Test against JRuby.

Fix release date in CHANGELOG.md

.travis.yml

@@ -1,22 +1,27 @@
 language: ruby
 
 rvm:
-  - 2.1.5
-  - 2.2.4
-  - 2.3.0
+  - 2.1.9
+  - 2.2.5
+  - 2.3.1
+  - ruby-head
+  - jruby-9.0.5.0
 
 gemfile:
+  - Gemfile
+  - gemfiles/Gemfile.rails-5.0
   - gemfiles/Gemfile.rails-4.2-stable
   - gemfiles/Gemfile.rails-4.1-stable
-  - gemfiles/Gemfile.rails-5.0-beta
-  - Gemfile
 
 matrix:
   exclude:
-    - rvm: 2.1.5
-      gemfile: gemfiles/Gemfile.rails-5.0-beta
+    - rvm: 2.1.9
+      gemfile: gemfiles/Gemfile.rails-5.0
     - env: DEVISE_ORM=mongoid
-      gemfile: gemfiles/Gemfile.rails-5.0-beta
+      gemfile: gemfiles/Gemfile.rails-5.0
+  allow_failures:
+    - rvm: ruby-head
+  fast_finish: true
 services:
   - mongodb
 
@@ -26,14 +31,14 @@ cache: bundler
 
 env:
   matrix:
-    - DEVISE_ORM=mongoid
     - DEVISE_ORM=active_record
+    - DEVISE_ORM=mongoid
 
 before_install: "rm ${BUNDLE_GEMFILE}.lock"
 
 before_script: "bundle update"
 
-script: "bundle exec rake test"
+script: "bin/test"
 
 notifications:
   email: false

CHANGELOG.md

@@ -1,4 +1,127 @@
-### 4.0.0.rc1 - 2016-01-02
+### Unreleased
+
+* removals
+  * Remove the deprecated `Devise::ParameterSanitizer` API from Devise 3.
+    Please use the `#permit` and `#sanitize` methods over `#for`.
+  * Remove the deprecated OmniAuth URL helpers. Use the fully qualified helpers
+    (`user_facebook_omniauth_authorize_path`) over the scope based helpers
+    ( `user_omniauth_authorize_path(:facebook)`).
+  * Remove the `Devise.bcrypt` method, use `Devise::Encryptor.digest` instead.
+  * Remove the `Devise::Models::Confirmable#confirm!` method, use `confirm` instead.
+  * Remove the `Devise::Models::Recoverable#reset_password!` method, use `reset_password` instead.
+  * Remove the `Devise::Models::Recoverable#after_password_reset` method.
+* enhancements
+  * Display the minimum password length on `registrations/edit` view (by @Yanchek99).
+  * You can disable Devise's routes reloading on boot by through the `reload_routes = false` config.
+    This can reduce the time taken to boot the application but it might trigger
+    some errors if you application (mostly your controllers) requires that
+    Devise mappings be loaded during boot time (by @sidonath).
+  * Added `Devise::Test::IntegrationHelpers` to bypass the sign in process using
+    Warden test API (by @lucasmazza).
+* deprecations
+  * `Devise::TestHelpers` is deprecated in favor of `Devise::Test::ControllerHelpers`
+    (by @lucasmazza).
+  * The `sign_in` test helper has changed to use keyword arguments when passing
+    a scope. `sign_in :admin, users(:alice)` should be rewritten as
+    `sign_in users(:alice), scope: :admin` (by @lucasmazza).
+  * The option `bypass` of `Devise::Controllers::SignInOut#sign_in` method is
+    deprecated in favor of `Devise::Controllers::SignInOut#bypass_sign_in`
+    method (by @ulissesalmeida).
+
+### 4.1.1 - 2016-05-15
+
+* bug fixes
+  * Fix overwriting the remember_token when a valid one already exists (by @ralinchimev).
+
+### 4.1.0
+
+* bug fixes
+  * Fix race condition of sending the confirmation instructions e-mail using background jobs.
+    Using the previous `after_create` callback, the e-mail can be sent before
+    the record be committed on database, generating a `ActiveRecord::NotFound` error.
+    Now the confirmation e-mail will be only sent after the database commit,
+    using the `after_commit` callback.
+    It may break your test suite on Rails 4 if you are testing the sent e-mails
+    or enqueued jobs using transactional fixtures enabled or `DatabaseCleaner` with `transaction` strategy.
+    You can easily fix your test suite using the gem
+    [test_after_commit](https://github.com/grosser/test_after_commit). For example, put in your Gemfile:
+
+    ```ruby
+      gem 'test_after_commit', :group => :test
+    ```
+
+    On Rails 5 `after_commit` callbacks are triggered even using transactional
+    fixtures, then this fix will not break your test suite. If you are using `DatabaseCleaner` with the `deletion` or `truncation` strategies it may not break your tests. (by @allenwq)
+  * Fix strategy checking in `Lockable#unlock_strategy_enabled?` for `:none` and
+  `:undefined` strategies. (by @f3ndot)
+* features
+  * Humanize authentication keys in failure flash message (by @byzg)
+    When you are configuring the translations of `devise.failure.invalid`, the
+    `authentication_keys` is translated now.
+* deprecations
+  * Remove code supporting old session serialization format (by @fphilipe).
+  * Now the `email_regexp` default uses a more permissive regex:
+    `/\A[^@\s]+@[^@\s]+\z/` (by @kimgb)
+  * Now the `strip_whitespace_keys` default is `[:email]` (by @ulissesalmeida)
+  * Now the `reconfirmable` default is `true` (by @ulissesalmeida)
+  * Now the `skip_session_storage` default is `[:http_auth]` (by @ulissesalmeida)
+  * Now the `sign_out_via` default is `:delete` (by @ulissesalmeida)
+* improvements
+  * Avoids extra computation of friendly token for confirmation token (by @sbc100)
+
+### 4.0.3 - 2016-05-15
+
+  * bug fixes
+    * Fix overwriting the remember_token when a valid one already exists (by @ralinchimev).
+
+### 4.0.2 - 2016-05-02
+
+* bug fixes
+  * Fix strategy checking in `Lockable#unlock_strategy_enabled?` for `:none`
+    and `:undefined` strategies. (by @f3ndot)
+
+### 4.0.1 - 2016-04-25
+
+* bug fixes
+  * Fix the e-mail confirmation instructions send when a user updates the email
+    address from nil. (by @lmduc)
+  * Remove unnecessary `attribute_will_change!` call. (by @cadejscroggins)
+  * Consistent `permit!` check. (by @ulissesalmeida)
+
+### 4.0.0 - 2016-04-18
+
+* bug fixes
+  * Fix the `extend_remember_period` configuration. When set to `false` it does
+    not update the cookie expiration anymore.(by @ulissesalmeida)
+
+* deprecations
+  * Added a warning of default value change in Devise 4.1 for users that uses
+    the the default configuration of the following configurations: (by @ulissesalmeida)
+    * `strip_whitespace_keys` - The default will be `[:email]`.
+    * `skip_session_storage` - The default will be `[:http_auth]`.
+    * `sign_out_via` - The default will be `:delete`.
+    * `reconfirmable` - The default will be `true`.
+    * `email_regexp` - The default will be `/\A[^@\s]+@[^@\s]+\z/`.
+  * Removed deprecated argument of `Devise::Models::Rememberable#remember_me!` (by @ulissesalmeida)
+  * Removed deprecated private method Devise::Controllers::Helpers#expire_session_data_after_sign_in!
+    (by @bogdanvlviv)
+
+### 4.0.0.rc2 - 2016-03-09
+
+* enhancements
+  * Introduced `DeviseController#set_flash_message!` for conditional flash
+    messages setting to reduce complexity.
+  * `rails g devise:install` will fail if the app does not have a ORM configured
+    (by @arjunsharma)
+  * Support to Rails 5 versioned migrations added.
+
+* deprecations
+  * omniauth routes are no longer defined with a wildcard `:provider` parameter,
+    and provider specific routes are defined instead, so route helpers like `user_omniauth_authorize_path(:github)` are deprecated in favor of `user_github_omniauth_authorize_path`.
+    You can still use `omniauth_authorize_path(:user, :github)` if you need to
+    call the helpers dynamically.
+
+### 4.0.0.rc1 - 2016-02-01
 
 * Support added to Rails 5 (by @twalpole).
 * Devise no longer supports Rails 3.2 and 4.0.

CONTRIBUTING.md

@@ -1,16 +1,39 @@
 ### Please read before contributing
 
-1) Do not post questions in the issues tracker. If you have any questions about Devise, search the [Wiki](https://github.com/plataformatec/devise/wiki) or use the [Mailing List](https://groups.google.com/group/plataformatec-devise) or [Stack Overflow](http://stackoverflow.com/questions/tagged/devise).
+1) Do not post questions in the issues tracker. If you have any questions about
+Devise, search the [Wiki](https://github.com/plataformatec/devise/wiki) or use
+the [Mailing List](https://groups.google.com/group/plataformatec-devise) or
+[Stack Overflow](http://stackoverflow.com/questions/tagged/devise).
 
-2) If you find a security bug, **DO NOT** submit an issue here. Please send an e-mail to [opensource@plataformatec.com.br](mailto:opensource@plataformatec.com.br) instead.
+2) If you find a security bug, **DO NOT** submit an issue here. Please send an
+e-mail to [opensource@plataformatec.com.br](mailto:opensource@plataformatec.com.br)
+instead.
 
-3) Do a small search on the issues tracker before submitting your issue to see if it was already reported / fixed.
+3) If possible, replicate your issue with our
+[guides/bug_report_templates/integration_test.rb](test case example), and attach
+it to your issue or Pull Request - this way we have an isolated way to replicate
+your issue and investigate it further.
 
-4) When reporting an issue, include Rails, Devise and Warden versions. If you are getting exceptions, please include the full backtrace.
+4) Otherwise, please provide a fresh new Rails application that replicates your
+issue on a public GitHub repository, as some scenarios might not be possible to
+replicate using the standalone test case example.
 
-5) Notice that all of your interactions in the project are expected to follow our [Code of Conduct](CODE_OF_CONDUCT.md)
+5) Do a small search on the issues tracker before submitting your issue to see
+if it was already reported / fixed. Duplicated issues will be closed to avoid
+too much noise/duplication in the issue tracker.
 
-That's it! The more information you give, the easier it becomes for us to track it down and fix it.
-Ideally, you should provide an application that reproduces the error or a test case to Devise's suite.
+6) When reporting an issue, include Rails, Devise and Warden versions. If you
+are getting exceptions, please include the full backtrace.
+
+7) Please do not attempt to translate Devise built in views. The views are meant
+to be a starting point and not a final version. For historical references,
+please look into closed issues/Pull regarding i18n.
+
+8) Notice that all of your interactions in the project are expected to follow
+our [Code of Conduct](CODE_OF_CONDUCT.md)
+
+That's it! The more information you give, the easier it becomes for us to track
+it down and fix it. Ideally, you should provide an application that reproduces
+the error or a test case to Devise's suite.
 
 Thanks!

Gemfile

@@ -2,16 +2,17 @@ source "https://rubygems.org"
 
 gemspec
 
-gem "rails", "4.2.2"
-gem "omniauth", "~> 1.2.0"
-gem "omniauth-oauth2", "~> 1.1.0"
+gem "rails", "~> 4.2.6"
+gem "omniauth"
+gem "omniauth-oauth2"
 gem "rdoc"
 
 group :test do
   gem "omniauth-facebook"
-  gem "omniauth-openid", "~> 1.0.1"
+  gem "omniauth-openid"
   gem "webrat", "0.7.3", require: false
   gem "mocha", "~> 1.1", require: false
+  gem 'test_after_commit', require: false
 end
 
 platforms :jruby do
@@ -25,5 +26,5 @@ platforms :ruby do
 end
 
 group :mongoid do
-  gem "mongoid", "~> 4.0"
+  gem "mongoid", "~> 5.0"
 end

Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    devise (4.0.0.rc1)
+    devise (4.1.0)
       bcrypt (~> 3.0)
       orm_adapter (~> 0.1)
       railties (>= 4.1.0, < 5.1)
@@ -11,100 +11,96 @@ PATH
 GEM
   remote: https://rubygems.org/
   specs:
-    actionmailer (4.2.2)
-      actionpack (= 4.2.2)
-      actionview (= 4.2.2)
-      activejob (= 4.2.2)
+    actionmailer (4.2.6)
+      actionpack (= 4.2.6)
+      actionview (= 4.2.6)
+      activejob (= 4.2.6)
       mail (~> 2.5, >= 2.5.4)
       rails-dom-testing (~> 1.0, >= 1.0.5)
-    actionpack (4.2.2)
-      actionview (= 4.2.2)
-      activesupport (= 4.2.2)
+    actionpack (4.2.6)
+      actionview (= 4.2.6)
+      activesupport (= 4.2.6)
       rack (~> 1.6)
       rack-test (~> 0.6.2)
       rails-dom-testing (~> 1.0, >= 1.0.5)
-      rails-html-sanitizer (~> 1.0, >= 1.0.1)
-    actionview (4.2.2)
-      activesupport (= 4.2.2)
+      rails-html-sanitizer (~> 1.0, >= 1.0.2)
+    actionview (4.2.6)
+      activesupport (= 4.2.6)
       builder (~> 3.1)
       erubis (~> 2.7.0)
       rails-dom-testing (~> 1.0, >= 1.0.5)
-      rails-html-sanitizer (~> 1.0, >= 1.0.1)
-    activejob (4.2.2)
-      activesupport (= 4.2.2)
+      rails-html-sanitizer (~> 1.0, >= 1.0.2)
+    activejob (4.2.6)
+      activesupport (= 4.2.6)
       globalid (>= 0.3.0)
-    activemodel (4.2.2)
-      activesupport (= 4.2.2)
+    activemodel (4.2.6)
+      activesupport (= 4.2.6)
       builder (~> 3.1)
-    activerecord (4.2.2)
-      activemodel (= 4.2.2)
-      activesupport (= 4.2.2)
+    activerecord (4.2.6)
+      activemodel (= 4.2.6)
+      activesupport (= 4.2.6)
       arel (~> 6.0)
-    activesupport (4.2.2)
+    activesupport (4.2.6)
       i18n (~> 0.7)
       json (~> 1.7, >= 1.7.7)
       minitest (~> 5.1)
       thread_safe (~> 0.3, >= 0.3.4)
       tzinfo (~> 1.1)
     arel (6.0.3)
-    bcrypt (3.1.10)
-    bson (3.2.6)
+    bcrypt (3.1.11)
+    bson (4.1.1)
     builder (3.2.2)
-    concurrent-ruby (1.0.0)
-    connection_pool (2.2.0)
+    concurrent-ruby (1.0.2)
     erubis (2.7.0)
     faraday (0.9.2)
       multipart-post (>= 1.2, < 3)
     globalid (0.3.6)
       activesupport (>= 4.1.0)
-    hashie (3.4.3)
+    hashie (3.4.4)
     i18n (0.7.0)
     json (1.8.3)
-    jwt (1.5.2)
+    jwt (1.5.1)
     loofah (2.0.3)
       nokogiri (>= 1.5.9)
-    mail (2.6.3)
-      mime-types (>= 1.16, < 3)
+    mail (2.6.4)
+      mime-types (>= 1.16, < 4)
     metaclass (0.0.4)
-    mime-types (2.99)
+    mime-types (3.0)
+      mime-types-data (~> 3.2015)
+    mime-types-data (3.2016.0221)
     mini_portile2 (2.0.0)
-    minitest (5.8.4)
+    minitest (5.9.0)
     mocha (1.1.0)
       metaclass (~> 0.0.1)
-    mongoid (4.0.2)
+    mongo (2.2.5)
+      bson (~> 4.0)
+    mongoid (5.1.3)
       activemodel (~> 4.0)
-      moped (~> 2.0.0)
-      origin (~> 2.1)
+      mongo (~> 2.1)
+      origin (~> 2.2)
       tzinfo (>= 0.3.37)
-    moped (2.0.7)
-      bson (~> 3.0)
-      connection_pool (~> 2.0)
-      optionable (~> 0.2.0)
-    multi_json (1.11.2)
+    multi_json (1.12.0)
     multi_xml (0.5.5)
     multipart-post (2.0.0)
     nokogiri (1.6.7.2)
       mini_portile2 (~> 2.0.0.rc2)
-    oauth2 (0.9.4)
+    oauth2 (1.1.0)
       faraday (>= 0.8, < 0.10)
-      jwt (~> 1.0)
+      jwt (~> 1.0, < 1.5.2)
       multi_json (~> 1.3)
       multi_xml (~> 0.5)
-      rack (~> 1.2)
-    omniauth (1.2.2)
+      rack (>= 1.2, < 3)
+    omniauth (1.3.1)
       hashie (>= 1.2, < 4)
-      rack (~> 1.0)
-    omniauth-facebook (1.6.0)
-      omniauth-oauth2 (~> 1.1)
-    omniauth-oauth2 (1.1.2)
-      faraday (>= 0.8, < 0.10)
-      multi_json (~> 1.3)
-      oauth2 (~> 0.9.3)
+      rack (>= 1.0, < 3)
+    omniauth-facebook (3.0.0)
+      omniauth-oauth2 (~> 1.2)
+    omniauth-oauth2 (1.4.0)
+      oauth2 (~> 1.0)
       omniauth (~> 1.2)
     omniauth-openid (1.0.1)
       omniauth (~> 1.0)
       rack-openid (~> 1.3.1)
-    optionable (0.2.0)
     origin (2.2.0)
     orm_adapter (0.5.0)
     rack (1.6.4)
@@ -113,16 +109,16 @@ GEM
       ruby-openid (>= 2.1.8)
     rack-test (0.6.3)
       rack (>= 1.0)
-    rails (4.2.2)
-      actionmailer (= 4.2.2)
-      actionpack (= 4.2.2)
-      actionview (= 4.2.2)
-      activejob (= 4.2.2)
-      activemodel (= 4.2.2)
-      activerecord (= 4.2.2)
-      activesupport (= 4.2.2)
+    rails (4.2.6)
+      actionmailer (= 4.2.6)
+      actionpack (= 4.2.6)
+      actionview (= 4.2.6)
+      activejob (= 4.2.6)
+      activemodel (= 4.2.6)
+      activerecord (= 4.2.6)
+      activesupport (= 4.2.6)
       bundler (>= 1.3.0, < 2.0)
-      railties (= 4.2.2)
+      railties (= 4.2.6)
       sprockets-rails
     rails-deprecated_sanitizer (1.0.3)
       activesupport (>= 4.2.0.alpha)
@@ -132,24 +128,27 @@ GEM
       rails-deprecated_sanitizer (>= 1.0.1)
     rails-html-sanitizer (1.0.3)
       loofah (~> 2.0)
-    railties (4.2.2)
-      actionpack (= 4.2.2)
-      activesupport (= 4.2.2)
+    railties (4.2.6)
+      actionpack (= 4.2.6)
+      activesupport (= 4.2.6)
       rake (>= 0.8.7)
       thor (>= 0.18.1, < 2.0)
-    rake (10.5.0)
-    rdoc (4.2.1)
-    responders (2.1.1)
+    rake (11.1.2)
+    rdoc (4.2.2)
+      json (~> 1.4)
+    responders (2.2.0)
       railties (>= 4.2.0, < 5.1)
     ruby-openid (2.7.0)
-    sprockets (3.5.2)
+    sprockets (3.6.0)
       concurrent-ruby (~> 1.0)
       rack (> 1, < 3)
-    sprockets-rails (3.0.0)
+    sprockets-rails (3.0.4)
       actionpack (>= 4.0)
       activesupport (>= 4.0)
       sprockets (>= 3.0.0)
     sqlite3 (1.3.11)
+    test_after_commit (1.0.0)
+      activerecord (>= 3.2)
     thor (0.19.1)
     thread_safe (0.3.5)
     tzinfo (1.2.2)
@@ -170,14 +169,15 @@ DEPENDENCIES
   devise!
   jruby-openssl
   mocha (~> 1.1)
-  mongoid (~> 4.0)
-  omniauth (~> 1.2.0)
+  mongoid (~> 5.0)
+  omniauth
   omniauth-facebook
-  omniauth-oauth2 (~> 1.1.0)
-  omniauth-openid (~> 1.0.1)
-  rails (= 4.2.2)
+  omniauth-oauth2
+  omniauth-openid
+  rails (~> 4.2.6)
   rdoc
   sqlite3
+  test_after_commit
   webrat (= 0.7.3)
 
 BUNDLED WITH

README.md

@@ -4,7 +4,6 @@ By [Plataformatec](http://plataformatec.com.br/).
 
 [![Build Status](https://api.travis-ci.org/plataformatec/devise.svg?branch=master)](http://travis-ci.org/plataformatec/devise)
 [![Code Climate](https://codeclimate.com/github/plataformatec/devise.svg)](https://codeclimate.com/github/plataformatec/devise)
-[![Security](https://hakiri.io/github/plataformatec/devise/master.svg)](https://hakiri.io/github/plataformatec/devise/master)
 
 This README is [also available in a friendly navigable format](http://devise.plataformatec.com.br/).
 
@@ -17,7 +16,7 @@ Devise is a flexible authentication solution for Rails based on Warden. It:
 
 It's composed of 10 modules:
 
-* [Database Authenticatable](http://rubydoc.info/github/plataformatec/devise/master/Devise/Models/DatabaseAuthenticatable): encrypts and stores a password in the database to validate the authenticity of a user while signing in. The authentication can be done both through POST requests or HTTP Basic Authentication.
+* [Database Authenticatable](http://rubydoc.info/github/plataformatec/devise/master/Devise/Models/DatabaseAuthenticatable): hashes and stores a password in the database to validate the authenticity of a user while signing in. The authentication can be done both through POST requests or HTTP Basic Authentication.
 * [Omniauthable](http://rubydoc.info/github/plataformatec/devise/master/Devise/Models/Omniauthable): adds OmniAuth (https://github.com/intridea/omniauth) support.
 * [Confirmable](http://rubydoc.info/github/plataformatec/devise/master/Devise/Models/Confirmable): sends emails with confirmation instructions and verifies whether an account is already confirmed during sign in.
 * [Recoverable](http://rubydoc.info/github/plataformatec/devise/master/Devise/Models/Recoverable): resets the user password and sends reset instructions.
@@ -28,8 +27,6 @@ It's composed of 10 modules:
 * [Validatable](http://rubydoc.info/github/plataformatec/devise/master/Devise/Models/Validatable): provides validations of email and password. It's optional and can be customized, so you're able to define your own validations.
 * [Lockable](http://rubydoc.info/github/plataformatec/devise/master/Devise/Models/Lockable): locks an account after a specified number of failed sign-in attempts. Can unlock via email or after a specified time period.
 
-Devise is guaranteed to be thread-safe on YARV. Thread-safety support on JRuby is in progress.
-
 ## Information
 
 ### The Devise wiki
@@ -92,7 +89,7 @@ Once you have solidified your understanding of Rails and authentication mechanis
 
 ## Getting started
 
-Devise 4.0 works with Rails 4.2 onwards. You can add it to your Gemfile with:
+Devise 4.0 works with Rails 4.1 onwards. You can add it to your Gemfile with:
 
 ```ruby
 gem 'devise'
@@ -103,16 +100,16 @@ Run the bundle command to install it.
 After you install Devise and add it to your Gemfile, you need to run the generator:
 
 ```console
-rails generate devise:install
+$ rails generate devise:install
 ```
 
 The generator will install an initializer which describes ALL of Devise's configuration options. It is *imperative* that you take a look at it. When you are done, you are ready to add Devise to any of your models using the generator:
 
 ```console
-rails generate devise MODEL
+$ rails generate devise MODEL
 ```
 
-Replace MODEL with the class name used for the application’s users (it’s frequently `User` but could also be `Admin`). This will create a model (if one does not exist) and configure it with default Devise modules. The generator also configures your `config/routes.rb` file to point to the Devise controller.
+Replace MODEL with the class name used for the application’s users (it’s frequently `User` but could also be `Admin`). This will create a model (if one does not exist) and configure it with the default Devise modules. The generator also configures your `config/routes.rb` file to point to the Devise controller.
 
 Next, check the MODEL for any additional configuration options you might want to add, such as confirmable or lockable. If you add an option, be sure to inspect the migration file (created by the generator if your ORM supports them) and uncomment the appropriate section.  For example, if you add the confirmable option in the model, you'll need to uncomment the Confirmable section in the migration. Then run `rake db:migrate`
 
@@ -132,6 +129,8 @@ Devise will create some helpers to use inside your controllers and views. To set
 before_action :authenticate_user!
 ```
 
+For Rails 5, note that `protect_from_forgery` is no longer prepended to the `before_action` chain, so if you have set `authenticate_user` before `protect_from_forgery`, your request will result in "Can't verify CSRF token authenticity." To resolve this, either change the order in which you call them, or use `protect_from_forgery prepend: true`.
+
 If your devise model is something other than User, replace "_user" with "_yourmodel". The same logic applies to the instructions below.
 
 To verify if a user is signed in, use the following helper:
@@ -155,7 +154,7 @@ user_session
 After signing in a user, confirming the account or updating the password, Devise will look for a scoped root path to redirect to. For instance, when using a `:user` resource, the `user_root_path` will be used if it exists; otherwise, the default `root_path` will be used. This means that you need to set the root inside your routes:
 
 ```ruby
-root to: "home#index"
+root to: 'home#index'
 ```
 
 You can also override `after_sign_in_path_for` and `after_sign_out_path_for` to customize your redirect hooks.
@@ -174,7 +173,7 @@ member_session
 
 ### Configuring Models
 
-The Devise method in your models also accepts some options to configure its modules. For example, you can choose the cost of the encryption algorithm with:
+The Devise method in your models also accepts some options to configure its modules. For example, you can choose the cost of the hashing algorithm with:
 
 ```ruby
 devise :database_authenticatable, :registerable, :confirmable, :recoverable, stretches: 20
@@ -190,7 +189,7 @@ Besides `:stretches`, you can define `:pepper`, `:encryptor`, `:confirm_within`,
 
 When you customize your own views, you may end up adding new attributes to forms. Rails 4 moved the parameter sanitization from the model to the controller, causing Devise to handle this concern at the controller as well.
 
-There are just three actions in Devise that allow any set of parameters to be passed down to the model, therefore requiring sanitization. Their names and the permitted parameters by default are:
+There are just three actions in Devise that allow any set of parameters to be passed down to the model, therefore requiring sanitization. Their names and default permitted parameters are:
 
 * `sign_in` (`Devise::SessionsController#create`) - Permits only the authentication keys (like `email`)
 * `sign_up` (`Devise::RegistrationsController#create`) - Permits authentication keys plus `password` and `password_confirmation`
@@ -271,7 +270,7 @@ We built Devise to help you quickly develop an application that uses authenticat
 Since Devise is an engine, all its views are packaged inside the gem. These views will help you get started, but after some time you may want to change them. If this is the case, you just need to invoke the following generator, and it will copy all views to your application:
 
 ```console
-rails generate devise:views
+$ rails generate devise:views
 ```
 
 If you have more than one Devise model in your application (such as `User` and `Admin`), you will notice that Devise uses the same views for all models. Fortunately, Devise offers an easy way to customize views. All you need to do is set `config.scoped_views = true` inside the `config/initializers/devise.rb` file.
@@ -279,14 +278,14 @@ If you have more than one Devise model in your application (such as `User` and `
 After doing so, you will be able to have views based on the role like `users/sessions/new` and `admins/sessions/new`. If no view is found within the scope, Devise will use the default view at `devise/sessions/new`. You can also use the generator to generate scoped views:
 
 ```console
-rails generate devise:views users
+$ rails generate devise:views users
 ```
 
 If you would like to generate only a few sets of views, like the ones for the `registerable` and `confirmable` module,
 you can pass a list of modules to the generator with the `-v` flag.
 
 ```console
-rails generate devise:views -v registrations confirmations
+$ rails generate devise:views -v registrations confirmations
 ```
 
 ### Configuring controllers
@@ -296,7 +295,7 @@ If the customization at the views level is not enough, you can customize each co
 1. Create your custom controllers using the generator which requires a scope:
 
     ```console
-    rails generate devise:controllers [scope]
+    $ rails generate devise:controllers [scope]
     ```
 
     If you specify `users` as the scope, controllers will be created in `app/controllers/users/`.
@@ -315,7 +314,7 @@ If the customization at the views level is not enough, you can customize each co
 2. Tell the router to use this controller:
 
     ```ruby
-    devise_for :users, controllers: { sessions: "users/sessions" }
+    devise_for :users, controllers: { sessions: 'users/sessions' }
     ```
 
 3. Copy the views from `devise/sessions` to `users/sessions`. Since the controller was changed, it won't use the default views located in `devise/sessions`.
@@ -353,7 +352,7 @@ Remember that Devise uses flash messages to let users know if sign in was succes
 Devise also ships with default routes. If you need to customize them, you should probably be able to do it through the devise_for method. It accepts several options like :class_name, :path_prefix and so on, including the possibility to change path names for I18n:
 
 ```ruby
-devise_for :users, path: "auth", path_names: { sign_in: 'login', sign_out: 'logout', password: 'secret', confirmation: 'verification', unlock: 'unblock', registration: 'register', sign_up: 'cmon_let_me_in' }
+devise_for :users, path: 'auth', path_names: { sign_in: 'login', sign_out: 'logout', password: 'secret', confirmation: 'verification', unlock: 'unblock', registration: 'register', sign_up: 'cmon_let_me_in' }
 ```
 
 Be sure to check `devise_for` [documentation](http://www.rubydoc.info/github/plataformatec/devise/master/ActionDispatch/Routing/Mapper%3Adevise_for) for details.
@@ -362,7 +361,7 @@ If you have the need for more deep customization, for instance to also allow "/s
 
 ```ruby
 devise_scope :user do
-  get "sign_in", to: "devise/sessions#new"
+  get 'sign_in', to: 'devise/sessions#new'
 end
 ```
 
@@ -412,45 +411,94 @@ Caution: Devise Controllers inherit from ApplicationController. If your app uses
 
 ### Test helpers
 
-Devise includes some test helpers for functional specs. In order to use them, you need to include Devise in your functional tests by adding the following to the bottom of your `test/test_helper.rb` file:
+Devise includes some test helpers for controller and integration tests.
+In order to use them, you need to include the respective module in your test
+cases/specs.
+
+### Controller tests
+
+Controller tests require that you include `Devise::Test::ControllerHelpers` on
+your test case or its parent `ActionController::TestCase` superclass.
 
 ```ruby
-class ActionController::TestCase
-  include Devise::TestHelpers
+class PostsControllerTest < ActionController::TestCase
+  include Devise::Test::ControllerHelpers
 end
 ```
 
-If you're using RSpec, you can put the following inside a file named `spec/support/devise.rb` or in your `spec/spec_helper.rb` (or `spec/rails_helper.rb` if you are using rspec-rails):
+If you're using RSpec, you can put the following inside a file named
+`spec/support/devise.rb` or in your `spec/spec_helper.rb` (or
+`spec/rails_helper.rb` if you are using `rspec-rails`):
 
 ```ruby
 RSpec.configure do |config|
-  config.include Devise::TestHelpers, type: :controller
-  config.include Devise::TestHelpers, type: :view
+  config.include Devise::Test::ControllerHelpers, type: :controller
+  config.include Devise::Test::ControllerHelpers, type: :view
 end
 ```
 
 Just be sure that this inclusion is made *after* the `require 'rspec/rails'` directive.
 
-Now you are ready to use the `sign_in` and `sign_out` methods. Such methods have the same signature as in controllers:
+Now you are ready to use the `sign_in` and `sign_out` methods on your controller
+tests:
 
 ```ruby
-sign_in :user, @user   # sign_in(scope, resource)
-sign_in @user          # sign_in(resource)
-
-sign_out :user         # sign_out(scope)
-sign_out @user         # sign_out(resource)
+sign_in @user
+sign_in @user, scope: admin
 ```
 
-There are two things that are important to keep in mind:
+If you are testing Devise internal controllers or a controller that inherits
+from Devise's, you need to tell Devise which mapping should be used before a
+request. This is necessary because Devise gets this information from the router,
+but since controller tests do not pass through the router, it needs to be stated
+explicitly. For example, if you are testing the user scope, simply use:
 
-1. These helpers are not going to work for integration tests driven by Capybara or Webrat. They are meant to be used with functional tests only. It is undesirable even to include `Devise::TestHelpers` during integration tests. Instead, fill in the form or explicitly set the user in session;
+```ruby
+test 'GET new' do
+  # Mimic the router behavior of setting the Devise scope through the env.
+  @request.env['devise.mapping'] = Devise.mappings[:user]
 
-2. If you are testing Devise internal controllers or a controller that inherits from Devise's, you need to tell Devise which mapping should be used before a request. This is necessary because Devise gets this information from the router, but since functional tests do not pass through the router, it needs to be stated explicitly. For example, if you are testing the user scope, simply use:
+  # Use the sign_in helper to sign in a fixture `User` record.
+  sign_in users(:alice)
 
-    ```ruby
-    @request.env["devise.mapping"] = Devise.mappings[:user]
-    get :new
-    ```
+  get :new
+
+  # assert something
+end
+```
+
+### Integration tests
+
+Integration test helpers are available by including the
+`Devise::Test::IntegrationHelpers` module.
+
+```ruby
+class PostsTests < ActionDispatch::IntegrationTest
+  include Devise::Test::IntegrationHelpers
+end
+```
+
+Now you can use the following `sign_in` and `sign_out` methods in your integration
+tests:
+
+```ruby
+sign_in users(:bob)
+sign_in users(:bob), scope: :admin
+
+sign_out :user
+```
+
+RSpec users can include the `IntegrationHelpers` module on their `:feature` specs.
+
+```ruby
+RSpec.configure do |config|
+  config.include Devise::Test::IntegrationHelpers, type: :feature
+end
+```
+
+Unlike controller tests, integration tests do not need to supply the
+`devise.mapping` `env` value, as the mapping can be inferred by the routes that
+are executed in your tests.
 
 You can read more about testing your Rails 3 - Rails 4 controllers with RSpec in the wiki:
 

app/controllers/devise/confirmations_controller.rb

@@ -22,7 +22,7 @@ class Devise::ConfirmationsController < DeviseController
     yield resource if block_given?
 
     if resource.errors.empty?
-      set_flash_message(:notice, :confirmed) if is_flashing_format?
+      set_flash_message!(:notice, :confirmed)
       respond_with_navigational(resource){ redirect_to after_confirmation_path_for(resource_name, resource) }
     else
       respond_with_navigational(resource.errors, status: :unprocessable_entity){ render :new }

app/controllers/devise/passwords_controller.rb

@@ -36,10 +36,10 @@ class Devise::PasswordsController < DeviseController
       resource.unlock_access! if unlockable?(resource)
       if Devise.sign_in_after_reset_password
         flash_message = resource.active_for_authentication? ? :updated : :updated_not_active
-        set_flash_message(:notice, flash_message) if is_flashing_format?
+        set_flash_message!(:notice, flash_message)
         sign_in(resource_name, resource)
       else
-        set_flash_message(:notice, :updated_not_active) if is_flashing_format?
+        set_flash_message!(:notice, :updated_not_active)
       end
       respond_with resource, location: after_resetting_password_path_for(resource)
     else

app/controllers/devise/registrations_controller.rb

@@ -1,11 +1,11 @@
 class Devise::RegistrationsController < DeviseController
   prepend_before_action :require_no_authentication, only: [:new, :create, :cancel]
   prepend_before_action :authenticate_scope!, only: [:edit, :update, :destroy]
+  prepend_before_action :set_minimum_password_length, only: [:new, :edit]
 
   # GET /resource/sign_up
   def new
     build_resource({})
-    set_minimum_password_length
     yield resource if block_given?
     respond_with self.resource
   end
@@ -18,11 +18,11 @@ class Devise::RegistrationsController < DeviseController
     yield resource if block_given?
     if resource.persisted?
       if resource.active_for_authentication?
-        set_flash_message :notice, :signed_up if is_flashing_format?
+        set_flash_message! :notice, :signed_up
         sign_up(resource_name, resource)
         respond_with resource, location: after_sign_up_path_for(resource)
       else
-        set_flash_message :notice, :"signed_up_but_#{resource.inactive_message}" if is_flashing_format?
+        set_flash_message! :notice, :"signed_up_but_#{resource.inactive_message}"
         expire_data_after_sign_in!
         respond_with resource, location: after_inactive_sign_up_path_for(resource)
       end
@@ -53,7 +53,7 @@ class Devise::RegistrationsController < DeviseController
           :update_needs_confirmation : :updated
         set_flash_message :notice, flash_key
       end
-      sign_in resource_name, resource, bypass: true
+      bypass_sign_in resource, scope: resource_name
       respond_with resource, location: after_update_path_for(resource)
     else
       clean_up_passwords resource
@@ -65,7 +65,7 @@ class Devise::RegistrationsController < DeviseController
   def destroy
     resource.destroy
     Devise.sign_out_all_scopes ? sign_out : sign_out(resource_name)
-    set_flash_message :notice, :destroyed if is_flashing_format?
+    set_flash_message! :notice, :destroyed
     yield resource if block_given?
     respond_with_navigational(resource){ redirect_to after_sign_out_path_for(resource_name) }
   end

app/controllers/devise/sessions_controller.rb

@@ -15,7 +15,7 @@ class Devise::SessionsController < DeviseController
   # POST /resource/sign_in
   def create
     self.resource = warden.authenticate!(auth_options)
-    set_flash_message(:notice, :signed_in) if is_flashing_format?
+    set_flash_message!(:notice, :signed_in)
     sign_in(resource_name, resource)
     yield resource if block_given?
     respond_with resource, location: after_sign_in_path_for(resource)
@@ -24,7 +24,7 @@ class Devise::SessionsController < DeviseController
   # DELETE /resource/sign_out
   def destroy
     signed_out = (Devise.sign_out_all_scopes ? sign_out : sign_out(resource_name))
-    set_flash_message :notice, :signed_out if signed_out && is_flashing_format?
+    set_flash_message! :notice, :signed_out if signed_out
     yield if block_given?
     respond_to_on_destroy
   end
@@ -58,7 +58,7 @@ class Devise::SessionsController < DeviseController
   # to the after_sign_out path.
   def verify_signed_out_user
     if all_signed_out?
-      set_flash_message :notice, :already_signed_out if is_flashing_format?
+      set_flash_message! :notice, :already_signed_out
 
       respond_to_on_destroy
     end

app/controllers/devise/unlocks_controller.rb

@@ -24,7 +24,7 @@ class Devise::UnlocksController < DeviseController
     yield resource if block_given?
 
     if resource.errors.empty?
-      set_flash_message :notice, :unlocked if is_flashing_format?
+      set_flash_message! :notice, :unlocked
       respond_with_navigational(resource){ redirect_to after_unlock_path_for(resource) }
     else
       respond_with_navigational(resource.errors, status: :unprocessable_entity){ render :new }

app/controllers/devise_controller.rb

@@ -127,13 +127,13 @@ MESSAGE
     end
 
     if notice
-      set_flash_message :notice, notice if is_flashing_format?
+      set_flash_message! :notice, notice
       true
     end
   end
 
   # Sets the flash message with :key, using I18n. By default you are able
-  # to setup your messages using specific resource scope, and if no message is
+  # to set up your messages using specific resource scope, and if no message is
   # found we look to the default scope. Set the "now" options key to a true
   # value to populate the flash.now hash in lieu of the default flash hash (so
   # the flash message will be available to the current action instead of the
@@ -158,6 +158,13 @@ MESSAGE
     end
   end
 
+  # Sets flash message if is_flashing_format? equals true
+  def set_flash_message!(key, kind, options = {})
+    if is_flashing_format?
+      set_flash_message(key, kind, options)
+    end
+  end
+
   # Sets minimum password length to show to user
   def set_minimum_password_length
     if devise_mapping.validatable?

app/views/devise/confirmations/new.html.erb

@@ -5,7 +5,7 @@
 
   <div class="field">
     <%= f.label :email %><br />
-    <%= f.email_field :email, autofocus: true, value: (resource.pending_reconfirmation? ? resource.unconfirmed_email : resource.email) %> 
+    <%= f.email_field :email, autofocus: true, value: (resource.pending_reconfirmation? ? resource.unconfirmed_email : resource.email) %>
   </div>
 
   <div class="actions">

app/views/devise/registrations/edit.html.erb

@@ -15,6 +15,10 @@
   <div class="field">
     <%= f.label :password %> <i>(leave blank if you don't want to change it)</i><br />
     <%= f.password_field :password, autocomplete: "off" %>
+    <% if @minimum_password_length %>
+      <br />
+      <em><%= @minimum_password_length %> characters minimum</em>
+    <% end %>
   </div>
 
   <div class="field">

bin/test

@@ -0,0 +1,13 @@
+#!/usr/bin/env ruby
+$: << File.expand_path(File.expand_path('../../test', __FILE__))
+
+require 'bundler/setup'
+begin
+  require 'rails/test_unit/minitest_plugin'
+rescue LoadError
+  exec 'rake'
+end
+
+Rails::TestUnitReporter.executable = 'bin/test'
+
+exit Minitest.run(ARGV)

gemfiles/Gemfile.rails-4.1-stable

@@ -1,17 +1,18 @@
 source "https://rubygems.org"
 
-gemspec path: '..'
+gemspec path: ".."
 
-gem "rails", github: 'rails/rails', branch: '4-1-stable'
-gem "omniauth", "~> 1.2.0"
-gem "omniauth-oauth2", "~> 1.1.0"
+gem "rails", github: "rails/rails", branch: "4-1-stable"
+gem "omniauth"
+gem "omniauth-oauth2"
 gem "rdoc"
 
 group :test do
   gem "omniauth-facebook"
-  gem "omniauth-openid", "~> 1.0.1"
+  gem "omniauth-openid"
   gem "webrat", "0.7.3", require: false
   gem "mocha", "~> 1.1", require: false
+  gem 'test_after_commit', require: false
 end
 
 platforms :jruby do
@@ -25,5 +26,5 @@ platforms :ruby do
 end
 
 group :mongoid do
-  gem "mongoid", "~> 4.0.0"
+  gem "mongoid", "~> 4.0"
 end

gemfiles/Gemfile.rails-4.1-stable.lock

@@ -1,54 +1,54 @@
 GIT
   remote: git://github.com/rails/rails.git
-  revision: e8eda76893479a29ace8d85cf4e4cfc67cd6fd4b
+  revision: 41b4d81b4fd14cbf43060c223bea0f461256d099
   branch: 4-1-stable
   specs:
-    actionmailer (4.1.14.1)
-      actionpack (= 4.1.14.1)
-      actionview (= 4.1.14.1)
+    actionmailer (4.1.15)
+      actionpack (= 4.1.15)
+      actionview (= 4.1.15)
       mail (~> 2.5, >= 2.5.4)
-    actionpack (4.1.14.1)
-      actionview (= 4.1.14.1)
-      activesupport (= 4.1.14.1)
+    actionpack (4.1.15)
+      actionview (= 4.1.15)
+      activesupport (= 4.1.15)
       rack (~> 1.5.2)
       rack-test (~> 0.6.2)
-    actionview (4.1.14.1)
-      activesupport (= 4.1.14.1)
+    actionview (4.1.15)
+      activesupport (= 4.1.15)
       builder (~> 3.1)
       erubis (~> 2.7.0)
-    activemodel (4.1.14.1)
-      activesupport (= 4.1.14.1)
+    activemodel (4.1.15)
+      activesupport (= 4.1.15)
       builder (~> 3.1)
-    activerecord (4.1.14.1)
-      activemodel (= 4.1.14.1)
-      activesupport (= 4.1.14.1)
+    activerecord (4.1.15)
+      activemodel (= 4.1.15)
+      activesupport (= 4.1.15)
       arel (~> 5.0.0)
-    activesupport (4.1.14.1)
+    activesupport (4.1.15)
       i18n (~> 0.6, >= 0.6.9)
       json (~> 1.7, >= 1.7.7)
       minitest (~> 5.1)
       thread_safe (~> 0.1)
       tzinfo (~> 1.1)
-    rails (4.1.14.1)
-      actionmailer (= 4.1.14.1)
-      actionpack (= 4.1.14.1)
-      actionview (= 4.1.14.1)
-      activemodel (= 4.1.14.1)
-      activerecord (= 4.1.14.1)
-      activesupport (= 4.1.14.1)
+    rails (4.1.15)
+      actionmailer (= 4.1.15)
+      actionpack (= 4.1.15)
+      actionview (= 4.1.15)
+      activemodel (= 4.1.15)
+      activerecord (= 4.1.15)
+      activesupport (= 4.1.15)
       bundler (>= 1.3.0, < 2.0)
-      railties (= 4.1.14.1)
+      railties (= 4.1.15)
       sprockets-rails (~> 2.0)
-    railties (4.1.14.1)
-      actionpack (= 4.1.14.1)
-      activesupport (= 4.1.14.1)
+    railties (4.1.15)
+      actionpack (= 4.1.15)
+      activesupport (= 4.1.15)
       rake (>= 0.8.7)
       thor (>= 0.18.1, < 2.0)
 
 PATH
   remote: ..
   specs:
-    devise (4.0.0.rc1)
+    devise (4.1.0)
       bcrypt (~> 3.0)
       orm_adapter (~> 0.1)
       railties (>= 4.1.0, < 5.1)
@@ -59,24 +59,26 @@ GEM
   remote: https://rubygems.org/
   specs:
     arel (5.0.1.20140414130214)
-    bcrypt (3.1.10)
+    bcrypt (3.1.11)
     bson (3.2.6)
     builder (3.2.2)
-    concurrent-ruby (1.0.0)
+    concurrent-ruby (1.0.2)
     connection_pool (2.2.0)
     erubis (2.7.0)
     faraday (0.9.2)
       multipart-post (>= 1.2, < 3)
-    hashie (3.4.3)
+    hashie (3.4.4)
     i18n (0.7.0)
     json (1.8.3)
-    jwt (1.5.2)
-    mail (2.6.3)
-      mime-types (>= 1.16, < 3)
+    jwt (1.5.1)
+    mail (2.6.4)
+      mime-types (>= 1.16, < 4)
     metaclass (0.0.4)
-    mime-types (2.99)
+    mime-types (3.0)
+      mime-types-data (~> 3.2015)
+    mime-types-data (3.2016.0221)
     mini_portile2 (2.0.0)
-    minitest (5.8.4)
+    minitest (5.9.0)
     mocha (1.1.0)
       metaclass (~> 0.0.1)
     mongoid (4.0.2)
@@ -88,26 +90,24 @@ GEM
       bson (~> 3.0)
       connection_pool (~> 2.0)
       optionable (~> 0.2.0)
-    multi_json (1.11.2)
+    multi_json (1.12.0)
     multi_xml (0.5.5)
     multipart-post (2.0.0)
     nokogiri (1.6.7.2)
       mini_portile2 (~> 2.0.0.rc2)
-    oauth2 (0.9.4)
+    oauth2 (1.1.0)
       faraday (>= 0.8, < 0.10)
-      jwt (~> 1.0)
+      jwt (~> 1.0, < 1.5.2)
       multi_json (~> 1.3)
       multi_xml (~> 0.5)
-      rack (~> 1.2)
-    omniauth (1.2.2)
+      rack (>= 1.2, < 3)
+    omniauth (1.3.1)
       hashie (>= 1.2, < 4)
-      rack (~> 1.0)
-    omniauth-facebook (1.6.0)
-      omniauth-oauth2 (~> 1.1)
-    omniauth-oauth2 (1.1.2)
-      faraday (>= 0.8, < 0.10)
-      multi_json (~> 1.3)
-      oauth2 (~> 0.9.3)
+      rack (>= 1.0, < 3)
+    omniauth-facebook (3.0.0)
+      omniauth-oauth2 (~> 1.2)
+    omniauth-oauth2 (1.4.0)
+      oauth2 (~> 1.0)
       omniauth (~> 1.2)
     omniauth-openid (1.0.1)
       omniauth (~> 1.0)
@@ -121,12 +121,13 @@ GEM
       ruby-openid (>= 2.1.8)
     rack-test (0.6.3)
       rack (>= 1.0)
-    rake (10.5.0)
-    rdoc (4.2.1)
+    rake (11.1.2)
+    rdoc (4.2.2)
+      json (~> 1.4)
     responders (1.1.2)
       railties (>= 3.2, < 4.2)
     ruby-openid (2.7.0)
-    sprockets (3.5.2)
+    sprockets (3.6.0)
       concurrent-ruby (~> 1.0)
       rack (> 1, < 3)
     sprockets-rails (2.3.3)
@@ -134,6 +135,8 @@ GEM
       activesupport (>= 3.0)
       sprockets (>= 2.8, < 4.0)
     sqlite3 (1.3.11)
+    test_after_commit (1.0.0)
+      activerecord (>= 3.2)
     thor (0.19.1)
     thread_safe (0.3.5)
     tzinfo (1.2.2)
@@ -154,14 +157,15 @@ DEPENDENCIES
   devise!
   jruby-openssl
   mocha (~> 1.1)
-  mongoid (~> 4.0.0)
-  omniauth (~> 1.2.0)
+  mongoid (~> 4.0)
+  omniauth
   omniauth-facebook
-  omniauth-oauth2 (~> 1.1.0)
-  omniauth-openid (~> 1.0.1)
+  omniauth-oauth2
+  omniauth-openid
   rails!
   rdoc
   sqlite3
+  test_after_commit
   webrat (= 0.7.3)
 
 BUNDLED WITH

gemfiles/Gemfile.rails-4.2-stable

@@ -1,17 +1,18 @@
 source "https://rubygems.org"
 
-gemspec path: '..'
+gemspec path: ".."
 
-gem "rails", github: 'rails/rails', branch: '4-2-stable'
-gem "omniauth", "~> 1.2.2"
-gem "omniauth-oauth2", "~> 1.2.0"
+gem "rails", github: "rails/rails", branch: "4-2-stable"
+gem "omniauth"
+gem "omniauth-oauth2"
 gem "rdoc"
 
 group :test do
   gem "omniauth-facebook"
-  gem "omniauth-openid", "~> 1.0.1"
+  gem "omniauth-openid"
   gem "webrat", "0.7.3", require: false
   gem "mocha", "~> 1.1", require: false
+  gem 'test_after_commit', require: false
 end
 
 platforms :jruby do
@@ -25,5 +26,5 @@ platforms :ruby do
 end
 
 group :mongoid do
-  gem "mongoid", "~> 4.0.0"
+  gem "mongoid", "~> 4.0"
 end

gemfiles/Gemfile.rails-4.2-stable.lock

@@ -1,64 +1,64 @@
 GIT
   remote: git://github.com/rails/rails.git
-  revision: acf654b1c4a1ffe2a90d6ea63a0b989d656bb87d
+  revision: 5be7cfa46e055148c8b74ac5d48982a3435f477c
   branch: 4-2-stable
   specs:
-    actionmailer (4.2.5.1)
-      actionpack (= 4.2.5.1)
-      actionview (= 4.2.5.1)
-      activejob (= 4.2.5.1)
+    actionmailer (4.2.6)
+      actionpack (= 4.2.6)
+      actionview (= 4.2.6)
+      activejob (= 4.2.6)
       mail (~> 2.5, >= 2.5.4)
       rails-dom-testing (~> 1.0, >= 1.0.5)
-    actionpack (4.2.5.1)
-      actionview (= 4.2.5.1)
-      activesupport (= 4.2.5.1)
+    actionpack (4.2.6)
+      actionview (= 4.2.6)
+      activesupport (= 4.2.6)
       rack (~> 1.6)
       rack-test (~> 0.6.2)
       rails-dom-testing (~> 1.0, >= 1.0.5)
       rails-html-sanitizer (~> 1.0, >= 1.0.2)
-    actionview (4.2.5.1)
-      activesupport (= 4.2.5.1)
+    actionview (4.2.6)
+      activesupport (= 4.2.6)
       builder (~> 3.1)
       erubis (~> 2.7.0)
       rails-dom-testing (~> 1.0, >= 1.0.5)
       rails-html-sanitizer (~> 1.0, >= 1.0.2)
-    activejob (4.2.5.1)
-      activesupport (= 4.2.5.1)
+    activejob (4.2.6)
+      activesupport (= 4.2.6)
       globalid (>= 0.3.0)
-    activemodel (4.2.5.1)
-      activesupport (= 4.2.5.1)
+    activemodel (4.2.6)
+      activesupport (= 4.2.6)
       builder (~> 3.1)
-    activerecord (4.2.5.1)
-      activemodel (= 4.2.5.1)
-      activesupport (= 4.2.5.1)
+    activerecord (4.2.6)
+      activemodel (= 4.2.6)
+      activesupport (= 4.2.6)
       arel (~> 6.0)
-    activesupport (4.2.5.1)
+    activesupport (4.2.6)
       i18n (~> 0.7)
       json (~> 1.7, >= 1.7.7)
       minitest (~> 5.1)
       thread_safe (~> 0.3, >= 0.3.4)
       tzinfo (~> 1.1)
-    rails (4.2.5.1)
-      actionmailer (= 4.2.5.1)
-      actionpack (= 4.2.5.1)
-      actionview (= 4.2.5.1)
-      activejob (= 4.2.5.1)
-      activemodel (= 4.2.5.1)
-      activerecord (= 4.2.5.1)
-      activesupport (= 4.2.5.1)
+    rails (4.2.6)
+      actionmailer (= 4.2.6)
+      actionpack (= 4.2.6)
+      actionview (= 4.2.6)
+      activejob (= 4.2.6)
+      activemodel (= 4.2.6)
+      activerecord (= 4.2.6)
+      activesupport (= 4.2.6)
       bundler (>= 1.3.0, < 2.0)
-      railties (= 4.2.5.1)
+      railties (= 4.2.6)
       sprockets-rails
-    railties (4.2.5.1)
-      actionpack (= 4.2.5.1)
-      activesupport (= 4.2.5.1)
+    railties (4.2.6)
+      actionpack (= 4.2.6)
+      activesupport (= 4.2.6)
       rake (>= 0.8.7)
       thor (>= 0.18.1, < 2.0)
 
 PATH
   remote: ..
   specs:
-    devise (4.0.0.rc1)
+    devise (4.1.0)
       bcrypt (~> 3.0)
       orm_adapter (~> 0.1)
       railties (>= 4.1.0, < 5.1)
@@ -69,28 +69,30 @@ GEM
   remote: https://rubygems.org/
   specs:
     arel (6.0.3)
-    bcrypt (3.1.10)
+    bcrypt (3.1.11)
     bson (3.2.6)
     builder (3.2.2)
-    concurrent-ruby (1.0.0)
+    concurrent-ruby (1.0.2)
     connection_pool (2.2.0)
     erubis (2.7.0)
     faraday (0.9.2)
       multipart-post (>= 1.2, < 3)
     globalid (0.3.6)
       activesupport (>= 4.1.0)
-    hashie (3.4.3)
+    hashie (3.4.4)
     i18n (0.7.0)
     json (1.8.3)
-    jwt (1.5.2)
+    jwt (1.5.1)
     loofah (2.0.3)
       nokogiri (>= 1.5.9)
-    mail (2.6.3)
-      mime-types (>= 1.16, < 3)
+    mail (2.6.4)
+      mime-types (>= 1.16, < 4)
     metaclass (0.0.4)
-    mime-types (2.99)
+    mime-types (3.0)
+      mime-types-data (~> 3.2015)
+    mime-types-data (3.2016.0221)
     mini_portile2 (2.0.0)
-    minitest (5.8.4)
+    minitest (5.9.0)
     mocha (1.1.0)
       metaclass (~> 0.0.1)
     mongoid (4.0.2)
@@ -102,25 +104,23 @@ GEM
       bson (~> 3.0)
       connection_pool (~> 2.0)
       optionable (~> 0.2.0)
-    multi_json (1.11.2)
+    multi_json (1.12.0)
     multi_xml (0.5.5)
     multipart-post (2.0.0)
     nokogiri (1.6.7.2)
       mini_portile2 (~> 2.0.0.rc2)
-    oauth2 (1.0.0)
+    oauth2 (1.1.0)
       faraday (>= 0.8, < 0.10)
-      jwt (~> 1.0)
+      jwt (~> 1.0, < 1.5.2)
       multi_json (~> 1.3)
       multi_xml (~> 0.5)
-      rack (~> 1.2)
-    omniauth (1.2.2)
+      rack (>= 1.2, < 3)
+    omniauth (1.3.1)
       hashie (>= 1.2, < 4)
-      rack (~> 1.0)
+      rack (>= 1.0, < 3)
     omniauth-facebook (3.0.0)
       omniauth-oauth2 (~> 1.2)
-    omniauth-oauth2 (1.2.0)
-      faraday (>= 0.8, < 0.10)
-      multi_json (~> 1.3)
+    omniauth-oauth2 (1.4.0)
       oauth2 (~> 1.0)
       omniauth (~> 1.2)
     omniauth-openid (1.0.1)
@@ -143,19 +143,22 @@ GEM
       rails-deprecated_sanitizer (>= 1.0.1)
     rails-html-sanitizer (1.0.3)
       loofah (~> 2.0)
-    rake (10.5.0)
-    rdoc (4.2.1)
-    responders (2.1.1)
+    rake (11.1.2)
+    rdoc (4.2.2)
+      json (~> 1.4)
+    responders (2.2.0)
       railties (>= 4.2.0, < 5.1)
     ruby-openid (2.7.0)
-    sprockets (3.5.2)
+    sprockets (3.6.0)
       concurrent-ruby (~> 1.0)
       rack (> 1, < 3)
-    sprockets-rails (3.0.0)
+    sprockets-rails (3.0.4)
       actionpack (>= 4.0)
       activesupport (>= 4.0)
       sprockets (>= 3.0.0)
     sqlite3 (1.3.11)
+    test_after_commit (1.0.0)
+      activerecord (>= 3.2)
     thor (0.19.1)
     thread_safe (0.3.5)
     tzinfo (1.2.2)
@@ -176,14 +179,15 @@ DEPENDENCIES
   devise!
   jruby-openssl
   mocha (~> 1.1)
-  mongoid (~> 4.0.0)
-  omniauth (~> 1.2.2)
+  mongoid (~> 4.0)
+  omniauth
   omniauth-facebook
-  omniauth-oauth2 (~> 1.2.0)
-  omniauth-openid (~> 1.0.1)
+  omniauth-oauth2
+  omniauth-openid
   rails!
   rdoc
   sqlite3
+  test_after_commit
   webrat (= 0.7.3)
 
 BUNDLED WITH

gemfiles/Gemfile.rails-5.0

@@ -0,0 +1,37 @@
+source "https://rubygems.org"
+
+gemspec path: ".."
+
+gem "rails", "5.0.0.rc1"
+gem "omniauth", " ~> 1.3"
+gem "oauth2"
+gem "omniauth-oauth2"
+gem "rdoc"
+
+gem "activemodel-serializers-xml", github: "rails/activemodel-serializers-xml"
+
+gem "rails-controller-testing"
+
+gem "responders", "~> 2.1"
+
+group :test do
+  gem "omniauth-facebook"
+  gem "omniauth-openid"
+  gem "webrat", "0.7.3", require: false
+  gem "mocha", "~> 1.1", require: false
+end
+
+platforms :jruby do
+  gem "activerecord-jdbc-adapter"
+  gem "activerecord-jdbcsqlite3-adapter"
+  gem "jruby-openssl"
+end
+
+platforms :ruby do
+  gem "sqlite3"
+end
+
+# TODO:
+# group :mongoid do
+#   gem "mongoid", "~> 4.0.0"
+# end

gemfiles/Gemfile.rails-5.0-beta

@@ -1,37 +0,0 @@
-source 'https://rubygems.org'
-
-gemspec path: '..'
-
-gem 'rails', '5.0.0.beta1.1'
-gem 'omniauth', '~>1.3.1'
-gem 'oauth2', github: 'intridea/oauth2', branch: 'master'
-gem 'omniauth-oauth2', '>= 1.2.0', '< 1.5.0'
-gem 'rdoc'
-
-gem 'activemodel-serializers-xml', github: 'rails/activemodel-serializers-xml'
-
-gem 'rails-controller-testing'
-
-gem 'responders', '~>2.1.1'
-
-group :test do
-  gem 'omniauth-facebook'
-  gem 'omniauth-openid', '~> 1.0.1'
-  gem 'webrat', '0.7.3', require: false
-  gem 'mocha', '~> 1.1', require: false
-end
-
-platforms :jruby do
-  gem 'activerecord-jdbc-adapter'
-  gem 'activerecord-jdbcsqlite3-adapter'
-  gem 'jruby-openssl'
-end
-
-platforms :ruby do
-  gem 'sqlite3'
-end
-
-# TODO:
-# group :mongoid do
-#   gem 'mongoid', '~> 4.0.0'
-# end

gemfiles/Gemfile.rails-5.0-beta.lock

@@ -1,28 +1,17 @@
-GIT
-  remote: git://github.com/intridea/oauth2.git
-  revision: 43e1fdd87e95a5b02438d5cce6a67e411afb5fec
-  branch: master
-  specs:
-    oauth2 (1.0.0)
-      faraday (>= 0.8, < 0.10)
-      jwt (~> 1.0, < 1.5.2)
-      multi_json (~> 1.3)
-      multi_xml (~> 0.5)
-      rack (>= 1.2, < 3)
-
 GIT
   remote: git://github.com/rails/activemodel-serializers-xml.git
-  revision: 1f72d9507c91b1cda10d1d20eac2b74dd6d9d4b9
+  revision: f380ea5ddefcb9a37f4fbc47606ed6fbecdb2b2a
   specs:
-    activemodel-serializers-xml (0.1.0)
-      activemodel
-      activerecord
-      activesupport
+    activemodel-serializers-xml (1.0.0)
+      activemodel (> 5.x)
+      activerecord (> 5.x)
+      activesupport (> 5.x)
+      builder (~> 3.1)
 
 PATH
   remote: ..
   specs:
-    devise (4.0.0.rc1)
+    devise (4.0.0.rc2)
       bcrypt (~> 3.0)
       orm_adapter (~> 0.1)
       railties (>= 4.1.0, < 5.1)
@@ -32,104 +21,65 @@ PATH
 GEM
   remote: https://rubygems.org/
   specs:
-    actioncable (5.0.0.beta1.1)
-      actionpack (= 5.0.0.beta1.1)
-      celluloid (~> 0.17.2)
-      coffee-rails (~> 4.1.0)
-      em-hiredis (~> 0.3.0)
-      faye-websocket (~> 0.10.0)
-      redis (~> 3.0)
+    actioncable (5.0.0.beta3)
+      actionpack (= 5.0.0.beta3)
+      nio4r (~> 1.2)
       websocket-driver (~> 0.6.1)
-    actionmailer (5.0.0.beta1.1)
-      actionpack (= 5.0.0.beta1.1)
-      actionview (= 5.0.0.beta1.1)
-      activejob (= 5.0.0.beta1.1)
+    actionmailer (5.0.0.beta3)
+      actionpack (= 5.0.0.beta3)
+      actionview (= 5.0.0.beta3)
+      activejob (= 5.0.0.beta3)
       mail (~> 2.5, >= 2.5.4)
       rails-dom-testing (~> 1.0, >= 1.0.5)
-    actionpack (5.0.0.beta1.1)
-      actionview (= 5.0.0.beta1.1)
-      activesupport (= 5.0.0.beta1.1)
+    actionpack (5.0.0.beta3)
+      actionview (= 5.0.0.beta3)
+      activesupport (= 5.0.0.beta3)
       rack (~> 2.x)
       rack-test (~> 0.6.3)
       rails-dom-testing (~> 1.0, >= 1.0.5)
       rails-html-sanitizer (~> 1.0, >= 1.0.2)
-    actionview (5.0.0.beta1.1)
-      activesupport (= 5.0.0.beta1.1)
+    actionview (5.0.0.beta3)
+      activesupport (= 5.0.0.beta3)
       builder (~> 3.1)
       erubis (~> 2.7.0)
       rails-dom-testing (~> 1.0, >= 1.0.5)
       rails-html-sanitizer (~> 1.0, >= 1.0.2)
-    activejob (5.0.0.beta1.1)
-      activesupport (= 5.0.0.beta1.1)
+    activejob (5.0.0.beta3)
+      activesupport (= 5.0.0.beta3)
       globalid (>= 0.3.6)
-    activemodel (5.0.0.beta1.1)
-      activesupport (= 5.0.0.beta1.1)
-      builder (~> 3.1)
-    activerecord (5.0.0.beta1.1)
-      activemodel (= 5.0.0.beta1.1)
-      activesupport (= 5.0.0.beta1.1)
+    activemodel (5.0.0.beta3)
+      activesupport (= 5.0.0.beta3)
+    activerecord (5.0.0.beta3)
+      activemodel (= 5.0.0.beta3)
+      activesupport (= 5.0.0.beta3)
       arel (~> 7.0)
-    activesupport (5.0.0.beta1.1)
+    activesupport (5.0.0.beta3)
       concurrent-ruby (~> 1.0)
       i18n (~> 0.7)
-      json (~> 1.7, >= 1.7.7)
-      method_source
       minitest (~> 5.1)
       tzinfo (~> 1.1)
     arel (7.0.0)
-    bcrypt (3.1.10)
+    bcrypt (3.1.11)
     builder (3.2.2)
-    celluloid (0.17.3)
-      celluloid-essentials
-      celluloid-extras
-      celluloid-fsm
-      celluloid-pool
-      celluloid-supervision
-      timers (>= 4.1.1)
-    celluloid-essentials (0.20.5)
-      timers (>= 4.1.1)
-    celluloid-extras (0.20.5)
-      timers (>= 4.1.1)
-    celluloid-fsm (0.20.5)
-      timers (>= 4.1.1)
-    celluloid-pool (0.20.5)
-      timers (>= 4.1.1)
-    celluloid-supervision (0.20.5)
-      timers (>= 4.1.1)
-    coffee-rails (4.1.1)
-      coffee-script (>= 2.2.0)
-      railties (>= 4.0.0, < 5.1.x)
-    coffee-script (2.4.1)
-      coffee-script-source
-      execjs
-    coffee-script-source (1.10.0)
-    concurrent-ruby (1.0.0)
-    em-hiredis (0.3.0)
-      eventmachine (~> 1.0)
-      hiredis (~> 0.5.0)
+    concurrent-ruby (1.0.1)
     erubis (2.7.0)
-    eventmachine (1.0.9.1)
-    execjs (2.6.0)
     faraday (0.9.2)
       multipart-post (>= 1.2, < 3)
-    faye-websocket (0.10.2)
-      eventmachine (>= 0.12.0)
-      websocket-driver (>= 0.5.1)
     globalid (0.3.6)
       activesupport (>= 4.1.0)
     hashie (3.4.3)
-    hiredis (0.5.2)
-    hitimes (1.2.3)
     i18n (0.7.0)
     json (1.8.3)
     jwt (1.5.1)
     loofah (2.0.3)
       nokogiri (>= 1.5.9)
-    mail (2.6.3)
-      mime-types (>= 1.16, < 3)
+    mail (2.6.4)
+      mime-types (>= 1.16, < 4)
     metaclass (0.0.4)
     method_source (0.8.2)
-    mime-types (2.99)
+    mime-types (3.0)
+      mime-types-data (~> 3.2015)
+    mime-types-data (3.2016.0221)
     mini_portile2 (2.0.0)
     minitest (5.8.4)
     mocha (1.1.0)
@@ -137,8 +87,15 @@ GEM
     multi_json (1.11.2)
     multi_xml (0.5.5)
     multipart-post (2.0.0)
+    nio4r (1.2.1)
     nokogiri (1.6.7.2)
       mini_portile2 (~> 2.0.0.rc2)
+    oauth2 (1.1.0)
+      faraday (>= 0.8, < 0.10)
+      jwt (~> 1.0, < 1.5.2)
+      multi_json (~> 1.3)
+      multi_xml (~> 0.5)
+      rack (>= 1.2, < 3)
     omniauth (1.3.1)
       hashie (>= 1.2, < 4)
       rack (>= 1.0, < 3)
@@ -158,20 +115,22 @@ GEM
       ruby-openid (>= 2.1.8)
     rack-test (0.6.3)
       rack (>= 1.0)
-    rails (5.0.0.beta1.1)
-      actioncable (= 5.0.0.beta1.1)
-      actionmailer (= 5.0.0.beta1.1)
-      actionpack (= 5.0.0.beta1.1)
-      actionview (= 5.0.0.beta1.1)
-      activejob (= 5.0.0.beta1.1)
-      activemodel (= 5.0.0.beta1.1)
-      activerecord (= 5.0.0.beta1.1)
-      activesupport (= 5.0.0.beta1.1)
+    rails (5.0.0.beta3)
+      actioncable (= 5.0.0.beta3)
+      actionmailer (= 5.0.0.beta3)
+      actionpack (= 5.0.0.beta3)
+      actionview (= 5.0.0.beta3)
+      activejob (= 5.0.0.beta3)
+      activemodel (= 5.0.0.beta3)
+      activerecord (= 5.0.0.beta3)
+      activesupport (= 5.0.0.beta3)
       bundler (>= 1.3.0, < 2.0)
-      railties (= 5.0.0.beta1.1)
+      railties (= 5.0.0.beta3)
       sprockets-rails (>= 2.0.0)
-    rails-controller-testing (0.0.3)
-      rails (>= 4.2)
+    rails-controller-testing (0.1.1)
+      actionpack (~> 5.x)
+      actionview (~> 5.x)
+      activesupport (~> 5.x)
     rails-deprecated_sanitizer (1.0.3)
       activesupport (>= 4.2.0.alpha)
     rails-dom-testing (1.0.7)
@@ -180,30 +139,28 @@ GEM
       rails-deprecated_sanitizer (>= 1.0.1)
     rails-html-sanitizer (1.0.3)
       loofah (~> 2.0)
-    railties (5.0.0.beta1.1)
-      actionpack (= 5.0.0.beta1.1)
-      activesupport (= 5.0.0.beta1.1)
+    railties (5.0.0.beta3)
+      actionpack (= 5.0.0.beta3)
+      activesupport (= 5.0.0.beta3)
       method_source
       rake (>= 0.8.7)
       thor (>= 0.18.1, < 2.0)
-    rake (10.5.0)
-    rdoc (4.2.1)
-    redis (3.2.2)
-    responders (2.1.1)
+    rake (11.1.2)
+    rdoc (4.2.2)
+      json (~> 1.4)
+    responders (2.1.2)
       railties (>= 4.2.0, < 5.1)
     ruby-openid (2.7.0)
-    sprockets (3.5.2)
+    sprockets (3.6.0)
       concurrent-ruby (~> 1.0)
       rack (> 1, < 3)
-    sprockets-rails (3.0.0)
+    sprockets-rails (3.0.4)
       actionpack (>= 4.0)
       activesupport (>= 4.0)
       sprockets (>= 3.0.0)
     sqlite3 (1.3.11)
     thor (0.19.1)
     thread_safe (0.3.5)
-    timers (4.1.1)
-      hitimes
     tzinfo (1.2.2)
       thread_safe (~> 0.1)
     warden (1.2.6)
@@ -226,12 +183,12 @@ DEPENDENCIES
   devise!
   jruby-openssl
   mocha (~> 1.1)
-  oauth2!
-  omniauth (~> 1.3.1)
+  oauth2
+  omniauth (~> 1.3)
   omniauth-facebook
   omniauth-oauth2 (>= 1.2.0, < 1.5.0)
   omniauth-openid (~> 1.0.1)
-  rails (= 5.0.0.beta1.1)
+  rails (= 5.0.0.beta3)
   rails-controller-testing
   rdoc
   responders (~> 2.1.1)

gemfiles/Gemfile.rails-5.0.lock

@@ -0,0 +1,199 @@
+GIT
+  remote: git://github.com/rails/activemodel-serializers-xml.git
+  revision: 570ee7ed33d60e44ca1f3ccbec3d1fbf61d52cbf
+  specs:
+    activemodel-serializers-xml (1.0.1)
+      activemodel (> 5.x)
+      activerecord (> 5.x)
+      activesupport (> 5.x)
+      builder (~> 3.1)
+
+PATH
+  remote: ..
+  specs:
+    devise (4.1.0)
+      bcrypt (~> 3.0)
+      orm_adapter (~> 0.1)
+      railties (>= 4.1.0, < 5.1)
+      responders
+      warden (~> 1.2.3)
+
+GEM
+  remote: https://rubygems.org/
+  specs:
+    actioncable (5.0.0.rc1)
+      actionpack (= 5.0.0.rc1)
+      nio4r (~> 1.2)
+      websocket-driver (~> 0.6.1)
+    actionmailer (5.0.0.rc1)
+      actionpack (= 5.0.0.rc1)
+      actionview (= 5.0.0.rc1)
+      activejob (= 5.0.0.rc1)
+      mail (~> 2.5, >= 2.5.4)
+      rails-dom-testing (~> 1.0, >= 1.0.5)
+    actionpack (5.0.0.rc1)
+      actionview (= 5.0.0.rc1)
+      activesupport (= 5.0.0.rc1)
+      rack (~> 2.x)
+      rack-test (~> 0.6.3)
+      rails-dom-testing (~> 1.0, >= 1.0.5)
+      rails-html-sanitizer (~> 1.0, >= 1.0.2)
+    actionview (5.0.0.rc1)
+      activesupport (= 5.0.0.rc1)
+      builder (~> 3.1)
+      erubis (~> 2.7.0)
+      rails-dom-testing (~> 1.0, >= 1.0.5)
+      rails-html-sanitizer (~> 1.0, >= 1.0.2)
+    activejob (5.0.0.rc1)
+      activesupport (= 5.0.0.rc1)
+      globalid (>= 0.3.6)
+    activemodel (5.0.0.rc1)
+      activesupport (= 5.0.0.rc1)
+    activerecord (5.0.0.rc1)
+      activemodel (= 5.0.0.rc1)
+      activesupport (= 5.0.0.rc1)
+      arel (~> 7.0)
+    activesupport (5.0.0.rc1)
+      concurrent-ruby (~> 1.0, >= 1.0.2)
+      i18n (~> 0.7)
+      minitest (~> 5.1)
+      tzinfo (~> 1.1)
+    arel (7.0.0)
+    bcrypt (3.1.11)
+    builder (3.2.2)
+    concurrent-ruby (1.0.2)
+    erubis (2.7.0)
+    faraday (0.9.2)
+      multipart-post (>= 1.2, < 3)
+    globalid (0.3.6)
+      activesupport (>= 4.1.0)
+    hashie (3.4.4)
+    i18n (0.7.0)
+    json (1.8.3)
+    jwt (1.5.1)
+    loofah (2.0.3)
+      nokogiri (>= 1.5.9)
+    mail (2.6.4)
+      mime-types (>= 1.16, < 4)
+    metaclass (0.0.4)
+    method_source (0.8.2)
+    mime-types (3.0)
+      mime-types-data (~> 3.2015)
+    mime-types-data (3.2016.0221)
+    mini_portile2 (2.0.0)
+    minitest (5.9.0)
+    mocha (1.1.0)
+      metaclass (~> 0.0.1)
+    multi_json (1.12.0)
+    multi_xml (0.5.5)
+    multipart-post (2.0.0)
+    nio4r (1.2.1)
+    nokogiri (1.6.7.2)
+      mini_portile2 (~> 2.0.0.rc2)
+    oauth2 (1.1.0)
+      faraday (>= 0.8, < 0.10)
+      jwt (~> 1.0, < 1.5.2)
+      multi_json (~> 1.3)
+      multi_xml (~> 0.5)
+      rack (>= 1.2, < 3)
+    omniauth (1.3.1)
+      hashie (>= 1.2, < 4)
+      rack (>= 1.0, < 3)
+    omniauth-facebook (3.0.0)
+      omniauth-oauth2 (~> 1.2)
+    omniauth-oauth2 (1.4.0)
+      oauth2 (~> 1.0)
+      omniauth (~> 1.2)
+    omniauth-openid (1.0.1)
+      omniauth (~> 1.0)
+      rack-openid (~> 1.3.1)
+    orm_adapter (0.5.0)
+    rack (2.0.0.rc1)
+      json
+    rack-openid (1.3.1)
+      rack (>= 1.1.0)
+      ruby-openid (>= 2.1.8)
+    rack-test (0.6.3)
+      rack (>= 1.0)
+    rails (5.0.0.rc1)
+      actioncable (= 5.0.0.rc1)
+      actionmailer (= 5.0.0.rc1)
+      actionpack (= 5.0.0.rc1)
+      actionview (= 5.0.0.rc1)
+      activejob (= 5.0.0.rc1)
+      activemodel (= 5.0.0.rc1)
+      activerecord (= 5.0.0.rc1)
+      activesupport (= 5.0.0.rc1)
+      bundler (>= 1.3.0, < 2.0)
+      railties (= 5.0.0.rc1)
+      sprockets-rails (>= 2.0.0)
+    rails-controller-testing (0.1.1)
+      actionpack (~> 5.x)
+      actionview (~> 5.x)
+      activesupport (~> 5.x)
+    rails-deprecated_sanitizer (1.0.3)
+      activesupport (>= 4.2.0.alpha)
+    rails-dom-testing (1.0.7)
+      activesupport (>= 4.2.0.beta, < 5.0)
+      nokogiri (~> 1.6.0)
+      rails-deprecated_sanitizer (>= 1.0.1)
+    rails-html-sanitizer (1.0.3)
+      loofah (~> 2.0)
+    railties (5.0.0.rc1)
+      actionpack (= 5.0.0.rc1)
+      activesupport (= 5.0.0.rc1)
+      method_source
+      rake (>= 0.8.7)
+      thor (>= 0.18.1, < 2.0)
+    rake (11.1.2)
+    rdoc (4.2.2)
+      json (~> 1.4)
+    responders (2.2.0)
+      railties (>= 4.2.0, < 5.1)
+    ruby-openid (2.7.0)
+    sprockets (3.6.0)
+      concurrent-ruby (~> 1.0)
+      rack (> 1, < 3)
+    sprockets-rails (3.0.4)
+      actionpack (>= 4.0)
+      activesupport (>= 4.0)
+      sprockets (>= 3.0.0)
+    sqlite3 (1.3.11)
+    thor (0.19.1)
+    thread_safe (0.3.5)
+    tzinfo (1.2.2)
+      thread_safe (~> 0.1)
+    warden (1.2.6)
+      rack (>= 1.0)
+    webrat (0.7.3)
+      nokogiri (>= 1.2.0)
+      rack (>= 1.0)
+      rack-test (>= 0.5.3)
+    websocket-driver (0.6.3)
+      websocket-extensions (>= 0.1.0)
+    websocket-extensions (0.1.2)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  activemodel-serializers-xml!
+  activerecord-jdbc-adapter
+  activerecord-jdbcsqlite3-adapter
+  devise!
+  jruby-openssl
+  mocha (~> 1.1)
+  oauth2
+  omniauth (~> 1.3)
+  omniauth-facebook
+  omniauth-oauth2
+  omniauth-openid
+  rails (= 5.0.0.rc1)
+  rails-controller-testing
+  rdoc
+  responders (~> 2.1)
+  sqlite3
+  webrat (= 0.7.3)
+
+BUNDLED WITH
+   1.11.2

guides/bug_report_templates/integration_test.rb

@@ -0,0 +1,104 @@
+begin
+  require 'bundler/inline'
+rescue LoadError => e
+  $stderr.puts 'Bundler version 1.10 or later is required. Please update your Bundler'
+  raise e
+end
+
+gemfile(true) do
+  source 'https://rubygems.org'
+  # Activate the gem you are reporting the issue against.
+  gem 'rails', '~> 4.2.0'
+  gem 'devise', '~> 4.0'
+  gem 'sqlite3'
+  gem 'byebug'
+end
+
+require 'rack/test'
+require 'action_controller/railtie'
+require 'active_record'
+require 'devise/rails/routes'
+require 'devise/rails/warden_compat'
+
+ActiveRecord::Base.establish_connection( adapter: :sqlite3, database:  ':memory:')
+
+class DeviseCreateUsers < ActiveRecord::Migration
+  def change
+    create_table(:users) do |t|
+      t.string :email,              null: false
+      t.string :encrypted_password, null: true
+      t.timestamps null: false
+    end
+
+  end
+end
+
+Devise.setup do |config|
+  require 'devise/orm/active_record'
+  config.secret_key = 'secret_key_base'
+end
+
+class TestApp < Rails::Application
+  config.root = File.dirname(__FILE__)
+  config.session_store :cookie_store, key: 'cookie_store_key'
+  secrets.secret_token    = 'secret_token'
+  secrets.secret_key_base = 'secret_key_base'
+  config.eager_load = false
+
+  config.middleware.use Warden::Manager do |config|
+    Devise.warden_config = config
+  end
+
+  config.logger = Logger.new($stdout)
+  Rails.logger  = config.logger
+
+end
+
+Rails.application.initialize!
+
+DeviseCreateUsers.migrate(:up)
+
+class User < ActiveRecord::Base
+  devise :database_authenticatable
+end
+
+Rails.application.routes.draw do
+  devise_for :users
+
+  get '/' => 'test#index'
+end
+
+class ApplicationController < ActionController::Base
+end
+
+class TestController < ApplicationController
+  include Rails.application.routes.url_helpers
+
+  before_filter :authenticate_user!
+
+  def index
+    render plain: 'Home'
+  end
+end
+
+require 'minitest/autorun'
+
+class BugTest < ActionDispatch::IntegrationTest
+  include Rack::Test::Methods
+  include Warden::Test::Helpers
+
+  def test_returns_success
+    Warden.test_mode!
+
+    login_as User.create!(email: 'test@test.com', password: 'test123456', password_confirmation: 'test123456')
+
+    get '/'
+    assert last_response.ok?
+  end
+
+  private
+
+  def app
+    Rails.application
+  end
+end

lib/devise.rb

@@ -39,13 +39,18 @@ module Devise
     autoload :Authenticatable, 'devise/strategies/authenticatable'
   end
 
+  module Test
+    autoload :ControllerHelpers,  'devise/test/controller_helpers'
+    autoload :IntegrationHelpers, 'devise/test/integration_helpers'
+  end
+
   # Constants which holds devise configuration for extensions. Those should
   # not be modified by the "end user" (this is why they are constants).
   ALL         = []
-  CONTROLLERS = ActiveSupport::OrderedHash.new
-  ROUTES      = ActiveSupport::OrderedHash.new
-  STRATEGIES  = ActiveSupport::OrderedHash.new
-  URL_HELPERS = ActiveSupport::OrderedHash.new
+  CONTROLLERS = {}
+  ROUTES      = {}
+  STRATEGIES  = {}
+  URL_HELPERS = {}
 
   # Strategies that do not require user input.
   NO_INPUT = []
@@ -61,9 +66,9 @@ module Devise
   mattr_accessor :rememberable_options
   @@rememberable_options = {}
 
-  # The number of times to encrypt password.
+  # The number of times to hash the password.
   mattr_accessor :stretches
-  @@stretches = 10
+  @@stretches = 11
 
   # The default key used when authenticating over http auth.
   mattr_accessor :http_authentication_key
@@ -83,7 +88,7 @@ module Devise
 
   # Keys that should have whitespace stripped.
   mattr_accessor :strip_whitespace_keys
-  @@strip_whitespace_keys = []
+  @@strip_whitespace_keys = [:email]
 
   # If http authentication is enabled by default.
   mattr_accessor :http_authenticatable
@@ -101,11 +106,11 @@ module Devise
   mattr_accessor :http_authentication_realm
   @@http_authentication_realm = "Application"
 
-  # Email regex used to validate email formats. It simply asserts that
-  # an one (and only one) @ exists in the given string. This is mainly
-  # to give user feedback and not to assert the e-mail validity.
+  # Email regex used to validate email formats. It asserts that there are no
+  # @ symbols or whitespaces in either the localpart or the domain, and that
+  # there is a single @ symbol separating the localpart and the domain.
   mattr_accessor :email_regexp
-  @@email_regexp = /\A[^@\s]+@([^@\s]+\.)+[^@\W]+\z/
+  @@email_regexp = /\A[^@\s]+@[^@\s]+\z/
 
   # Range validation for password length
   mattr_accessor :password_length
@@ -115,7 +120,6 @@ module Devise
   mattr_accessor :remember_for
   @@remember_for = 2.weeks
 
-  # TODO: extend_remember_period is no longer used
   # If true, extends the user's remember period when remembered via cookie.
   mattr_accessor :extend_remember_period
   @@extend_remember_period = false
@@ -138,15 +142,14 @@ module Devise
   @@confirmation_keys = [:email]
 
   # Defines if email should be reconfirmable.
-  # False by default for backwards compatibility.
   mattr_accessor :reconfirmable
-  @@reconfirmable = false
+  @@reconfirmable = true
 
   # Time interval to timeout the user session without activity.
   mattr_accessor :timeout_in
   @@timeout_in = 30.minutes
 
-  # Used to encrypt password. Please generate one with rake secret.
+  # Used to hash the password. Please generate one with rake secret.
   mattr_accessor :pepper
   @@pepper = nil
 
@@ -203,7 +206,7 @@ module Devise
 
   # Skip session storage for the following strategies
   mattr_accessor :skip_session_storage
-  @@skip_session_storage = []
+  @@skip_session_storage = [:http_auth]
 
   # Which formats should be treated as navigational.
   mattr_accessor :navigational_formats
@@ -215,7 +218,7 @@ module Devise
 
   # The default method used while signing out
   mattr_accessor :sign_out_via
-  @@sign_out_via = :get
+  @@sign_out_via = :delete
 
   # The parent controller all Devise controllers inherits from.
   # Defaults to ApplicationController. This should be set early
@@ -244,15 +247,22 @@ module Devise
   mattr_accessor :clean_up_csrf_token_on_authentication
   @@clean_up_csrf_token_on_authentication = true
 
+  # When false, Devise will not attempt to reload routes on eager load.
+  # This can reduce the time taken to boot the app but if your application
+  # requires the Devise mappings to be loaded during boot time the application
+  # won't boot properly.
+  mattr_accessor :reload_routes
+  @@reload_routes = true
+
   # PRIVATE CONFIGURATION
 
   # Store scopes mappings.
   mattr_reader :mappings
-  @@mappings = ActiveSupport::OrderedHash.new
+  @@mappings = {}
 
   # OmniAuth configurations.
   mattr_reader :omniauth_configs
-  @@omniauth_configs = ActiveSupport::OrderedHash.new
+  @@omniauth_configs = {}
 
   # Define a set of modules that are called when a mapping is added.
   mattr_reader :helpers
@@ -276,14 +286,14 @@ module Devise
   mattr_accessor :token_generator
   @@token_generator = nil
 
-  # Default way to setup Devise. Run rails generate devise_install to create
+  # Default way to set up Devise. Run rails generate devise_install to create
   # a fresh initializer with all configuration values.
   def self.setup
     yield self
   end
 
   class Getter
-    def initialize name
+    def initialize(name)
       @name = name
     end
 
@@ -293,12 +303,8 @@ module Devise
   end
 
   def self.ref(arg)
-    if defined?(ActiveSupport::Dependencies::ClassCache)
-      ActiveSupport::Dependencies::reference(arg)
-      Getter.new(arg)
-    else
-      ActiveSupport::Dependencies.ref(arg)
-    end
+    ActiveSupport::Dependencies.reference(arg)
+    Getter.new(arg)
   end
 
   def self.available_router_name
@@ -419,7 +425,6 @@ module Devise
   #   config.omniauth :github, APP_ID, APP_SECRET
   #
   def self.omniauth(provider, *args)
-    @@helpers << Devise::OmniAuth::UrlHelpers
     config = Devise::OmniAuth::Config.new(provider, args)
     @@omniauth_configs[config.strategy_name.to_sym] = config
   end
@@ -457,10 +462,7 @@ module Devise
           mapping.to.serialize_into_session(record)
         end
 
-        warden_config.serialize_from_session(mapping.name) do |key|
-          # Previous versions contained an additional entry at the beginning of
-          # key with the record's class name.
-          args = key[-2, 2]
+        warden_config.serialize_from_session(mapping.name) do |args|
           mapping.to.serialize_from_session(*args)
         end
       end

lib/devise/controllers/helpers.rb

@@ -138,7 +138,7 @@ module Devise
 
       # The main accessor for the warden proxy instance
       def warden
-        request.env['warden']
+        request.env['warden'] or raise MissingWarden
       end
 
       # Return true if it's a devise_controller. false to all controllers unless
@@ -150,7 +150,7 @@ module Devise
         is_a?(::DeviseController)
       end
 
-      # Setup a param sanitizer to filter parameters using strong_parameters. See
+      # Set up a param sanitizer to filter parameters using strong_parameters. See
       # lib/devise/parameter_sanitizer.rb for more info. Override this
       # method in your application controller to use your own parameter sanitizer.
       def devise_parameter_sanitizer
@@ -271,16 +271,21 @@ module Devise
 
       private
 
-      def expire_session_data_after_sign_in!
-        ActiveSupport::Deprecation.warn "expire_session_data_after_sign_in! is deprecated " \
-          "in favor of expire_data_after_sign_in!"
-        expire_data_after_sign_in!
-      end
-
       def expire_data_after_sign_out!
         Devise.mappings.each { |_,m| instance_variable_set("@current_#{m.name}", nil) }
         super
       end
     end
   end
+
+  class MissingWarden < StandardError
+    def initialize
+      super "Devise could not find the `Warden::Proxy` instance on your request environment.\n" + \
+        "Make sure that your application is loading Devise and Warden as expected and that " + \
+        "the `Warden::Manager` middleware is present in your middleware stack.\n" + \
+        "If you are seeing this on one of your tests, ensure that your tests are either " + \
+        "executing the Rails middleware stack or that your tests are using the `Devise::Test::ControllerHelpers` " + \
+        "module to inject the `request.env['warden']` object for you."
+    end
+  end
 end

lib/devise/controllers/sign_in_out.rb

@@ -12,20 +12,15 @@ module Devise
       end
 
       # Sign in a user that already was authenticated. This helper is useful for logging
-      # users in after sign up.
-      #
-      # All options given to sign_in is passed forward to the set_user method in warden.
-      # The only exception is the :bypass option, which bypass warden callbacks and stores
-      # the user straight in session. This option is useful in cases the user is already
-      # signed in, but we want to refresh the credentials in session.
+      # users in after sign up. All options given to sign_in is passed forward
+      # to the set_user method in warden.
       #
       # Examples:
       #
       #   sign_in :user, @user                      # sign_in(scope, resource)
       #   sign_in @user                             # sign_in(resource)
-      #   sign_in @user, event: :authentication  # sign_in(resource, options)
-      #   sign_in @user, store: false            # sign_in(resource, options)
-      #   sign_in @user, bypass: true            # sign_in(resource, options)
+      #   sign_in @user, event: :authentication     # sign_in(resource, options)
+      #   sign_in @user, store: false               # sign_in(resource, options)
       #
       def sign_in(resource_or_scope, *args)
         options  = args.extract_options!
@@ -35,6 +30,13 @@ module Devise
         expire_data_after_sign_in!
 
         if options[:bypass]
+          ActiveSupport::Deprecation.warn(<<-DEPRECATION.strip_heredoc, caller)
+          [Devise] bypass option is deprecated and it will be removed in future version of Devise.
+          Please use bypass_sign_in method instead.
+          Example:
+
+            bypass_sign_in(user)
+          DEPRECATION
           warden.session_serializer.store(resource, scope)
         elsif warden.user(scope) == resource && !options.delete(:force)
           # Do nothing. User already signed in and we are not forcing it.
@@ -44,6 +46,20 @@ module Devise
         end
       end
 
+      # Sign in a user bypassing the warden callbacks and stores the user
+      # straight in session. This option is useful in cases the user is already
+      # signed in, but we want to refresh the credentials in session.
+      #
+      # Examples:
+      #
+      #   bypass_sign_in @user, scope: :user
+      #   bypass_sign_in @user
+      def bypass_sign_in(resource, scope: nil)
+        scope ||= Devise::Mapping.find_scope!(resource)
+        expire_data_after_sign_in!
+        warden.session_serializer.store(resource, scope)
+      end
+
       # Sign out a given user or scope. This helper is useful for signing out a user
       # after deleting accounts. Returns true if there was a logout and false if there
       # is no user logged in on the referred scope

lib/devise/encryptor.rb

@@ -9,14 +9,14 @@ module Devise
       ::BCrypt::Password.create(password, cost: klass.stretches).to_s
     end
 
-    def self.compare(klass, encrypted_password, password)
-      return false if encrypted_password.blank?
-      bcrypt   = ::BCrypt::Password.new(encrypted_password)
+    def self.compare(klass, hashed_password, password)
+      return false if hashed_password.blank?
+      bcrypt   = ::BCrypt::Password.new(hashed_password)
       if klass.pepper.present?
         password = "#{password}#{klass.pepper}"
       end
       password = ::BCrypt::Engine.hash_secret(password, bcrypt.salt)
-      Devise.secure_compare(password, encrypted_password)
+      Devise.secure_compare(password, hashed_password)
     end
   end
 end

lib/devise/failure_app.rb

@@ -103,7 +103,7 @@ module Devise
         options[:scope] = "devise.failure"
         options[:default] = [message]
         auth_keys = scope_class.authentication_keys
-        keys = auth_keys.respond_to?(:keys) ? auth_keys.keys : auth_keys
+        keys = (auth_keys.respond_to?(:keys) ? auth_keys.keys : auth_keys).map { |key| scope_class.human_attribute_name(key) }
         options[:authentication_keys] = keys.join(I18n.translate(:"support.array.words_connector"))
         options = i18n_options(options)
 
@@ -140,11 +140,10 @@ module Devise
 
       config = Rails.application.config
 
-      # Rails 4.2 goes into an infinite loop if opts[:script_name] is unset
-      if (Rails::VERSION::MAJOR >= 4) && (Rails::VERSION::MINOR >= 2)
-        opts[:script_name] = (config.relative_url_root if config.respond_to?(:relative_url_root))
-      else
-        if config.respond_to?(:relative_url_root) && config.relative_url_root.present?
+      if config.respond_to?(:relative_url_root)
+        # Rails 4.2 goes into an infinite loop if opts[:script_name] is unset
+        rails_4_2 = (Rails::VERSION::MAJOR >= 4) && (Rails::VERSION::MINOR >= 2)
+        if config.relative_url_root.present? || rails_4_2
           opts[:script_name] = config.relative_url_root
         end
       end

lib/devise/mailers/helpers.rb

@@ -64,7 +64,7 @@ module Devise
         template_path
       end
 
-      # Setup a subject doing an I18n lookup. At first, it attempts to set a subject
+      # Set up a subject doing an I18n lookup. At first, it attempts to set a subject
       # based on the current mapping:
       #
       #   en:

lib/devise/models/authenticatable.rb

@@ -143,13 +143,25 @@ module Devise
       #         if new_record? || changed?
       #           pending_notifications << [notification, args]
       #         else
-      #           devise_mailer.send(notification, self, *args).deliver
+      #           message = devise_mailer.send(notification, self, *args)
+      #           Remove once we move to Rails 4.2+ only.
+      #           if message.respond_to?(:deliver_now)
+      #             message.deliver_now
+      #           else
+      #             message.deliver
+      #           end
       #         end
       #       end
       #
       #       def send_pending_notifications
       #         pending_notifications.each do |notification, args|
-      #           devise_mailer.send(notification, self, *args).deliver
+      #           message = devise_mailer.send(notification, self, *args)
+      #           Remove once we move to Rails 4.2+ only.
+      #           if message.respond_to?(:deliver_now)
+      #             message.deliver_now
+      #           else
+      #             message.deliver
+      #           end
       #         end
       #
       #         # Empty the pending notifications array because the
@@ -253,7 +265,7 @@ module Devise
 
         # Find or initialize a record with group of attributes based on a list of required attributes.
         def find_or_initialize_with_errors(required_attributes, attributes, error=:invalid) #:nodoc:
-          attributes = if attributes.respond_to? :permit
+          attributes = if attributes.respond_to? :permit!
             attributes.slice(*required_attributes).permit!.to_h.with_indifferent_access
           else
             attributes.with_indifferent_access.slice(*required_attributes)

lib/devise/models/confirmable.rb

@@ -24,7 +24,7 @@ module Devise
     #     By default allow_unconfirmed_access_for is zero, it means users always have to confirm to sign in.
     #   * +reconfirmable+: requires any email changes to be confirmed (exactly the same way as
     #     initial account confirmation) to be applied. Requires additional unconfirmed_email
-    #     db field to be setup (t.reconfirmable in migrations). Until confirmed, new email is
+    #     db field to be set up (t.reconfirmable in migrations). Until confirmed, new email is
     #     stored in unconfirmed email column, and copied to email column on successful
     #     confirmation.
     #   * +confirm_within+: the time before a sent confirmation token becomes invalid.
@@ -43,9 +43,15 @@ module Devise
 
       included do
         before_create :generate_confirmation_token, if: :confirmation_required?
-        after_create  :send_on_create_confirmation_instructions, if: :send_confirmation_notification?
+        after_create :skip_reconfirmation!, if: :send_confirmation_notification?
+        if respond_to?(:after_commit) # ActiveRecord
+          after_commit :send_on_create_confirmation_instructions, on: :create, if: :send_confirmation_notification?
+          after_commit :send_reconfirmation_instructions, on: :update, if: :reconfirmation_required?
+        else # Mongoid
+          after_create :send_on_create_confirmation_instructions, if: :send_confirmation_notification?
+          after_update :send_reconfirmation_instructions, if: :reconfirmation_required?
+        end
         before_update :postpone_email_change_until_confirmation_and_regenerate_confirmation_token, if: :postpone_email_change?
-        after_update  :send_reconfirmation_instructions,  if: :reconfirmation_required?
       end
 
       def initialize(*args, &block)
@@ -75,7 +81,7 @@ module Devise
 
           self.confirmed_at = Time.now.utc
 
-          saved = if self.class.reconfirmable && unconfirmed_email.present?
+          saved = if pending_reconfirmation?
             skip_reconfirmation!
             self.email = unconfirmed_email
             self.unconfirmed_email = nil
@@ -91,11 +97,6 @@ module Devise
         end
       end
 
-      def confirm!(args={})
-        ActiveSupport::Deprecation.warn "confirm! is deprecated in favor of confirm"
-        confirm(args)
-      end
-
       # Verifies whether a user is confirmed or not
       def confirmed?
         !!confirmed_at
@@ -179,7 +180,7 @@ module Devise
         # Checks if the confirmation for the user is within the limit time.
         # We do this by calculating if the difference between today and the
         # confirmation sent date does not exceed the confirm in time configured.
-        # Confirm_within is a model configuration, must always be an integer value.
+        # allow_unconfirmed_access_for is a model configuration, must always be an integer value.
         #
         # Example:
         #
@@ -234,8 +235,7 @@ module Devise
           if self.confirmation_token && !confirmation_period_expired?
             @raw_confirmation_token = self.confirmation_token
           else
-            raw, _ = Devise.token_generator.generate(self.class, :confirmation_token)
-            self.confirmation_token = @raw_confirmation_token = raw
+            self.confirmation_token = @raw_confirmation_token = Devise.friendly_token
             self.confirmation_sent_at = Time.now.utc
           end
         end
@@ -253,13 +253,13 @@ module Devise
         end
 
         def postpone_email_change?
-          postpone = self.class.reconfirmable && email_changed? && email_was.present? && !@bypass_confirmation_postpone && self.email.present?
+          postpone = self.class.reconfirmable && email_changed? && !@bypass_confirmation_postpone && self.email.present?
           @bypass_confirmation_postpone = false
           postpone
         end
 
         def reconfirmation_required?
-          self.class.reconfirmable && @reconfirmation_required && self.email.present?
+          self.class.reconfirmable && @reconfirmation_required && (self.email.present? || self.unconfirmed_email.present?)
         end
 
         def send_confirmation_notification?

lib/devise/models/database_authenticatable.rb

@@ -1,14 +1,9 @@
 require 'devise/strategies/database_authenticatable'
 
 module Devise
-  def self.bcrypt(klass, password)
-    ActiveSupport::Deprecation.warn "Devise.bcrypt is deprecated; use Devise::Encryptor.digest instead"
-    Devise::Encryptor.digest(klass, password)
-  end
-
   module Models
-    # Authenticatable Module, responsible for encrypting password and validating
-    # authenticity of a user while signing in.
+    # Authenticatable Module, responsible for hashing the password and
+    # validating the authenticity of a user while signing in.
     #
     # == Options
     #
@@ -37,9 +32,10 @@ module Devise
         [:encrypted_password] + klass.authentication_keys
       end
 
-      # Generates password encryption based on the given value.
+      # Generates a hashed password based on the given value.
+      # For legacy reasons, we use `encrypted_password` to store
+      # the hashed password.
       def password=(new_password)
-        attribute_will_change! 'password'
         @password = new_password
         self.encrypted_password = password_digest(@password) if @password.present?
       end
@@ -142,11 +138,11 @@ module Devise
 
     protected
 
-      # Digests the password using bcrypt. Custom encryption should override
+      # Hashes the password using bcrypt. Custom hash functions should override
       # this method to apply their own algorithm.
       #
       # See https://github.com/plataformatec/devise-encryptable for examples
-      # of other encryption engines.
+      # of other hashing engines.
       def password_digest(password)
         Devise::Encryptor.digest(self.class, password)
       end

lib/devise/models/lockable.rb

@@ -7,7 +7,7 @@ module Devise
     # blocked: email and time. The former will send an email to the user when
     # the lock happens, containing a link to unlock its account. The second
     # will unlock the user automatically after some configured time (ie 2.hours).
-    # It's also possible to setup lockable to use both email and time strategies.
+    # It's also possible to set up lockable to use both email and time strategies.
     #
     # == Options
     #
@@ -64,7 +64,7 @@ module Devise
       def send_unlock_instructions
         raw, enc = Devise.token_generator.generate(self.class, :unlock_token)
         self.unlock_token = enc
-        self.save(validate: false)
+        save(validate: false)
         send_devise_notification(:unlock_instructions, raw, {})
         raw
       end
@@ -155,6 +155,9 @@ module Devise
         end
 
       module ClassMethods
+        # List of strategies that are enabled/supported if :both is used.
+        BOTH_STRATEGIES = [:time, :email]
+
         # Attempt to find a user by its unlock keys. If a record is found, send new
         # unlock instructions to it. If not user is found, returns a new user
         # with an email not found error.
@@ -181,7 +184,8 @@ module Devise
 
         # Is the unlock enabled for the given unlock strategy?
         def unlock_strategy_enabled?(strategy)
-          [:both, strategy].include?(self.unlock_strategy)
+          self.unlock_strategy == strategy ||
+            (self.unlock_strategy == :both && BOTH_STRATEGIES.include?(strategy))
         end
 
         # Is the lock enabled for the given lock strategy?

lib/devise/models/recoverable.rb

@@ -40,19 +40,9 @@ module Devise
         self.password = new_password
         self.password_confirmation = new_password_confirmation
 
-        if respond_to?(:after_password_reset) && valid?
-          ActiveSupport::Deprecation.warn "after_password_reset is deprecated"
-          after_password_reset
-        end
-
         save
       end
 
-      def reset_password!(new_password, new_password_confirmation)
-        ActiveSupport::Deprecation.warn "reset_password! is deprecated in favor of reset_password"
-        reset_password(new_password, new_password_confirmation)
-      end
-
       # Resets reset password token and send reset password instructions by email.
       # Returns the token sent in the e-mail.
       def send_reset_password_instructions
@@ -99,7 +89,7 @@ module Devise
 
           self.reset_password_token   = enc
           self.reset_password_sent_at = Time.now.utc
-          self.save(validate: false)
+          save(validate: false)
           raw
         end
 

lib/devise/models/rememberable.rb

@@ -39,16 +39,14 @@ module Devise
     module Rememberable
       extend ActiveSupport::Concern
 
-      attr_accessor :remember_me, :extend_remember_period
+      attr_accessor :remember_me
 
       def self.required_fields(klass)
         [:remember_created_at]
       end
 
-      # TODO: We were used to receive a extend period argument but we no longer do.
-      # Remove this for Devise 4.0.
-      def remember_me!(*)
-        self.remember_token = self.class.remember_token if respond_to?(:remember_token)
+      def remember_me!
+        self.remember_token ||= self.class.remember_token if respond_to?(:remember_token)
         self.remember_created_at ||= Time.now.utc
         save(validate: false) if self.changed?
       end
@@ -66,6 +64,10 @@ module Devise
         self.class.remember_for.from_now
       end
 
+      def extend_remember_period
+        self.class.extend_remember_period
+      end
+
       def rememberable_value
         if respond_to?(:remember_token)
           remember_token
@@ -147,9 +149,6 @@ module Devise
           end
         end
 
-        private
-
-        # TODO: extend_remember_period is no longer used
         Devise::Models.config(self, :remember_for, :extend_remember_period, :rememberable_options, :expire_all_remember_me_on_sign_out)
       end
     end

lib/devise/omniauth/url_helpers.rb

@@ -1,17 +1,24 @@
 module Devise
   module OmniAuth
     module UrlHelpers
-      def self.define_helpers(mapping)
+      def omniauth_authorize_path(resource_or_scope, provider, *args)
+        scope = Devise::Mapping.find_scope!(resource_or_scope)
+        _devise_route_context.send("#{scope}_#{provider}_omniauth_authorize_path", *args)
       end
 
-      def omniauth_authorize_path(resource_or_scope, *args)
+      def omniauth_authorize_url(resource_or_scope, provider, *args)
         scope = Devise::Mapping.find_scope!(resource_or_scope)
-        _devise_route_context.send("#{scope}_omniauth_authorize_path", *args)
+        _devise_route_context.send("#{scope}_#{provider}_omniauth_authorize_url", *args)
       end
 
-      def omniauth_callback_path(resource_or_scope, *args)
+      def omniauth_callback_path(resource_or_scope, provider, *args)
         scope = Devise::Mapping.find_scope!(resource_or_scope)
-        _devise_route_context.send("#{scope}_omniauth_callback_path", *args)
+        _devise_route_context.send("#{scope}_#{provider}_omniauth_callback_path", *args)
+      end
+
+      def omniauth_callback_url(resource_or_scope, provider, *args)
+        scope = Devise::Mapping.find_scope!(resource_or_scope)
+        _devise_route_context.send("#{scope}_#{provider}_omniauth_callback_url", *args)
       end
     end
   end

lib/devise/parameter_sanitizer.rb

@@ -68,12 +68,6 @@ module Devise
     def sanitize(action)
       permissions = @permitted[action]
 
-      # DEPRECATED: Remove this branch on Devise 4.1.
-      if respond_to?(action, true)
-        deprecate_instance_method_sanitization(action)
-        return cast_to_hash send(action)
-      end
-
       if permissions.respond_to?(:call)
         cast_to_hash permissions.call(default_params)
       elsif permissions.present?
@@ -127,17 +121,6 @@ module Devise
       end
     end
 
-    # DEPRECATED: Remove this method on Devise 4.1.
-    def for(action, &block) # :nodoc:
-      if block_given?
-        deprecate_for_with_block(action)
-        permit(action, &block)
-      else
-        deprecate_for_without_block(action)
-        @permitted[action] or unknown_action!(action)
-      end
-    end
-
     private
 
     # Cast a sanitized +ActionController::Parameters+ to a +HashWithIndifferentAccess+
@@ -169,45 +152,7 @@ module Devise
         If you want to define a new set of parameters to be sanitized use the
         `permit` method first:
 
-          devise_parameter_sanitizer.permit(:#{action}, keys: [:param1, param2, param3])
-      MESSAGE
-    end
-
-    def deprecate_for_with_block(action)
-      ActiveSupport::Deprecation.warn(<<-MESSAGE.strip_heredoc)
-        [Devise] Changing the sanitized parameters through "#{self.class.name}#for(#{action}) is deprecated and it will be removed from Devise 4.1.
-        Please use the `permit` method:
-
-          devise_parameter_sanitizer.permit(:#{action}) do |user|
-            # Your block here.
-          end
-      MESSAGE
-    end
-
-    def deprecate_for_without_block(action)
-      ActiveSupport::Deprecation.warn(<<-MESSAGE.strip_heredoc)
-        [Devise] Changing the sanitized parameters through "#{self.class.name}#for(#{action}) is deprecated and it will be removed from Devise 4.1.
-        Please use the `permit` method to add or remove any key:
-
-          To add any new key, use the `keys` keyword argument:
           devise_parameter_sanitizer.permit(:#{action}, keys: [:param1, :param2, :param3])
-
-          To remove any existing key, use the `except` keyword argument:
-          devise_parameter_sanitizer.permit(:#{action}, except: [:email])
-      MESSAGE
-    end
-
-    def deprecate_instance_method_sanitization(action)
-      ActiveSupport::Deprecation.warn(<<-MESSAGE.strip_heredoc)
-        [Devise] Parameter sanitization through a "#{self.class.name}##{action}" method is deprecated and it will be removed from Devise 4.1.
-        Please use the `permit` method on your sanitizer `initialize` method.
-
-          class #{self.class.name} < Devise::ParameterSanitizer
-            def initialize(*)
-              super
-              permit(:#{action}, keys: [:param1, :param2, :param3])
-            end
-          end
       MESSAGE
     end
   end

lib/devise/rails.rb

@@ -11,7 +11,9 @@ module Devise
     end
 
     # Force routes to be loaded if we are doing any eager load.
-    config.before_eager_load { |app| app.reload_routes! }
+    config.before_eager_load do |app|
+      app.reload_routes! if Devise.reload_routes
+    end
 
     initializer "devise.url_helpers" do
       Devise.include_helpers(Devise::Controllers)

lib/devise/rails/routes.rb

@@ -87,17 +87,17 @@ module ActionDispatch::Routing
     #
     # You can configure your routes with some options:
     #
-    #  * class_name: setup a different class to be looked up by devise, if it cannot be
+    #  * class_name: set up a different class to be looked up by devise, if it cannot be
     #    properly found by the route name.
     #
     #      devise_for :users, class_name: 'Account'
     #
-    #  * path: allows you to setup path name that will be used, as rails routes does.
-    #    The following route configuration would setup your route as /accounts instead of /users:
+    #  * path: allows you to set up path name that will be used, as rails routes does.
+    #    The following route configuration would set up your route as /accounts instead of /users:
     #
     #      devise_for :users, path: 'accounts'
     #
-    #  * singular: setup the singular name for the given resource. This is used as the helper methods
+    #  * singular: set up the singular name for the given resource. This is used as the helper methods
     #    names in controller ("authenticate_#{singular}!", "#{singular}_signed_in?", "current_#{singular}"
     #    and "#{singular}_session"), as the scope name in routes and as the scope given to warden.
     #
@@ -441,19 +441,17 @@ ERROR
 
         set_omniauth_path_prefix!(path_prefix)
 
-        providers = Regexp.union(mapping.to.omniauth_providers.map(&:to_s))
+        mapping.to.omniauth_providers.each do |provider|
+          match "#{path_prefix}/#{provider}",
+            to: "#{controllers[:omniauth_callbacks]}#passthru",
+            as: "#{provider}_omniauth_authorize",
+            via: [:get, :post]
 
-        match "#{path_prefix}/:provider",
-          constraints: { provider: providers },
-          to: "#{controllers[:omniauth_callbacks]}#passthru",
-          as: :omniauth_authorize,
-          via: [:get, :post]
-
-        match "#{path_prefix}/:action/callback",
-          constraints: { action: providers },
-          to: "#{controllers[:omniauth_callbacks]}#:action",
-          as: :omniauth_callback,
-          via: [:get, :post]
+          match "#{path_prefix}/#{provider}/callback",
+            to: "#{controllers[:omniauth_callbacks]}##{provider}",
+            as: "#{provider}_omniauth_callback",
+            via: [:get, :post]
+        end
       ensure
         @scope = current_scope
       end

lib/devise/strategies/database_authenticatable.rb

@@ -6,15 +6,15 @@ module Devise
     class DatabaseAuthenticatable < Authenticatable
       def authenticate!
         resource  = password.present? && mapping.to.find_for_database_authentication(authentication_hash)
-        encrypted = false
+        hashed = false
 
-        if validate(resource){ encrypted = true; resource.valid_password?(password) }
+        if validate(resource){ hashed = true; resource.valid_password?(password) }
           remember_me(resource)
           resource.after_database_authentication
           success!(resource)
         end
 
-        mapping.to.new.password = password if !encrypted && Devise.paranoid
+        mapping.to.new.password = password if !hashed && Devise.paranoid
         fail(:not_found_in_database) unless resource
       end
     end

lib/devise/strategies/rememberable.rb

@@ -25,8 +25,7 @@ module Devise
         end
 
         if validate(resource)
-          remember_me(resource)
-          extend_remember_me_period(resource)
+          remember_me(resource) if extend_remember_me?(resource)
           resource.after_remembered
           success!(resource)
         end
@@ -43,10 +42,8 @@ module Devise
 
     private
 
-      def extend_remember_me_period(resource)
-        if resource.respond_to?(:extend_remember_period=)
-          resource.extend_remember_period = mapping.to.extend_remember_period
-        end
+      def extend_remember_me?(resource)
+        resource.respond_to?(:extend_remember_period) && resource.extend_remember_period
       end
 
       def remember_me?

lib/devise/test/controller_helpers.rb

@@ -0,0 +1,163 @@
+module Devise
+  module Test
+    # `Devise::Test::ControllerHelpers` provides a facility to test controllers
+    # in isolation when using `ActionController::TestCase` allowing you to
+    # quickly sign_in or sign_out a user. Do not use
+    # `Devise::Test::ControllerHelpers` in integration tests.
+    #
+    # Examples
+    #
+    #  class PostsTest < ActionController::TestCase
+    #    include Devise::Test::ControllerHelpers
+    #
+    #    test 'authenticated users can GET index' do
+    #      sign_in users(:bob)
+    #
+    #      get :index
+    #      assert_response :success
+    #    end
+    #  end
+    #
+    # Important: you should not test Warden specific behavior (like callbacks)
+    # using `Devise::Test::ControllerHelpers` since it is a stub of the actual
+    # behavior. Such callbacks should be tested in your integration suite instead.
+    module ControllerHelpers
+      extend ActiveSupport::Concern
+
+      included do
+        setup :setup_controller_for_warden, :warden
+      end
+
+      # Override process to consider warden.
+      def process(*)
+        _catch_warden { super }
+
+        @response
+      end
+
+      # We need to set up the environment variables and the response in the controller.
+      def setup_controller_for_warden #:nodoc:
+        @request.env['action_controller.instance'] = @controller
+      end
+
+      # Quick access to Warden::Proxy.
+      def warden #:nodoc:
+        @request.env['warden'] ||= begin
+          manager = Warden::Manager.new(nil) do |config|
+            config.merge! Devise.warden_config
+          end
+          Warden::Proxy.new(@request.env, manager)
+        end
+      end
+
+      # sign_in a given resource by storing its keys in the session.
+      # This method bypass any warden authentication callback.
+      #
+      # * +resource+ - The resource that should be authenticated
+      # * +scope+    - An optional +Symbol+ with the scope where the resource
+      #                should be signed in with.
+      # Examples:
+      #
+      # sign_in users(:alice)
+      # sign_in users(:alice), scope: :admin
+      def sign_in(resource, deprecated = nil, scope: nil)
+        if deprecated.present?
+          scope = resource
+          resource = deprecated
+
+          ActiveSupport::Deprecation.warn <<-DEPRECATION
+            [Devise] sign_in(:#{scope}, resource) on controller tests is deprecated and will be removed from Devise.
+            Please use sign_in(resource, scope: :#{scope}) instead.
+          DEPRECATION
+        end
+
+        scope ||= Devise::Mapping.find_scope!(resource)
+
+        warden.instance_variable_get(:@users).delete(scope)
+        warden.session_serializer.store(resource, scope)
+      end
+
+      # Sign out a given resource or scope by calling logout on Warden.
+      # This method bypass any warden logout callback.
+      #
+      # Examples:
+      #
+      #   sign_out :user     # sign_out(scope)
+      #   sign_out @user     # sign_out(resource)
+      #
+      def sign_out(resource_or_scope)
+        scope = Devise::Mapping.find_scope!(resource_or_scope)
+        @controller.instance_variable_set(:"@current_#{scope}", nil)
+        user = warden.instance_variable_get(:@users).delete(scope)
+        warden.session_serializer.delete(scope, user)
+      end
+
+      protected
+
+      # Catch warden continuations and handle like the middleware would.
+      # Returns nil when interrupted, otherwise the normal result of the block.
+      def _catch_warden(&block)
+        result = catch(:warden, &block)
+
+        env = @controller.request.env
+
+        result ||= {}
+
+        # Set the response. In production, the rack result is returned
+        # from Warden::Manager#call, which the following is modelled on.
+        case result
+        when Array
+          if result.first == 401 && intercept_401?(env) # does this happen during testing?
+            _process_unauthenticated(env)
+          else
+            result
+          end
+        when Hash
+          _process_unauthenticated(env, result)
+        else
+          result
+        end
+      end
+
+      def _process_unauthenticated(env, options = {})
+        options[:action] ||= :unauthenticated
+        proxy = env['warden']
+        result = options[:result] || proxy.result
+
+        ret = case result
+        when :redirect
+          body = proxy.message || "You are being redirected to #{proxy.headers['Location']}"
+          [proxy.status, proxy.headers, [body]]
+        when :custom
+          proxy.custom_response
+        else
+          env["PATH_INFO"] = "/#{options[:action]}"
+          env["warden.options"] = options
+          Warden::Manager._run_callbacks(:before_failure, env, options)
+
+          status, headers, response = Devise.warden_config[:failure_app].call(env).to_a
+          @controller.response.headers.merge!(headers)
+          r_opts = { status: status, content_type: headers["Content-Type"], location: headers["Location"] }
+          r_opts[Rails.version.start_with?('5') ? :body : :text] = response.body
+          @controller.send :render, r_opts
+          nil # causes process return @response
+        end
+
+        # ensure that the controller response is set up. In production, this is
+        # not necessary since warden returns the results to rack. However, at
+        # testing time, we want the response to be available to the testing
+        # framework to verify what would be returned to rack.
+        if ret.is_a?(Array)
+          # ensure the controller response is set to our response.
+          @controller.response ||= @response
+          @response.status = ret.first
+          @response.headers.clear
+          ret.second.each { |k,v| @response[k] = v }
+          @response.body = ret.third
+        end
+
+        ret
+      end
+    end
+  end
+end

lib/devise/test/integration_helpers.rb

@@ -0,0 +1,61 @@
+module Devise
+  # Devise::Test::IntegrationHelpers is a helper module for facilitating
+  # authentication on Rails integration tests to bypass the required steps for
+  # signin in or signin out a record.
+  #
+  # Examples
+  #
+  #  class PostsTest < ActionDispatch::IntegrationTest
+  #    include Devise::Test::IntegrationHelpers
+  #
+  #    test 'authenticated users can see posts' do
+  #      sign_in users(:bob)
+  #
+  #      get '/posts'
+  #      assert_response :success
+  #    end
+  #  end
+  module Test
+    module IntegrationHelpers
+      def self.included(base)
+        base.class_eval do
+          include Warden::Test::Helpers
+
+          setup :setup_integration_for_devise
+          teardown :teardown_integration_for_devise
+        end
+      end
+
+      # Signs in a specific resource, mimicking a successfull sign in
+      # operation through +Devise::SessionsController#create+.
+      #
+      # * +resource+ - The resource that should be authenticated
+      # * +scope+    - An optional +Symbol+ with the scope where the resource
+      #                should be signed in with.
+      def sign_in(resource, scope: nil)
+        scope ||= Devise::Mapping.find_scope!(resource)
+
+        login_as(resource, scope: scope)
+      end
+
+      # Signs out a specific scope from the session.
+      #
+      # * +resource_or_scope+ - The resource or scope that should be signed out.
+      def sign_out(resource_or_scope)
+        scope = Devise::Mapping.find_scope!(resource_or_scope)
+
+        logout scope
+      end
+
+      protected
+
+      def setup_integration_for_devise
+        Warden.test_mode!
+      end
+
+      def teardown_integration_for_devise
+        Warden.test_reset!
+      end
+    end
+  end
+end

lib/devise/test_helpers.rb

@@ -1,137 +1,13 @@
 module Devise
-  # Devise::TestHelpers provides a facility to test controllers in isolation
-  # when using ActionController::TestCase allowing you to quickly sign_in or
-  # sign_out a user. Do not use Devise::TestHelpers in integration tests.
-  #
-  # Notice you should not test Warden specific behavior (like Warden callbacks)
-  # using Devise::TestHelpers since it is a stub of the actual behavior. Such
-  # callbacks should be tested in your integration suite instead.
   module TestHelpers
     def self.included(base)
       base.class_eval do
-        setup :setup_controller_for_warden, :warden if respond_to?(:setup)
+        ActiveSupport::Deprecation.warn <<-DEPRECATION
+          [Devise] including `Devise::TestHelpers` is deprecated and will be removed from Devise.
+          For controller tests, please include `Devise::Test::ControllerHelpers` instead.
+        DEPRECATION
+        include Devise::Test::ControllerHelpers
       end
     end
-
-    # Override process to consider warden.
-    def process(*)
-      # Make sure we always return @response, a la ActionController::TestCase::Behaviour#process, even if warden interrupts
-      _catch_warden { super } # || @response  # _catch_warden will setup the @response object
-
-      # process needs to return the ActionDispath::TestResponse object
-      @response
-    end
-
-    # We need to setup the environment variables and the response in the controller.
-    def setup_controller_for_warden #:nodoc:
-      @request.env['action_controller.instance'] = @controller
-    end
-
-    # Quick access to Warden::Proxy.
-    def warden #:nodoc:
-      @request.env['warden'] ||= begin
-        manager = Warden::Manager.new(nil) do |config|
-          config.merge! Devise.warden_config
-        end
-        Warden::Proxy.new(@request.env, manager)
-      end
-    end
-
-    # sign_in a given resource by storing its keys in the session.
-    # This method bypass any warden authentication callback.
-    #
-    # Examples:
-    #
-    #   sign_in :user, @user   # sign_in(scope, resource)
-    #   sign_in @user          # sign_in(resource)
-    #
-    def sign_in(resource_or_scope, resource=nil)
-      scope    ||= Devise::Mapping.find_scope!(resource_or_scope)
-      resource ||= resource_or_scope
-      warden.instance_variable_get(:@users).delete(scope)
-      warden.session_serializer.store(resource, scope)
-    end
-
-    # Sign out a given resource or scope by calling logout on Warden.
-    # This method bypass any warden logout callback.
-    #
-    # Examples:
-    #
-    #   sign_out :user     # sign_out(scope)
-    #   sign_out @user     # sign_out(resource)
-    #
-    def sign_out(resource_or_scope)
-      scope = Devise::Mapping.find_scope!(resource_or_scope)
-      @controller.instance_variable_set(:"@current_#{scope}", nil)
-      user = warden.instance_variable_get(:@users).delete(scope)
-      warden.session_serializer.delete(scope, user)
-    end
-
-    protected
-
-    # Catch warden continuations and handle like the middleware would.
-    # Returns nil when interrupted, otherwise the normal result of the block.
-    def _catch_warden(&block)
-      result = catch(:warden, &block)
-
-      env = @controller.request.env
-
-      result ||= {}
-
-      # Set the response. In production, the rack result is returned
-      # from Warden::Manager#call, which the following is modelled on.
-      case result
-      when Array
-        if result.first == 401 && intercept_401?(env) # does this happen during testing?
-          _process_unauthenticated(env)
-        else
-          result
-        end
-      when Hash
-        _process_unauthenticated(env, result)
-      else
-        result
-      end
-    end
-
-    def _process_unauthenticated(env, options = {})
-      options[:action] ||= :unauthenticated
-      proxy = env['warden']
-      result = options[:result] || proxy.result
-
-      ret = case result
-      when :redirect
-        body = proxy.message || "You are being redirected to #{proxy.headers['Location']}"
-        [proxy.status, proxy.headers, [body]]
-      when :custom
-        proxy.custom_response
-      else
-        env["PATH_INFO"] = "/#{options[:action]}"
-        env["warden.options"] = options
-        Warden::Manager._run_callbacks(:before_failure, env, options)
-
-        status, headers, response = Devise.warden_config[:failure_app].call(env).to_a
-        @controller.response.headers.merge!(headers)
-        r_opts = { status: status, content_type: headers["Content-Type"], location: headers["Location"] }
-        r_opts[Rails.version.start_with?('5') ? :body : :text] = response.body
-        @controller.send :render, r_opts
-        nil # causes process return @response
-      end
-
-      # ensure that the controller response is set up. In production, this is
-      # not necessary since warden returns the results to rack. However, at
-      # testing time, we want the response to be available to the testing
-      # framework to verify what would be returned to rack.
-      if ret.is_a?(Array)
-        # ensure the controller response is set to our response.
-        @controller.response ||= @response
-        @response.status = ret.first
-        @response.headers.clear
-        ret.second.each { |k,v| @response[k] = v }
-        @response.body = ret.third
-      end
-
-      ret
-    end
   end
 end

lib/devise/version.rb

@@ -1,3 +1,3 @@
 module Devise
-  VERSION = "4.0.0.rc1".freeze
+  VERSION = "4.1.0".freeze
 end

lib/generators/active_record/devise_generator.rb

@@ -11,9 +11,9 @@ module ActiveRecord
 
       def copy_devise_migration
         if (behavior == :invoke && model_exists?) || (behavior == :revoke && migration_exists?(table_name))
-          migration_template "migration_existing.rb", "db/migrate/add_devise_to_#{table_name}.rb"
+          migration_template "migration_existing.rb", "db/migrate/add_devise_to_#{table_name}.rb", migration_version: migration_version
         else
-          migration_template "migration.rb", "db/migrate/devise_create_#{table_name}.rb"
+          migration_template "migration.rb", "db/migrate/devise_create_#{table_name}.rb", migration_version: migration_version
         end
       end
 
@@ -86,6 +86,12 @@ RUBY
         config = ActiveRecord::Base.configurations[Rails.env]
         config && config['adapter'] == 'postgresql'
       end
+
+     def migration_version
+       if rails5?
+         "[#{Rails::VERSION::MAJOR}.#{Rails::VERSION::MINOR}]"
+       end
+     end
     end
   end
 end

lib/generators/active_record/templates/migration.rb

@@ -1,4 +1,4 @@
-class DeviseCreate<%= table_name.camelize %> < ActiveRecord::Migration
+class DeviseCreate<%= table_name.camelize %> < ActiveRecord::Migration<%= migration_version %>
   def change
     create_table :<%= table_name %> do |t|
 <%= migration_data -%>

lib/generators/active_record/templates/migration_existing.rb

@@ -1,4 +1,4 @@
-class AddDeviseTo<%= table_name.camelize %> < ActiveRecord::Migration
+class AddDeviseTo<%= table_name.camelize %> < ActiveRecord::Migration<%= migration_version %>
   def self.up
     change_table :<%= table_name %> do |t|
 <%= migration_data -%>

lib/generators/devise/install_generator.rb

@@ -3,6 +3,8 @@ require 'securerandom'
 
 module Devise
   module Generators
+    MissingORMError = Class.new(Thor::Error)
+
     class InstallGenerator < Rails::Generators::Base
       source_root File.expand_path("../../templates", __FILE__)
 
@@ -10,6 +12,19 @@ module Devise
       class_option :orm
 
       def copy_initializer
+        unless options[:orm]
+          raise MissingORMError, <<-ERROR.strip_heredoc
+          An ORM must be set to install Devise in your application.
+
+          Be sure to have an ORM like Active Record or Mongoid loaded in your
+          app or configure your own at `config/application.rb`.
+
+            config.generators do |g|
+              g.orm :your_orm_gem
+            end
+          ERROR
+        end
+
         template "devise.rb", "config/initializers/devise.rb"
       end
 

lib/generators/devise/orm_helpers.rb

@@ -15,7 +15,7 @@ CONTENT
       private
 
       def model_exists?
-        File.exists?(File.join(destination_root, model_path))
+        File.exist?(File.join(destination_root, model_path))
       end
 
       def migration_exists?(table_name)

lib/generators/templates/README

@@ -21,14 +21,7 @@ Some setup you must do manually if you haven't yet:
        <p class="notice"><%= notice %></p>
        <p class="alert"><%= alert %></p>
 
-  4. If you are deploying on Heroku with Rails 3.2 only, you may want to set:
-
-       config.assets.initialize_on_precompile = false
-
-     On config/application.rb forcing your application to not access the DB
-     or load models when precompiling your assets.
-
-  5. You can copy Devise views (for customization) to your app by running:
+  4. You can copy Devise views (for customization) to your app by running:
 
        rails g devise:views
 

lib/generators/templates/devise.rb

@@ -90,18 +90,24 @@ Devise.setup do |config|
   # from the server. You can disable this option at your own risk.
   # config.clean_up_csrf_token_on_authentication = true
 
+  # When false, Devise will not attempt to reload routes on eager load.
+  # This can reduce the time taken to boot the app but if your application
+  # requires the Devise mappings to be loaded during boot time the application
+  # won't boot properly.
+  # config.reload_routes = true
+
   # ==> Configuration for :database_authenticatable
-  # For bcrypt, this is the cost for hashing the password and defaults to 10. If
-  # using other encryptors, it sets how many times you want the password re-encrypted.
+  # For bcrypt, this is the cost for hashing the password and defaults to 11. If
+  # using other algorithms, it sets how many times you want the password to be hashed.
   #
   # Limiting the stretches to just one in testing will increase the performance of
   # your test suite dramatically. However, it is STRONGLY RECOMMENDED to not use
   # a value less than 10 in other environments. Note that, for bcrypt (the default
-  # encryptor), the cost increases exponentially with the number of stretches (e.g.
+  # algorithm), the cost increases exponentially with the number of stretches (e.g.
   # a value of 20 is already extremely slow: approx. 60 seconds for 1 calculation).
-  config.stretches = Rails.env.test? ? 1 : 10
+  config.stretches = Rails.env.test? ? 1 : 11
 
-  # Setup a pepper to generate the encrypted password.
+  # Set up a pepper to generate the hashed password.
   # config.pepper = '<%= SecureRandom.hex(64) %>'
 
   # Send a notification email when the user's password is changed
@@ -148,12 +154,12 @@ Devise.setup do |config|
 
   # ==> Configuration for :validatable
   # Range for password length.
-  config.password_length = 8..72
+  config.password_length = 6..128
 
   # Email regex used to validate email formats. It simply asserts that
   # one (and only one) @ exists in the given string. This is mainly
   # to give user feedback and not to assert the e-mail validity.
-  # config.email_regexp = /\A[^@]+@[^@]+\z/
+  config.email_regexp = /\A[^@\s]+@[^@\s]+\z/
 
   # ==> Configuration for :timeoutable
   # The time you want to timeout the user session without activity. After this
@@ -201,11 +207,11 @@ Devise.setup do |config|
   # config.sign_in_after_reset_password = true
 
   # ==> Configuration for :encryptable
-  # Allow you to use another encryption algorithm besides bcrypt (default). You can use
-  # :sha1, :sha512 or encryptors from others authentication tools as :clearance_sha1,
-  # :authlogic_sha512 (then you should set stretches above to 20 for default behavior)
-  # and :restful_authentication_sha1 (then you should set stretches to 10, and copy
-  # REST_AUTH_SITE_KEY to pepper).
+  # Allow you to use another hashing or encryption algorithm besides bcrypt (default).
+  # You can use :sha1, :sha512 or algorithms from others authentication tools as
+  # :clearance_sha1, :authlogic_sha512 (then you should set stretches above to 20
+  # for default behavior) and :restful_authentication_sha1 (then you should set
+  # stretches to 10, and copy REST_AUTH_SITE_KEY to pepper).
   #
   # Require the `devise-encryptable` gem when using anything other than bcrypt
   # config.encryptor = :sha512

test/controllers/custom_registrations_controller_test.rb

@@ -3,7 +3,7 @@ require 'test_helper'
 class CustomRegistrationsControllerTest < Devise::ControllerTestCase
   tests Custom::RegistrationsController
 
-  include Devise::TestHelpers
+  include Devise::Test::ControllerHelpers
 
   setup do
     request.env["devise.mapping"] = Devise.mappings[:user]

test/controllers/custom_strategy_test.rb

@@ -27,7 +27,7 @@ end
 class CustomStrategyTest < Devise::ControllerTestCase
   tests CustomStrategyController
 
-  include Devise::TestHelpers
+  include Devise::Test::ControllerHelpers
 
   setup do
     Warden::Strategies.add(:custom_strategy, CustomStrategy)

test/controllers/helpers_test.rb

@@ -96,7 +96,7 @@ class ControllerAuthenticatableTest < Devise::ControllerTestCase
 
   test 'proxy admin_signed_in? to authenticatewith admin scope' do
     @mock_warden.expects(:authenticate).with(scope: :admin)
-    assert_not @controller.admin_signed_in?
+    refute @controller.admin_signed_in?
   end
 
   test 'proxy publisher_account_signed_in? to authenticate with namespaced publisher account scope' do
@@ -150,11 +150,11 @@ class ControllerAuthenticatableTest < Devise::ControllerTestCase
     @controller.sign_in(user, force: true)
   end
 
-  test 'sign in accepts bypass as option' do
+  test 'bypass the sign in' do
     user = User.new
     @mock_warden.expects(:session_serializer).returns(serializer = mock())
     serializer.expects(:store).with(user, :user)
-    @controller.sign_in(user, bypass: true)
+    @controller.bypass_sign_in(user)
   end
 
   test 'sign out clears up any signed in user from all scopes' do
@@ -311,6 +311,6 @@ class ControllerAuthenticatableTest < Devise::ControllerTestCase
   end
 
   test 'is not a devise controller' do
-    assert_not @controller.devise_controller?
+    refute @controller.devise_controller?
   end
 end

test/controllers/internal_helpers_test.rb

@@ -119,7 +119,7 @@ class HelpersTest < Devise::ControllerTestCase
     MyController.send(:public, :navigational_formats)
 
     swap Devise, navigational_formats: ['*/*', :html] do
-      assert_not @controller.navigational_formats.include?("*/*")
+      refute @controller.navigational_formats.include?("*/*")
     end
 
     MyController.send(:protected, :navigational_formats)

test/controllers/passwords_controller_test.rb

@@ -2,7 +2,7 @@ require 'test_helper'
 
 class PasswordsControllerTest < Devise::ControllerTestCase
   tests Devise::PasswordsController
-  include Devise::TestHelpers
+  include Devise::Test::ControllerHelpers
 
   setup do
     request.env["devise.mapping"] = Devise.mappings[:user]

test/controllers/sessions_controller_test.rb

@@ -2,11 +2,11 @@ require 'test_helper'
 
 class SessionsControllerTest < Devise::ControllerTestCase
   tests Devise::SessionsController
-  include Devise::TestHelpers
+  include Devise::Test::ControllerHelpers
 
   test "#create doesn't raise unpermitted params when sign in fails" do
     begin
-      subscriber = ActiveSupport::Notifications.subscribe /unpermitted_parameters/ do |name, start, finish, id, payload|
+      subscriber = ActiveSupport::Notifications.subscribe %r{unpermitted_parameters} do |name, start, finish, id, payload|
         flunk "Unpermitted params: #{payload}"
       end
       request.env["devise.mapping"] = Devise.mappings[:user]

test/devise_test.rb

@@ -69,8 +69,8 @@ class DeviseTest < ActiveSupport::TestCase
   test 'add new module using the helper method' do
     assert_nothing_raised(Exception) { Devise.add_module(:coconut) }
     assert_equal 1, Devise::ALL.select { |v| v == :coconut }.size
-    assert_not Devise::STRATEGIES.include?(:coconut)
-    assert_not defined?(Devise::Models::Coconut)
+    refute Devise::STRATEGIES.include?(:coconut)
+    refute defined?(Devise::Models::Coconut)
     Devise::ALL.delete(:coconut)
 
     assert_nothing_raised(Exception) { Devise.add_module(:banana, strategy: :fruits) }
@@ -86,16 +86,16 @@ class DeviseTest < ActiveSupport::TestCase
 
   test 'should complain when comparing empty or different sized passes' do
     [nil, ""].each do |empty|
-      assert_not Devise.secure_compare(empty, "something")
-      assert_not Devise.secure_compare("something", empty)
-      assert_not Devise.secure_compare(empty, empty)
+      refute Devise.secure_compare(empty, "something")
+      refute Devise.secure_compare("something", empty)
+      refute Devise.secure_compare(empty, empty)
     end
-    assert_not Devise.secure_compare("size_1", "size_four")
+    refute Devise.secure_compare("size_1", "size_four")
   end
 
   test 'Devise.email_regexp should match valid email addresses' do
-    valid_emails = ["test@example.com", "jo@jo.co", "f4$_m@you.com", "testing.example@example.com.ua"]
-    non_valid_emails = ["rex", "test@go,com", "test user@example.com", "test_user@example server.com", "test_user@example.com."]
+    valid_emails = ["test@example.com", "jo@jo.co", "f4$_m@you.com", "testing.example@example.com.ua", "test@tt", "test@valid---domain.com"]
+    non_valid_emails = ["rex", "test user@example.com", "test_user@example server.com"]
 
     valid_emails.each do |email|
       assert_match Devise.email_regexp, email

test/failure_app_test.rb

@@ -133,14 +133,14 @@ class FailureTest < ActiveSupport::TestCase
 
     test 'uses the proxy failure message as symbol' do
       call_failure('warden' => OpenStruct.new(message: :invalid))
-      assert_equal 'Invalid email or password.', @request.flash[:alert]
+      assert_equal 'Invalid Email or password.', @request.flash[:alert]
       assert_equal 'http://test.host/users/sign_in', @response.second["Location"]
     end
 
     test 'supports authentication_keys as a Hash for the flash message' do
       swap Devise, authentication_keys: { email: true, login: true } do
         call_failure('warden' => OpenStruct.new(message: :invalid))
-        assert_equal 'Invalid email, login or password.', @request.flash[:alert]
+        assert_equal 'Invalid Email, Login or password.', @request.flash[:alert]
       end
     end
 
@@ -160,7 +160,7 @@ class FailureTest < ActiveSupport::TestCase
       assert_equal 'text/html; charset=utf-8', @response.second['Content-Type']
     end
 
-    test 'setup a default message' do
+    test 'set up a default message' do
       call_failure
       assert_match(/You are being/, @response.last.body)
       assert_match(/redirected/, @response.last.body)
@@ -226,7 +226,7 @@ class FailureTest < ActiveSupport::TestCase
 
     test 'uses the failure message as response body' do
       call_failure('formats' => Mime[:xml], 'warden' => OpenStruct.new(message: :invalid))
-      assert_match '<error>Invalid email or password.</error>', @response.third.body
+      assert_match '<error>Invalid Email or password.</error>', @response.third.body
     end
 
     context 'on ajax call' do
@@ -275,7 +275,7 @@ class FailureTest < ActiveSupport::TestCase
       }
       call_failure(env)
       assert @response.third.body.include?('<h2>Log in</h2>')
-      assert @response.third.body.include?('Invalid email or password.')
+      assert @response.third.body.include?('Invalid Email or password.')
     end
 
     test 'calls the original controller if not confirmed email' do
@@ -310,7 +310,7 @@ class FailureTest < ActiveSupport::TestCase
           }
           call_failure(env)
           assert @response.third.body.include?('<h2>Log in</h2>')
-          assert @response.third.body.include?('Invalid email or password.')
+          assert @response.third.body.include?('Invalid Email or password.')
           assert_equal @request.env["SCRIPT_NAME"], '/sample'
           assert_equal @request.env["PATH_INFO"], '/users/sign_in'
         end

test/generators/active_record_generator_test.rb

@@ -74,7 +74,7 @@ if DEVISE_ORM == :active_record
 
         assert_file "app/models/rails_engine/monster.rb", /devise/
         assert_file "app/models/rails_engine/monster.rb" do |content|
-          assert_no_match /attr_accessible :email/, content
+          assert_no_match %r{attr_accessible :email}, content
         end
       end
     end

test/generators/install_generator_test.rb

@@ -5,9 +5,20 @@ class InstallGeneratorTest < Rails::Generators::TestCase
   destination File.expand_path("../../tmp", __FILE__)
   setup :prepare_destination
 
-  test "Assert all files are properly created" do
-    run_generator
-    assert_file "config/initializers/devise.rb"
+  test "assert all files are properly created" do
+    run_generator(["--orm=active_record"])
+    assert_file "config/initializers/devise.rb", /devise\/orm\/active_record/
     assert_file "config/locales/devise.en.yml"
   end
+
+  test "fails if no ORM is specified" do
+    stderr = capture(:stderr) do
+      run_generator
+    end
+
+    assert_match %r{An ORM must be set to install Devise}, stderr
+
+    assert_no_file "config/initializers/devise.rb"
+    assert_no_file "config/locales/devise.en.yml"
+  end
 end

test/integration/authenticatable_test.rb

@@ -10,13 +10,13 @@ class AuthenticationSanityTest < Devise::IntegrationTest
   test 'sign in as user should not authenticate admin scope' do
     sign_in_as_user
     assert warden.authenticated?(:user)
-    assert_not warden.authenticated?(:admin)
+    refute warden.authenticated?(:admin)
   end
 
   test 'sign in as admin should not authenticate user scope' do
     sign_in_as_admin
     assert warden.authenticated?(:admin)
-    assert_not warden.authenticated?(:user)
+    refute warden.authenticated?(:user)
   end
 
   test 'sign in as both user and admin at same time' do
@@ -30,8 +30,8 @@ class AuthenticationSanityTest < Devise::IntegrationTest
     swap Devise, sign_out_all_scopes: false do
       sign_in_as_user
       sign_in_as_admin
-      get destroy_user_session_path
-      assert_not warden.authenticated?(:user)
+      delete destroy_user_session_path
+      refute warden.authenticated?(:user)
       assert warden.authenticated?(:admin)
     end
   end
@@ -41,8 +41,8 @@ class AuthenticationSanityTest < Devise::IntegrationTest
       sign_in_as_user
       sign_in_as_admin
 
-      get destroy_admin_session_path
-      assert_not warden.authenticated?(:admin)
+      delete destroy_admin_session_path
+      refute warden.authenticated?(:admin)
       assert warden.authenticated?(:user)
     end
   end
@@ -52,9 +52,9 @@ class AuthenticationSanityTest < Devise::IntegrationTest
       sign_in_as_user
       sign_in_as_admin
 
-      get destroy_user_session_path
-      assert_not warden.authenticated?(:user)
-      assert_not warden.authenticated?(:admin)
+      delete destroy_user_session_path
+      refute warden.authenticated?(:user)
+      refute warden.authenticated?(:admin)
     end
   end
 
@@ -63,22 +63,22 @@ class AuthenticationSanityTest < Devise::IntegrationTest
       sign_in_as_user
       sign_in_as_admin
 
-      get destroy_admin_session_path
-      assert_not warden.authenticated?(:admin)
-      assert_not warden.authenticated?(:user)
+      delete destroy_admin_session_path
+      refute warden.authenticated?(:admin)
+      refute warden.authenticated?(:user)
     end
   end
 
   test 'not signed in as admin should not be able to access admins actions' do
     get admins_path
     assert_redirected_to new_admin_session_path
-    assert_not warden.authenticated?(:admin)
+    refute warden.authenticated?(:admin)
   end
 
   test 'signed in as user should not be able to access admins actions' do
     sign_in_as_user
     assert warden.authenticated?(:user)
-    assert_not warden.authenticated?(:admin)
+    refute warden.authenticated?(:admin)
 
     get admins_path
     assert_redirected_to new_admin_session_path
@@ -87,7 +87,7 @@ class AuthenticationSanityTest < Devise::IntegrationTest
   test 'signed in as admin should be able to access admin actions' do
     sign_in_as_admin
     assert warden.authenticated?(:admin)
-    assert_not warden.authenticated?(:user)
+    refute warden.authenticated?(:user)
 
     get admins_path
 
@@ -109,17 +109,17 @@ class AuthenticationSanityTest < Devise::IntegrationTest
     sign_in_as_admin
     assert warden.authenticated?(:admin)
 
-    get destroy_admin_session_path
+    delete destroy_admin_session_path
     assert_response :redirect
     assert_redirected_to root_path
 
     get root_path
     assert_contain 'Signed out successfully'
-    assert_not warden.authenticated?(:admin)
+    refute warden.authenticated?(:admin)
   end
 
   test 'unauthenticated admin set message on sign out' do
-    get destroy_admin_session_path
+    delete destroy_admin_session_path
     assert_response :redirect
     assert_redirected_to root_path
 
@@ -138,13 +138,13 @@ class AuthenticationRoutesRestrictions < Devise::IntegrationTest
   test 'not signed in should not be able to access private route (authenticate denied)' do
     get private_path
     assert_redirected_to new_admin_session_path
-    assert_not warden.authenticated?(:admin)
+    refute warden.authenticated?(:admin)
   end
 
   test 'signed in as user should not be able to access private route restricted to admins (authenticate denied)' do
     sign_in_as_user
     assert warden.authenticated?(:user)
-    assert_not warden.authenticated?(:admin)
+    refute warden.authenticated?(:admin)
     get private_path
     assert_redirected_to new_admin_session_path
   end
@@ -152,7 +152,7 @@ class AuthenticationRoutesRestrictions < Devise::IntegrationTest
   test 'signed in as admin should be able to access private route restricted to admins (authenticate accepted)' do
     sign_in_as_admin
     assert warden.authenticated?(:admin)
-    assert_not warden.authenticated?(:user)
+    refute warden.authenticated?(:user)
 
     get private_path
 
@@ -164,7 +164,7 @@ class AuthenticationRoutesRestrictions < Devise::IntegrationTest
   test 'signed in as inactive admin should not be able to access private/active route restricted to active admins (authenticate denied)' do
     sign_in_as_admin(active: false)
     assert warden.authenticated?(:admin)
-    assert_not warden.authenticated?(:user)
+    refute warden.authenticated?(:user)
 
     assert_raises ActionController::RoutingError do
       get "/private/active"
@@ -174,7 +174,7 @@ class AuthenticationRoutesRestrictions < Devise::IntegrationTest
   test 'signed in as active admin should be able to access private/active route restricted to active admins (authenticate accepted)' do
     sign_in_as_admin(active: true)
     assert warden.authenticated?(:admin)
-    assert_not warden.authenticated?(:user)
+    refute warden.authenticated?(:user)
 
     get private_active_path
 
@@ -186,7 +186,7 @@ class AuthenticationRoutesRestrictions < Devise::IntegrationTest
   test 'signed in as admin should get admin dashboard (authenticated accepted)' do
     sign_in_as_admin
     assert warden.authenticated?(:admin)
-    assert_not warden.authenticated?(:user)
+    refute warden.authenticated?(:user)
 
     get dashboard_path
 
@@ -198,7 +198,7 @@ class AuthenticationRoutesRestrictions < Devise::IntegrationTest
   test 'signed in as user should get user dashboard (authenticated accepted)' do
     sign_in_as_user
     assert warden.authenticated?(:user)
-    assert_not warden.authenticated?(:admin)
+    refute warden.authenticated?(:admin)
 
     get dashboard_path
 
@@ -216,7 +216,7 @@ class AuthenticationRoutesRestrictions < Devise::IntegrationTest
   test 'signed in as inactive admin should not be able to access dashboard/active route restricted to active admins (authenticated denied)' do
     sign_in_as_admin(active: false)
     assert warden.authenticated?(:admin)
-    assert_not warden.authenticated?(:user)
+    refute warden.authenticated?(:user)
 
     assert_raises ActionController::RoutingError do
       get "/dashboard/active"
@@ -226,7 +226,7 @@ class AuthenticationRoutesRestrictions < Devise::IntegrationTest
   test 'signed in as active admin should be able to access dashboard/active route restricted to active admins (authenticated accepted)' do
     sign_in_as_admin(active: true)
     assert warden.authenticated?(:admin)
-    assert_not warden.authenticated?(:user)
+    refute warden.authenticated?(:user)
 
     get dashboard_active_path
 
@@ -238,7 +238,7 @@ class AuthenticationRoutesRestrictions < Devise::IntegrationTest
   test 'signed in user should not see unauthenticated page (unauthenticated denied)' do
     sign_in_as_user
     assert warden.authenticated?(:user)
-    assert_not warden.authenticated?(:admin)
+    refute warden.authenticated?(:admin)
 
     assert_raises ActionController::RoutingError do
       get join_path
@@ -347,37 +347,6 @@ class AuthenticationSessionTest < Devise::IntegrationTest
     assert_equal "Cart", @controller.user_session[:cart]
   end
 
-  test 'does not explode when class name is still stored in session' do
-    # In order to test that old sessions do not break with the new scoped
-    # deserialization, we need to serialize the session the old way. This is
-    # done by removing the newly used scoped serialization method
-    # (#user_serialize) and bringing back the old uncsoped #serialize method
-    # that includes the record's class name in the serialization.
-    begin
-      Warden::SessionSerializer.class_eval do
-        alias_method :original_serialize, :serialize
-        alias_method :original_user_serialize, :user_serialize
-        remove_method :user_serialize
-
-        def serialize(record)
-          klass = record.class
-          array = klass.serialize_into_session(record)
-          array.unshift(klass.name)
-        end
-      end
-
-      sign_in_as_user
-      assert warden.authenticated?(:user)
-    ensure
-      Warden::SessionSerializer.class_eval do
-        alias_method :serialize, :original_serialize
-        remove_method :original_serialize
-        alias_method :user_serialize, :original_user_serialize
-        remove_method :original_user_serialize
-      end
-    end
-  end
-
   test 'session id is changed on sign in' do
     get '/users'
     session_id = request.session["session_id"]
@@ -396,7 +365,7 @@ class AuthenticationWithScopedViewsTest < Devise::IntegrationTest
       assert_raise Webrat::NotFoundError do
         sign_in_as_user
       end
-      assert_match /Special user view/, response.body
+      assert_match %r{Special user view}, response.body
     end
   end
 
@@ -407,7 +376,7 @@ class AuthenticationWithScopedViewsTest < Devise::IntegrationTest
         sign_in_as_user
       end
 
-      assert_match /Special user view/, response.body
+      assert_match %r{Special user view}, response.body
       assert !Devise::PasswordsController.scoped_views?
     ensure
       Devise::SessionsController.send :remove_instance_variable, :@scoped_views
@@ -435,13 +404,13 @@ class AuthenticationOthersTest < Devise::IntegrationTest
   test 'handles unverified requests gets rid of caches' do
     swap ApplicationController, allow_forgery_protection: true do
       post exhibit_user_url(1)
-      assert_not warden.authenticated?(:user)
+      refute warden.authenticated?(:user)
 
       sign_in_as_user
       assert warden.authenticated?(:user)
 
       post exhibit_user_url(1)
-      assert_not warden.authenticated?(:user)
+      refute warden.authenticated?(:user)
       assert_equal "User is not authenticated", response.body
     end
   end
@@ -480,7 +449,7 @@ class AuthenticationOthersTest < Devise::IntegrationTest
   test 'sign in stub in xml format' do
     get new_user_session_path(format: 'xml')
     assert_match '<?xml version="1.0" encoding="UTF-8"?>', response.body
-    assert_match /<user>.*<\/user>/m, response.body
+    assert_match %r{<user>.*</user>}m, response.body
     assert_match '<email></email>', response.body
     assert_match '<password nil="true"', response.body
   end
@@ -504,7 +473,7 @@ class AuthenticationOthersTest < Devise::IntegrationTest
   test 'uses the mapping from router' do
     sign_in_as_user visit: "/as/sign_in"
     assert warden.authenticated?(:user)
-    assert_not warden.authenticated?(:admin)
+    refute warden.authenticated?(:admin)
   end
 
   test 'sign in with xml format returns xml response' do
@@ -532,36 +501,36 @@ class AuthenticationOthersTest < Devise::IntegrationTest
 
   test 'sign out with html redirects' do
     sign_in_as_user
-    get destroy_user_session_path
+    delete destroy_user_session_path
     assert_response :redirect
     assert_current_url '/'
 
     sign_in_as_user
-    get destroy_user_session_path(format: 'html')
+    delete destroy_user_session_path(format: 'html')
     assert_response :redirect
     assert_current_url '/'
   end
 
   test 'sign out with xml format returns no content' do
     sign_in_as_user
-    get destroy_user_session_path(format: 'xml')
+    delete destroy_user_session_path(format: 'xml')
     assert_response :no_content
-    assert_not warden.authenticated?(:user)
+    refute warden.authenticated?(:user)
   end
 
   test 'sign out with json format returns no content' do
     sign_in_as_user
-    get destroy_user_session_path(format: 'json')
+    delete destroy_user_session_path(format: 'json')
     assert_response :no_content
-    assert_not warden.authenticated?(:user)
+    refute warden.authenticated?(:user)
   end
 
   test 'sign out with non-navigational format via XHR does not redirect' do
     swap Devise, navigational_formats: ['*/*', :html] do
-      sign_in_as_user
-      get destroy_user_session_path, xhr: true, headers: { "HTTP_ACCEPT" => "application/json,text/javascript,*/*" } # NOTE: Bug is triggered by combination of XHR and */*.
+      sign_in_as_admin
+      get destroy_sign_out_via_get_session_path, xhr: true, headers: { "HTTP_ACCEPT" => "application/json,text/javascript,*/*" } # NOTE: Bug is triggered by combination of XHR and */*.
       assert_response :no_content
-      assert_not warden.authenticated?(:user)
+      refute warden.authenticated?(:user)
     end
   end
 
@@ -569,9 +538,9 @@ class AuthenticationOthersTest < Devise::IntegrationTest
   test 'sign out with navigational format via XHR does redirect' do
     swap Devise, navigational_formats: ['*/*', :html] do
       sign_in_as_user
-      get destroy_user_session_path, xhr: true, headers: { "HTTP_ACCEPT" => "text/html,*/*" }
+      delete destroy_user_session_path, xhr: true, headers: { "HTTP_ACCEPT" => "text/html,*/*" }
       assert_response :redirect
-      assert_not warden.authenticated?(:user)
+      refute warden.authenticated?(:user)
     end
   end
 end
@@ -580,8 +549,8 @@ class AuthenticationKeysTest < Devise::IntegrationTest
   test 'missing authentication keys cause authentication to abort' do
     swap Devise, authentication_keys: [:subdomain] do
       sign_in_as_user
-      assert_contain "Invalid subdomain or password."
-      assert_not warden.authenticated?(:user)
+      assert_contain "Invalid Subdomain or password."
+      refute warden.authenticated?(:user)
     end
   end
 
@@ -610,7 +579,7 @@ class AuthenticationRequestKeysTest < Devise::IntegrationTest
         sign_in_as_user
       end
 
-      assert_not warden.authenticated?(:user)
+      refute warden.authenticated?(:user)
     end
   end
 
@@ -619,8 +588,8 @@ class AuthenticationRequestKeysTest < Devise::IntegrationTest
 
     swap Devise, request_keys: [:subdomain] do
       sign_in_as_user
-      assert_contain "Invalid email or password."
-      assert_not warden.authenticated?(:user)
+      assert_contain "Invalid Email or password."
+      refute warden.authenticated?(:user)
     end
   end
 
@@ -643,7 +612,7 @@ class AuthenticationSignOutViaTest < Devise::IntegrationTest
   test 'allow sign out via delete when sign_out_via provides only delete' do
     sign_in!(:sign_out_via_delete)
     delete destroy_sign_out_via_delete_session_path
-    assert_not warden.authenticated?(:sign_out_via_delete)
+    refute warden.authenticated?(:sign_out_via_delete)
   end
 
   test 'do not allow sign out via get when sign_out_via provides only delete' do
@@ -657,7 +626,7 @@ class AuthenticationSignOutViaTest < Devise::IntegrationTest
   test 'allow sign out via post when sign_out_via provides only post' do
     sign_in!(:sign_out_via_post)
     post destroy_sign_out_via_post_session_path
-    assert_not warden.authenticated?(:sign_out_via_post)
+    refute warden.authenticated?(:sign_out_via_post)
   end
 
   test 'do not allow sign out via get when sign_out_via provides only post' do
@@ -671,13 +640,13 @@ class AuthenticationSignOutViaTest < Devise::IntegrationTest
   test 'allow sign out via delete when sign_out_via provides delete and post' do
     sign_in!(:sign_out_via_delete_or_post)
     delete destroy_sign_out_via_delete_or_post_session_path
-    assert_not warden.authenticated?(:sign_out_via_delete_or_post)
+    refute warden.authenticated?(:sign_out_via_delete_or_post)
   end
 
   test 'allow sign out via post when sign_out_via provides delete and post' do
     sign_in!(:sign_out_via_delete_or_post)
     post destroy_sign_out_via_delete_or_post_session_path
-    assert_not warden.authenticated?(:sign_out_via_delete_or_post)
+    refute warden.authenticated?(:sign_out_via_delete_or_post)
   end
 
   test 'do not allow sign out via get when sign_out_via provides delete and post' do

test/integration/confirmable_test.rb

@@ -35,18 +35,18 @@ class ConfirmationTest < Devise::IntegrationTest
   test 'user with invalid confirmation token should not be able to confirm an account' do
     visit_user_confirmation_with_token('invalid_confirmation')
     assert_have_selector '#error_explanation'
-    assert_contain /Confirmation token(.*)invalid/
+    assert_contain %r{Confirmation token(.*)invalid}
   end
 
   test 'user with valid confirmation token should not be able to confirm an account after the token has expired' do
     swap Devise, confirm_within: 3.days do
       user = create_user(confirm: false, confirmation_sent_at: 4.days.ago)
-      assert_not user.confirmed?
+      refute user.confirmed?
       visit_user_confirmation_with_token(user.raw_confirmation_token)
 
       assert_have_selector '#error_explanation'
-      assert_contain /needs to be confirmed within 3 days/
-      assert_not user.reload.confirmed?
+      assert_contain %r{needs to be confirmed within 3 days}
+      refute user.reload.confirmed?
       assert_current_url "/users/confirmation?confirmation_token=#{user.raw_confirmation_token}"
     end
   end
@@ -84,7 +84,7 @@ class ConfirmationTest < Devise::IntegrationTest
   test 'user with valid confirmation token should be able to confirm an account before the token has expired' do
     swap Devise, confirm_within: 3.days do
       user = create_user(confirm: false, confirmation_sent_at: 2.days.ago)
-      assert_not user.confirmed?
+      refute user.confirmed?
       visit_user_confirmation_with_token(user.raw_confirmation_token)
 
       assert_contain 'Your email address has been successfully confirmed.'
@@ -130,7 +130,7 @@ class ConfirmationTest < Devise::IntegrationTest
       sign_in_as_user(confirm: false)
 
       assert_contain 'You have to confirm your email address before continuing'
-      assert_not warden.authenticated?(:user)
+      refute warden.authenticated?(:user)
     end
   end
 
@@ -140,8 +140,8 @@ class ConfirmationTest < Devise::IntegrationTest
         fill_in 'password', with: 'invalid'
       end
 
-      assert_contain 'Invalid email or password'
-      assert_not warden.authenticated?(:user)
+      assert_contain 'Invalid Email or password'
+      refute warden.authenticated?(:user)
     end
   end
 
@@ -284,7 +284,7 @@ class ConfirmationOnChangeTest < Devise::IntegrationTest
     assert_contain 'Your email address has been successfully confirmed.'
     assert_current_url '/admin_area/sign_in'
     assert admin.reload.confirmed?
-    assert_not admin.reload.pending_reconfirmation?
+    refute admin.reload.pending_reconfirmation?
   end
 
   test 'admin with previously valid confirmation token should not be able to confirm email after email changed again' do
@@ -306,7 +306,7 @@ class ConfirmationOnChangeTest < Devise::IntegrationTest
     assert_contain 'Your email address has been successfully confirmed.'
     assert_current_url '/admin_area/sign_in'
     assert admin.reload.confirmed?
-    assert_not admin.reload.pending_reconfirmation?
+    refute admin.reload.pending_reconfirmation?
   end
 
   test 'admin email should be unique also within unconfirmed_email' do

test/integration/database_authenticatable_test.rb

@@ -19,7 +19,7 @@ class DatabaseAuthenticationTest < Devise::IntegrationTest
         fill_in 'email', with: 'foo@bar.com'
       end
 
-      assert_not warden.authenticated?(:user)
+      refute warden.authenticated?(:user)
     end
   end
 
@@ -41,14 +41,14 @@ class DatabaseAuthenticationTest < Devise::IntegrationTest
         fill_in 'email', with: ' foo@bar.com '
       end
 
-      assert_not warden.authenticated?(:user)
+      refute warden.authenticated?(:user)
     end
   end
 
   test 'sign in should not authenticate if not using proper authentication keys' do
     swap Devise, authentication_keys: [:username] do
       sign_in_as_user
-      assert_not warden.authenticated?(:user)
+      refute warden.authenticated?(:user)
     end
   end
 
@@ -59,7 +59,7 @@ class DatabaseAuthenticationTest < Devise::IntegrationTest
       end
 
       assert_contain 'Invalid email address'
-      assert_not warden.authenticated?(:admin)
+      refute warden.authenticated?(:admin)
     end
   end
 
@@ -68,8 +68,8 @@ class DatabaseAuthenticationTest < Devise::IntegrationTest
       fill_in 'password', with: 'abcdef'
     end
 
-    assert_contain 'Invalid email or password'
-    assert_not warden.authenticated?(:admin)
+    assert_contain 'Invalid Email or password'
+    refute warden.authenticated?(:admin)
   end
 
   test 'error message is configurable by resource name' do

test/integration/http_authenticatable_test.rb

@@ -11,13 +11,15 @@ class HttpAuthenticationTest < Devise::IntegrationTest
   end
 
   test 'sign in should authenticate with http' do
-    sign_in_as_new_user_with_http
-    assert_response 200
-    assert_match '<email>user@test.com</email>', response.body
-    assert warden.authenticated?(:user)
+    swap Devise, skip_session_storage: [] do
+      sign_in_as_new_user_with_http
+      assert_response 200
+      assert_match '<email>user@test.com</email>', response.body
+      assert warden.authenticated?(:user)
 
-    get users_path(format: :xml)
-    assert_response 200
+      get users_path(format: :xml)
+      assert_response 200
+    end
   end
 
   test 'sign in should authenticate with http but not emit a cookie if skipping session storage' do
@@ -42,7 +44,7 @@ class HttpAuthenticationTest < Devise::IntegrationTest
     sign_in_as_new_user_with_http("unknown")
     assert_equal 401, status
     assert_equal "application/xml; charset=utf-8", headers["Content-Type"]
-    assert_match "<error>Invalid email or password.</error>", response.body
+    assert_match "<error>Invalid Email or password.</error>", response.body
   end
 
   test 'returns a custom response with www-authenticate and chosen realm' do
@@ -63,7 +65,7 @@ class HttpAuthenticationTest < Devise::IntegrationTest
   end
 
   test 'it uses appropriate authentication_keys when configured with hash' do
-    swap Devise, authentication_keys: ActiveSupport::OrderedHash[:username, false, :email, false] do
+    swap Devise, authentication_keys: { username: false, email: false } do
       sign_in_as_new_user_with_http("usertest")
       assert_response :success
       assert_match '<email>user@test.com</email>', response.body
@@ -72,7 +74,7 @@ class HttpAuthenticationTest < Devise::IntegrationTest
   end
 
   test 'it uses the appropriate key when configured explicitly' do
-    swap Devise, authentication_keys: ActiveSupport::OrderedHash[:email, false, :username, false], http_authentication_key: :username do
+    swap Devise, authentication_keys: { email: false, username: false }, http_authentication_key: :username do
       sign_in_as_new_user_with_http("usertest")
       assert_response :success
       assert_match '<email>user@test.com</email>', response.body

test/integration/lockable_test.rb

@@ -75,7 +75,7 @@ class LockTest < Devise::IntegrationTest
     assert_response :success
     assert_current_url '/users/unlock?unlock_token=invalid_token'
     assert_have_selector '#error_explanation'
-    assert_contain /Unlock token(.*)invalid/
+    assert_contain %r{Unlock token(.*)invalid}
   end
 
   test "locked user should be able to unlock account" do
@@ -85,7 +85,7 @@ class LockTest < Devise::IntegrationTest
 
     assert_current_url "/users/sign_in"
     assert_contain 'Your account has been unlocked successfully. Please sign in to continue.'
-    assert_not user.reload.access_locked?
+    refute user.reload.access_locked?
   end
 
   test "user should not send a new e-mail if already locked" do

test/integration/omniauthable_test.rb

@@ -71,7 +71,7 @@ class OmniauthableIntegrationTest < Devise::IntegrationTest
     assert_current_url "/"
     assert_contain "You have signed up successfully."
     assert_contain "Hello User user@example.com"
-    assert_not session["devise.facebook_data"]
+    refute session["devise.facebook_data"]
   end
 
   test "cleans up session on cancel" do

test/integration/recoverable_test.rb

@@ -10,7 +10,7 @@ class PasswordTest < Devise::IntegrationTest
   def request_forgot_password(&block)
     visit_new_password_path
     assert_response :success
-    assert_not warden.authenticated?(:user)
+    refute warden.authenticated?(:user)
 
     fill_in 'email', with: 'user@test.com'
     yield if block_given?
@@ -146,8 +146,8 @@ class PasswordTest < Devise::IntegrationTest
     assert_response :success
     assert_current_url '/users/password'
     assert_have_selector '#error_explanation'
-    assert_contain /Reset password token(.*)invalid/
-    assert_not user.reload.valid_password?('987654321')
+    assert_contain %r{Reset password token(.*)invalid}
+    refute user.reload.valid_password?('987654321')
   end
 
   test 'not authenticated user with valid reset password token but invalid password should not be able to change their password' do
@@ -161,7 +161,7 @@ class PasswordTest < Devise::IntegrationTest
     assert_current_url '/users/password'
     assert_have_selector '#error_explanation'
     assert_contain "Password confirmation doesn't match Password"
-    assert_not user.reload.valid_password?('987654321')
+    refute user.reload.valid_password?('987654321')
   end
 
   test 'not authenticated user with valid data should be able to change their password' do
@@ -181,7 +181,7 @@ class PasswordTest < Devise::IntegrationTest
     reset_password {  fill_in 'Confirm new password', with: 'other_password' }
     assert_response :success
     assert_have_selector '#error_explanation'
-    assert_not user.reload.valid_password?('987654321')
+    refute user.reload.valid_password?('987654321')
 
     reset_password visit: false
     assert_contain 'Your password has been changed successfully.'
@@ -212,7 +212,7 @@ class PasswordTest < Devise::IntegrationTest
   test 'does not sign in user automatically after changing its password if it\'s locked and unlock strategy is :none or :time' do
     [:none, :time].each do |strategy|
       swap Devise, unlock_strategy: strategy do
-        user = create_user(locked: true)
+        create_user(locked: true)
         request_forgot_password
         reset_password
 

test/integration/registerable_test.rb

@@ -64,11 +64,11 @@ class RegistrationTest < Devise::IntegrationTest
     assert_not_contain 'You have to confirm your account before continuing'
     assert_current_url "/"
 
-    assert_not warden.authenticated?(:user)
+    refute warden.authenticated?(:user)
 
     user = User.to_adapter.find_first(order: [:id, :desc])
     assert_equal user.email, 'new_user@test.com'
-    assert_not user.confirmed?
+    refute user.confirmed?
   end
 
   test 'a guest user should receive the confirmation instructions from the default mailer' do
@@ -92,7 +92,7 @@ class RegistrationTest < Devise::IntegrationTest
     click_button 'Sign up'
 
     assert_current_url "/?custom=1"
-    assert_not warden.authenticated?(:user)
+    refute warden.authenticated?(:user)
   end
 
   test 'a guest user cannot sign up with invalid information' do
@@ -114,7 +114,7 @@ class RegistrationTest < Devise::IntegrationTest
     assert_contain "2 errors prohibited"
     assert_nil User.to_adapter.find_first
 
-    assert_not warden.authenticated?(:user)
+    refute warden.authenticated?(:user)
   end
 
   test 'a guest should not sign up with email/password that already exists' do
@@ -133,7 +133,7 @@ class RegistrationTest < Devise::IntegrationTest
     assert_current_url '/users'
     assert_contain(/Email.*already.*taken/)
 
-    assert_not warden.authenticated?(:user)
+    refute warden.authenticated?(:user)
   end
 
   test 'a guest should not be able to change account' do
@@ -217,7 +217,13 @@ class RegistrationTest < Devise::IntegrationTest
     click_button 'Update'
 
     assert_contain "Password confirmation doesn't match Password"
-    assert_not User.to_adapter.find_first.valid_password?('pas123')
+    refute User.to_adapter.find_first.valid_password?('pas123')
+  end
+  
+  test 'a signed in user should see a warning about minimum password length' do
+    sign_in_as_user
+    get edit_user_registration_path
+    assert_contain 'characters minimum'
   end
 
   test 'a signed in user should be able to cancel their account' do

test/integration/rememberable_test.rb

@@ -33,12 +33,12 @@ class RememberMeTest < Devise::IntegrationTest
   test 'handle unverified requests gets rid of caches' do
     swap ApplicationController, allow_forgery_protection: true do
       post exhibit_user_url(1)
-      assert_not warden.authenticated?(:user)
+      refute warden.authenticated?(:user)
 
       create_user_and_remember
       post exhibit_user_url(1)
       assert_equal "User is not authenticated", response.body
-      assert_not warden.authenticated?(:user)
+      refute warden.authenticated?(:user)
     end
   end
 
@@ -51,8 +51,8 @@ class RememberMeTest < Devise::IntegrationTest
           authenticity_token: "oops",
           user: { email: "jose.valim@gmail.com", password: "123456", remember_me: "1" }
         }
-      assert_not warden.authenticated?(:user)
-      assert_not request.cookies['remember_user_token']
+      refute warden.authenticated?(:user)
+      refute request.cookies['remember_user_token']
     end
   end
 
@@ -94,7 +94,6 @@ class RememberMeTest < Devise::IntegrationTest
     assert_response :success
     assert warden.authenticated?(:user)
     assert warden.user(:user) == user
-    assert_match /remember_user_token[^\n]*HttpOnly/, response.headers["Set-Cookie"], "Expected Set-Cookie header in response to set HttpOnly flag on remember_user_token cookie."
   end
 
   test 'remember the user before sign up and redirect them to their home' do
@@ -120,18 +119,52 @@ class RememberMeTest < Devise::IntegrationTest
     end
   end
 
+  test 'extends remember period when extend remember period config is true' do
+    swap Devise, extend_remember_period: true, remember_for: 1.year do
+      create_user_and_remember
+      old_remember_token = nil
+
+      travel_to 1.day.ago do
+        get root_path
+        old_remember_token = request.cookies['remember_user_token']
+      end
+
+      get root_path
+      current_remember_token = request.cookies['remember_user_token']
+
+      refute_equal old_remember_token, current_remember_token
+    end
+  end
+
+  test 'does not extend remember period when extend period config is false' do
+    swap Devise, extend_remember_period: false, remember_for: 1.year do
+      create_user_and_remember
+      old_remember_token = nil
+
+      travel_to 1.day.ago do
+        get root_path
+        old_remember_token = request.cookies['remember_user_token']
+      end
+
+      get root_path
+      current_remember_token = request.cookies['remember_user_token']
+
+      assert_equal old_remember_token, current_remember_token
+    end
+  end
+
   test 'do not remember other scopes' do
     create_user_and_remember
     get root_path
     assert_response :success
     assert warden.authenticated?(:user)
-    assert_not warden.authenticated?(:admin)
+    refute warden.authenticated?(:admin)
   end
 
   test 'do not remember with invalid token' do
     create_user_and_remember('add')
     get users_path
-    assert_not warden.authenticated?(:user)
+    refute warden.authenticated?(:user)
     assert_redirected_to new_user_session_path
   end
 
@@ -139,7 +172,7 @@ class RememberMeTest < Devise::IntegrationTest
     create_user_and_remember
     swap Devise, remember_for: 0.days do
       get users_path
-      assert_not warden.authenticated?(:user)
+      refute warden.authenticated?(:user)
       assert_redirected_to new_user_session_path
     end
   end
@@ -149,12 +182,12 @@ class RememberMeTest < Devise::IntegrationTest
     get users_path
     assert warden.authenticated?(:user)
 
-    get destroy_user_session_path
-    assert_not warden.authenticated?(:user)
+    delete destroy_user_session_path
+    refute warden.authenticated?(:user)
     assert_nil warden.cookies['remember_user_token']
 
     get users_path
-    assert_not warden.authenticated?(:user)
+    refute warden.authenticated?(:user)
   end
 
   test 'changing user password expires remember me token' do
@@ -164,7 +197,7 @@ class RememberMeTest < Devise::IntegrationTest
     user.save!
 
     get users_path
-    assert_not warden.authenticated?(:user)
+    refute warden.authenticated?(:user)
   end
 
   test 'valid sign in calls after_remembered callback' do

test/integration/timeoutable_test.rb

@@ -56,7 +56,7 @@ class SessionTimeoutTest < Devise::IntegrationTest
 
       get users_path
       assert_redirected_to users_path
-      assert_not warden.authenticated?(:user)
+      refute warden.authenticated?(:user)
       assert warden.authenticated?(:admin)
     end
   end
@@ -70,8 +70,8 @@ class SessionTimeoutTest < Devise::IntegrationTest
       assert_not_nil last_request_at
 
       get root_path
-      assert_not warden.authenticated?(:user)
-      assert_not warden.authenticated?(:admin)
+      refute warden.authenticated?(:user)
+      refute warden.authenticated?(:admin)
     end
   end
 
@@ -89,7 +89,7 @@ class SessionTimeoutTest < Devise::IntegrationTest
     user = sign_in_as_user
     get expire_user_path(user)
 
-    get destroy_user_session_path
+    delete destroy_user_session_path
 
     assert_response :redirect
     assert_redirected_to root_path
@@ -108,7 +108,7 @@ class SessionTimeoutTest < Devise::IntegrationTest
 
     assert_response :success
     assert_contain 'Sign in'
-    assert_not warden.authenticated?(:user)
+    refute warden.authenticated?(:user)
   end
 
   test 'time out is not triggered on sign in' do
@@ -134,7 +134,7 @@ class SessionTimeoutTest < Devise::IntegrationTest
       get expire_user_path(user)
       get users_path
       assert_redirected_to users_path
-      assert_not warden.authenticated?(:user)
+      refute warden.authenticated?(:user)
     end
   end
 

test/integration/trackable_test.rb

@@ -16,7 +16,7 @@ class TrackableHooksTest < Devise::IntegrationTest
     assert_equal user.current_sign_in_at, user.last_sign_in_at
     assert user.current_sign_in_at >= user.created_at
 
-    visit destroy_user_session_path
+    delete destroy_user_session_path
     new_time = 2.seconds.from_now
     Time.stubs(:now).returns(new_time)
 
@@ -56,7 +56,7 @@ class TrackableHooksTest < Devise::IntegrationTest
     user.reload
     assert_equal 1, user.sign_in_count
 
-    visit destroy_user_session_path
+    delete destroy_user_session_path
     sign_in_as_user
     user.reload
     assert_equal 2, user.sign_in_count
@@ -80,7 +80,7 @@ class TrackableHooksTest < Devise::IntegrationTest
     end
     user.reload
     assert_equal 0, user.sign_in_count
-    visit destroy_user_session_path
+    delete destroy_user_session_path
 
     sign_in_as_user do
       header 'devise.skip_trackable', false

test/mailers/confirmation_instructions_test.rb

@@ -37,16 +37,16 @@ class ConfirmationInstructionsTest < ActionMailer::TestCase
     assert_equal [user.email], mail.to
   end
 
-  test 'setup sender from configuration' do
+  test 'set up sender from configuration' do
     assert_equal ['test@example.com'], mail.from
   end
 
-  test 'setup sender from custom mailer defaults' do
+  test 'set up sender from custom mailer defaults' do
     Devise.mailer = 'Users::Mailer'
     assert_equal ['custom@example.com'], mail.from
   end
 
-  test 'setup sender from custom mailer defaults with proc' do
+  test 'set up sender from custom mailer defaults with proc' do
     Devise.mailer = 'Users::FromProcMailer'
     assert_equal ['custom@example.com'], mail.from
   end
@@ -56,17 +56,17 @@ class ConfirmationInstructionsTest < ActionMailer::TestCase
     assert_present mail.body.encoded
   end
 
-  test 'setup reply to as copy from sender' do
+  test 'set up reply to as copy from sender' do
     assert_equal ['test@example.com'], mail.reply_to
   end
 
-  test 'setup reply to as different if set in defaults' do
+  test 'set up reply to as different if set in defaults' do
     Devise.mailer = 'Users::ReplyToMailer'
     assert_equal ['custom@example.com'], mail.from
     assert_equal ['custom_reply_to@example.com'], mail.reply_to
   end
 
-  test 'setup subject from I18n' do
+  test 'set up subject from I18n' do
     store_translations :en, devise: { mailer: { confirmation_instructions: { subject: 'Account Confirmation' } } } do
       assert_equal 'Account Confirmation', mail.subject
     end

test/mailers/reset_password_instructions_test.rb

@@ -39,16 +39,16 @@ class ResetPasswordInstructionsTest < ActionMailer::TestCase
     assert_equal [user.email], mail.to
   end
 
-  test 'setup sender from configuration' do
+  test 'set up sender from configuration' do
     assert_equal ['test@example.com'], mail.from
   end
 
-  test 'setup sender from custom mailer defaults' do
+  test 'set up sender from custom mailer defaults' do
     Devise.mailer = 'Users::Mailer'
     assert_equal ['custom@example.com'], mail.from
   end
 
-  test 'setup sender from custom mailer defaults with proc' do
+  test 'set up sender from custom mailer defaults with proc' do
     Devise.mailer = 'Users::FromProcMailer'
     assert_equal ['custom@example.com'], mail.from
   end
@@ -58,11 +58,11 @@ class ResetPasswordInstructionsTest < ActionMailer::TestCase
     assert_present mail.body.encoded
   end
 
-  test 'setup reply to as copy from sender' do
+  test 'set up reply to as copy from sender' do
     assert_equal ['test@example.com'], mail.reply_to
   end
 
-  test 'setup subject from I18n' do
+  test 'set up subject from I18n' do
     store_translations :en, devise: { mailer: { reset_password_instructions: { subject: 'Reset instructions' } } } do
       assert_equal 'Reset instructions', mail.subject
     end

test/mailers/unlock_instructions_test.rb

@@ -40,16 +40,16 @@ class UnlockInstructionsTest < ActionMailer::TestCase
     assert_equal [user.email], mail.to
   end
 
-  test 'setup sender from configuration' do
+  test 'set up sender from configuration' do
     assert_equal ['test@example.com'], mail.from
   end
 
-  test 'setup sender from custom mailer defaults' do
+  test 'set up sender from custom mailer defaults' do
     Devise.mailer = 'Users::Mailer'
     assert_equal ['custom@example.com'], mail.from
   end
 
-  test 'setup sender from custom mailer defaults with proc' do
+  test 'set up sender from custom mailer defaults with proc' do
     Devise.mailer = 'Users::FromProcMailer'
     assert_equal ['custom@example.com'], mail.from
   end
@@ -59,11 +59,11 @@ class UnlockInstructionsTest < ActionMailer::TestCase
     assert_present mail.body.encoded
   end
 
-  test 'setup reply to as copy from sender' do
+  test 'set up reply to as copy from sender' do
     assert_equal ['test@example.com'], mail.reply_to
   end
 
-  test 'setup subject from I18n' do
+  test 'set up subject from I18n' do
     store_translations :en, devise: { mailer: { unlock_instructions:  { subject: 'Yo unlock instructions' } } } do
       assert_equal 'Yo unlock instructions', mail.subject
     end

test/mapping_test.rb

@@ -35,8 +35,8 @@ class MappingTest < ActiveSupport::TestCase
     assert_equal [], Devise.mappings[:skip_admin].used_routes
   end
 
-  test 'sign_out_via defaults to :get' do
-    assert_equal :get, Devise.mappings[:user].sign_out_via
+  test 'sign_out_via defaults to :delete' do
+    assert_equal :delete, Devise.mappings[:user].sign_out_via
   end
 
   test 'allows custom sign_out_via to be given' do
@@ -115,7 +115,7 @@ class MappingTest < ActiveSupport::TestCase
     assert mapping.authenticatable?
     assert mapping.recoverable?
     assert mapping.lockable?
-    assert_not mapping.omniauthable?
+    refute mapping.omniauthable?
   end
 
   test 'find mapping by path' do

test/models/confirmable_test.rb

@@ -28,9 +28,9 @@ class ConfirmableTest < ActiveSupport::TestCase
   end
 
   test 'should verify whether a user is confirmed or not' do
-    assert_not new_user.confirmed?
+    refute new_user.confirmed?
     user = create_user
-    assert_not user.confirmed?
+    refute user.confirmed?
     user.confirm
     assert user.confirmed?
   end
@@ -40,7 +40,7 @@ class ConfirmableTest < ActiveSupport::TestCase
     assert user.confirm
     assert_blank user.errors[:email]
 
-    assert_not user.confirm
+    refute user.confirm
     assert_equal "was already confirmed, please try signing in", user.errors[:email].join
   end
 
@@ -54,13 +54,13 @@ class ConfirmableTest < ActiveSupport::TestCase
 
   test 'should return a new record with errors when a invalid token is given' do
     confirmed_user = User.confirm_by_token('invalid_confirmation_token')
-    assert_not confirmed_user.persisted?
+    refute confirmed_user.persisted?
     assert_equal "is invalid", confirmed_user.errors[:confirmation_token].join
   end
 
   test 'should return a new record with errors when a blank token is given' do
     confirmed_user = User.confirm_by_token('')
-    assert_not confirmed_user.persisted?
+    refute confirmed_user.persisted?
     assert_equal "can't be blank", confirmed_user.errors[:confirmation_token].join
   end
 
@@ -114,7 +114,7 @@ class ConfirmableTest < ActiveSupport::TestCase
 
     assert_email_not_sent do
       user.save!
-      assert !user.confirmed?
+      refute user.confirmed?
     end
   end
 
@@ -134,7 +134,7 @@ class ConfirmableTest < ActiveSupport::TestCase
 
   test 'should return a new user if no email was found' do
     confirmation_user = User.send_confirmation_instructions(email: "invalid@example.com")
-    assert_not confirmation_user.persisted?
+    refute confirmation_user.persisted?
   end
 
   test 'should add error to new user email if no email was found' do
@@ -181,16 +181,16 @@ class ConfirmableTest < ActiveSupport::TestCase
   test 'should not be able to send instructions if the user is already confirmed' do
     user = create_user
     user.confirm
-    assert_not user.resend_confirmation_instructions
+    refute user.resend_confirmation_instructions
     assert user.confirmed?
     assert_equal 'was already confirmed, please try signing in', user.errors[:email].join
   end
 
   test 'confirm time should fallback to devise confirm in default configuration' do
     swap Devise, allow_unconfirmed_access_for: 1.day do
-      user = new_user
+      user = create_user
       user.confirmation_sent_at = 2.days.ago
-      assert_not user.active_for_authentication?
+      refute user.active_for_authentication?
 
       Devise.allow_unconfirmed_access_for = 3.days
       assert user.active_for_authentication?
@@ -206,14 +206,14 @@ class ConfirmableTest < ActiveSupport::TestCase
       assert user.active_for_authentication?
 
       user.confirmation_sent_at = 5.days.ago
-      assert_not user.active_for_authentication?
+      refute user.active_for_authentication?
     end
   end
 
   test 'should be active when already confirmed' do
     user = create_user
-    assert_not user.confirmed?
-    assert_not user.active_for_authentication?
+    refute user.confirmed?
+    refute user.active_for_authentication?
 
     user.confirm
     assert user.confirmed?
@@ -224,7 +224,7 @@ class ConfirmableTest < ActiveSupport::TestCase
     Devise.allow_unconfirmed_access_for = 0.days
     user = create_user
     user.confirmation_sent_at = Time.zone.today
-    assert_not user.active_for_authentication?
+    refute user.active_for_authentication?
   end
 
   test 'should be active when we set allow_unconfirmed_access_for to nil' do
@@ -239,7 +239,7 @@ class ConfirmableTest < ActiveSupport::TestCase
     user = create_user
     user.confirmation_sent_at = nil
     user.save
-    assert_not user.reload.active_for_authentication?
+    refute user.reload.active_for_authentication?
   end
 
   test 'should be active without confirmation when confirmation is not required' do
@@ -256,7 +256,7 @@ class ConfirmableTest < ActiveSupport::TestCase
       user.instance_eval { def confirmation_required?; false end }
       user.confirmation_sent_at = nil
       user.save
-      assert user.reload.confirm!
+      assert user.reload.confirm
     end
   end
 
@@ -272,7 +272,7 @@ class ConfirmableTest < ActiveSupport::TestCase
     swap Devise, confirmation_keys: [:username, :email] do
       user = create_user
       confirm_user = User.send_confirmation_instructions(email: user.email)
-      assert_not confirm_user.persisted?
+      refute confirm_user.persisted?
       assert_equal "can't be blank", confirm_user.errors[:username].join
     end
   end
@@ -297,7 +297,7 @@ class ConfirmableTest < ActiveSupport::TestCase
 
   test 'should not accept confirmation email token after 4 days when expiration is set to 3 days' do
     swap Devise, confirm_within: 3.days do
-      assert_not confirm_user_by_token_with_confirmation_sent_at(4.days.ago)
+      refute confirm_user_by_token_with_confirmation_sent_at(4.days.ago)
     end
   end
 
@@ -337,14 +337,14 @@ class ConfirmableTest < ActiveSupport::TestCase
       self.username = self.username.to_s + 'updated'
     end
     old = user.username
-    assert_not user.confirm
+    refute user.confirm
     assert_equal user.username, old
   end
 
   test 'should always perform validations upon confirm when ensure valid true' do
     admin = create_admin
     admin.stubs(:valid?).returns(false)
-    assert_not admin.confirm(ensure_valid: true)
+    refute admin.confirm(ensure_valid: true)
   end
 end
 
@@ -370,7 +370,7 @@ class ReconfirmableTest < ActiveSupport::TestCase
     admin.skip_reconfirmation!
     assert admin.update_attributes(email: 'new_test@example.com')
     assert admin.confirmed?
-    assert_not admin.pending_reconfirmation?
+    refute admin.pending_reconfirmation?
     assert_equal original_token, admin.confirmation_token
   end
 
@@ -401,6 +401,14 @@ class ReconfirmableTest < ActiveSupport::TestCase
     assert_match "new_test@example.com", ActionMailer::Base.deliveries.last.body.encoded
   end
 
+  test 'should send confirmation instructions by email after changing email from nil' do
+    admin = create_admin(email: nil)
+    assert_email_sent "new_test@example.com" do
+      assert admin.update_attributes(email: 'new_test@example.com')
+    end
+    assert_match "new_test@example.com", ActionMailer::Base.deliveries.last.body.encoded
+  end
+
   test 'should not send confirmation by email after changing password' do
     admin = create_admin
     assert admin.confirm
@@ -453,7 +461,7 @@ class ReconfirmableTest < ActiveSupport::TestCase
 
   test 'should return a new admin if no email or unconfirmed_email was found' do
     confirmation_admin = Admin.send_confirmation_instructions(email: "invalid@email.com")
-    assert_not confirmation_admin.persisted?
+    refute confirmation_admin.persisted?
   end
 
   test 'should add error to new admin email if no email or unconfirmed_email was found' do
@@ -471,25 +479,25 @@ class ReconfirmableTest < ActiveSupport::TestCase
   end
 
   test 'required_fields should contain the fields that Devise uses' do
-    assert_same_content Devise::Models::Confirmable.required_fields(User), [
-      :confirmation_sent_at,
+    assert_equal Devise::Models::Confirmable.required_fields(User), [
       :confirmation_token,
-      :confirmed_at
+      :confirmed_at,
+      :confirmation_sent_at
     ]
   end
 
   test 'required_fields should also contain unconfirmable when reconfirmable_email is true' do
-    assert_same_content Devise::Models::Confirmable.required_fields(Admin), [
-      :confirmation_sent_at,
+    assert_equal Devise::Models::Confirmable.required_fields(Admin), [
       :confirmation_token,
       :confirmed_at,
+      :confirmation_sent_at,
       :unconfirmed_email
     ]
   end
 
   test 'should not require reconfirmation after creating a record' do
-    user = create_admin
-    assert !user.pending_reconfirmation?
+    admin = create_admin
+    assert !admin.pending_reconfirmation?
   end
 
   test 'should not require reconfirmation after creating a record with #save called in callback' do
@@ -497,7 +505,7 @@ class ReconfirmableTest < ActiveSupport::TestCase
       after_create :save
     end
 
-    user = Admin::WithSaveInCallback.create(valid_attributes.except(:username))
-    assert !user.pending_reconfirmation?
+    admin = Admin::WithSaveInCallback.create(valid_attributes.except(:username))
+    assert !admin.pending_reconfirmation?
   end
 end

test/models/database_authenticatable_test.rb

@@ -92,28 +92,28 @@ class DatabaseAuthenticatableTest < ActiveSupport::TestCase
     assert user.respond_to?(:password_confirmation)
   end
 
-  test 'should generate encrypted password while setting password' do
+  test 'should generate a hashed password while setting password' do
     user = new_user
     assert_present user.encrypted_password
   end
 
-  test 'should support custom encryption methods' do
-    user = UserWithCustomEncryption.new(password: '654321')
+  test 'should support custom hashing methods' do
+    user = UserWithCustomHashing.new(password: '654321')
     assert_equal user.encrypted_password, '123456'
   end
 
-  test 'allow authenticatable_salt to work even with nil encrypted password' do
+  test 'allow authenticatable_salt to work even with nil hashed password' do
     user = User.new
     user.encrypted_password = nil
     assert_nil user.authenticatable_salt
   end
 
-  test 'should not generate encrypted password if password is blank' do
+  test 'should not generate a hashed password if password is blank' do
     assert_blank new_user(password: nil).encrypted_password
     assert_blank new_user(password: '').encrypted_password
   end
 
-  test 'should encrypt password again if password has changed' do
+  test 'should hash password again if password has changed' do
     user = create_user
     encrypted_password = user.encrypted_password
     user.password = user.password_confirmation = 'new_password'
@@ -124,7 +124,7 @@ class DatabaseAuthenticatableTest < ActiveSupport::TestCase
   test 'should test for a valid password' do
     user = create_user
     assert user.valid_password?('12345678')
-    assert_not user.valid_password?('654321')
+    refute user.valid_password?('654321')
   end
 
   test 'should not raise error with an empty password' do
@@ -136,7 +136,7 @@ class DatabaseAuthenticatableTest < ActiveSupport::TestCase
   test 'should be an invalid password if the user has an empty password' do
     user = create_user
     user.encrypted_password = ''
-    assert_not user.valid_password?('654321')
+    refute user.valid_password?('654321')
   end
 
   test 'should respond to current password' do
@@ -152,7 +152,7 @@ class DatabaseAuthenticatableTest < ActiveSupport::TestCase
 
   test 'should add an error to current password when it is invalid' do
     user = create_user
-    assert_not user.update_with_password(current_password: 'other',
+    refute user.update_with_password(current_password: 'other',
       password: 'pass4321', password_confirmation: 'pass4321')
     assert user.reload.valid_password?('12345678')
     assert_match "is invalid", user.errors[:current_password].join
@@ -160,7 +160,7 @@ class DatabaseAuthenticatableTest < ActiveSupport::TestCase
 
   test 'should add an error to current password when it is blank' do
     user = create_user
-    assert_not user.update_with_password(password: 'pass4321',
+    refute user.update_with_password(password: 'pass4321',
       password_confirmation: 'pass4321')
     assert user.reload.valid_password?('12345678')
     assert_match "can't be blank", user.errors[:current_password].join
@@ -170,7 +170,7 @@ class DatabaseAuthenticatableTest < ActiveSupport::TestCase
     user = UserWithValidation.create!(valid_attributes)
     user.save
     assert user.persisted?
-    assert_not user.update_with_password(username: "")
+    refute user.update_with_password(username: "")
     assert_match "usertest", user.reload.username
     assert_match "can't be blank", user.errors[:username].join
   end
@@ -183,14 +183,14 @@ class DatabaseAuthenticatableTest < ActiveSupport::TestCase
 
   test 'should not update password with invalid confirmation' do
     user = create_user
-    assert_not user.update_with_password(current_password: '12345678',
+    refute user.update_with_password(current_password: '12345678',
       password: 'pass4321', password_confirmation: 'other')
     assert user.reload.valid_password?('12345678')
   end
 
   test 'should clean up password fields on failure' do
     user = create_user
-    assert_not user.update_with_password(current_password: '12345678',
+    refute user.update_with_password(current_password: '12345678',
       password: 'pass4321', password_confirmation: 'other')
     assert user.password.blank?
     assert user.password_confirmation.blank?
@@ -217,14 +217,14 @@ class DatabaseAuthenticatableTest < ActiveSupport::TestCase
 
   test 'should not destroy user with invalid password' do
     user = create_user
-    assert_not user.destroy_with_password('other')
+    refute user.destroy_with_password('other')
     assert user.persisted?
     assert_match "is invalid", user.errors[:current_password].join
   end
 
   test 'should not destroy user with blank password' do
     user = create_user
-    assert_not user.destroy_with_password(nil)
+    refute user.destroy_with_password(nil)
     assert user.persisted?
     assert_match "can't be blank", user.errors[:current_password].join
   end
@@ -252,15 +252,15 @@ class DatabaseAuthenticatableTest < ActiveSupport::TestCase
   end
 
   test 'required_fields should be encryptable_password and the email field by default' do
-    assert_same_content Devise::Models::DatabaseAuthenticatable.required_fields(User), [
-      :email,
-      :encrypted_password
+    assert_equal Devise::Models::DatabaseAuthenticatable.required_fields(User), [
+      :encrypted_password,
+      :email
     ]
   end
 
   test 'required_fields should be encryptable_password and the login when the login is on authentication_keys' do
     swap Devise, authentication_keys: [:login] do
-      assert_same_content Devise::Models::DatabaseAuthenticatable.required_fields(User), [
+      assert_equal Devise::Models::DatabaseAuthenticatable.required_fields(User), [
         :encrypted_password,
         :login
       ]

test/models/lockable_test.rb

@@ -46,7 +46,7 @@ class LockableTest < ActiveSupport::TestCase
 
   test "should verify whether a user is locked or not" do
     user = create_user
-    assert_not user.access_locked?
+    refute user.access_locked?
     user.lock_access!
     assert user.access_locked?
   end
@@ -56,7 +56,7 @@ class LockableTest < ActiveSupport::TestCase
     user.confirm
     assert user.active_for_authentication?
     user.lock_access!
-    assert_not user.active_for_authentication?
+    refute user.active_for_authentication?
   end
 
   test "should unlock a user by cleaning locked_at, failed_attempts and unlock_token" do
@@ -72,7 +72,7 @@ class LockableTest < ActiveSupport::TestCase
   end
 
   test "new user should not be locked and should have zero failed_attempts" do
-    assert_not new_user.access_locked?
+    refute new_user.access_locked?
     assert_equal 0, create_user.failed_attempts
   end
 
@@ -83,7 +83,7 @@ class LockableTest < ActiveSupport::TestCase
       assert user.access_locked?
 
       Devise.unlock_in = 1.hour
-      assert_not user.access_locked?
+      refute user.access_locked?
     end
   end
 
@@ -162,18 +162,18 @@ class LockableTest < ActiveSupport::TestCase
     raw  = user.send_unlock_instructions
     locked_user = User.unlock_access_by_token(raw)
     assert_equal locked_user, user
-    assert_not user.reload.access_locked?
+    refute user.reload.access_locked?
   end
 
   test 'should return a new record with errors when a invalid token is given' do
     locked_user = User.unlock_access_by_token('invalid_token')
-    assert_not locked_user.persisted?
+    refute locked_user.persisted?
     assert_equal "is invalid", locked_user.errors[:unlock_token].join
   end
 
   test 'should return a new record with errors when a blank token is given' do
     locked_user = User.unlock_access_by_token('')
-    assert_not locked_user.persisted?
+    refute locked_user.persisted?
     assert_equal "can't be blank", locked_user.errors[:unlock_token].join
   end
 
@@ -186,7 +186,7 @@ class LockableTest < ActiveSupport::TestCase
 
   test 'should return a new user if no email was found' do
     unlock_user = User.send_unlock_instructions(email: "invalid@example.com")
-    assert_not unlock_user.persisted?
+    refute unlock_user.persisted?
   end
 
   test 'should add error to new user email if no email was found' do
@@ -206,23 +206,23 @@ class LockableTest < ActiveSupport::TestCase
     swap Devise, unlock_keys: [:username, :email] do
       user = create_user
       unlock_user = User.send_unlock_instructions(email: user.email)
-      assert_not unlock_user.persisted?
+      refute unlock_user.persisted?
       assert_equal "can't be blank", unlock_user.errors[:username].join
     end
   end
 
   test 'should not be able to send instructions if the user is not locked' do
     user = create_user
-    assert_not user.resend_unlock_instructions
-    assert_not user.access_locked?
+    refute user.resend_unlock_instructions
+    refute user.access_locked?
     assert_equal 'was not locked', user.errors[:email].join
   end
 
   test 'should not be able to send instructions if the user if not locked and have username as unlock key' do
     swap Devise, unlock_keys: [:username] do
       user = create_user
-      assert_not user.resend_unlock_instructions
-      assert_not user.access_locked?
+      refute user.resend_unlock_instructions
+      refute user.access_locked?
       assert_equal 'was not locked', user.errors[:username].join
     end
   end
@@ -257,7 +257,7 @@ class LockableTest < ActiveSupport::TestCase
   test 'required_fields should contain the all the fields when all the strategies are enabled' do
     swap Devise, unlock_strategy: :both do
       swap Devise, lock_strategy: :failed_attempts do
-        assert_same_content Devise::Models::Lockable.required_fields(User), [
+        assert_equal Devise::Models::Lockable.required_fields(User), [
          :failed_attempts,
          :locked_at,
          :unlock_token
@@ -269,7 +269,7 @@ class LockableTest < ActiveSupport::TestCase
   test 'required_fields should contain only failed_attempts and locked_at when the strategies are time and failed_attempts are enabled' do
     swap Devise, unlock_strategy: :time do
       swap Devise, lock_strategy: :failed_attempts do
-        assert_same_content Devise::Models::Lockable.required_fields(User), [
+        assert_equal Devise::Models::Lockable.required_fields(User), [
          :failed_attempts,
          :locked_at
         ]
@@ -280,7 +280,7 @@ class LockableTest < ActiveSupport::TestCase
   test 'required_fields should contain only failed_attempts and unlock_token when the strategies are token and failed_attempts are enabled' do
     swap Devise, unlock_strategy: :email do
       swap Devise, lock_strategy: :failed_attempts do
-        assert_same_content Devise::Models::Lockable.required_fields(User), [
+        assert_equal Devise::Models::Lockable.required_fields(User), [
          :failed_attempts,
          :unlock_token
         ]
@@ -325,4 +325,26 @@ class LockableTest < ActiveSupport::TestCase
     user.lock_access!
     assert_equal :locked, user.unauthenticated_message
   end
+
+  test 'unlock_strategy_enabled? should return true for both, email, and time strategies if :both is used' do
+    swap Devise, unlock_strategy: :both do
+      user = create_user
+      assert_equal true, user.unlock_strategy_enabled?(:both)
+      assert_equal true, user.unlock_strategy_enabled?(:time)
+      assert_equal true, user.unlock_strategy_enabled?(:email)
+      assert_equal false, user.unlock_strategy_enabled?(:none)
+      assert_equal false, user.unlock_strategy_enabled?(:an_undefined_strategy)
+    end
+  end
+
+  test 'unlock_strategy_enabled? should return true only for the configured strategy' do
+    swap Devise, unlock_strategy: :email do
+      user = create_user
+      assert_equal false, user.unlock_strategy_enabled?(:both)
+      assert_equal false, user.unlock_strategy_enabled?(:time)
+      assert_equal true, user.unlock_strategy_enabled?(:email)
+      assert_equal false, user.unlock_strategy_enabled?(:none)
+      assert_equal false, user.unlock_strategy_enabled?(:an_undefined_strategy)
+    end
+  end
 end

test/models/omniauthable_test.rb

@@ -2,6 +2,6 @@ require 'test_helper'
 
 class OmniauthableTest < ActiveSupport::TestCase
   test 'required_fields should contain the fields that Devise uses' do
-    assert_same_content Devise::Models::Omniauthable.required_fields(User), []
+    assert_equal Devise::Models::Omniauthable.required_fields(User), []
   end
 end

test/models/recoverable_test.rb

@@ -92,14 +92,14 @@ class RecoverableTest < ActiveSupport::TestCase
     user = create_user
     user.send_reset_password_instructions
     assert_present user.reset_password_token
-    assert_not user.reset_password('123456789', '987654321')
+    refute user.reset_password('123456789', '987654321')
     assert_present user.reset_password_token
   end
 
   test 'should not reset password with invalid data' do
     user = create_user
     user.stubs(:valid?).returns(false)
-    assert_not user.reset_password('123456789', '987654321')
+    refute user.reset_password('123456789', '987654321')
   end
 
   test 'should reset reset password token and send instructions by email' do
@@ -119,7 +119,7 @@ class RecoverableTest < ActiveSupport::TestCase
 
   test 'should return a new record with errors if user was not found by e-mail' do
     reset_password_user = User.send_reset_password_instructions(email: "invalid@example.com")
-    assert_not reset_password_user.persisted?
+    refute reset_password_user.persisted?
     assert_equal "not found", reset_password_user.errors[:email].join
   end
 
@@ -135,7 +135,7 @@ class RecoverableTest < ActiveSupport::TestCase
       swap Devise, reset_password_keys: [:username, :email] do
           user = create_user
           reset_password_user = User.send_reset_password_instructions(email: user.email)
-          assert_not reset_password_user.persisted?
+          refute reset_password_user.persisted?
           assert_equal "can't be blank", reset_password_user.errors[:username].join
       end
   end
@@ -164,13 +164,13 @@ class RecoverableTest < ActiveSupport::TestCase
 
   test 'should return a new record with errors if no reset_password_token is found' do
     reset_password_user = User.reset_password_by_token(reset_password_token: 'invalid_token')
-    assert_not reset_password_user.persisted?
+    refute reset_password_user.persisted?
     assert_equal "is invalid", reset_password_user.errors[:reset_password_token].join
   end
 
   test 'should return a new record with errors if reset_password_token is blank' do
     reset_password_user = User.reset_password_by_token(reset_password_token: '')
-    assert_not reset_password_user.persisted?
+    refute reset_password_user.persisted?
     assert_match "can't be blank", reset_password_user.errors[:reset_password_token].join
   end
 
@@ -179,7 +179,7 @@ class RecoverableTest < ActiveSupport::TestCase
     raw  = user.send_reset_password_instructions
 
     reset_password_user = User.reset_password_by_token(reset_password_token: raw, password: '')
-    assert_not reset_password_user.errors.empty?
+    refute reset_password_user.errors.empty?
     assert_match "can't be blank", reset_password_user.errors[:password].join
     assert_equal raw, reset_password_user.reset_password_token
   end
@@ -197,7 +197,7 @@ class RecoverableTest < ActiveSupport::TestCase
     assert_nil reset_password_user.reset_password_token
 
     user.reload
-    assert_not user.valid_password?(old_password)
+    refute user.valid_password?(old_password)
     assert user.valid_password?('new_password')
     assert_nil user.reset_password_token
   end
@@ -219,13 +219,13 @@ class RecoverableTest < ActiveSupport::TestCase
       user.reload
 
       assert user.valid_password?(old_password)
-      assert_not user.valid_password?('new_password')
+      refute user.valid_password?('new_password')
       assert_equal "has expired, please request a new one", reset_password_user.errors[:reset_password_token].join
     end
   end
 
   test 'required_fields should contain the fields that Devise uses' do
-    assert_same_content Devise::Models::Recoverable.required_fields(User), [
+    assert_equal Devise::Models::Recoverable.required_fields(User), [
       :reset_password_sent_at,
       :reset_password_token
     ]

test/models/registerable_test.rb

@@ -2,6 +2,6 @@ require 'test_helper'
 
 class RegisterableTest < ActiveSupport::TestCase
   test 'required_fields should contain the fields that Devise uses' do
-    assert_same_content Devise::Models::Registerable.required_fields(User), []
+    assert_equal Devise::Models::Registerable.required_fields(User), []
   end
 end

test/models/rememberable_test.rb

@@ -16,6 +16,18 @@ class RememberableTest < ActiveSupport::TestCase
     assert user.remember_created_at
   end
 
+  test 'remember_me should not generate a new token if valid token exists' do
+    user = create_user
+    user.singleton_class.send(:attr_accessor, :remember_token)
+    User.to_adapter.expects(:find_first).returns(nil)
+
+    user.remember_me!
+    existing_token = user.remember_token
+
+    user.remember_me!
+    assert_equal existing_token, user.remember_token
+  end
+
   test 'forget_me should not clear remember token if using salt' do
     user = create_user
     user.remember_me!
@@ -150,7 +162,7 @@ class RememberableTest < ActiveSupport::TestCase
   end
 
   test 'should have the required_fields array' do
-    assert_same_content Devise::Models::Rememberable.required_fields(User), [
+    assert_equal Devise::Models::Rememberable.required_fields(User), [
       :remember_created_at
     ]
   end

test/models/timeoutable_test.rb

@@ -7,11 +7,11 @@ class TimeoutableTest < ActiveSupport::TestCase
   end
 
   test 'should not be expired' do
-    assert_not new_user.timedout?(29.minutes.ago)
+    refute new_user.timedout?(29.minutes.ago)
   end
 
   test 'should not be expired when params is nil' do
-    assert_not new_user.timedout?(nil)
+    refute new_user.timedout?(nil)
   end
 
   test 'should use timeout_in method' do
@@ -19,29 +19,29 @@ class TimeoutableTest < ActiveSupport::TestCase
     user.instance_eval { def timeout_in; 10.minutes end }
 
     assert user.timedout?(12.minutes.ago)
-    assert_not user.timedout?(8.minutes.ago)
+    refute user.timedout?(8.minutes.ago)
   end
 
   test 'should not be expired when timeout_in method returns nil' do
     user = new_user
     user.instance_eval { def timeout_in; nil end }
-    assert_not user.timedout?(10.hours.ago)
+    refute user.timedout?(10.hours.ago)
   end
 
   test 'fallback to Devise config option' do
     swap Devise, timeout_in: 1.minute do
       user = new_user
       assert user.timedout?(2.minutes.ago)
-      assert_not user.timedout?(30.seconds.ago)
+      refute user.timedout?(30.seconds.ago)
 
       Devise.timeout_in = 5.minutes
-      assert_not user.timedout?(2.minutes.ago)
+      refute user.timedout?(2.minutes.ago)
       assert user.timedout?(6.minutes.ago)
     end
   end
 
   test 'required_fields should contain the fields that Devise uses' do
-    assert_same_content Devise::Models::Timeoutable.required_fields(User), []
+    assert_equal Devise::Models::Timeoutable.required_fields(User), []
   end
 
   test 'should not raise error if remember_created_at is not empty and rememberable is disabled' do

test/models/trackable_test.rb

@@ -2,7 +2,7 @@ require 'test_helper'
 
 class TrackableTest < ActiveSupport::TestCase
   test 'required_fields should contain the fields that Devise uses' do
-    assert_same_content Devise::Models::Trackable.required_fields(User), [
+    assert_equal Devise::Models::Trackable.required_fields(User), [
       :current_sign_in_at,
       :current_sign_in_ip,
       :last_sign_in_at,

test/models/validatable_test.rb

@@ -29,7 +29,7 @@ class ValidatableTest < ActiveSupport::TestCase
     assert user.invalid?
     assert_not_equal 'is invalid', user.errors[:email].join
 
-    %w{invalid_email_format 123 $$$ () ☃ bla@bla.}.each do |email|
+    %w{invalid_email_format 123 $$$ () ☃}.each do |email|
       user.email = email
       assert user.invalid?, 'should be invalid with email ' << email
       assert_equal 'is invalid', user.errors[:email].join
@@ -97,7 +97,7 @@ class ValidatableTest < ActiveSupport::TestCase
 
     user.password_confirmation = 'confirmation'
     assert user.invalid?
-    assert_not (user.errors[:password].join =~ /is too long/)
+    refute (user.errors[:password].join =~ /is too long/)
   end
 
   test 'should complain about length even if password is not required' do

test/models_test.rb

@@ -13,7 +13,7 @@ class ActiveRecordTest < ActiveSupport::TestCase
     end
 
     (Devise::ALL - modules).each do |mod|
-      assert_not include_module?(klass, mod)
+      refute include_module?(klass, mod)
     end
   end
 

test/omniauth/url_helpers_test.rb

@@ -1,23 +1,21 @@
 require 'test_helper'
 
 class OmniAuthRoutesTest < ActionController::TestCase
-  ExpectedUrlGeneratiorError = ActionController::UrlGenerationError
-
   tests ApplicationController
 
   def assert_path(action, provider, with_param=true)
     # Resource param
     assert_equal @controller.send(action, :user, provider),
-                 @controller.send("user_#{action}", provider)
+                 @controller.send("user_#{provider}_#{action}")
 
     # With an object
     assert_equal @controller.send(action, User.new, provider),
-                 @controller.send("user_#{action}", provider)
+                 @controller.send("user_#{provider}_#{action}")
 
     if with_param
       # Default url params
       assert_equal @controller.send(action, :user, provider, param: 123),
-                   @controller.send("user_#{action}", provider, param: 123)
+                   @controller.send("user_#{provider}_#{action}", param: 123)
     end
   end
 
@@ -32,7 +30,7 @@ class OmniAuthRoutesTest < ActionController::TestCase
   test 'should generate authorization path' do
     assert_match "/users/auth/facebook", @controller.omniauth_authorize_path(:user, :facebook)
 
-    assert_raise ExpectedUrlGeneratiorError do
+    assert_raise NoMethodError do
       @controller.omniauth_authorize_path(:user, :github)
     end
   end

test/orm/active_record.rb

@@ -5,9 +5,11 @@ ActiveRecord::Base.include_root_in_json = true
 ActiveRecord::Migrator.migrate(File.expand_path("../../rails_app/db/migrate/", __FILE__))
 
 class ActiveSupport::TestCase
-  if Rails.version >= '5.0.0'
+  if Devise.rails5?
     self.use_transactional_tests = true
   else
+    # Let `after_commit` work with transactional fixtures, however this is not needed for Rails 5.
+    require 'test_after_commit'
     self.use_transactional_fixtures = true
   end
 

test/parameter_sanitizer_test.rb

@@ -73,59 +73,3 @@ class ParameterSanitizerTest < ActiveSupport::TestCase
     assert_equal({ 'username' => 'jose' }, sanitized)
   end
 end
-
-class DeprecatedParameterSanitizerAPITest < ActiveSupport::TestCase
-  class CustomSanitizer < Devise::ParameterSanitizer
-    def sign_in
-      default_params.permit(:username)
-    end
-  end
-
-  def sanitizer(params)
-    params = ActionController::Parameters.new(params)
-    Devise::ParameterSanitizer.new(User, :user, params)
-  end
-
-  test 'overriding instance methods have precedence over the default sanitized attributes' do
-    assert_deprecated do
-      params =  ActionController::Parameters.new(user: { "username" => "jose", "name" => "Jose" })
-      sanitizer = CustomSanitizer.new(User, :user, params)
-
-      sanitized = sanitizer.sanitize(:sign_in)
-
-      assert_equal({ "username" => "jose" }, sanitized)
-    end
-  end
-
-  test 'adding new parameters by mutating the Array' do
-    assert_deprecated do
-      sanitizer = sanitizer('user' => { 'username' => 'jose' })
-      sanitizer.for(:sign_in) << :username
-      sanitized = sanitizer.sanitize(:sign_in)
-
-      assert_equal({ 'username' => 'jose' }, sanitized)
-    end
-  end
-
-   test 'adding new parameters with a block' do
-     assert_deprecated do
-       sanitizer = sanitizer('user' => { 'username' => 'jose' })
-       sanitizer.for(:sign_in) { |user| user.permit(:username) }
-
-       sanitized = sanitizer.sanitize(:sign_in)
-
-       assert_equal({ 'username' => 'jose' }, sanitized)
-     end
-   end
-
-  test 'removing multiple default parameters' do
-    assert_deprecated do
-      sanitizer = sanitizer('user' => { 'email' => 'jose', 'password' => 'invalid', 'remember_me' => '1' })
-      sanitizer.for(:sign_in).delete(:email)
-      sanitizer.for(:sign_in).delete(:password)
-      sanitized = sanitizer.sanitize(:sign_in)
-
-      assert_equal({ 'remember_me' => '1' }, sanitized)
-    end
-  end
-end

test/rails_app/app/active_record/user.rb

@@ -1,6 +1,4 @@
 require 'shared_user'
-require 'active_model/serializers/xml' if Devise.rails5?
-require 'active_model-serializers' if Devise.rails5?
 
 class User < ActiveRecord::Base
   include Shim

test/rails_app/app/controllers/application_controller.rb

@@ -5,8 +5,7 @@ class ApplicationController < ActionController::Base
   protect_from_forgery
   before_action :current_user, unless: :devise_controller?
   before_action :authenticate_user!, if: :devise_controller?
-  respond_to *Mime::SET.map(&:to_sym)
+  respond_to(*Mime::SET.map(&:to_sym))
 
   devise_group :commenter, contains: [:user, :admin]
 end
-

test/rails_app/config/application.rb

@@ -32,6 +32,10 @@ module RailsApp
 
     config.action_mailer.default_url_options = { host: "localhost", port: 3000 }
 
+    if DEVISE_ORM == :active_record && (Rails::VERSION::MAJOR >= 4 && Rails::VERSION::MINOR >= 2)
+      config.active_record.raise_in_transactional_callbacks = true
+    end
+
     # This was used to break devise in some situations
     config.to_prepare do
       Devise::SessionsController.layout "application"

test/rails_app/config/boot.rb

@@ -11,4 +11,4 @@ end
 
 # Set up gems listed in the Gemfile.
 ENV['BUNDLE_GEMFILE'] ||= File.expand_path('../../../../Gemfile', __FILE__)
-require 'bundler/setup' if File.exists?(ENV['BUNDLE_GEMFILE'])
+require 'bundler/setup' if File.exist?(ENV['BUNDLE_GEMFILE'])

test/rails_app/config/initializers/devise.rb

@@ -135,7 +135,7 @@ Devise.setup do |config|
   # reset. Defaults to true, so a user is signed in automatically after a reset.
   # config.sign_in_after_reset_password = true
 
-  # Setup a pepper to generate the encrypted password.
+  # Set up a pepper to generate the encrypted password.
   config.pepper = "d142367154e5beacca404b1a6a4f8bc52c6fdcfa3ccc3cf8eb49f3458a688ee6ac3b9fae488432a3bfca863b8a90008368a9f3a3dfbe5a962e64b6ab8f3a3a1a"
 
   # ==> Scopes configuration

test/rails_app/config/routes.rb

@@ -114,6 +114,7 @@ Rails.application.routes.draw do
   namespace :sign_out_via, module: "devise" do
     devise_for :deletes, sign_out_via: :delete, class_name: "Admin"
     devise_for :posts, sign_out_via: :post, class_name: "Admin"
+    devise_for :gets, sign_out_via: :get, class_name: "Admin"
     devise_for :delete_or_posts, sign_out_via: [:delete, :post], class_name: "Admin"
   end
 

test/rails_app/lib/shared_user.rb

@@ -4,7 +4,8 @@ module SharedUser
   included do
     devise :database_authenticatable, :confirmable, :lockable, :recoverable,
            :registerable, :rememberable, :timeoutable,
-           :trackable, :validatable, :omniauthable, password_length: 7..72
+           :trackable, :validatable, :omniauthable, password_length: 7..72,
+           reconfirmable: false
 
     attr_accessor :other_key
 

test/rails_app/lib/shared_user_without_omniauth.rb

@@ -4,7 +4,7 @@ module SharedUserWithoutOmniauth
   included do
     devise :database_authenticatable, :confirmable, :lockable, :recoverable,
       :registerable, :rememberable, :timeoutable,
-      :trackable, :validatable
+      :trackable, :validatable, reconfirmable: false
   end
 
   def raw_confirmation_token