Release 2.0.6

Yes we still support Ruby 1.8 😢

Conflicts:
	Gemfile.lock

.gitignore

@@ -1,5 +1,5 @@
-**/*/log/*
-**/*/tmp/*
+test/rails_app/log/*
+test/rails_app/tmp/*
 *~
 coverage/*
 *.sqlite3

CHANGELOG.rdoc

@@ -1,40 +1,71 @@
-== 2.0.0.rc2
-
-Notes: https://github.com/plataformatec/devise/wiki/How-To:-Upgrade-to-Devise-2.0
+== 2.0.6
 
 * bug fix
-  * Fix incorrect message for locked account (by @jigyasa)
-  * Regenerate confirmation token on reconfirmation (by @nashby)
-  * Allow alternate ORMs to run compatibility setup code before Authenticatable is included (by @jm81)
-  * Do not run validations unless on reconfirmable branch
+  * Do not confirm account after reset password
+
+== 2.0.5
+
+* bug fix
+  * Require string conversion for all values
+
+== 2.0.4
+
+* bug fix
+  * Fix a regression that caused Warden to be initialized too late
+
+== 2.0.3 (yanked)
+
+* bug fix
+  * Ensure warning is not shown by mistake on apps with mounted engines
+  * Fixes related to remember_token and rememberable_options
+  * Ensure serializable_hash does not depend on accessible attributes
+  * Ensure that timeout callback does not run on sign out action
+
+== 2.0.2
 
 * enhancements
-  * Redirect to the previous URL on timeout
-  * Inherit from the same Devise parent controller (by @sj26)
-  * Allow parent_controller to be customizable via Devise.parent_controller, useful for engines
-  * Allow router_name to be customizable via Devise.router_name, useful for engines
+  * Add devise_i18n_options to customize I18n message
 
-* deprecation
-  * Move devise/shared/_links.erb to devise/_links.erb
-  * Devise only supports Rails 3.1 forward
-  * Deprecated support for nested devise_for blocks
-  * Deprecated support to devise.registrations.reasons and devise.registrations.inactive_signed_up in favor of devise.registrations.signed_up_but_*
+* bug fix
+  * Ensure Devise.available_router_name defaults to :main_app
+  * Set autocomplete to off for password on edit forms
+  * Better error messages in case a trackable model can't be saved
+  * Show a warning in case someone gives a pluralized name to devise generator
+  * Fix test behavior for rspec subject requests (by @sj26)
 
-== 2.0.0.rc
+== 2.0.1
+
+* enhancements
+  * Improved error messages on deprecation warnings
+  * Hide Devise's internal generators from `rails g` command
+
+* bug fix
+  * Removed tmp and log files from gem
+
+== 2.0.0
 
 * enhancements
   * Add support for e-mail reconfirmation on change (by @Mandaryn and @heimidal)
   * Redirect users to sign in page after unlock (by @nashby)
+  * Redirect to the previous URL on timeout
+  * Inherit from the same Devise parent controller (by @sj26)
+  * Allow parent_controller to be customizable via Devise.parent_controller, useful for engines
+  * Allow router_name to be customizable via Devise.router_name, useful for engines
+  * Allow alternate ORMs to run compatibility setup code before Authenticatable is included (by @jm81)
 
 * deprecation
-  * Devise.apply_schema is deprecated
-  * Devise migration helpers are deprecated
+  * Devise now only supports Rails 3.1 forward
+  * Devise.confirm_within was deprecated in favor Devise.allow_unconfirmed_access_for
+  * Devise.stateless_token= is deprecated in favor of appending :token_auth to Devise.skip_session_storage
+  * Usage of Devise.apply_schema is deprecated
+  * Usage of Devise migration helpers are deprecated
   * Usage of Devise.remember_across_browsers was deprecated
-  * Usage of Devise.confirm_within was deprecated in favor Devise.allow_unconfirmed_access_for
   * Usage of rememberable with remember_token was removed
   * Usage of recoverable without reset_password_sent_at was removed
   * Usage of Devise.case_insensitive_keys equals to false was removed
-  * Usage of Devise.stateless_token= is deprecated in favor of appending :token_auth to Devise.skip_session_storage
+  * Move devise/shared/_links.erb to devise/_links.erb
+  * Deprecated support of nested devise_for blocks
+  * Deprecated support to devise.registrations.reasons and devise.registrations.inactive_signed_up in favor of devise.registrations.signed_up_but_*
 
 == 1.5.3
 
@@ -96,7 +127,7 @@ Notes: https://github.com/plataformatec/devise/wiki/How-To:-Upgrade-to-Devise-2.
 * bug fix
   * Fix backward incompatible change from 1.4.6 for those using custom controllers
 
-== 1.4.6
+== 1.4.6 (yanked)
 
 * enhancements
   * Allow devise_for :skip => :all

Gemfile.lock

@@ -1,11 +1,11 @@
 PATH
   remote: .
   specs:
-    devise (2.0.0.rc)
+    devise (2.0.6)
       bcrypt-ruby (~> 3.0)
       orm_adapter (~> 0.0.3)
       railties (~> 3.1)
-      warden (~> 1.1)
+      warden (~> 1.1.1)
 
 GEM
   remote: http://rubygems.org/
@@ -39,7 +39,7 @@ GEM
       multi_json (~> 1.0)
     addressable (2.2.6)
     arel (3.0.0)
-    bcrypt-ruby (3.0.1)
+    bcrypt-ruby (3.1.1)
     bson (1.5.1)
     bson_ext (1.3.1)
     builder (3.0.0)
@@ -87,7 +87,7 @@ GEM
     omniauth-openid (1.0.1)
       omniauth (~> 1.0)
       rack-openid (~> 1.3.1)
-    orm_adapter (0.0.5)
+    orm_adapter (0.0.7)
     polyglot (0.3.3)
     rack (1.4.1)
     rack-cache (1.1)
@@ -137,7 +137,7 @@ GEM
       polyglot
       polyglot (>= 0.3.1)
     tzinfo (0.3.31)
-    warden (1.1.0)
+    warden (1.1.1)
       rack (>= 1.0)
     webrat (0.7.2)
       nokogiri (>= 1.2.0)

MIT-LICENSE

@@ -1,4 +1,4 @@
-Copyright 2009-2011 Plataforma Tecnologia. http://blog.plataformatec.com.br
+Copyright 2009-2012 Plataforma Tecnologia. http://blog.plataformatec.com.br
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the

README.md

@@ -1,8 +1,10 @@
-*IMPORTANT:* Devise 2.0.0.rc is out. If you are upgrading, please read: https://github.com/plataformatec/devise/wiki/How-To:-Upgrade-to-Devise-2.0-migration-schema-style
+*IMPORTANT:* Devise 2.0.0 is out. If you are upgrading, please read: https://github.com/plataformatec/devise/wiki/How-To:-Upgrade-to-Devise-2.0
 
-== Devise
+## Devise
 
-{<img src="https://secure.travis-ci.org/plataformatec/devise.png" />}[http://travis-ci.org/plataformatec/devise]
+INFO: This README is [also available in a friendly navigable format](http://devise.plataformatec.com.br/).
+
+[![Build Status](https://secure.travis-ci.org/plataformatec/devise.png)](http://travis-ci.org/plataformatec/devise)
 
 Devise is a flexible authentication solution for Rails based on Warden. It:
 
@@ -26,15 +28,15 @@ It's comprised of 12 modules:
 * Lockable: locks an account after a specified number of failed sign-in attempts. Can unlock via email or after a specified time period.
 * Encryptable: adds support of other authentication mechanisms besides the built-in Bcrypt (the default).
 
-== Information
+## Information
 
-=== The Devise wiki
+### The Devise wiki
 
 The Devise Wiki has lots of additional information about Devise including many "how-to" articles and answers to the most frequently asked questions. Please browse the Wiki after finishing this README:
 
 https://wiki.github.com/plataformatec/devise
 
-=== Bug reports
+### Bug reports
 
 If you discover a problem with Devise, we would like to know about it. However, we ask that you please review these guidelines before submitting a bug report:
 
@@ -42,59 +44,41 @@ https://github.com/plataformatec/devise/wiki/Bug-reports
 
 If you found a security bug, do *NOT* use the GitHub issue tracker. Send email or a private GitHub message to the maintainers listed at the bottom of the README.
 
-=== Mailing list
+### Mailing list
 
 If you have any questions, comments, or concerns, please use the Google Group instead of the GitHub issue tracker:
 
 https://groups.google.com/group/plataformatec-devise
 
-=== RDocs
+### RDocs
 
 You can view the Devise documentation in RDoc format here:
 
 http://rubydoc.info/github/plataformatec/devise/master/frames
 
-If you need to use Devise with Rails 2.3, you can always run `gem server` from the command line after you install the gem to access the old documentation.
+If you need to use Devise with Rails 2.3, you can always run "gem server" from the command line after you install the gem to access the old documentation.
 
-=== Example applications
+### Example applications
 
 There are a few example applications available on GitHub that demonstrate various features of Devise with different versions of Rails. You can view them here:
 
 https://github.com/plataformatec/devise/wiki/Example-Applications
 
-=== Extensions
+### Extensions
 
 Our community has created a number of extensions that add functionality above and beyond what is included with Devise. You can view a list of available extensions and add your own here:
 
 https://github.com/plataformatec/devise/wiki/Extensions
 
-=== Contributing
+### Contributing
 
 We hope that you will consider contributing to Devise. Please read this short overview for some information about how to get started:
 
 https://github.com/plataformatec/devise/wiki/Contributing
 
-You will usually want to write tests for your changes.  To run the test suite, `cd` into Devise's top-level directory and run `bundle install` and `rake`.  For the tests to pass, you will need to have a MongoDB server (version 2.0 or newer) running on your system.
+You will usually want to write tests for your changes.  To run the test suite, go into Devise's top-level directory and run "bundle install" and "rake".  For the tests to pass, you will need to have a MongoDB server (version 2.0 or newer) running on your system.
 
-== Installation
-
-You can use the latest Rails 3 gem with the latest Devise gem:
-
-  gem install devise
-
-After you install Devise and add it to your Gemfile, you need to run the generator:
-
-  rails generate devise:install
-
-The generator will install an initializer which describes ALL Devise's configuration options and you MUST take a look at it. When you are done, you are ready to add Devise to any of your models using the generator:
-
-  rails generate devise MODEL
-
-Replace MODEL by the class name used for the applications users, it's frequently 'User' but could also be 'Admin'. This will create a model (if one does not exist) and configure it with default Devise modules. Next, you'll usually run db:migrate as the generator will have created a migration file (if your ORM supports them). This generator also configures your config/routes.rb file, continue reading this file to understand exactly what the generator produces and how to use it. Finally, if your server was already running, then restart it as Rails doesn't automatically load methods from a new gem.
-
-Support for Rails 2.3.x can be found by installing Devise 1.0.x from the v1.0 branch.
-
-== Starting with Rails?
+## Starting with Rails?
 
 If you are building your first Rails application, we recommend you to *not* use Devise. Devise requires a good understanding of the Rails Framework. In such cases, we advise you to start a simple authentication system from scratch, today we have two resources:
 
@@ -103,266 +87,302 @@ If you are building your first Rails application, we recommend you to *not* use
 
 Once you have solidified your understanding of Rails and authentication mechanisms, we assure you Devise will be very pleasant to work with. :)
 
-== Getting started
+## Getting started
 
-This is a walkthrough with all steps you need to setup a devise resource, including model, migration, route files, and optional configuration.
+Devise 2.0 works with Rails 3.1 onwards. You can add it to your Gemfile with:
 
-Devise must be set up within the model (or models) you want to use. Devise routes must be created inside your config/routes.rb file.
+  gem 'devise'
 
-We're assuming here you want a User model with some Devise modules, as outlined below:
+Run the bundle command to install it.
 
-  class User < ActiveRecord::Base
-    devise :database_authenticatable, :registerable, :confirmable, :recoverable, :rememberable, :trackable, :validatable
-  end
+After you install Devise and add it to your Gemfile, you need to run the generator:
 
-After you choose which modules to use, you need to set up your migrations. Luckily, Devise has some helpers to save you from this boring work:
+```console
+rails generate devise:install
+```
 
-  create_table :users do |t|
-    t.database_authenticatable
-    t.confirmable
-    t.recoverable
-    t.rememberable
-    t.trackable
-    t.timestamps
-  end
+The generator will install an initializer which describes ALL Devise's configuration options and you MUST take a look at it. When you are done, you are ready to add Devise to any of your models using the generator:
 
-Devise doesn't use _attr_accessible_ or _attr_protected_ inside its modules, so be sure to define attributes as accessible or protected in your model.
+```console
+rails generate devise MODEL
+```
 
-Configure your routes after setting up your model. Open your config/routes.rb file and add:
+Replace MODEL by the class name used for the applications users, it's frequently 'User' but could also be 'Admin'. This will create a model (if one does not exist) and configure it with default Devise modules. Next, you'll usually run "rake db:migrate" as the generator will have created a migration file (if your ORM supports them). This generator also configures your config/routes.rb file to point to Devise controller.
 
-  devise_for :users
-
-This will use your User model to create a set of needed routes (you can see them by running `rake routes`). If you invoked the devise generator, you noticed that this is exactly what the generator produces for us: model, routes and migrations.
-
-Don't forget to run rake db:migrate and you are ready to go! But don't stop reading here, we still have a lot to tell you.
-
-=== Controller filters and helpers
+### Controller filters and helpers
 
 Devise will create some helpers to use inside your controllers and views. To set up a controller with user authentication, just add this before_filter:
 
-  before_filter :authenticate_user!
+```ruby
+before_filter :authenticate_user!
+```
 
 To verify if a user is signed in, use the following helper:
 
-  user_signed_in?
+```ruby
+user_signed_in?
+```
 
 For the current signed-in user, this helper is available:
 
-  current_user
+```ruby
+current_user
+```
 
 You can access the session for this scope:
 
-  user_session
+```ruby
+user_session
+```
 
-After signing in a user, confirming the account or updating the password, Devise will look for a scoped root path to redirect. Example: For a :user resource, it will use user_root_path if it exists, otherwise default root_path will be used. This means that you need to set the root inside your routes:
+After signing in a user, confirming the account or updating the password, Devise will look for a scoped root path to redirect. Example: For a :user resource, it will use +user_root_path+ if it exists, otherwise default +root_path+ will be used. This means that you need to set the root inside your routes:
 
-  root :to => "home#index"
+```ruby
+root :to => "home#index"
+```
 
-You can also overwrite after_sign_in_path_for and after_sign_out_path_for to customize your redirect hooks.
+You can also overwrite +after_sign_in_path_for+ and +after_sign_out_path_for+ to customize your redirect hooks.
 
-Finally, you need to set up default url options for the mailer in each environment. Here is the configuration for config/environments/development.rb:
+Finally, you need to set up default url options for the mailer in each environment. Here is the configuration for "config/environments/development.rb":
 
-  config.action_mailer.default_url_options = { :host => 'localhost:3000' }
+```ruby
+config.action_mailer.default_url_options = { :host => 'localhost:3000' }
+```
 
 Notice that if your devise model is not called "user" but "member", then the helpers you should use are:
 
-  before_filter :authenticate_member!
+```ruby
+before_filter :authenticate_member!
 
-  member_signed_in?
+member_signed_in?
 
-  current_member
+current_member
 
-  member_session
+member_session
+```
 
-=== Configuring Models
+### Configuring Models
 
-The devise method in your models also accepts some options to configure its modules. For example, you can choose which encryptor to use in database_authenticatable:
+The devise method in your models also accepts some options to configure its modules. For example, you can choose the cost of the encryption algorithm with:
 
-  devise :database_authenticatable, :registerable, :confirmable, :recoverable, :stretches => 20
+```ruby
+devise :database_authenticatable, :registerable, :confirmable, :recoverable, :stretches => 20
+```
 
 Besides :stretches, you can define :pepper, :encryptor, :confirm_within, :remember_for, :timeout_in, :unlock_in and other values. For details, see the initializer file that was created when you invoked the "devise:install" generator described above.
 
-=== Configuring multiple models
+### Configuring multiple models
 
-Devise allows you to set up as many roles as you want. For example, you may have a User model and also want an Admin model with just authentication, trackable, lockable and timeoutable features and no confirmation or password-recovery features. Just follow these steps:
+Devise allows you to set up as many roles as you want. For example, you may have a User model and also want an Admin model with just authentication and timeoutable features. If so, just follow these steps:
 
-  # Create a migration with the required fields
-  create_table :admins do |t|
-    t.database_authenticatable
-    t.lockable
-    t.trackable
-    t.timestamps
-  end
+```ruby
+# Create a migration with the required fields
+create_table :admins do |t|
+  t.string :email
+  t.string :encrypted_password
+  t.timestamps
+end
 
-  # Inside your Admin model
-  devise :database_authenticatable, :trackable, :timeoutable, :lockable
+# Inside your Admin model
+devise :database_authenticatable, :timeoutable
 
-  # Inside your routes
-  devise_for :admins
+# Inside your routes
+devise_for :admins
 
-  # Inside your protected controller
-  before_filter :authenticate_admin!
+# Inside your protected controller
+before_filter :authenticate_admin!
 
-  # Inside your controllers and views
-  admin_signed_in?
-  current_admin
-  admin_session
+# Inside your controllers and views
+admin_signed_in?
+current_admin
+admin_session
+```
 
-=== Configuring views
+On the other hand, you can simply run the generator!
+
+### Configuring views
 
 We built Devise to help you quickly develop an application that uses authentication. However, we don't want to be in your way when you need to customize it.
 
 Since Devise is an engine, all its views are packaged inside the gem. These views will help you get started, but after some time you may want to change them. If this is the case, you just need to invoke the following generator, and it will copy all views to your application:
 
-  rails generate devise:views
+```console
+rails generate devise:views
+```
 
 If you have more than one role in your application (such as "User" and "Admin"), you will notice that Devise uses the same views for all roles. Fortunately, Devise offers an easy way to customize views. All you need to do is set "config.scoped_views = true" inside "config/initializers/devise.rb".
 
 After doing so, you will be able to have views based on the role like "users/sessions/new" and "admins/sessions/new". If no view is found within the scope, Devise will use the default view at "devise/sessions/new". You can also use the generator to generate scoped views:
 
-  rails generate devise:views users
+```console
+rails generate devise:views users
+```
 
-=== Configuring controllers
+### Configuring controllers
 
 If the customization at the views level is not enough, you can customize each controller by following these steps:
 
 1) Create your custom controller, for example a Admins::SessionsController:
 
-    class Admins::SessionsController < Devise::SessionsController
-    end
+```ruby
+class Admins::SessionsController < Devise::SessionsController
+end
+```
 
 2) Tell the router to use this controller:
 
-    devise_for :admins, :controllers => { :sessions => "admins/sessions" }
+```ruby
+devise_for :admins, :controllers => { :sessions => "admins/sessions" }
+```
 
 3) And since we changed the controller, it won't use the "devise/sessions" views, so remember to copy "devise/sessions" to "admin/sessions".
 
 Remember that Devise uses flash messages to let users know if sign in was successful or failed. Devise expects your application to call "flash[:notice]" and "flash[:alert]" as appropriate.
 
-=== Configuring routes
+### Configuring routes
 
 Devise also ships with default routes. If you need to customize them, you should probably be able to do it through the devise_for method. It accepts several options like :class_name, :path_prefix and so on, including the possibility to change path names for I18n:
 
-  devise_for :users, :path => "usuarios", :path_names => { :sign_in => 'login', :sign_out => 'logout', :password => 'secret', :confirmation => 'verification', :unlock => 'unblock', :registration => 'register', :sign_up => 'cmon_let_me_in' }
+```ruby
+devise_for :users, :path => "usuarios", :path_names => { :sign_in => 'login', :sign_out => 'logout', :password => 'secret', :confirmation => 'verification', :unlock => 'unblock', :registration => 'register', :sign_up => 'cmon_let_me_in' }
+```
 
-Be sure to check devise_for documentation for details.
+Be sure to check +devise_for+ documentation for details.
 
 If you have the need for more deep customization, for instance to also allow "/sign_in" besides "/users/sign_in", all you need to do is to create your routes normally and wrap them in a +devise_scope+ block in the router:
 
-  devise_scope :user do
-    get "sign_in", :to => "devise/sessions#new"
-  end
+```ruby
+devise_scope :user do
+  get "sign_in", :to => "devise/sessions#new"
+end
+```
 
 This way you tell devise to use the scope :user when "/sign_in" is accessed. Notice +devise_scope+ is also aliased as +as+ and you can also give a block to +devise_for+, resulting in the same behavior:
 
-  devise_for :users do
-    get "sign_in", :to => "devise/sessions#new"
-  end
+```ruby
+devise_for :users do
+  get "sign_in", :to => "devise/sessions#new"
+end
+```
 
 Feel free to choose the one you prefer!
 
-=== I18n
+### I18n
 
 Devise uses flash messages with I18n with the flash keys :notice and :alert. To customize your app, you can set up your locale file:
 
-  en:
-    devise:
-      sessions:
-        signed_in: 'Signed in successfully.'
+```yaml
+en:
+  devise:
+    sessions:
+      signed_in: 'Signed in successfully.'
+```
 
 You can also create distinct messages based on the resource you've configured using the singular name given in routes:
 
-  en:
-    devise:
-      sessions:
-        user:
-          signed_in: 'Welcome user, you are signed in.'
-        admin:
-          signed_in: 'Hello admin!'
+```yaml
+en:
+  devise:
+    sessions:
+      user:
+        signed_in: 'Welcome user, you are signed in.'
+      admin:
+        signed_in: 'Hello admin!'
+```
 
 The Devise mailer uses a similar pattern to create subject messages:
 
-  en:
-    devise:
-      mailer:
-        confirmation_instructions:
-          subject: 'Hello everybody!'
-          user_subject: 'Hello User! Please confirm your email'
-        reset_password_instructions:
-          subject: 'Reset instructions'
+```yaml
+en:
+  devise:
+    mailer:
+      confirmation_instructions:
+        subject: 'Hello everybody!'
+        user_subject: 'Hello User! Please confirm your email'
+      reset_password_instructions:
+        subject: 'Reset instructions'
+```
 
 Take a look at our locale file to check all available messages. You may also be interested in one of the many translations that are available on our wiki:
 
 https://github.com/plataformatec/devise/wiki/I18n
 
-=== Test helpers
+### Test helpers
 
 Devise includes some tests helpers for functional specs. To use them, you just need to include Devise::TestHelpers in your test class and use the sign_in and sign_out method. Such methods have the same signature as in controllers:
 
-  sign_in :user, @user   # sign_in(scope, resource)
-  sign_in @user          # sign_in(resource)
+```ruby
+sign_in :user, @user   # sign_in(scope, resource)
+sign_in @user          # sign_in(resource)
 
-  sign_out :user         # sign_out(scope)
-  sign_out @user         # sign_out(resource)
+sign_out :user         # sign_out(scope)
+sign_out @user         # sign_out(resource)
+```
 
 You can include the Devise Test Helpers in all of your tests by adding the following to the bottom of your test/test_helper.rb file:
 
-  class ActionController::TestCase
-    include Devise::TestHelpers
-  end
+```ruby
+class ActionController::TestCase
+  include Devise::TestHelpers
+end
+```
 
 If you're using RSpec and want the helpers automatically included within all +describe+ blocks, add a file called spec/support/devise.rb with the following contents:
 
-  RSpec.configure do |config|
-    config.include Devise::TestHelpers, :type => :controller
-  end
+```ruby
+RSpec.configure do |config|
+  config.include Devise::TestHelpers, :type => :controller
+end
+```
 
 Do not use such helpers for integration tests such as Cucumber or Webrat. Instead, fill in the form or explicitly set the user in session. For more tips, check the wiki (https://wiki.github.com/plataformatec/devise).
 
-=== Omniauth
+### Omniauth
 
 Devise comes with Omniauth support out of the box to authenticate from other providers. You can read more about Omniauth support in the wiki:
 
 * https://github.com/plataformatec/devise/wiki/OmniAuth:-Overview
 
-=== Other ORMs
+### Other ORMs
 
 Devise supports ActiveRecord (default) and Mongoid. To choose other ORM, you just need to require it in the initializer file.
 
-=== Migrating from other solutions
+### Migrating from other solutions
 
 Devise implements encryption strategies for Clearance, Authlogic and Restful-Authentication. To make use of these strategies, you need set the desired encryptor in the encryptor initializer config option and add :encryptable to your model. You might also need to rename your encrypted password and salt columns to match Devise's fields (encrypted_password and password_salt).
 
-== Troubleshooting
+## Troubleshooting
 
-=== Heroku
+### Heroku
 
 Using devise on Heroku with Ruby on Rails 3.1 requires setting:
 
-  config.assets.initialize_on_precompile = false
+```ruby
+config.assets.initialize_on_precompile = false
+```
 
 Read more about the potential issues at http://guides.rubyonrails.org/asset_pipeline.html
 
-== Additional information
+## Additional information
 
-=== Warden
+### Warden
 
 Devise is based on Warden, which is a general Rack authentication framework created by Daniel Neighman. We encourage you to read more about Warden here:
 
 https://github.com/hassox/warden
 
-=== Contributors
+### Contributors
 
 We have a long list of valued contributors. Check them all at:
 
 https://github.com/plataformatec/devise/contributors
 
-=== Maintainers
+### Maintainers
 
 * José Valim (https://github.com/josevalim)
 * Carlos Antônio da Silva (https://github.com/carlosantoniodasilva)
 * Rodrigo Flores (https://github.com/rodrigoflores)
 
-== License
+## License
 
-MIT License. Copyright 2011 Plataforma Tecnologia. http://blog.plataformatec.com.br
+MIT License. Copyright 2012 Plataforma Tecnologia. http://blog.plataformatec.com.br

app/controllers/devise/sessions_controller.rb

@@ -6,12 +6,12 @@ class Devise::SessionsController < DeviseController
   def new
     resource = build_resource
     clean_up_passwords(resource)
-    respond_with(resource, stub_options(resource))
+    respond_with(resource, serialize_options(resource))
   end
 
   # POST /resource/sign_in
   def create
-    resource = warden.authenticate!(:scope => resource_name, :recall => "#{controller_path}#new")
+    resource = warden.authenticate!(auth_options)
     set_flash_message(:notice, :signed_in) if is_navigational_format?
     sign_in(resource_name, resource)
     respond_with resource, :location => after_sign_in_path_for(resource)
@@ -19,10 +19,9 @@ class Devise::SessionsController < DeviseController
 
   # DELETE /resource/sign_out
   def destroy
-    signed_in = signed_in?(resource_name)
     redirect_path = after_sign_out_path_for(resource_name)
-    Devise.sign_out_all_scopes ? sign_out : sign_out(resource_name)
-    set_flash_message :notice, :signed_out if signed_in
+    signed_out = (Devise.sign_out_all_scopes ? sign_out : sign_out(resource_name))
+    set_flash_message :notice, :signed_out if signed_out
 
     # We actually need to hardcode this as Rails default responder doesn't
     # support returning empty response on GET request
@@ -38,11 +37,15 @@ class Devise::SessionsController < DeviseController
 
   protected
 
-  def stub_options(resource)
+  def serialize_options(resource)
     methods = resource_class.authentication_keys.dup
     methods = methods.keys if methods.is_a?(Hash)
     methods << :password if resource.respond_to?(:password)
     { :methods => methods, :only => [:password] }
   end
+
+  def auth_options
+    { :scope => resource_name, :recall => "#{controller_path}#new" }
+  end
 end
 

app/controllers/devise_controller.rb

@@ -5,7 +5,7 @@ class DeviseController < Devise.parent_controller.constantize
   helper DeviseHelper
 
   helpers = %w(resource scope_name resource_name signed_in_resource
-               resource_class devise_mapping devise_controller?)
+               resource_class devise_mapping)
   hide_action *helpers
   helper_method *helpers
 
@@ -38,11 +38,6 @@ class DeviseController < Devise.parent_controller.constantize
     @devise_mapping ||= request.env["devise.mapping"]
   end
 
-  # Overwrites devise_controller? to return true
-  def devise_controller?
-    true
-  end
-
   protected
 
   # Checks whether it's a devise mapped resource or not.
@@ -136,6 +131,7 @@ MESSAGE
     options[:scope] = "devise.#{controller_name}"
     options[:default] = Array(options[:default]).unshift(kind.to_sym)
     options[:resource_name] = resource_name
+    options = devise_i18n_options(options) if respond_to?(:devise_i18n_options, true)
     message = I18n.t("#{resource_name}.#{kind}", options)
     flash[key] = message if message.present?
   end
@@ -160,7 +156,7 @@ MESSAGE
 
   # Override prefixes to consider the scoped view.
   def _prefixes #:nodoc:
-    @_prefixes ||= if self.class.scoped_views?
+    @_prefixes ||= if self.class.scoped_views? && devise_mapping
       super.unshift("#{devise_mapping.scoped_path}/#{controller_name}")
     else
       super

app/views/devise/registrations/edit.html.erb

@@ -7,7 +7,7 @@
   <%= f.email_field :email %></div>
 
   <div><%= f.label :password %> <i>(leave blank if you don't want to change it)</i><br />
-  <%= f.password_field :password %></div>
+  <%= f.password_field :password, :autocomplete => "off" %></div>
 
   <div><%= f.label :password_confirmation %><br />
   <%= f.password_field :password_confirmation %></div>

devise.gemspec

@@ -14,11 +14,11 @@ Gem::Specification.new do |s|
 
   s.rubyforge_project = "devise"
 
-  s.files         = Dir["CHANGELOG.rdoc", "MIT-LICENSE", "README.rdoc", "app/**/*", "config/**/*", "lib/**/*"]
-  s.test_files    = Dir["test/**/*"]
+  s.files         = `git ls-files`.split("\n")
+  s.test_files    = `git ls-files -- test/*`.split("\n")
   s.require_paths = ["lib"]
 
-  s.add_dependency("warden", "~> 1.1")
+  s.add_dependency("warden", "~> 1.1.1")
   s.add_dependency("orm_adapter", "~> 0.0.3")
   s.add_dependency("bcrypt-ruby", "~> 3.0")
   s.add_dependency("railties", "~> 3.1")

gemfiles/Gemfile.rails-3.1.x.lock

@@ -0,0 +1,169 @@
+PATH
+  remote: ..
+  specs:
+    devise (2.0.6)
+      bcrypt-ruby (~> 3.0)
+      orm_adapter (~> 0.0.3)
+      railties (~> 3.1)
+      warden (~> 1.1.1)
+
+GEM
+  remote: http://rubygems.org/
+  specs:
+    actionmailer (3.1.3)
+      actionpack (= 3.1.3)
+      mail (~> 2.3.0)
+    actionpack (3.1.3)
+      activemodel (= 3.1.3)
+      activesupport (= 3.1.3)
+      builder (~> 3.0.0)
+      erubis (~> 2.7.0)
+      i18n (~> 0.6)
+      rack (~> 1.3.5)
+      rack-cache (~> 1.1)
+      rack-mount (~> 0.8.2)
+      rack-test (~> 0.6.1)
+      sprockets (~> 2.0.3)
+    activemodel (3.1.3)
+      activesupport (= 3.1.3)
+      builder (~> 3.0.0)
+      i18n (~> 0.6)
+    activerecord (3.1.3)
+      activemodel (= 3.1.3)
+      activesupport (= 3.1.3)
+      arel (~> 2.2.1)
+      tzinfo (~> 0.3.29)
+    activeresource (3.1.3)
+      activemodel (= 3.1.3)
+      activesupport (= 3.1.3)
+    activesupport (3.1.3)
+      multi_json (~> 1.0)
+    addressable (2.2.7)
+    arel (2.2.1)
+    bcrypt-ruby (3.1.1)
+    bson (1.5.2)
+    bson_ext (1.3.1)
+    builder (3.0.0)
+    columnize (0.3.6)
+    erubis (2.7.0)
+    faraday (0.7.6)
+      addressable (~> 2.2)
+      multipart-post (~> 1.1)
+      rack (~> 1.1)
+    hashie (1.2.0)
+    hike (1.2.1)
+    i18n (0.6.0)
+    json (1.6.5)
+    linecache (0.46)
+      rbx-require-relative (> 0.0.4)
+    mail (2.3.0)
+      i18n (>= 0.4.0)
+      mime-types (~> 1.16)
+      treetop (~> 1.4.8)
+    metaclass (0.0.1)
+    mime-types (1.17.2)
+    mocha (0.10.4)
+      metaclass (~> 0.0.1)
+    mongo (1.3.1)
+      bson (>= 1.3.1)
+    mongoid (2.4.4)
+      activemodel (~> 3.1)
+      mongo (~> 1.3)
+      tzinfo (~> 0.3.22)
+    multi_json (1.0.4)
+    multipart-post (1.1.5)
+    nokogiri (1.5.0)
+    oauth2 (0.5.2)
+      faraday (~> 0.7)
+      multi_json (~> 1.0)
+    omniauth (1.0.2)
+      hashie (~> 1.2)
+      rack
+    omniauth-facebook (1.2.0)
+      omniauth-oauth2 (~> 1.0.0)
+    omniauth-oauth2 (1.0.0)
+      oauth2 (~> 0.5.0)
+      omniauth (~> 1.0)
+    omniauth-openid (1.0.1)
+      omniauth (~> 1.0)
+      rack-openid (~> 1.3.1)
+    orm_adapter (0.0.7)
+    polyglot (0.3.3)
+    rack (1.3.6)
+    rack-cache (1.1)
+      rack (>= 0.4)
+    rack-mount (0.8.3)
+      rack (>= 1.0.0)
+    rack-openid (1.3.1)
+      rack (>= 1.1.0)
+      ruby-openid (>= 2.1.8)
+    rack-ssl (1.3.2)
+      rack
+    rack-test (0.6.1)
+      rack (>= 1.0)
+    rails (3.1.3)
+      actionmailer (= 3.1.3)
+      actionpack (= 3.1.3)
+      activerecord (= 3.1.3)
+      activeresource (= 3.1.3)
+      activesupport (= 3.1.3)
+      bundler (~> 1.0)
+      railties (= 3.1.3)
+    railties (3.1.3)
+      actionpack (= 3.1.3)
+      activesupport (= 3.1.3)
+      rack-ssl (~> 1.3.2)
+      rake (>= 0.8.7)
+      rdoc (~> 3.4)
+      thor (~> 0.14.6)
+    rake (0.9.2.2)
+    rbx-require-relative (0.0.5)
+    rdoc (3.12)
+      json (~> 1.4)
+    ruby-debug (0.10.4)
+      columnize (>= 0.1)
+      ruby-debug-base (~> 0.10.4.0)
+    ruby-debug-base (0.10.4)
+      linecache (>= 0.3)
+    ruby-openid (2.1.8)
+    sprockets (2.0.3)
+      hike (~> 1.2)
+      rack (~> 1.0)
+      tilt (~> 1.1, != 1.3.0)
+    sqlite3 (1.3.5)
+    sqlite3-ruby (1.3.3)
+      sqlite3 (>= 1.3.3)
+    thor (0.14.6)
+    tilt (1.3.3)
+    treetop (1.4.10)
+      polyglot
+      polyglot (>= 0.3.1)
+    tzinfo (0.3.31)
+    warden (1.1.1)
+      rack (>= 1.0)
+    webrat (0.7.2)
+      nokogiri (>= 1.2.0)
+      rack (>= 1.0)
+      rack-test (>= 0.5.3)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  activerecord-jdbc-adapter
+  activerecord-jdbcsqlite3-adapter
+  bson_ext (~> 1.3.0)
+  devise!
+  jruby-openssl
+  mocha
+  mongo (~> 1.3.0)
+  mongoid (~> 2.0)
+  omniauth (~> 1.0.0)
+  omniauth-facebook
+  omniauth-oauth2 (~> 1.0.0)
+  omniauth-openid (~> 1.0.1)
+  rails (~> 3.1.0)
+  rdoc
+  ruby-debug (>= 0.10.3)
+  sqlite3-ruby
+  webrat (= 0.7.2)

lib/devise.rb

@@ -10,7 +10,6 @@ module Devise
   autoload :FailureApp,  'devise/failure_app'
   autoload :OmniAuth,    'devise/omniauth'
   autoload :ParamFilter, 'devise/param_filter'
-  autoload :PathChecker, 'devise/path_checker'
   autoload :Schema,      'devise/schema'
   autoload :TestHelpers, 'devise/test_helpers'
 
@@ -63,8 +62,8 @@ module Devise
   }
 
   # Custom domain for cookies. Not set by default
-  mattr_accessor :cookie_options
-  @@cookie_options = {}
+  mattr_accessor :rememberable_options
+  @@rememberable_options = {}
 
   # The number of times to encrypt password.
   mattr_accessor :stretches
@@ -221,7 +220,7 @@ module Devise
   # to :main_app. Should be overriden by engines in order
   # to provide custom routes.
   mattr_accessor :router_name
-  @@router_name = :main_app
+  @@router_name = nil
 
   # DEPRECATED CONFIG
 
@@ -244,6 +243,11 @@ module Devise
     Devise.allow_unconfirmed_access_for = value
   end
 
+  def self.cookie_options=(value)
+    warn "\n[DEVISE] Devise.cookie_options= is deprecated. Please set Devise.rememberable_options= instead.\n"
+    Devise.rememberable_options = value
+  end
+
   def self.stateless_token=(value)
     warn "\n[DEVISE] Devise.stateless_token= is deprecated. Please append :token_auth to Devise.skip_session_storage " \
       "instead, for example: Devise.skip_session_storage << :token_auth\n"
@@ -299,6 +303,10 @@ module Devise
     end
   end
 
+  def self.available_router_name
+    router_name || :main_app
+  end
+
   def self.omniauth_providers
     omniauth_configs.keys
   end

lib/devise/controllers/helpers.rb

@@ -75,9 +75,9 @@ module Devise
       # the controllers defined inside devise. Useful if you want to apply a before
       # filter to all controllers, except the ones in devise:
       #
-      #   before_filter :my_filter, :unless => { |c| c.devise_controller? }
+      #   before_filter :my_filter, :unless => :devise_controller?
       def devise_controller?
-        false
+        is_a?(DeviseController)
       end
 
       # Tell warden that params authentication is allowed for that specific page.
@@ -126,7 +126,8 @@ module Devise
       end
 
       # Sign out a given user or scope. This helper is useful for signing out a user
-      # after deleting accounts.
+      # after deleting accounts. Returns true if there was a logout and false if there is no user logged in
+      # on the referred scope
       #
       # Examples:
       #
@@ -136,19 +137,26 @@ module Devise
       def sign_out(resource_or_scope=nil)
         return sign_out_all_scopes unless resource_or_scope
         scope = Devise::Mapping.find_scope!(resource_or_scope)
-        warden.user(scope) # Without loading user here, before_logout hook is not called
+        user = warden.user(:scope => scope, :run_callbacks => false) # If there is no user
+
         warden.raw_session.inspect # Without this inspect here. The session does not clear.
         warden.logout(scope)
         instance_variable_set(:"@current_#{scope}", nil)
+
+        !!user
       end
 
       # Sign out all active users or scopes. This helper is useful for signing out all roles
-      # in one click. This signs out ALL scopes in warden.
+      # in one click. This signs out ALL scopes in warden. Returns true if there was at least one logout
+      # and false if there was no user logged in on all scopes.
       def sign_out_all_scopes
-        Devise.mappings.keys.each { |s| warden.user(s) }
+        users = Devise.mappings.keys.map { |s| warden.user(:scope => s, :run_callbacks => false) }
+
         warden.raw_session.inspect
         warden.logout
         expire_devise_cached_variables!
+        
+        users.any?
       end
 
       # Returns and delete the url stored in the session for the given scope. Useful

lib/devise/controllers/rememberable.rb

@@ -36,7 +36,7 @@ module Devise
       protected
 
       def forget_cookie_values(resource)
-        Devise::Controllers::Rememberable.cookie_values.merge!(resource.cookie_options)
+        Devise::Controllers::Rememberable.cookie_values.merge!(resource.rememberable_options)
       end
 
       def remember_cookie_values(resource)

lib/devise/controllers/url_helpers.rb

@@ -60,7 +60,7 @@ module Devise
       private
 
       def _devise_route_context
-        @_devise_route_context ||= send(Devise.router_name)
+        @_devise_route_context ||= send(Devise.available_router_name)
       end
     end
   end

lib/devise/failure_app.rb

@@ -89,7 +89,7 @@ module Devise
       route = :"new_#{scope}_session_path"
       opts[:format] = request_format unless skip_format?
 
-      context = send(Devise.router_name)
+      context = send(Devise.available_router_name)
 
       if context.respond_to?(route)
         context.send(route, opts)

lib/devise/hooks/timeoutable.rb

@@ -10,11 +10,8 @@ Warden::Manager.after_set_user do |record, warden, options|
     last_request_at = warden.session(scope)['last_request_at']
 
     if record.timedout?(last_request_at)
-      path_checker = Devise::PathChecker.new(warden.env, scope)
-      unless path_checker.signing_out?
-        warden.logout(scope)
-        throw :warden, :scope => scope, :message => :timeout
-      end
+      warden.logout(scope)
+      throw :warden, :scope => scope, :message => :timeout
     end
 
     unless warden.request.env['devise.skip_trackable']

lib/devise/models/authenticatable.rb

@@ -1,5 +1,4 @@
 require 'devise/hooks/activatable'
-require 'devise/models/serializable'
 
 module Devise
   module Models
@@ -52,7 +51,10 @@ module Devise
     module Authenticatable
       extend ActiveSupport::Concern
 
-      include Devise::Models::Serializable
+      BLACKLIST_FOR_SERIALIZATION = [:encrypted_password, :reset_password_token, :reset_password_sent_at,
+        :remember_created_at, :sign_in_count, :current_sign_in_at, :last_sign_in_at, :current_sign_in_ip,
+        :last_sign_in_ip, :password_salt, :confirmation_token, :confirmed_at, :confirmation_sent_at,
+        :unconfirmed_email, :failed_attempts, :unlock_token, :locked_at, :authentication_token]
 
       included do
         class_attribute :devise_modules, :instance_writer => false
@@ -99,6 +101,31 @@ module Devise
         (self.class.strip_whitespace_keys || []).each { |k| self[k].try(:strip!) }
       end
 
+      array = %w(serializable_hash)
+      # to_xml does not call serializable_hash on 3.1
+      array << "to_xml" if Rails::VERSION::STRING[0,3] == "3.1"
+
+      array.each do |method|
+        class_eval <<-RUBY, __FILE__, __LINE__
+          # Redefine to_xml and serializable_hash in models for more secure defaults.
+          # By default, it removes from the serializable model all attributes that
+          # are *not* accessible. You can remove this default by using :force_except
+          # and passing a new list of attributes you want to exempt. All attributes
+          # given to :except will simply add names to exempt to Devise internal list.
+          def #{method}(options=nil)
+            options ||= {}
+            options[:except] = Array(options[:except])
+
+            if options[:force_except]
+              options[:except].concat Array(options[:force_except])
+            else
+              options[:except].concat BLACKLIST_FOR_SERIALIZATION
+            end
+            super(options)
+          end
+        RUBY
+      end
+
       module ClassMethods
         Devise::Models.config(self, :authentication_keys, :request_keys, :strip_whitespace_keys,
           :case_insensitive_keys, :http_authenticatable, :params_authenticatable, :skip_session_storage)
@@ -127,17 +154,20 @@ module Devise
         # namedscope to filter records while authenticating.
         # Example:
         #
-        #   def self.find_for_authentication(conditions={})
-        #     conditions[:active] = true
-        #     super
+        #   def self.find_for_authentication(tainted_conditions)
+        #     find_first_by_auth_conditions(tainted_conditions, :active => true)
         #   end
         #
-        def find_for_authentication(conditions)
-          find_first_by_auth_conditions(conditions)
+        # Finally, notice that Devise also queries for users in other scenarios
+        # besides authentication, for example when retrieving an user to send
+        # an e-mail for password reset. In such cases, find_for_authentication
+        # is not called.
+        def find_for_authentication(tainted_conditions)
+          find_first_by_auth_conditions(tainted_conditions)
         end
 
-        def find_first_by_auth_conditions(conditions)
-          to_adapter.find_first devise_param_filter.filter(conditions)
+        def find_first_by_auth_conditions(tainted_conditions, opts={})
+          to_adapter.find_first(devise_param_filter.filter(tainted_conditions).merge(opts))
         end
 
         # Find an initialize a record setting an error if it can't be found.
@@ -183,4 +213,4 @@ module Devise
       end
     end
   end
-end
+end

lib/devise/models/confirmable.rb

@@ -31,7 +31,7 @@ module Devise
 
       included do
         before_create :generate_confirmation_token, :if => :confirmation_required?
-        after_create  :send_confirmation_instructions, :if => :confirmation_required?
+        after_create  :send_on_create_confirmation_instructions, :if => :confirmation_required?
         before_update :postpone_email_change_until_confirmation, :if => :postpone_email_change?
         after_update :send_confirmation_instructions, :if => :reconfirmation_required?
       end
@@ -109,6 +109,13 @@ module Devise
 
       protected
 
+        # A callback method used to deliver confirmation
+        # instructions on creation. This can be overriden
+        # in models to map to a nice sign up e-mail.
+        def send_on_create_confirmation_instructions
+          self.devise_mailer.confirmation_instructions(self).deliver
+        end
+
         # Callback to overwrite if confirmation is required or not.
         def confirmation_required?
           !confirmed?
@@ -158,11 +165,6 @@ module Devise
           generate_confirmation_token && save(:validate => false)
         end
 
-        def after_password_reset
-          super
-          confirm! unless confirmed?
-        end
-
         def postpone_email_change_until_confirmation
           @reconfirmation_required = true
           self.unconfirmed_email = self.email

lib/devise/models/rememberable.rb

@@ -44,6 +44,7 @@ module Devise
       # Generate a new remember token and save the record without validations
       # unless remember_across_browsers is true and the user already has a valid token.
       def remember_me!(extend_period=false)
+        self.remember_token = self.class.remember_token if generate_remember_token?
         self.remember_created_at = Time.now.utc if generate_remember_timestamp?(extend_period)
         save(:validate => false)
       end
@@ -51,11 +52,10 @@ module Devise
       # If the record is persisted, remove the remember token (but only if
       # it exists), and save the record without validations.
       def forget_me!
-        if persisted?
-          self.remember_token = nil if respond_to?(:remember_token=)
-          self.remember_created_at = nil
-          save(:validate => false)
-        end
+        return unless persisted?
+        self.remember_token = nil if respond_to?(:remember_token=)
+        self.remember_created_at = nil
+        save(:validate => false)
       end
 
       # Remember token should be expired if expiration time not overpass now.
@@ -69,21 +69,28 @@ module Devise
       end
 
       def rememberable_value
-        if salt = authenticatable_salt
+        if respond_to?(:remember_token)
+          remember_token
+        elsif salt = authenticatable_salt
           salt
         else
           raise "authenticable_salt returned nil for the #{self.class.name} model. " \
             "In order to use rememberable, you must ensure a password is always set " \
-            "or implement rememberable_value in your model with your own logic."
+            "or have a remember_token column in your model or implement your own " \
+            "rememberable_value in the model with custom logic."
         end
       end
 
-      def cookie_options
-        self.class.cookie_options
+      def rememberable_options
+        self.class.rememberable_options
       end
 
     protected
 
+      def generate_remember_token?
+        respond_to?(:remember_token) && remember_expired?
+      end
+
       # Generate a timestamp if extend_remember_period is true, if no remember_token
       # exists, or if an existing remember token has expired.
       def generate_remember_timestamp?(extend_period) #:nodoc:
@@ -107,7 +114,7 @@ module Devise
           generate_token(:remember_token)
         end
 
-        Devise::Models.config(self, :remember_for, :extend_remember_period, :cookie_options)
+        Devise::Models.config(self, :remember_for, :extend_remember_period, :rememberable_options)
       end
     end
   end

lib/devise/models/serializable.rb

@@ -1,46 +0,0 @@
-module Devise
-  module Models
-    # This module redefine to_xml and serializable_hash in models for more
-    # secure defaults. By default, it removes from the serializable model
-    # all attributes that are *not* accessible. You can remove this default
-    # by using :force_except and passing a new list of attributes you want
-    # to exempt. All attributes given to :except will simply add names to
-    # exempt to Devise internal list.
-    module Serializable
-      extend ActiveSupport::Concern
-
-      array = %w(serializable_hash)
-      # to_xml does not call serializable_hash on 3.1
-      array << "to_xml" if Rails::VERSION::STRING[0,3] == "3.1"
-
-      array.each do |method|
-        class_eval <<-RUBY, __FILE__, __LINE__
-          def #{method}(options=nil)
-            options ||= {}
-            if options.key?(:force_except)
-              options[:except] = options.delete(:force_except)
-              super(options)
-            elsif self.class.blacklist_keys?
-              except = Array(options[:except])
-              super(options.merge(:except => except + self.class.blacklist_keys))
-            else
-              super
-            end
-          end
-        RUBY
-      end
-
-      module ClassMethods
-        # Return true if we can retrieve blacklist keys from the record.
-        def blacklist_keys?
-          @has_except_keys ||= respond_to?(:accessible_attributes) && !accessible_attributes.to_a.empty?
-        end
-
-        # Returns keys that should be removed when serializing the record.
-        def blacklist_keys
-          @blacklist_keys ||= to_adapter.column_names.map(&:to_s) - accessible_attributes.to_a.map(&:to_s)
-        end
-      end
-    end
-  end
-end

lib/devise/models/trackable.rb

@@ -23,7 +23,8 @@ module Devise
         self.sign_in_count ||= 0
         self.sign_in_count += 1
 
-        save(:validate => false)
+        save(:validate => false) or raise "Devise trackable could not save #{inspect}." \
+          "Please make sure a model using trackable can be saved at sign in."
       end
     end
   end

lib/devise/param_filter.rb

@@ -33,9 +33,8 @@ module Devise
 
     private
 
-    # Determine which values should be transformed to string or passed as-is to the query builder underneath
     def param_requires_string_conversion?(value)
-      [Fixnum, TrueClass, FalseClass, Regexp].none? {|clz| value.is_a? clz }
+      true
     end
   end
 end

lib/devise/path_checker.rb

@@ -1,23 +0,0 @@
-module Devise
-  class PathChecker
-    include Rails.application.routes.url_helpers
-
-    def self.default_url_options(*args)
-      if defined?(ApplicationController)
-        ApplicationController.default_url_options(*args)
-      else
-        {}
-      end
-    end
-
-    def initialize(env, scope)
-      @current_path = "/#{env["SCRIPT_NAME"]}/#{env["PATH_INFO"]}".squeeze("/")
-      @scope = scope
-    end
-
-    def signing_out?
-      route = "destroy_#{@scope}_session_path"
-      respond_to?(route) && @current_path == send(route)
-    end
-  end
-end

lib/devise/rails.rb

@@ -55,9 +55,14 @@ module Devise
       unless defined?(Rails::Generators)
         if Devise.case_insensitive_keys == false
           warn "\n[DEVISE] Devise.case_insensitive_keys is false which is no longer " \
-            "supported. If you want to continue running on this mode, please ensure " \
-            "you are not using validatable (you can copy the validations directly to your model) " \
-            "and set case_insensitive_keys to an empty array.\n"
+            "supported. Recent Devise versions automatically downcase the e-mail before " \
+            "saving it to the database but your app isn't using this feature. You can solve " \
+            "this issue by either:\n\n" \
+            "1) Setting config.case_insensitive_keys = [:email] in your Devise initializer and " \
+            "running a migration that will downcase all emails already in the database;\n\n" \
+            "2) Setting config.case_insensitive_keys = [] (so nothing will be downcased) and " \
+            "making sure you are not using Devise :validatable (since validatable assumes case" \
+            "insensitivity)\n"
         end
 
         if Devise.apply_schema && defined?(Mongoid)
@@ -82,14 +87,23 @@ module Devise
       end
 
       config.after_initialize do
+        example = <<-YAML
+en:
+  devise:
+    registrations:
+      signed_up_but_unconfirmed: 'A message with a confirmation link has been sent to your email address. Please open the link to activate your account.'
+      signed_up_but_inactive: 'You have signed up successfully. However, we could not sign you in because your account is not yet activated.'
+      signed_up_but_locked: 'You have signed up successfully. However, we could not sign you in because your account is locked.'
+        YAML
+
         if I18n.t(:"devise.registrations.reasons", :default => {}).present?
           warn "\n[DEVISE] devise.registrations.reasons in yml files is deprecated, " \
-            "please use devise.registrations.signed_up_but_REASON instead.\n"
+            "please use devise.registrations.signed_up_but_REASON instead. The default values are:\n\n#{example}\n"
         end
 
         if I18n.t(:"devise.registrations.inactive_signed_up", :default => "").present?
           warn "\n[DEVISE] devise.registrations.inactive_signed_up in yml files is deprecated, " \
-            "please use devise.registrations.signed_up_but_inactive instead.\n"
+            "please use devise.registrations.signed_up_but_REASON instead. The default values are:\n\n#{example}\n"
         end
       end
     end

lib/devise/rails/routes.rb

@@ -1,15 +1,27 @@
+require "active_support/core_ext/object/try"
+
 module ActionDispatch::Routing
   class RouteSet #:nodoc:
     # Ensure Devise modules are included only after loading routes, because we
     # need devise_for mappings already declared to create filters and helpers.
     def finalize_with_devise!
-      finalize_without_devise!
+      result = finalize_without_devise!
 
       @devise_finalized ||= begin
+        if Devise.router_name.nil? && defined?(@devise_finalized) && self != Rails.application.try(:routes)
+          warn "[DEVISE] We have detected that you are using devise_for inside engine routes. " \
+            "In this case, you probably want to set Devise.router_name = MOUNT_POINT, where "   \
+            "MOUNT_POINT is a symbol representing where this engine will be mounted at. For "   \
+            "now Devise will default the mount point to :main_app. You can explicitly set it"   \
+            " to :main_app as well in case you want to keep the current behavior."
+        end
+
         Devise.configure_warden!
         Devise.regenerate_helpers!
         true
       end
+
+      result
     end
     alias_method_chain :finalize!, :devise
   end
@@ -210,7 +222,9 @@ module ActionDispatch::Routing
         devise_scope mapping.name do
           if block_given?
             ActiveSupport::Deprecation.warn "Passing a block to devise_for is deprecated. " \
-              "Please call devise_scope :#{mapping.name} do ... end with the block instead", caller
+              "Please remove the block from devise_for (only the block, the call to " \
+              "devise_for must still exist) and call devise_scope :#{mapping.name} do ... end " \
+              "with the block instead", caller
             yield
           end
 
@@ -363,7 +377,10 @@ module ActionDispatch::Routing
         path_prefix = "/#{mapping.path}/auth".squeeze("/")
 
         if ::OmniAuth.config.path_prefix && ::OmniAuth.config.path_prefix != path_prefix
-          raise "You can only add :omniauthable behavior to one Devise model"
+          raise "Wrong OmniAuth configuration. If you are getting this exception, it means that either:\n\n" \
+            "1) You are manually setting OmniAuth.config.path_prefix and it doesn't match the Devise one\n" \
+            "2) You are setting :omniauthable in more than one model\n" \
+            "3) You changed your Devise routes/OmniAuth setting and haven't restarted your server"
         else
           ::OmniAuth.config.path_prefix = path_prefix
         end

lib/devise/test_helpers.rb

@@ -15,9 +15,8 @@ module Devise
 
     # Override process to consider warden.
     def process(*)
-      result = nil
-      _catch_warden { result = super }
-      result
+      # Make sure we always return @response, a la ActionController::TestCase::Behaviour#process, even if warden interrupts
+      _catch_warden { super } || @response
     end
 
     # We need to setup the environment variables and the response in the controller.
@@ -66,6 +65,8 @@ module Devise
 
     protected
 
+    # Catch warden continuations and handle like the middleware would.
+    # Returns nil when interrupted, otherwise the normal result of the block.
     def _catch_warden(&block)
       result = catch(:warden, &block)
 

lib/devise/version.rb

@@ -1,3 +1,3 @@
 module Devise
-  VERSION = "2.0.0.rc2".freeze
+  VERSION = "2.0.6".freeze
 end

lib/generators/devise/devise_generator.rb

@@ -1,6 +1,8 @@
 module Devise
   module Generators
     class DeviseGenerator < Rails::Generators::NamedBase
+      include Rails::Generators::ResourceHelpers
+
       namespace "devise"
       source_root File.expand_path("../templates", __FILE__)
 

lib/generators/devise/views_generator.rb

@@ -13,6 +13,13 @@ module Devise
         public_task :copy_views
       end
 
+      # TODO: Add this to Rails itslef
+      module ClassMethods
+        def hide!
+          Rails::Generators.hide_namespace self.namespace
+        end
+      end
+
       def copy_views
         view_directory :confirmations
         view_directory :passwords
@@ -36,18 +43,21 @@ module Devise
       include ViewPathTemplates
       source_root File.expand_path("../../../../app/views/devise", __FILE__)
       desc "Copies default Devise views to your application."
+      hide!
     end
 
     class SimpleFormForGenerator < Rails::Generators::Base #:nodoc:
       include ViewPathTemplates
       source_root File.expand_path("../../templates/simple_form_for", __FILE__)
       desc "Copies simple form enabled views to your application."
+      hide!
     end
 
     class ErbGenerator < Rails::Generators::Base #:nodoc:
       include ViewPathTemplates
       source_root File.expand_path("../../../../app/views/devise", __FILE__)
       desc "Copies Devise mail erb views to your application."
+      hide!
 
       def copy_views
         view_directory :mailer
@@ -58,6 +68,7 @@ module Devise
       include ViewPathTemplates
       source_root File.expand_path("../../templates", __FILE__)
       desc "Copies Devise mail markerb views to your application."
+      hide!
 
       def copy_views
         view_directory :markerb, target_path

lib/generators/templates/README

@@ -1,15 +1,14 @@
-
 ===============================================================================
 
 Some setup you must do manually if you haven't yet:
 
-  1. Setup default url options for your specific environment. Here is an
-     example of development environment:
+  1. Ensure you have defined default url options in your environments files. Here 
+     is an example of default_url_options appropriate for a development environment 
+     in config/environments/development.rb:
 
        config.action_mailer.default_url_options = { :host => 'localhost:3000' }
 
-     This is a required Rails configuration. In production it must be the
-     actual host of your application
+     In production, :host should be set to the actual host of your application.
 
   2. Ensure you have defined root_url to *something* in your config/routes.rb.
      For example:

lib/generators/templates/simple_form_for/registrations/edit.html.erb

@@ -5,7 +5,7 @@
 
   <div class="inputs">
     <%= f.input :email, :required => true, :autofocus => true %>
-    <%= f.input :password, :hint => "leave it blank if you don't want to change it", :required => false %>
+    <%= f.input :password, :autocomplete => "off", :hint => "leave it blank if you don't want to change it", :required => false %>
     <%= f.input :password_confirmation, :required => false %>
     <%= f.input :current_password, :hint => "we need your current password to confirm your changes", :required => true %>
   </div>

test/controllers/helpers_test.rb

@@ -141,7 +141,7 @@ class ControllerAuthenticatableTest < ActionController::TestCase
 
   test 'sign out clears up any signed in user by scope' do
     user = User.new
-    @mock_warden.expects(:user).with(:user).returns(user)
+    @mock_warden.expects(:user).with(:scope => :user, :run_callbacks => false).returns(user)
     @mock_warden.expects(:logout).with(:user).returns(true)
     @controller.instance_variable_set(:@current_user, user)
     @controller.sign_out(:user)
@@ -149,13 +149,13 @@ class ControllerAuthenticatableTest < ActionController::TestCase
   end
   
   test 'sign out proxy to logout on warden' do
-    @mock_warden.expects(:user).with(:user).returns(true)
+    @mock_warden.expects(:user).with(:scope => :user, :run_callbacks => false).returns(true)
     @mock_warden.expects(:logout).with(:user).returns(true)
     @controller.sign_out(:user)
   end
 
   test 'sign out accepts a resource as argument' do
-    @mock_warden.expects(:user).with(:user).returns(true)
+    @mock_warden.expects(:user).with(:scope => :user, :run_callbacks => false).returns(true)
     @mock_warden.expects(:logout).with(:user).returns(true)
     @controller.sign_out(User.new)
   end
@@ -230,7 +230,7 @@ class ControllerAuthenticatableTest < ActionController::TestCase
 
   test 'sign out and redirect uses the configured after sign out path when signing out only the current scope' do
     swap Devise, :sign_out_all_scopes => false do
-      @mock_warden.expects(:user).with(:admin).returns(true)
+      @mock_warden.expects(:user).with(:scope => :admin, :run_callbacks => false).returns(true)
       @mock_warden.expects(:logout).with(:admin).returns(true)
       @controller.expects(:redirect_to).with(admin_root_path)
       @controller.instance_eval "def after_sign_out_path_for(resource); admin_root_path; end"

test/controllers/internal_helpers_test.rb

@@ -71,19 +71,21 @@ class HelpersTest < ActionController::TestCase
   end
 
   test 'does not issue blank flash messages' do
-    MyController.send(:public, :set_flash_message)
     I18n.stubs(:t).returns('   ')
-    @controller.set_flash_message :notice, :send_instructions
+    @controller.send :set_flash_message, :notice, :send_instructions
     assert flash[:notice].nil?
-    MyController.send(:protected, :set_flash_message)
   end
 
   test 'issues non-blank flash messages normally' do
-    MyController.send(:public, :set_flash_message)
     I18n.stubs(:t).returns('non-blank')
-    @controller.set_flash_message :notice, :send_instructions
-    assert flash[:notice] == 'non-blank'
-    MyController.send(:protected, :set_flash_message)
+    @controller.send :set_flash_message, :notice, :send_instructions
+    assert_equal 'non-blank', flash[:notice]
+  end
+
+  test 'uses custom i18n options' do
+    @controller.stubs(:devise_i18n_options).returns(:default => "devise custom options")
+    @controller.send :set_flash_message, :notice, :invalid_i18n_messagesend_instructions
+    assert_equal 'devise custom options', flash[:notice]
   end
 
   test 'navigational_formats not returning a wild card' do

test/integration/recoverable_test.rb

@@ -195,15 +195,6 @@ class PasswordTest < ActionController::IntegrationTest
     assert !warden.authenticated?(:user)
   end
 
-  test 'sign in user automatically and confirm after changing its password if it\'s not confirmed' do
-    user = create_user(:confirm => false)
-    request_forgot_password
-    reset_password :reset_password_token => user.reload.reset_password_token
-
-    assert warden.authenticated?(:user)
-    assert user.reload.confirmed?
-  end
-
   test 'reset password request with valid E-Mail in XML format should return valid response' do
     create_user
     post user_password_path(:format => 'xml'), :user => {:email => "user@test.com"}

test/integration/rememberable_test.rb

@@ -51,7 +51,7 @@ class RememberMeTest < ActionController::IntegrationTest
     # We test this by asserting the cookie is not sent after the redirect
     # since we changed the domain. This is the only difference with the
     # previous test.
-    swap Devise, :cookie_options => { :domain => "omg.somewhere.com" } do
+    swap Devise, :rememberable_options => { :domain => "omg.somewhere.com" } do
       user = sign_in_as_user :remember_me => true
       assert_nil request.cookies["remember_user_token"]
     end

test/integration/timeoutable_test.rb

@@ -50,10 +50,12 @@ class SessionTimeoutTest < ActionController::IntegrationTest
     get expire_user_path(user)
 
     get destroy_user_session_path
+
     assert_response :redirect
     assert_redirected_to root_path
 
     follow_redirect!
+
     assert_contain 'Signed out successfully'
   end
 

test/models/authenticatable_test.rb

@@ -0,0 +1,9 @@
+require 'test_helper'
+
+class AuthenticatableTest < ActiveSupport::TestCase
+  test 'find_first_by_auth_conditions allows custom filtering parameters' do
+    user = User.create!(:email => "example@example.com", :password => "123456")
+    assert_equal User.find_first_by_auth_conditions({ :email => "example@example.com" }), user
+    assert_equal User.find_first_by_auth_conditions({ :email => "example@example.com" }, :id => user.id + 1), nil
+  end
+end

test/models/database_authenticatable_test.rb

@@ -23,15 +23,9 @@ class DatabaseAuthenticatableTest < ActiveSupport::TestCase
   end
 
   test "param filter should not convert booleans and integer to strings" do
-    conditions = { 'login' => 'foo@bar.com', "bool1" => true, "bool2" => false, "fixnum" => 123, "will_be_converted" => (1..10) }
+    conditions = { "login" => "foo@bar.com", "bool1" => true, "bool2" => false, "fixnum" => 123, "will_be_converted" => (1..10) }
     conditions = Devise::ParamFilter.new([], []).filter(conditions)
-    assert_equal( { 'login' => 'foo@bar.com', "bool1" => true, "bool2" => false, "fixnum" => 123, "will_be_converted" => "1..10" }, conditions)
-  end
-
-  test "param filter should not convert regular expressions to strings" do
-    conditions = { "regexp" => /expression/ }
-    conditions = Devise::ParamFilter.new([], []).filter(conditions)
-    assert_equal( { "regexp" => /expression/ }, conditions)
+    assert_equal( { "login" => "foo@bar.com", "bool1" => "true", "bool2" => "false", "fixnum" => "123", "will_be_converted" => "1..10" }, conditions)
   end
 
   test 'should respond to password and password confirmation' do

test/models/serializable_test.rb

@@ -6,8 +6,8 @@ class SerializableTest < ActiveSupport::TestCase
   end
 
   test 'should not include unsafe keys on XML' do
-    assert_match /email/, @user.to_xml 
-    assert_no_match /confirmation-token/, @user.to_xml 
+    assert_match /email/, @user.to_xml
+    assert_no_match /confirmation-token/, @user.to_xml
   end
 
   test 'should not include unsafe keys on XML even if a new except is provided' do
@@ -21,18 +21,28 @@ class SerializableTest < ActiveSupport::TestCase
   end
 
   test 'should not include unsafe keys on JSON' do
-    assert_match /"email":/, @user.to_json 
-    assert_no_match /"confirmation_token":/, @user.to_json 
+    assert_equal %w(created_at email facebook_token id updated_at username), from_json().keys.sort
   end
 
   test 'should not include unsafe keys on JSON even if a new except is provided' do
-    assert_no_match /"email":/, @user.to_json(:except => :email)
-    assert_no_match /"confirmation_token":/, @user.to_json(:except => :email)
+    assert_no_key "email", from_json(:except => :email)
+    assert_no_key "confirmation_token", from_json(:except => :email)
   end
 
   test 'should include unsafe keys on JSON if a force_except is provided' do
-    assert_no_match /"email":/, @user.to_json(:force_except => :email)
-    assert_match /"confirmation_token":/, @user.to_json(:force_except => :email)
+    assert_no_key "email", from_json(:force_except => :email)
+    assert_key "confirmation_token", from_json(:force_except => :email)
   end
 
+  def assert_key(key, subject)
+    assert subject.key?(key), "Expected #{subject.inspect} to have key #{key.inspect}"
+  end
+
+  def assert_no_key(key, subject)
+    assert !subject.key?(key), "Expected #{subject.inspect} to not have key #{key.inspect}"
+  end
+
+  def from_json(options=nil)
+    ActiveSupport::JSON.decode(@user.to_json(options))["user"]
+  end
 end

test/path_checker_test.rb

@@ -1,21 +0,0 @@
-require 'test_helper'
-
-class PathCheckerTest < ActiveSupport::TestCase
-  test 'check if sign out path matches' do
-    path_checker = Devise::PathChecker.new({"PATH_INFO" => "/users/sign_out"}, :user)
-    assert path_checker.signing_out?
-
-    path_checker = Devise::PathChecker.new({"PATH_INFO" => "/users/sign_in"}, :user)
-    assert_not path_checker.signing_out?
-  end
-
-  test 'considers script name' do
-    path_checker = Devise::PathChecker.new({"SCRIPT_NAME" => "/users", "PATH_INFO" => "/sign_out"}, :user)
-    assert path_checker.signing_out?
-  end
-
-  test 'ignores invalid routes' do
-    path_checker = Devise::PathChecker.new({"PATH_INFO" => "/users/sign_in"}, :omg)
-    assert_not path_checker.signing_out?
-  end
-end

test/rails_app/app/controllers/application_controller.rb

@@ -3,6 +3,6 @@
 
 class ApplicationController < ActionController::Base
   protect_from_forgery
-  before_filter :current_user
+  before_filter :current_user, :unless => :devise_controller?
   before_filter :authenticate_user!, :if => :devise_controller?
 end