed_access_for is zero, the user won't be able to sign in without confirming.
+  # When confirm_within is zero, the user won't be able to sign in without confirming.
   # You can use this to let your user access some features of your application
   # without confirming the account, but blocking it after a certain period
   # (ie 2 days).
-  # config.allow_unconfirmed_access_for = 2.days
+  # config.confirm_within = 2.days
 
   # Defines which key will be used when confirming an account
   # config.confirmation_keys = [ :email ]
@@ -151,6 +148,10 @@ Devise.setup do |config|
   # Defines name of the authentication token params key
   # config.token_authentication_key = :auth_token
 
+  # If true, authentication through token does not store user in session and needs
+  # to be supplied on each request. Useful if you are using the token as API token.
+  # config.stateless_token = false
+
   # ==> Scopes configuration
   # Turn scoped views on. Before rendering "sessions/new", it will first check for
   # "users/sessions/new". It's turned off by default because it's slower if you

test/rails_app/config/routes.rb

@@ -12,7 +12,9 @@ Rails.application.routes.draw do
   resources :admins, :only => [:index]
 
   # Users scope
-  devise_for :users, :controllers => { :omniauth_callbacks => "users/omniauth_callbacks" }
+  devise_for :users, :controllers => { :omniauth_callbacks => "users/omniauth_callbacks" } do
+    match "/devise_for/sign_in", :to => "devise/sessions#new"
+  end
 
   as :user do
     match "/as/sign_in", :to => "devise/sessions#new"
@@ -62,14 +64,14 @@ Rails.application.routes.draw do
     devise_for :accounts, :class_name => "Admin", :path_names => { :sign_in => "get_in" }
   end
 
-  scope ":locale", :module => :invalid do
+  scope ":locale" do
     devise_for :accounts, :singular => "manager", :class_name => "Admin",
       :path_names => {
         :sign_in => "login", :sign_out => "logout",
         :password => "secret", :confirmation => "verification",
         :unlock => "unblock", :sign_up => "register",
         :registration => "management", :cancel => "giveup"
-      }, :failure_app => lambda { |env| [404, {"Content-Type" => "text/plain"}, ["Oops, not found"]] }, :module => :devise
+      }, :failure_app => lambda { |env| [404, {"Content-Type" => "text/plain"}, ["Oops, not found"]] }
   end
 
   namespace :sign_out_via, :module => "devise" do

test/rails_app/db/migrate/20100401102949_create_tables.rb

@@ -4,68 +4,22 @@ class CreateTables < ActiveRecord::Migration
       t.string :username
       t.string :facebook_token
 
-      ## Database authenticatable
-      t.string :email,              :null => false, :default => ""
-      t.string :encrypted_password, :null => false, :default => ""
-
-      ## Recoverable
-      t.string   :reset_password_token
-      t.datetime :reset_password_sent_at
-
-      ## Rememberable
-      t.datetime :remember_created_at
-
-      ## Trackable
-      t.integer  :sign_in_count, :default => 0
-      t.datetime :current_sign_in_at
-      t.datetime :last_sign_in_at
-      t.string   :current_sign_in_ip
-      t.string   :last_sign_in_ip
-
-      ## Encryptable
-      # t.string :password_salt
-
-      ## Confirmable
-      t.string   :confirmation_token
-      t.datetime :confirmed_at
-      t.datetime :confirmation_sent_at
-      # t.string   :unconfirmed_email # Only if using reconfirmable
-
-      ## Lockable
-      t.integer  :failed_attempts, :default => 0 # Only if lock strategy is :failed_attempts
-      t.string   :unlock_token # Only if unlock strategy is :email or :both
-      t.datetime :locked_at
-
-      ## Token authenticatable
-      t.string :authentication_token
-
+      t.database_authenticatable :null => false
+      t.confirmable
+      t.recoverable
+      t.rememberable
+      t.trackable
+      t.lockable
+      t.token_authenticatable
       t.timestamps
     end
 
     create_table :admins do |t|
-      ## Database authenticatable
-      t.string :email,              :null => true
-      t.string :encrypted_password, :null => true
-
-      ## Recoverable
-      t.string   :reset_password_token
-      t.datetime :reset_password_sent_at
-
-      ## Rememberable
-      t.datetime :remember_created_at
-
-      ## Confirmable
-      t.string   :confirmation_token
-      t.datetime :confirmed_at
-      t.datetime :confirmation_sent_at
-      t.string   :unconfirmed_email # Only if using reconfirmable
-
-      ## Encryptable
-      t.string :password_salt
-
-      ## Lockable
-      t.datetime :locked_at
-
+      t.database_authenticatable :null => true
+      t.encryptable
+      t.rememberable :use_salt => false
+      t.recoverable
+      t.lockable
       t.timestamps
     end
   end

test/rails_app/lib/shared_admin.rb

@@ -3,12 +3,8 @@ module SharedAdmin
 
   included do
     devise :database_authenticatable, :encryptable, :registerable,
-           :timeoutable, :recoverable, :lockable, :confirmable,
-           :unlock_strategy => :time, :lock_strategy => :none,
-           :allow_unconfirmed_access_for => 2.weeks, :reconfirmable => true
-
-    validates_length_of     :reset_password_token, :minimum => 3, :allow_blank => true
-    validates_uniqueness_of :email, :allow_blank => true, :if => :email_changed?
+           :timeoutable, :recoverable, :rememberable, :lockable,
+           :unlock_strategy => :time
   end
 
 end

test/schema_test.rb

@@ -0,0 +1,33 @@
+if DEVISE_ORM == :mongoid
+
+  require 'test_helper'
+
+  class User2
+    include Mongoid::Document
+    devise :database_authenticatable
+  end
+
+  class User3
+    include Mongoid::Document
+    devise :database_authenticatable, :authentication_keys => [:username, :email]
+   end
+
+  class User4
+    include Mongoid::Document
+    devise :database_authenticatable, :authentication_keys => [:username]
+  end
+
+  class SchemaTest < ActiveSupport::TestCase
+    test 'should create an email field if there are no custom authentication keys' do
+      assert_not_equal User2.fields['email'], nil
+    end
+
+    test 'should create an email field if there are custom authentication keys and they include email' do
+      assert_not_equal User3.fields['email'], nil
+    end
+
+    test 'should not create an email field if there are custom authentication keys they don\'t include email' do
+      assert_equal User4.fields['email'], nil
+    end
+  end
+end

test/support/assertions.rb

@@ -14,11 +14,8 @@ class ActiveSupport::TestCase
   end
   alias :assert_present :assert_not_blank
 
-  def assert_email_sent(address = nil, &block)
+  def assert_email_sent(&block)
     assert_difference('ActionMailer::Base.deliveries.size') { yield }
-    if address.present?
-      assert_equal address, ActionMailer::Base.deliveries.last['to'].to_s
-    end
   end
 
   def assert_email_not_sent(&block)

test/support/helpers.rb

@@ -67,4 +67,21 @@ class ActiveSupport::TestCase
       end
     end
   end
+
+  def with_rails_version(constants)
+    saved_constants = {}
+
+    constants.each do |constant, val|
+      saved_constants[constant] = ::Rails::VERSION.const_get constant
+      Kernel::silence_warnings { ::Rails::VERSION.const_set(constant, val) }
+    end
+
+    begin
+      yield
+    ensure
+      constants.each do |constant, val|
+        Kernel::silence_warnings { ::Rails::VERSION.const_set(constant, saved_constants[constant]) }
+      end
+    end
+  end
 end