Test against JRuby.

Update existing Gemfiles.
Update Rails 5 Gemfile.
2026-01-11 00:27:55 -05:00 · 2016-05-21 12:10:30 -03:00 · 2016-05-18 13:59:06 -03:00 · 2016-05-18 13:50:07 -03:00 · 2016-05-18 13:42:31 -03:00 · 2016-05-18 09:39:04 -03:00
64 changed files with 1074 additions and 640 deletions
--- a/.travis.yml
+++ b/.travis.yml
@@ -1,22 +1,27 @@
 language: ruby

 rvm:
-  - 2.3.0
-  - 2.2.4
-  - 2.1.8
+  - 2.1.9
+  - 2.2.5
+  - 2.3.1
+  - ruby-head
+  - jruby-9.0.5.0

 gemfile:
  - Gemfile
-  - gemfiles/Gemfile.rails-5.0-beta
+  - gemfiles/Gemfile.rails-5.0
  - gemfiles/Gemfile.rails-4.2-stable
  - gemfiles/Gemfile.rails-4.1-stable

 matrix:
  exclude:
-    - rvm: 2.1.8
-      gemfile: gemfiles/Gemfile.rails-5.0-beta
+    - rvm: 2.1.9
+      gemfile: gemfiles/Gemfile.rails-5.0
    - env: DEVISE_ORM=mongoid
-      gemfile: gemfiles/Gemfile.rails-5.0-beta
+      gemfile: gemfiles/Gemfile.rails-5.0
+  allow_failures:
+    - rvm: ruby-head
+  fast_finish: true
 services:
  - mongodb

--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,38 @@
+### Unreleased
+
+* removals
+  * Remove the deprecated `Devise::ParameterSanitizer` API from Devise 3.
+    Please use the `#permit` and `#sanitize` methods over `#for`.
+  * Remove the deprecated OmniAuth URL helpers. Use the fully qualified helpers
+    (`user_facebook_omniauth_authorize_path`) over the scope based helpers
+    ( `user_omniauth_authorize_path(:facebook)`).
+  * Remove the `Devise.bcrypt` method, use `Devise::Encryptor.digest` instead.
+  * Remove the `Devise::Models::Confirmable#confirm!` method, use `confirm` instead.
+  * Remove the `Devise::Models::Recoverable#reset_password!` method, use `reset_password` instead.
+  * Remove the `Devise::Models::Recoverable#after_password_reset` method.
+* enhancements
+  * Display the minimum password length on `registrations/edit` view (by @Yanchek99).
+  * You can disable Devise's routes reloading on boot by through the `reload_routes = false` config.
+    This can reduce the time taken to boot the application but it might trigger
+    some errors if you application (mostly your controllers) requires that
+    Devise mappings be loaded during boot time (by @sidonath).
+  * Added `Devise::Test::IntegrationHelpers` to bypass the sign in process using
+    Warden test API (by @lucasmazza).
+* deprecations
+  * `Devise::TestHelpers` is deprecated in favor of `Devise::Test::ControllerHelpers`
+    (by @lucasmazza).
+  * The `sign_in` test helper has changed to use keyword arguments when passing
+    a scope. `sign_in :admin, users(:alice)` should be rewritten as
+    `sign_in users(:alice), scope: :admin` (by @lucasmazza).
+  * The option `bypass` of `Devise::Controllers::SignInOut#sign_in` method is
+    deprecated in favor of `Devise::Controllers::SignInOut#bypass_sign_in`
+    method (by @ulissesalmeida).
+
+### 4.1.1 - 2016-05-15
+
+* bug fixes
+  * Fix overwriting the remember_token when a valid one already exists (by @ralinchimev).
+
 ### 4.1.0

 * bug fixes
@@ -34,6 +69,11 @@
 * improvements
  * Avoids extra computation of friendly token for confirmation token (by @sbc100)

+### 4.0.3 - 2016-05-15
+
+  * bug fixes
+    * Fix overwriting the remember_token when a valid one already exists (by @ralinchimev).
+
 ### 4.0.2 - 2016-05-02

 * bug fixes
@@ -77,11 +117,11 @@

 * deprecations
  * omniauth routes are no longer defined with a wildcard `:provider` parameter,
-    and provider specific routes are defined instead, so route helpers like `user_omniauth_authorize_path(:github)` are deprecated in favor of `user_github_authorize_path`.
+    and provider specific routes are defined instead, so route helpers like `user_omniauth_authorize_path(:github)` are deprecated in favor of `user_github_omniauth_authorize_path`.
    You can still use `omniauth_authorize_path(:user, :github)` if you need to
    call the helpers dynamically.

-### 4.0.0.rc1 - 2016-01-02
+### 4.0.0.rc1 - 2016-02-01

 * Support added to Rails 5 (by @twalpole).
 * Devise no longer supports Rails 3.2 and 4.0.
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -1,16 +1,39 @@
 ### Please read before contributing

-1) Do not post questions in the issues tracker. If you have any questions about Devise, search the [Wiki](https://github.com/plataformatec/devise/wiki) or use the [Mailing List](https://groups.google.com/group/plataformatec-devise) or [Stack Overflow](http://stackoverflow.com/questions/tagged/devise).
+1) Do not post questions in the issues tracker. If you have any questions about
+Devise, search the [Wiki](https://github.com/plataformatec/devise/wiki) or use
+the [Mailing List](https://groups.google.com/group/plataformatec-devise) or
+[Stack Overflow](http://stackoverflow.com/questions/tagged/devise).

-2) If you find a security bug, **DO NOT** submit an issue here. Please send an e-mail to [opensource@plataformatec.com.br](mailto:opensource@plataformatec.com.br) instead.
+2) If you find a security bug, **DO NOT** submit an issue here. Please send an
+e-mail to [opensource@plataformatec.com.br](mailto:opensource@plataformatec.com.br)
+instead.

-3) Do a small search on the issues tracker before submitting your issue to see if it was already reported / fixed.
+3) If possible, replicate your issue with our
+[guides/bug_report_templates/integration_test.rb](test case example), and attach
+it to your issue or Pull Request - this way we have an isolated way to replicate
+your issue and investigate it further.

-4) When reporting an issue, include Rails, Devise and Warden versions. If you are getting exceptions, please include the full backtrace.
+4) Otherwise, please provide a fresh new Rails application that replicates your
+issue on a public GitHub repository, as some scenarios might not be possible to
+replicate using the standalone test case example.

-5) Notice that all of your interactions in the project are expected to follow our [Code of Conduct](CODE_OF_CONDUCT.md)
+5) Do a small search on the issues tracker before submitting your issue to see
+if it was already reported / fixed. Duplicated issues will be closed to avoid
+too much noise/duplication in the issue tracker.

-That's it! The more information you give, the easier it becomes for us to track it down and fix it.
-Ideally, you should provide an application that reproduces the error or a test case to Devise's suite.
+6) When reporting an issue, include Rails, Devise and Warden versions. If you
+are getting exceptions, please include the full backtrace.
+
+7) Please do not attempt to translate Devise built in views. The views are meant
+to be a starting point and not a final version. For historical references,
+please look into closed issues/Pull regarding i18n.
+
+8) Notice that all of your interactions in the project are expected to follow
+our [Code of Conduct](CODE_OF_CONDUCT.md)
+
+That's it! The more information you give, the easier it becomes for us to track
+it down and fix it. Ideally, you should provide an application that reproduces
+the error or a test case to Devise's suite.

 Thanks!
--- a/6
+++ b/6
@@ -3,13 +3,13 @@ source "https://rubygems.org"
 gemspec

 gem "rails", "~> 4.2.6"
-gem "omniauth", "~> 1.3"
-gem "omniauth-oauth2", "~> 1.4"
+gem "omniauth"
+gem "omniauth-oauth2"
 gem "rdoc"

 group :test do
  gem "omniauth-facebook"
-  gem "omniauth-openid", "~> 1.0.1"
+  gem "omniauth-openid"
  gem "webrat", "0.7.3", require: false
  gem "mocha", "~> 1.1", require: false
  gem 'test_after_commit', require: false
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -48,36 +48,38 @@ GEM
      tzinfo (~> 1.1)
    arel (6.0.3)
    bcrypt (3.1.11)
-    bson (4.0.0)
+    bson (4.1.1)
    builder (3.2.2)
-    concurrent-ruby (1.0.1)
+    concurrent-ruby (1.0.2)
    erubis (2.7.0)
    faraday (0.9.2)
      multipart-post (>= 1.2, < 3)
    globalid (0.3.6)
      activesupport (>= 4.1.0)
-    hashie (3.4.3)
+    hashie (3.4.4)
    i18n (0.7.0)
    json (1.8.3)
    jwt (1.5.1)
    loofah (2.0.3)
      nokogiri (>= 1.5.9)
-    mail (2.6.3)
-      mime-types (>= 1.16, < 3)
+    mail (2.6.4)
+      mime-types (>= 1.16, < 4)
    metaclass (0.0.4)
-    mime-types (2.99.1)
+    mime-types (3.0)
+      mime-types-data (~> 3.2015)
+    mime-types-data (3.2016.0221)
    mini_portile2 (2.0.0)
-    minitest (5.8.4)
+    minitest (5.9.0)
    mocha (1.1.0)
      metaclass (~> 0.0.1)
-    mongo (2.2.0)
+    mongo (2.2.5)
      bson (~> 4.0)
-    mongoid (5.0.1)
+    mongoid (5.1.3)
      activemodel (~> 4.0)
      mongo (~> 2.1)
-      origin (~> 2.1)
+      origin (~> 2.2)
      tzinfo (>= 0.3.37)
-    multi_json (1.11.2)
+    multi_json (1.12.0)
    multi_xml (0.5.5)
    multipart-post (2.0.0)
    nokogiri (1.6.7.2)
@@ -131,13 +133,13 @@ GEM
      activesupport (= 4.2.6)
      rake (>= 0.8.7)
      thor (>= 0.18.1, < 2.0)
-    rake (11.0.1)
+    rake (11.1.2)
    rdoc (4.2.2)
      json (~> 1.4)
    responders (2.2.0)
      railties (>= 4.2.0, < 5.1)
    ruby-openid (2.7.0)
-    sprockets (3.5.2)
+    sprockets (3.6.0)
      concurrent-ruby (~> 1.0)
      rack (> 1, < 3)
    sprockets-rails (3.0.4)
@@ -168,10 +170,10 @@ DEPENDENCIES
  jruby-openssl
  mocha (~> 1.1)
  mongoid (~> 5.0)
-  omniauth (~> 1.3)
+  omniauth
  omniauth-facebook
-  omniauth-oauth2 (~> 1.4)
-  omniauth-openid (~> 1.0.1)
+  omniauth-oauth2
+  omniauth-openid
  rails (~> 4.2.6)
  rdoc
  sqlite3
--- a/README.md
+++ b/README.md
@@ -89,7 +89,7 @@ Once you have solidified your understanding of Rails and authentication mechanis

 ## Getting started

-Devise 4.0 works with Rails 4.2 onwards. You can add it to your Gemfile with:
+Devise 4.0 works with Rails 4.1 onwards. You can add it to your Gemfile with:

 ```ruby
 gem 'devise'
@@ -100,13 +100,13 @@ Run the bundle command to install it.
 After you install Devise and add it to your Gemfile, you need to run the generator:

 ```console
-rails generate devise:install
+$ rails generate devise:install
 ```

 The generator will install an initializer which describes ALL of Devise's configuration options. It is *imperative* that you take a look at it. When you are done, you are ready to add Devise to any of your models using the generator:

 ```console
-rails generate devise MODEL
+$ rails generate devise MODEL
 ```

 Replace MODEL with the class name used for the application’s users (it’s frequently `User` but could also be `Admin`). This will create a model (if one does not exist) and configure it with the default Devise modules. The generator also configures your `config/routes.rb` file to point to the Devise controller.
@@ -154,7 +154,7 @@ user_session
 After signing in a user, confirming the account or updating the password, Devise will look for a scoped root path to redirect to. For instance, when using a `:user` resource, the `user_root_path` will be used if it exists; otherwise, the default `root_path` will be used. This means that you need to set the root inside your routes:

 ```ruby
-root to: "home#index"
+root to: 'home#index'
 ```

 You can also override `after_sign_in_path_for` and `after_sign_out_path_for` to customize your redirect hooks.
@@ -270,7 +270,7 @@ We built Devise to help you quickly develop an application that uses authenticat
 Since Devise is an engine, all its views are packaged inside the gem. These views will help you get started, but after some time you may want to change them. If this is the case, you just need to invoke the following generator, and it will copy all views to your application:

 ```console
-rails generate devise:views
+$ rails generate devise:views
 ```

 If you have more than one Devise model in your application (such as `User` and `Admin`), you will notice that Devise uses the same views for all models. Fortunately, Devise offers an easy way to customize views. All you need to do is set `config.scoped_views = true` inside the `config/initializers/devise.rb` file.
@@ -278,14 +278,14 @@ If you have more than one Devise model in your application (such as `User` and `
 After doing so, you will be able to have views based on the role like `users/sessions/new` and `admins/sessions/new`. If no view is found within the scope, Devise will use the default view at `devise/sessions/new`. You can also use the generator to generate scoped views:

 ```console
-rails generate devise:views users
+$ rails generate devise:views users
 ```

 If you would like to generate only a few sets of views, like the ones for the `registerable` and `confirmable` module,
 you can pass a list of modules to the generator with the `-v` flag.

 ```console
-rails generate devise:views -v registrations confirmations
+$ rails generate devise:views -v registrations confirmations
 ```

 ### Configuring controllers
@@ -295,7 +295,7 @@ If the customization at the views level is not enough, you can customize each co
 1. Create your custom controllers using the generator which requires a scope:

    ```console
-    rails generate devise:controllers [scope]
+    $ rails generate devise:controllers [scope]
    ```

    If you specify `users` as the scope, controllers will be created in `app/controllers/users/`.
@@ -314,7 +314,7 @@ If the customization at the views level is not enough, you can customize each co
 2. Tell the router to use this controller:

    ```ruby
-    devise_for :users, controllers: { sessions: "users/sessions" }
+    devise_for :users, controllers: { sessions: 'users/sessions' }
    ```

 3. Copy the views from `devise/sessions` to `users/sessions`. Since the controller was changed, it won't use the default views located in `devise/sessions`.
@@ -352,7 +352,7 @@ Remember that Devise uses flash messages to let users know if sign in was succes
 Devise also ships with default routes. If you need to customize them, you should probably be able to do it through the devise_for method. It accepts several options like :class_name, :path_prefix and so on, including the possibility to change path names for I18n:

 ```ruby
-devise_for :users, path: "auth", path_names: { sign_in: 'login', sign_out: 'logout', password: 'secret', confirmation: 'verification', unlock: 'unblock', registration: 'register', sign_up: 'cmon_let_me_in' }
+devise_for :users, path: 'auth', path_names: { sign_in: 'login', sign_out: 'logout', password: 'secret', confirmation: 'verification', unlock: 'unblock', registration: 'register', sign_up: 'cmon_let_me_in' }
 ```

 Be sure to check `devise_for` [documentation](http://www.rubydoc.info/github/plataformatec/devise/master/ActionDispatch/Routing/Mapper%3Adevise_for) for details.
@@ -361,7 +361,7 @@ If you have the need for more deep customization, for instance to also allow "/s

 ```ruby
 devise_scope :user do
-  get "sign_in", to: "devise/sessions#new"
+  get 'sign_in', to: 'devise/sessions#new'
 end
 ```

@@ -411,45 +411,94 @@ Caution: Devise Controllers inherit from ApplicationController. If your app uses

 ### Test helpers

-Devise includes some test helpers for functional specs. In order to use them, you need to include Devise in your functional tests by adding the following to the bottom of your `test/test_helper.rb` file (make sure you place it out of scope of `ActiveSupport::TestCase` which is the default class inside of `test/test_helper.rb`):
+Devise includes some test helpers for controller and integration tests.
+In order to use them, you need to include the respective module in your test
+cases/specs.
+
+### Controller tests
+
+Controller tests require that you include `Devise::Test::ControllerHelpers` on
+your test case or its parent `ActionController::TestCase` superclass.

 ```ruby
-class ActionController::TestCase
-  include Devise::TestHelpers
+class PostsControllerTest < ActionController::TestCase
+  include Devise::Test::ControllerHelpers
 end
 ```

-If you're using RSpec, you can put the following inside a file named `spec/support/devise.rb` or in your `spec/spec_helper.rb` (or `spec/rails_helper.rb` if you are using rspec-rails):
+If you're using RSpec, you can put the following inside a file named
+`spec/support/devise.rb` or in your `spec/spec_helper.rb` (or
+`spec/rails_helper.rb` if you are using `rspec-rails`):

 ```ruby
 RSpec.configure do |config|
-  config.include Devise::TestHelpers, type: :controller
-  config.include Devise::TestHelpers, type: :view
+  config.include Devise::Test::ControllerHelpers, type: :controller
+  config.include Devise::Test::ControllerHelpers, type: :view
 end
 ```

 Just be sure that this inclusion is made *after* the `require 'rspec/rails'` directive.

-Now you are ready to use the `sign_in` and `sign_out` methods. Such methods have the same signature as in controllers:
+Now you are ready to use the `sign_in` and `sign_out` methods on your controller
+tests:

 ```ruby
-sign_in :user, @user   # sign_in(scope, resource)
-sign_in @user          # sign_in(resource)
-
-sign_out :user         # sign_out(scope)
-sign_out @user         # sign_out(resource)
+sign_in @user
+sign_in @user, scope: admin
 ```

-There are two things that are important to keep in mind:
+If you are testing Devise internal controllers or a controller that inherits
+from Devise's, you need to tell Devise which mapping should be used before a
+request. This is necessary because Devise gets this information from the router,
+but since controller tests do not pass through the router, it needs to be stated
+explicitly. For example, if you are testing the user scope, simply use:

-1. These helpers are not going to work for integration tests driven by Capybara or Webrat. They are meant to be used with functional tests only. It is undesirable even to include `Devise::TestHelpers` during integration tests. Instead, fill in the form or explicitly set the user in session;
+```ruby
+test 'GET new' do
+  # Mimic the router behavior of setting the Devise scope through the env.
+  @request.env['devise.mapping'] = Devise.mappings[:user]

-2. If you are testing Devise internal controllers or a controller that inherits from Devise's, you need to tell Devise which mapping should be used before a request. This is necessary because Devise gets this information from the router, but since functional tests do not pass through the router, it needs to be stated explicitly. For example, if you are testing the user scope, simply use:
+  # Use the sign_in helper to sign in a fixture `User` record.
+  sign_in users(:alice)

-    ```ruby
-    @request.env["devise.mapping"] = Devise.mappings[:user]
-    get :new
-    ```
+  get :new
+
+  # assert something
+end
+```
+
+### Integration tests
+
+Integration test helpers are available by including the
+`Devise::Test::IntegrationHelpers` module.
+
+```ruby
+class PostsTests < ActionDispatch::IntegrationTest
+  include Devise::Test::IntegrationHelpers
+end
+```
+
+Now you can use the following `sign_in` and `sign_out` methods in your integration
+tests:
+
+```ruby
+sign_in users(:bob)
+sign_in users(:bob), scope: :admin
+
+sign_out :user
+```
+
+RSpec users can include the `IntegrationHelpers` module on their `:feature` specs.
+
+```ruby
+RSpec.configure do |config|
+  config.include Devise::Test::IntegrationHelpers, type: :feature
+end
+```
+
+Unlike controller tests, integration tests do not need to supply the
+`devise.mapping` `env` value, as the mapping can be inferred by the routes that
+are executed in your tests.

 You can read more about testing your Rails 3 - Rails 4 controllers with RSpec in the wiki:

--- a/app/controllers/devise/registrations_controller.rb
+++ b/app/controllers/devise/registrations_controller.rb
@@ -1,11 +1,11 @@
 class Devise::RegistrationsController < DeviseController
  prepend_before_action :require_no_authentication, only: [:new, :create, :cancel]
  prepend_before_action :authenticate_scope!, only: [:edit, :update, :destroy]
+  prepend_before_action :set_minimum_password_length, only: [:new, :edit]

  # GET /resource/sign_up
  def new
    build_resource({})
-    set_minimum_password_length
    yield resource if block_given?
    respond_with self.resource
  end
@@ -53,7 +53,7 @@ class Devise::RegistrationsController < DeviseController
          :update_needs_confirmation : :updated
        set_flash_message :notice, flash_key
      end
-      sign_in resource_name, resource, bypass: true
+      bypass_sign_in resource, scope: resource_name
      respond_with resource, location: after_update_path_for(resource)
    else
      clean_up_passwords resource
--- a/app/views/devise/registrations/edit.html.erb
+++ b/app/views/devise/registrations/edit.html.erb
@@ -15,6 +15,10 @@
  <div class="field">
    <%= f.label :password %> <i>(leave blank if you don't want to change it)</i><br />
    <%= f.password_field :password, autocomplete: "off" %>
+    <% if @minimum_password_length %>
+      <br />
+      <em><%= @minimum_password_length %> characters minimum</em>
+    <% end %>
  </div>

  <div class="field">
--- a/gemfiles/Gemfile.rails-4.1-stable
+++ b/gemfiles/Gemfile.rails-4.1-stable
@@ -3,13 +3,13 @@ source "https://rubygems.org"
 gemspec path: ".."

 gem "rails", github: "rails/rails", branch: "4-1-stable"
-gem "omniauth", "~> 1.3"
-gem "omniauth-oauth2", "~> 1.4"
+gem "omniauth"
+gem "omniauth-oauth2"
 gem "rdoc"

 group :test do
  gem "omniauth-facebook"
-  gem "omniauth-openid", "~> 1.0.1"
+  gem "omniauth-openid"
  gem "webrat", "0.7.3", require: false
  gem "mocha", "~> 1.1", require: false
  gem 'test_after_commit', require: false
@@ -26,5 +26,5 @@ platforms :ruby do
 end

 group :mongoid do
-  gem "mongoid", "~> 4.0.0"
+  gem "mongoid", "~> 4.0"
 end
--- a/gemfiles/Gemfile.rails-4.1-stable.lock
+++ b/gemfiles/Gemfile.rails-4.1-stable.lock
@@ -48,7 +48,7 @@ GIT
 PATH
  remote: ..
  specs:
-    devise (4.0.1)
+    devise (4.1.0)
      bcrypt (~> 3.0)
      orm_adapter (~> 0.1)
      railties (>= 4.1.0, < 5.1)
@@ -62,21 +62,23 @@ GEM
    bcrypt (3.1.11)
    bson (3.2.6)
    builder (3.2.2)
-    concurrent-ruby (1.0.1)
+    concurrent-ruby (1.0.2)
    connection_pool (2.2.0)
    erubis (2.7.0)
    faraday (0.9.2)
      multipart-post (>= 1.2, < 3)
-    hashie (3.4.3)
+    hashie (3.4.4)
    i18n (0.7.0)
    json (1.8.3)
    jwt (1.5.1)
-    mail (2.6.3)
-      mime-types (>= 1.16, < 3)
+    mail (2.6.4)
+      mime-types (>= 1.16, < 4)
    metaclass (0.0.4)
-    mime-types (2.99.1)
+    mime-types (3.0)
+      mime-types-data (~> 3.2015)
+    mime-types-data (3.2016.0221)
    mini_portile2 (2.0.0)
-    minitest (5.8.4)
+    minitest (5.9.0)
    mocha (1.1.0)
      metaclass (~> 0.0.1)
    mongoid (4.0.2)
@@ -88,7 +90,7 @@ GEM
      bson (~> 3.0)
      connection_pool (~> 2.0)
      optionable (~> 0.2.0)
-    multi_json (1.11.2)
+    multi_json (1.12.0)
    multi_xml (0.5.5)
    multipart-post (2.0.0)
    nokogiri (1.6.7.2)
@@ -119,13 +121,13 @@ GEM
      ruby-openid (>= 2.1.8)
    rack-test (0.6.3)
      rack (>= 1.0)
-    rake (11.0.1)
+    rake (11.1.2)
    rdoc (4.2.2)
      json (~> 1.4)
    responders (1.1.2)
      railties (>= 3.2, < 4.2)
    ruby-openid (2.7.0)
-    sprockets (3.5.2)
+    sprockets (3.6.0)
      concurrent-ruby (~> 1.0)
      rack (> 1, < 3)
    sprockets-rails (2.3.3)
@@ -155,11 +157,11 @@ DEPENDENCIES
  devise!
  jruby-openssl
  mocha (~> 1.1)
-  mongoid (~> 4.0.0)
-  omniauth (~> 1.3)
+  mongoid (~> 4.0)
+  omniauth
  omniauth-facebook
-  omniauth-oauth2 (~> 1.4)
-  omniauth-openid (~> 1.0.1)
+  omniauth-oauth2
+  omniauth-openid
  rails!
  rdoc
  sqlite3
--- a/gemfiles/Gemfile.rails-4.2-stable
+++ b/gemfiles/Gemfile.rails-4.2-stable
@@ -3,13 +3,13 @@ source "https://rubygems.org"
 gemspec path: ".."

 gem "rails", github: "rails/rails", branch: "4-2-stable"
-gem "omniauth", "~> 1.3"
-gem "omniauth-oauth2", "~> 1.4"
+gem "omniauth"
+gem "omniauth-oauth2"
 gem "rdoc"

 group :test do
  gem "omniauth-facebook"
-  gem "omniauth-openid", "~> 1.0.1"
+  gem "omniauth-openid"
  gem "webrat", "0.7.3", require: false
  gem "mocha", "~> 1.1", require: false
  gem 'test_after_commit', require: false
@@ -26,5 +26,5 @@ platforms :ruby do
 end

 group :mongoid do
-  gem "mongoid", "~> 4.0.0"
+  gem "mongoid", "~> 4.0"
 end
--- a/gemfiles/Gemfile.rails-4.2-stable.lock
+++ b/gemfiles/Gemfile.rails-4.2-stable.lock
@@ -1,6 +1,6 @@
 GIT
  remote: git://github.com/rails/rails.git
-  revision: 2aa27582c202148296bb169159b0bf9a47a7bd80
+  revision: 5be7cfa46e055148c8b74ac5d48982a3435f477c
  branch: 4-2-stable
  specs:
    actionmailer (4.2.6)
@@ -58,7 +58,7 @@ GIT
 PATH
  remote: ..
  specs:
-    devise (4.0.1)
+    devise (4.1.0)
      bcrypt (~> 3.0)
      orm_adapter (~> 0.1)
      railties (>= 4.1.0, < 5.1)
@@ -72,25 +72,27 @@ GEM
    bcrypt (3.1.11)
    bson (3.2.6)
    builder (3.2.2)
-    concurrent-ruby (1.0.1)
+    concurrent-ruby (1.0.2)
    connection_pool (2.2.0)
    erubis (2.7.0)
    faraday (0.9.2)
      multipart-post (>= 1.2, < 3)
    globalid (0.3.6)
      activesupport (>= 4.1.0)
-    hashie (3.4.3)
+    hashie (3.4.4)
    i18n (0.7.0)
    json (1.8.3)
    jwt (1.5.1)
    loofah (2.0.3)
      nokogiri (>= 1.5.9)
-    mail (2.6.3)
-      mime-types (>= 1.16, < 3)
+    mail (2.6.4)
+      mime-types (>= 1.16, < 4)
    metaclass (0.0.4)
-    mime-types (2.99.1)
+    mime-types (3.0)
+      mime-types-data (~> 3.2015)
+    mime-types-data (3.2016.0221)
    mini_portile2 (2.0.0)
-    minitest (5.8.4)
+    minitest (5.9.0)
    mocha (1.1.0)
      metaclass (~> 0.0.1)
    mongoid (4.0.2)
@@ -102,7 +104,7 @@ GEM
      bson (~> 3.0)
      connection_pool (~> 2.0)
      optionable (~> 0.2.0)
-    multi_json (1.11.2)
+    multi_json (1.12.0)
    multi_xml (0.5.5)
    multipart-post (2.0.0)
    nokogiri (1.6.7.2)
@@ -141,13 +143,13 @@ GEM
      rails-deprecated_sanitizer (>= 1.0.1)
    rails-html-sanitizer (1.0.3)
      loofah (~> 2.0)
-    rake (11.0.1)
+    rake (11.1.2)
    rdoc (4.2.2)
      json (~> 1.4)
-    responders (2.1.2)
+    responders (2.2.0)
      railties (>= 4.2.0, < 5.1)
    ruby-openid (2.7.0)
-    sprockets (3.5.2)
+    sprockets (3.6.0)
      concurrent-ruby (~> 1.0)
      rack (> 1, < 3)
    sprockets-rails (3.0.4)
@@ -177,11 +179,11 @@ DEPENDENCIES
  devise!
  jruby-openssl
  mocha (~> 1.1)
-  mongoid (~> 4.0.0)
-  omniauth (~> 1.3)
+  mongoid (~> 4.0)
+  omniauth
  omniauth-facebook
-  omniauth-oauth2 (~> 1.4)
-  omniauth-openid (~> 1.0.1)
+  omniauth-oauth2
+  omniauth-openid
  rails!
  rdoc
  sqlite3
--- a/gemfiles/Gemfile.rails-5.0-beta
+++ b/gemfiles/Gemfile.rails-5.0-beta
@@ -2,21 +2,21 @@ source "https://rubygems.org"

 gemspec path: ".."

-gem "rails", "5.0.0.beta3"
-gem "omniauth", " ~>1.3"
+gem "rails", "5.0.0.rc1"
+gem "omniauth", " ~> 1.3"
 gem "oauth2"
-gem "omniauth-oauth2", ">= 1.2.0", "< 1.5.0"
+gem "omniauth-oauth2"
 gem "rdoc"

 gem "activemodel-serializers-xml", github: "rails/activemodel-serializers-xml"

 gem "rails-controller-testing"

-gem "responders", "~> 2.1.1"
+gem "responders", "~> 2.1"

 group :test do
  gem "omniauth-facebook"
-  gem "omniauth-openid", "~> 1.0.1"
+  gem "omniauth-openid"
  gem "webrat", "0.7.3", require: false
  gem "mocha", "~> 1.1", require: false
 end
--- a/gemfiles/Gemfile.rails-5.0.lock
+++ b/gemfiles/Gemfile.rails-5.0.lock
@@ -0,0 +1,199 @@
+GIT
+  remote: git://github.com/rails/activemodel-serializers-xml.git
+  revision: 570ee7ed33d60e44ca1f3ccbec3d1fbf61d52cbf
+  specs:
+    activemodel-serializers-xml (1.0.1)
+      activemodel (> 5.x)
+      activerecord (> 5.x)
+      activesupport (> 5.x)
+      builder (~> 3.1)
+
+PATH
+  remote: ..
+  specs:
+    devise (4.1.0)
+      bcrypt (~> 3.0)
+      orm_adapter (~> 0.1)
+      railties (>= 4.1.0, < 5.1)
+      responders
+      warden (~> 1.2.3)
+
+GEM
+  remote: https://rubygems.org/
+  specs:
+    actioncable (5.0.0.rc1)
+      actionpack (= 5.0.0.rc1)
+      nio4r (~> 1.2)
+      websocket-driver (~> 0.6.1)
+    actionmailer (5.0.0.rc1)
+      actionpack (= 5.0.0.rc1)
+      actionview (= 5.0.0.rc1)
+      activejob (= 5.0.0.rc1)
+      mail (~> 2.5, >= 2.5.4)
+      rails-dom-testing (~> 1.0, >= 1.0.5)
+    actionpack (5.0.0.rc1)
+      actionview (= 5.0.0.rc1)
+      activesupport (= 5.0.0.rc1)
+      rack (~> 2.x)
+      rack-test (~> 0.6.3)
+      rails-dom-testing (~> 1.0, >= 1.0.5)
+      rails-html-sanitizer (~> 1.0, >= 1.0.2)
+    actionview (5.0.0.rc1)
+      activesupport (= 5.0.0.rc1)
+      builder (~> 3.1)
+      erubis (~> 2.7.0)
+      rails-dom-testing (~> 1.0, >= 1.0.5)
+      rails-html-sanitizer (~> 1.0, >= 1.0.2)
+    activejob (5.0.0.rc1)
+      activesupport (= 5.0.0.rc1)
+      globalid (>= 0.3.6)
+    activemodel (5.0.0.rc1)
+      activesupport (= 5.0.0.rc1)
+    activerecord (5.0.0.rc1)
+      activemodel (= 5.0.0.rc1)
+      activesupport (= 5.0.0.rc1)
+      arel (~> 7.0)
+    activesupport (5.0.0.rc1)
+      concurrent-ruby (~> 1.0, >= 1.0.2)
+      i18n (~> 0.7)
+      minitest (~> 5.1)
+      tzinfo (~> 1.1)
+    arel (7.0.0)
+    bcrypt (3.1.11)
+    builder (3.2.2)
+    concurrent-ruby (1.0.2)
+    erubis (2.7.0)
+    faraday (0.9.2)
+      multipart-post (>= 1.2, < 3)
+    globalid (0.3.6)
+      activesupport (>= 4.1.0)
+    hashie (3.4.4)
+    i18n (0.7.0)
+    json (1.8.3)
+    jwt (1.5.1)
+    loofah (2.0.3)
+      nokogiri (>= 1.5.9)
+    mail (2.6.4)
+      mime-types (>= 1.16, < 4)
+    metaclass (0.0.4)
+    method_source (0.8.2)
+    mime-types (3.0)
+      mime-types-data (~> 3.2015)
+    mime-types-data (3.2016.0221)
+    mini_portile2 (2.0.0)
+    minitest (5.9.0)
+    mocha (1.1.0)
+      metaclass (~> 0.0.1)
+    multi_json (1.12.0)
+    multi_xml (0.5.5)
+    multipart-post (2.0.0)
+    nio4r (1.2.1)
+    nokogiri (1.6.7.2)
+      mini_portile2 (~> 2.0.0.rc2)
+    oauth2 (1.1.0)
+      faraday (>= 0.8, < 0.10)
+      jwt (~> 1.0, < 1.5.2)
+      multi_json (~> 1.3)
+      multi_xml (~> 0.5)
+      rack (>= 1.2, < 3)
+    omniauth (1.3.1)
+      hashie (>= 1.2, < 4)
+      rack (>= 1.0, < 3)
+    omniauth-facebook (3.0.0)
+      omniauth-oauth2 (~> 1.2)
+    omniauth-oauth2 (1.4.0)
+      oauth2 (~> 1.0)
+      omniauth (~> 1.2)
+    omniauth-openid (1.0.1)
+      omniauth (~> 1.0)
+      rack-openid (~> 1.3.1)
+    orm_adapter (0.5.0)
+    rack (2.0.0.rc1)
+      json
+    rack-openid (1.3.1)
+      rack (>= 1.1.0)
+      ruby-openid (>= 2.1.8)
+    rack-test (0.6.3)
+      rack (>= 1.0)
+    rails (5.0.0.rc1)
+      actioncable (= 5.0.0.rc1)
+      actionmailer (= 5.0.0.rc1)
+      actionpack (= 5.0.0.rc1)
+      actionview (= 5.0.0.rc1)
+      activejob (= 5.0.0.rc1)
+      activemodel (= 5.0.0.rc1)
+      activerecord (= 5.0.0.rc1)
+      activesupport (= 5.0.0.rc1)
+      bundler (>= 1.3.0, < 2.0)
+      railties (= 5.0.0.rc1)
+      sprockets-rails (>= 2.0.0)
+    rails-controller-testing (0.1.1)
+      actionpack (~> 5.x)
+      actionview (~> 5.x)
+      activesupport (~> 5.x)
+    rails-deprecated_sanitizer (1.0.3)
+      activesupport (>= 4.2.0.alpha)
+    rails-dom-testing (1.0.7)
+      activesupport (>= 4.2.0.beta, < 5.0)
+      nokogiri (~> 1.6.0)
+      rails-deprecated_sanitizer (>= 1.0.1)
+    rails-html-sanitizer (1.0.3)
+      loofah (~> 2.0)
+    railties (5.0.0.rc1)
+      actionpack (= 5.0.0.rc1)
+      activesupport (= 5.0.0.rc1)
+      method_source
+      rake (>= 0.8.7)
+      thor (>= 0.18.1, < 2.0)
+    rake (11.1.2)
+    rdoc (4.2.2)
+      json (~> 1.4)
+    responders (2.2.0)
+      railties (>= 4.2.0, < 5.1)
+    ruby-openid (2.7.0)
+    sprockets (3.6.0)
+      concurrent-ruby (~> 1.0)
+      rack (> 1, < 3)
+    sprockets-rails (3.0.4)
+      actionpack (>= 4.0)
+      activesupport (>= 4.0)
+      sprockets (>= 3.0.0)
+    sqlite3 (1.3.11)
+    thor (0.19.1)
+    thread_safe (0.3.5)
+    tzinfo (1.2.2)
+      thread_safe (~> 0.1)
+    warden (1.2.6)
+      rack (>= 1.0)
+    webrat (0.7.3)
+      nokogiri (>= 1.2.0)
+      rack (>= 1.0)
+      rack-test (>= 0.5.3)
+    websocket-driver (0.6.3)
+      websocket-extensions (>= 0.1.0)
+    websocket-extensions (0.1.2)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  activemodel-serializers-xml!
+  activerecord-jdbc-adapter
+  activerecord-jdbcsqlite3-adapter
+  devise!
+  jruby-openssl
+  mocha (~> 1.1)
+  oauth2
+  omniauth (~> 1.3)
+  omniauth-facebook
+  omniauth-oauth2
+  omniauth-openid
+  rails (= 5.0.0.rc1)
+  rails-controller-testing
+  rdoc
+  responders (~> 2.1)
+  sqlite3
+  webrat (= 0.7.3)
+
+BUNDLED WITH
+   1.11.2
--- a/guides/bug_report_templates/integration_test.rb
+++ b/guides/bug_report_templates/integration_test.rb
@@ -0,0 +1,104 @@
+begin
+  require 'bundler/inline'
+rescue LoadError => e
+  $stderr.puts 'Bundler version 1.10 or later is required. Please update your Bundler'
+  raise e
+end
+
+gemfile(true) do
+  source 'https://rubygems.org'
+  # Activate the gem you are reporting the issue against.
+  gem 'rails', '~> 4.2.0'
+  gem 'devise', '~> 4.0'
+  gem 'sqlite3'
+  gem 'byebug'
+end
+
+require 'rack/test'
+require 'action_controller/railtie'
+require 'active_record'
+require 'devise/rails/routes'
+require 'devise/rails/warden_compat'
+
+ActiveRecord::Base.establish_connection( adapter: :sqlite3, database:  ':memory:')
+
+class DeviseCreateUsers < ActiveRecord::Migration
+  def change
+    create_table(:users) do |t|
+      t.string :email,              null: false
+      t.string :encrypted_password, null: true
+      t.timestamps null: false
+    end
+
+  end
+end
+
+Devise.setup do |config|
+  require 'devise/orm/active_record'
+  config.secret_key = 'secret_key_base'
+end
+
+class TestApp < Rails::Application
+  config.root = File.dirname(__FILE__)
+  config.session_store :cookie_store, key: 'cookie_store_key'
+  secrets.secret_token    = 'secret_token'
+  secrets.secret_key_base = 'secret_key_base'
+  config.eager_load = false
+
+  config.middleware.use Warden::Manager do |config|
+    Devise.warden_config = config
+  end
+
+  config.logger = Logger.new($stdout)
+  Rails.logger  = config.logger
+
+end
+
+Rails.application.initialize!
+
+DeviseCreateUsers.migrate(:up)
+
+class User < ActiveRecord::Base
+  devise :database_authenticatable
+end
+
+Rails.application.routes.draw do
+  devise_for :users
+
+  get '/' => 'test#index'
+end
+
+class ApplicationController < ActionController::Base
+end
+
+class TestController < ApplicationController
+  include Rails.application.routes.url_helpers
+
+  before_filter :authenticate_user!
+
+  def index
+    render plain: 'Home'
+  end
+end
+
+require 'minitest/autorun'
+
+class BugTest < ActionDispatch::IntegrationTest
+  include Rack::Test::Methods
+  include Warden::Test::Helpers
+
+  def test_returns_success
+    Warden.test_mode!
+
+    login_as User.create!(email: 'test@test.com', password: 'test123456', password_confirmation: 'test123456')
+
+    get '/'
+    assert last_response.ok?
+  end
+
+  private
+
+  def app
+    Rails.application
+  end
+end
--- a/lib/devise.rb
+++ b/lib/devise.rb
@@ -39,13 +39,18 @@ module Devise
    autoload :Authenticatable, 'devise/strategies/authenticatable'
  end

+  module Test
+    autoload :ControllerHelpers,  'devise/test/controller_helpers'
+    autoload :IntegrationHelpers, 'devise/test/integration_helpers'
+  end
+
  # Constants which holds devise configuration for extensions. Those should
  # not be modified by the "end user" (this is why they are constants).
  ALL         = []
-  CONTROLLERS = ActiveSupport::OrderedHash.new
-  ROUTES      = ActiveSupport::OrderedHash.new
-  STRATEGIES  = ActiveSupport::OrderedHash.new
-  URL_HELPERS = ActiveSupport::OrderedHash.new
+  CONTROLLERS = {}
+  ROUTES      = {}
+  STRATEGIES  = {}
+  URL_HELPERS = {}

  # Strategies that do not require user input.
  NO_INPUT = []
@@ -242,15 +247,22 @@ module Devise
  mattr_accessor :clean_up_csrf_token_on_authentication
  @@clean_up_csrf_token_on_authentication = true

+  # When false, Devise will not attempt to reload routes on eager load.
+  # This can reduce the time taken to boot the app but if your application
+  # requires the Devise mappings to be loaded during boot time the application
+  # won't boot properly.
+  mattr_accessor :reload_routes
+  @@reload_routes = true
+
  # PRIVATE CONFIGURATION

  # Store scopes mappings.
  mattr_reader :mappings
-  @@mappings = ActiveSupport::OrderedHash.new
+  @@mappings = {}

  # OmniAuth configurations.
  mattr_reader :omniauth_configs
-  @@omniauth_configs = ActiveSupport::OrderedHash.new
+  @@omniauth_configs = {}

  # Define a set of modules that are called when a mapping is added.
  mattr_reader :helpers
@@ -281,7 +293,7 @@ module Devise
  end

  class Getter
-    def initialize name
+    def initialize(name)
      @name = name
    end

@@ -291,12 +303,8 @@ module Devise
  end

  def self.ref(arg)
-    if defined?(ActiveSupport::Dependencies::ClassCache)
-      ActiveSupport::Dependencies::reference(arg)
-      Getter.new(arg)
-    else
-      ActiveSupport::Dependencies.ref(arg)
-    end
+    ActiveSupport::Dependencies.reference(arg)
+    Getter.new(arg)
  end

  def self.available_router_name
@@ -417,7 +425,6 @@ module Devise
  #   config.omniauth :github, APP_ID, APP_SECRET
  #
  def self.omniauth(provider, *args)
-    @@helpers << Devise::OmniAuth::UrlHelpers
    config = Devise::OmniAuth::Config.new(provider, args)
    @@omniauth_configs[config.strategy_name.to_sym] = config
  end
--- a/lib/devise/controllers/helpers.rb
+++ b/lib/devise/controllers/helpers.rb
@@ -138,7 +138,7 @@ module Devise

      # The main accessor for the warden proxy instance
      def warden
-        request.env['warden']
+        request.env['warden'] or raise MissingWarden
      end

      # Return true if it's a devise_controller. false to all controllers unless
@@ -277,4 +277,15 @@ module Devise
      end
    end
  end
+
+  class MissingWarden < StandardError
+    def initialize
+      super "Devise could not find the `Warden::Proxy` instance on your request environment.\n" + \
+        "Make sure that your application is loading Devise and Warden as expected and that " + \
+        "the `Warden::Manager` middleware is present in your middleware stack.\n" + \
+        "If you are seeing this on one of your tests, ensure that your tests are either " + \
+        "executing the Rails middleware stack or that your tests are using the `Devise::Test::ControllerHelpers` " + \
+        "module to inject the `request.env['warden']` object for you."
+    end
+  end
 end
--- a/lib/devise/controllers/sign_in_out.rb
+++ b/lib/devise/controllers/sign_in_out.rb
@@ -12,20 +12,15 @@ module Devise
      end

      # Sign in a user that already was authenticated. This helper is useful for logging
-      # users in after sign up.
-      #
-      # All options given to sign_in is passed forward to the set_user method in warden.
-      # The only exception is the :bypass option, which bypass warden callbacks and stores
-      # the user straight in session. This option is useful in cases the user is already
-      # signed in, but we want to refresh the credentials in session.
+      # users in after sign up. All options given to sign_in is passed forward
+      # to the set_user method in warden.
      #
      # Examples:
      #
      #   sign_in :user, @user                      # sign_in(scope, resource)
      #   sign_in @user                             # sign_in(resource)
-      #   sign_in @user, event: :authentication  # sign_in(resource, options)
-      #   sign_in @user, store: false            # sign_in(resource, options)
-      #   sign_in @user, bypass: true            # sign_in(resource, options)
+      #   sign_in @user, event: :authentication     # sign_in(resource, options)
+      #   sign_in @user, store: false               # sign_in(resource, options)
      #
      def sign_in(resource_or_scope, *args)
        options  = args.extract_options!
@@ -35,6 +30,13 @@ module Devise
        expire_data_after_sign_in!

        if options[:bypass]
+          ActiveSupport::Deprecation.warn(<<-DEPRECATION.strip_heredoc, caller)
+          [Devise] bypass option is deprecated and it will be removed in future version of Devise.
+          Please use bypass_sign_in method instead.
+          Example:
+
+            bypass_sign_in(user)
+          DEPRECATION
          warden.session_serializer.store(resource, scope)
        elsif warden.user(scope) == resource && !options.delete(:force)
          # Do nothing. User already signed in and we are not forcing it.
@@ -44,6 +46,20 @@ module Devise
        end
      end

+      # Sign in a user bypassing the warden callbacks and stores the user
+      # straight in session. This option is useful in cases the user is already
+      # signed in, but we want to refresh the credentials in session.
+      #
+      # Examples:
+      #
+      #   bypass_sign_in @user, scope: :user
+      #   bypass_sign_in @user
+      def bypass_sign_in(resource, scope: nil)
+        scope ||= Devise::Mapping.find_scope!(resource)
+        expire_data_after_sign_in!
+        warden.session_serializer.store(resource, scope)
+      end
+
      # Sign out a given user or scope. This helper is useful for signing out a user
      # after deleting accounts. Returns true if there was a logout and false if there
      # is no user logged in on the referred scope
--- a/lib/devise/models/authenticatable.rb
+++ b/lib/devise/models/authenticatable.rb
@@ -143,13 +143,25 @@ module Devise
      #         if new_record? || changed?
      #           pending_notifications << [notification, args]
      #         else
-      #           devise_mailer.send(notification, self, *args).deliver
+      #           message = devise_mailer.send(notification, self, *args)
+      #           Remove once we move to Rails 4.2+ only.
+      #           if message.respond_to?(:deliver_now)
+      #             message.deliver_now
+      #           else
+      #             message.deliver
+      #           end
      #         end
      #       end
      #
      #       def send_pending_notifications
      #         pending_notifications.each do |notification, args|
-      #           devise_mailer.send(notification, self, *args).deliver
+      #           message = devise_mailer.send(notification, self, *args)
+      #           Remove once we move to Rails 4.2+ only.
+      #           if message.respond_to?(:deliver_now)
+      #             message.deliver_now
+      #           else
+      #             message.deliver
+      #           end
      #         end
      #
      #         # Empty the pending notifications array because the
--- a/lib/devise/models/confirmable.rb
+++ b/lib/devise/models/confirmable.rb
@@ -97,11 +97,6 @@ module Devise
        end
      end

-      def confirm!(args={})
-        ActiveSupport::Deprecation.warn "confirm! is deprecated in favor of confirm"
-        confirm(args)
-      end
-
      # Verifies whether a user is confirmed or not
      def confirmed?
        !!confirmed_at
--- a/lib/devise/models/database_authenticatable.rb
+++ b/lib/devise/models/database_authenticatable.rb
@@ -1,11 +1,6 @@
 require 'devise/strategies/database_authenticatable'

 module Devise
-  def self.bcrypt(klass, password)
-    ActiveSupport::Deprecation.warn "Devise.bcrypt is deprecated; use Devise::Encryptor.digest instead"
-    Devise::Encryptor.digest(klass, password)
-  end
-
  module Models
    # Authenticatable Module, responsible for hashing the password and
    # validating the authenticity of a user while signing in.
--- a/lib/devise/models/recoverable.rb
+++ b/lib/devise/models/recoverable.rb
@@ -40,19 +40,9 @@ module Devise
        self.password = new_password
        self.password_confirmation = new_password_confirmation

-        if respond_to?(:after_password_reset) && valid?
-          ActiveSupport::Deprecation.warn "after_password_reset is deprecated"
-          after_password_reset
-        end
-
        save
      end

-      def reset_password!(new_password, new_password_confirmation)
-        ActiveSupport::Deprecation.warn "reset_password! is deprecated in favor of reset_password"
-        reset_password(new_password, new_password_confirmation)
-      end
-
      # Resets reset password token and send reset password instructions by email.
      # Returns the token sent in the e-mail.
      def send_reset_password_instructions
--- a/lib/devise/models/rememberable.rb
+++ b/lib/devise/models/rememberable.rb
@@ -46,7 +46,7 @@ module Devise
      end

      def remember_me!
-        self.remember_token = self.class.remember_token if respond_to?(:remember_token)
+        self.remember_token ||= self.class.remember_token if respond_to?(:remember_token)
        self.remember_created_at ||= Time.now.utc
        save(validate: false) if self.changed?
      end
--- a/lib/devise/omniauth/url_helpers.rb
+++ b/lib/devise/omniauth/url_helpers.rb
@@ -1,57 +1,6 @@
 module Devise
  module OmniAuth
    module UrlHelpers
-      def self.define_helpers(mapping)
-        return unless mapping.omniauthable?
-
-        mapping = mapping.name
-
-        class_eval do
-          define_method("#{mapping}_omniauth_authorize_path") do |provider, *args|
-            ActiveSupport::Deprecation.warn(<<-DEPRECATION.strip_heredoc)
-            [Devise] #{mapping}_omniauth_authorize_path(#{provider.inspect}) is deprecated and it will be removed from Devise 4.2.
-
-            Please use #{mapping}_#{provider}_omniauth_authorize_path instead.
-            DEPRECATION
-            send("#{mapping}_#{provider}_omniauth_authorize_path", *args)
-          end
-
-          define_method("#{mapping}_omniauth_authorize_url") do |provider, *args|
-            ActiveSupport::Deprecation.warn(<<-DEPRECATION.strip_heredoc)
-            [Devise] #{mapping}_omniauth_authorize_url(#{provider.inspect}) is deprecated and it will be removed from Devise 4.2.
-
-            Please use #{mapping}_#{provider}_omniauth_authorize_url instead.
-            DEPRECATION
-            send("#{mapping}_#{provider}_omniauth_authorize_url", *args)
-          end
-
-          define_method("#{mapping}_omniauth_callback_path") do |provider, *args|
-            ActiveSupport::Deprecation.warn(<<-DEPRECATION.strip_heredoc)
-            [Devise] #{mapping}_omniauth_callback_path(#{provider.inspect}) is deprecated and it will be removed from Devise 4.2.
-
-            Please use #{mapping}_#{provider}_omniauth_callback_path instead.
-            DEPRECATION
-            send("#{mapping}_#{provider}_omniauth_callback_path", *args)
-          end
-
-          define_method("#{mapping}_omniauth_callback_url") do |provider, *args|
-            ActiveSupport::Deprecation.warn(<<-DEPRECATION.strip_heredoc)
-            [Devise] #{mapping}_omniauth_callback_url(#{provider.inspect}) is deprecated and it will be removed from Devise 4.2.
-
-            Please use #{mapping}_#{provider}_omniauth_callback_url instead.
-            DEPRECATION
-            send("#{mapping}_#{provider}_omniauth_callback_url", *args)
-          end
-        end
-
-        ActiveSupport.on_load(:action_controller) do
-          if respond_to?(:helper_method)
-            helper_method "#{mapping}_omniauth_authorize_path", "#{mapping}_omniauth_authorize_url"
-            helper_method "#{mapping}_omniauth_callback_path", "#{mapping}_omniauth_callback_url"
-          end
-        end
-      end
-
      def omniauth_authorize_path(resource_or_scope, provider, *args)
        scope = Devise::Mapping.find_scope!(resource_or_scope)
        _devise_route_context.send("#{scope}_#{provider}_omniauth_authorize_path", *args)
--- a/lib/devise/parameter_sanitizer.rb
+++ b/lib/devise/parameter_sanitizer.rb
@@ -68,12 +68,6 @@ module Devise
    def sanitize(action)
      permissions = @permitted[action]

-      # DEPRECATED: Remove this branch on Devise 4.2.
-      if respond_to?(action, true)
-        deprecate_instance_method_sanitization(action)
-        return cast_to_hash send(action)
-      end
-
      if permissions.respond_to?(:call)
        cast_to_hash permissions.call(default_params)
      elsif permissions.present?
@@ -127,17 +121,6 @@ module Devise
      end
    end

-    # DEPRECATED: Remove this method on Devise 4.2.
-    def for(action, &block) # :nodoc:
-      if block_given?
-        deprecate_for_with_block(action)
-        permit(action, &block)
-      else
-        deprecate_for_without_block(action)
-        @permitted[action] or unknown_action!(action)
-      end
-    end
-
    private

    # Cast a sanitized +ActionController::Parameters+ to a +HashWithIndifferentAccess+
@@ -172,43 +155,5 @@ module Devise
          devise_parameter_sanitizer.permit(:#{action}, keys: [:param1, :param2, :param3])
      MESSAGE
    end
-
-    def deprecate_for_with_block(action)
-      ActiveSupport::Deprecation.warn(<<-MESSAGE.strip_heredoc)
-        [Devise] Changing the sanitized parameters through "#{self.class.name}#for(#{action}) is deprecated and it will be removed from Devise 4.2.
-        Please use the `permit` method:
-
-          devise_parameter_sanitizer.permit(:#{action}) do |user|
-            # Your block here.
-          end
-      MESSAGE
-    end
-
-    def deprecate_for_without_block(action)
-      ActiveSupport::Deprecation.warn(<<-MESSAGE.strip_heredoc)
-        [Devise] Changing the sanitized parameters through "#{self.class.name}#for(#{action}) is deprecated and it will be removed from Devise 4.2.
-        Please use the `permit` method to add or remove any key:
-
-          To add any new key, use the `keys` keyword argument:
-          devise_parameter_sanitizer.permit(:#{action}, keys: [:param1, :param2, :param3])
-
-          To remove any existing key, use the `except` keyword argument:
-          devise_parameter_sanitizer.permit(:#{action}, except: [:email])
-      MESSAGE
-    end
-
-    def deprecate_instance_method_sanitization(action)
-      ActiveSupport::Deprecation.warn(<<-MESSAGE.strip_heredoc)
-        [Devise] Parameter sanitization through a "#{self.class.name}##{action}" method is deprecated and it will be removed from Devise 4.2.
-        Please use the `permit` method on your sanitizer `initialize` method.
-
-          class #{self.class.name} < Devise::ParameterSanitizer
-            def initialize(*)
-              super
-              permit(:#{action}, keys: [:param1, :param2, :param3])
-            end
-          end
-      MESSAGE
-    end
  end
 end
--- a/lib/devise/rails.rb
+++ b/lib/devise/rails.rb
@@ -11,7 +11,9 @@ module Devise
    end

    # Force routes to be loaded if we are doing any eager load.
-    config.before_eager_load { |app| app.reload_routes! }
+    config.before_eager_load do |app|
+      app.reload_routes! if Devise.reload_routes
+    end

    initializer "devise.url_helpers" do
      Devise.include_helpers(Devise::Controllers)
--- a/lib/devise/test/controller_helpers.rb
+++ b/lib/devise/test/controller_helpers.rb
@@ -0,0 +1,163 @@
+module Devise
+  module Test
+    # `Devise::Test::ControllerHelpers` provides a facility to test controllers
+    # in isolation when using `ActionController::TestCase` allowing you to
+    # quickly sign_in or sign_out a user. Do not use
+    # `Devise::Test::ControllerHelpers` in integration tests.
+    #
+    # Examples
+    #
+    #  class PostsTest < ActionController::TestCase
+    #    include Devise::Test::ControllerHelpers
+    #
+    #    test 'authenticated users can GET index' do
+    #      sign_in users(:bob)
+    #
+    #      get :index
+    #      assert_response :success
+    #    end
+    #  end
+    #
+    # Important: you should not test Warden specific behavior (like callbacks)
+    # using `Devise::Test::ControllerHelpers` since it is a stub of the actual
+    # behavior. Such callbacks should be tested in your integration suite instead.
+    module ControllerHelpers
+      extend ActiveSupport::Concern
+
+      included do
+        setup :setup_controller_for_warden, :warden
+      end
+
+      # Override process to consider warden.
+      def process(*)
+        _catch_warden { super }
+
+        @response
+      end
+
+      # We need to set up the environment variables and the response in the controller.
+      def setup_controller_for_warden #:nodoc:
+        @request.env['action_controller.instance'] = @controller
+      end
+
+      # Quick access to Warden::Proxy.
+      def warden #:nodoc:
+        @request.env['warden'] ||= begin
+          manager = Warden::Manager.new(nil) do |config|
+            config.merge! Devise.warden_config
+          end
+          Warden::Proxy.new(@request.env, manager)
+        end
+      end
+
+      # sign_in a given resource by storing its keys in the session.
+      # This method bypass any warden authentication callback.
+      #
+      # * +resource+ - The resource that should be authenticated
+      # * +scope+    - An optional +Symbol+ with the scope where the resource
+      #                should be signed in with.
+      # Examples:
+      #
+      # sign_in users(:alice)
+      # sign_in users(:alice), scope: :admin
+      def sign_in(resource, deprecated = nil, scope: nil)
+        if deprecated.present?
+          scope = resource
+          resource = deprecated
+
+          ActiveSupport::Deprecation.warn <<-DEPRECATION
+            [Devise] sign_in(:#{scope}, resource) on controller tests is deprecated and will be removed from Devise.
+            Please use sign_in(resource, scope: :#{scope}) instead.
+          DEPRECATION
+        end
+
+        scope ||= Devise::Mapping.find_scope!(resource)
+
+        warden.instance_variable_get(:@users).delete(scope)
+        warden.session_serializer.store(resource, scope)
+      end
+
+      # Sign out a given resource or scope by calling logout on Warden.
+      # This method bypass any warden logout callback.
+      #
+      # Examples:
+      #
+      #   sign_out :user     # sign_out(scope)
+      #   sign_out @user     # sign_out(resource)
+      #
+      def sign_out(resource_or_scope)
+        scope = Devise::Mapping.find_scope!(resource_or_scope)
+        @controller.instance_variable_set(:"@current_#{scope}", nil)
+        user = warden.instance_variable_get(:@users).delete(scope)
+        warden.session_serializer.delete(scope, user)
+      end
+
+      protected
+
+      # Catch warden continuations and handle like the middleware would.
+      # Returns nil when interrupted, otherwise the normal result of the block.
+      def _catch_warden(&block)
+        result = catch(:warden, &block)
+
+        env = @controller.request.env
+
+        result ||= {}
+
+        # Set the response. In production, the rack result is returned
+        # from Warden::Manager#call, which the following is modelled on.
+        case result
+        when Array
+          if result.first == 401 && intercept_401?(env) # does this happen during testing?
+            _process_unauthenticated(env)
+          else
+            result
+          end
+        when Hash
+          _process_unauthenticated(env, result)
+        else
+          result
+        end
+      end
+
+      def _process_unauthenticated(env, options = {})
+        options[:action] ||= :unauthenticated
+        proxy = env['warden']
+        result = options[:result] || proxy.result
+
+        ret = case result
+        when :redirect
+          body = proxy.message || "You are being redirected to #{proxy.headers['Location']}"
+          [proxy.status, proxy.headers, [body]]
+        when :custom
+          proxy.custom_response
+        else
+          env["PATH_INFO"] = "/#{options[:action]}"
+          env["warden.options"] = options
+          Warden::Manager._run_callbacks(:before_failure, env, options)
+
+          status, headers, response = Devise.warden_config[:failure_app].call(env).to_a
+          @controller.response.headers.merge!(headers)
+          r_opts = { status: status, content_type: headers["Content-Type"], location: headers["Location"] }
+          r_opts[Rails.version.start_with?('5') ? :body : :text] = response.body
+          @controller.send :render, r_opts
+          nil # causes process return @response
+        end
+
+        # ensure that the controller response is set up. In production, this is
+        # not necessary since warden returns the results to rack. However, at
+        # testing time, we want the response to be available to the testing
+        # framework to verify what would be returned to rack.
+        if ret.is_a?(Array)
+          # ensure the controller response is set to our response.
+          @controller.response ||= @response
+          @response.status = ret.first
+          @response.headers.clear
+          ret.second.each { |k,v| @response[k] = v }
+          @response.body = ret.third
+        end
+
+        ret
+      end
+    end
+  end
+end
--- a/lib/devise/test/integration_helpers.rb
+++ b/lib/devise/test/integration_helpers.rb
@@ -0,0 +1,61 @@
+module Devise
+  # Devise::Test::IntegrationHelpers is a helper module for facilitating
+  # authentication on Rails integration tests to bypass the required steps for
+  # signin in or signin out a record.
+  #
+  # Examples
+  #
+  #  class PostsTest < ActionDispatch::IntegrationTest
+  #    include Devise::Test::IntegrationHelpers
+  #
+  #    test 'authenticated users can see posts' do
+  #      sign_in users(:bob)
+  #
+  #      get '/posts'
+  #      assert_response :success
+  #    end
+  #  end
+  module Test
+    module IntegrationHelpers
+      def self.included(base)
+        base.class_eval do
+          include Warden::Test::Helpers
+
+          setup :setup_integration_for_devise
+          teardown :teardown_integration_for_devise
+        end
+      end
+
+      # Signs in a specific resource, mimicking a successfull sign in
+      # operation through +Devise::SessionsController#create+.
+      #
+      # * +resource+ - The resource that should be authenticated
+      # * +scope+    - An optional +Symbol+ with the scope where the resource
+      #                should be signed in with.
+      def sign_in(resource, scope: nil)
+        scope ||= Devise::Mapping.find_scope!(resource)
+
+        login_as(resource, scope: scope)
+      end
+
+      # Signs out a specific scope from the session.
+      #
+      # * +resource_or_scope+ - The resource or scope that should be signed out.
+      def sign_out(resource_or_scope)
+        scope = Devise::Mapping.find_scope!(resource_or_scope)
+
+        logout scope
+      end
+
+      protected
+
+      def setup_integration_for_devise
+        Warden.test_mode!
+      end
+
+      def teardown_integration_for_devise
+        Warden.test_reset!
+      end
+    end
+  end
+end
--- a/lib/devise/test_helpers.rb
+++ b/lib/devise/test_helpers.rb
@@ -1,137 +1,13 @@
 module Devise
-  # Devise::TestHelpers provides a facility to test controllers in isolation
-  # when using ActionController::TestCase allowing you to quickly sign_in or
-  # sign_out a user. Do not use Devise::TestHelpers in integration tests.
-  #
-  # Notice you should not test Warden specific behavior (like Warden callbacks)
-  # using Devise::TestHelpers since it is a stub of the actual behavior. Such
-  # callbacks should be tested in your integration suite instead.
  module TestHelpers
    def self.included(base)
      base.class_eval do
-        setup :setup_controller_for_warden, :warden if respond_to?(:setup)
+        ActiveSupport::Deprecation.warn <<-DEPRECATION
+          [Devise] including `Devise::TestHelpers` is deprecated and will be removed from Devise.
+          For controller tests, please include `Devise::Test::ControllerHelpers` instead.
+        DEPRECATION
+        include Devise::Test::ControllerHelpers
      end
    end
-
-    # Override process to consider warden.
-    def process(*)
-      # Make sure we always return @response, a la ActionController::TestCase::Behaviour#process, even if warden interrupts
-      _catch_warden { super } # || @response  # _catch_warden will setup the @response object
-
-      # process needs to return the ActionDispath::TestResponse object
-      @response
-    end
-
-    # We need to set up the environment variables and the response in the controller.
-    def setup_controller_for_warden #:nodoc:
-      @request.env['action_controller.instance'] = @controller
-    end
-
-    # Quick access to Warden::Proxy.
-    def warden #:nodoc:
-      @request.env['warden'] ||= begin
-        manager = Warden::Manager.new(nil) do |config|
-          config.merge! Devise.warden_config
-        end
-        Warden::Proxy.new(@request.env, manager)
-      end
-    end
-
-    # sign_in a given resource by storing its keys in the session.
-    # This method bypass any warden authentication callback.
-    #
-    # Examples:
-    #
-    #   sign_in :user, @user   # sign_in(scope, resource)
-    #   sign_in @user          # sign_in(resource)
-    #
-    def sign_in(resource_or_scope, resource=nil)
-      scope    ||= Devise::Mapping.find_scope!(resource_or_scope)
-      resource ||= resource_or_scope
-      warden.instance_variable_get(:@users).delete(scope)
-      warden.session_serializer.store(resource, scope)
-    end
-
-    # Sign out a given resource or scope by calling logout on Warden.
-    # This method bypass any warden logout callback.
-    #
-    # Examples:
-    #
-    #   sign_out :user     # sign_out(scope)
-    #   sign_out @user     # sign_out(resource)
-    #
-    def sign_out(resource_or_scope)
-      scope = Devise::Mapping.find_scope!(resource_or_scope)
-      @controller.instance_variable_set(:"@current_#{scope}", nil)
-      user = warden.instance_variable_get(:@users).delete(scope)
-      warden.session_serializer.delete(scope, user)
-    end
-
-    protected
-
-    # Catch warden continuations and handle like the middleware would.
-    # Returns nil when interrupted, otherwise the normal result of the block.
-    def _catch_warden(&block)
-      result = catch(:warden, &block)
-
-      env = @controller.request.env
-
-      result ||= {}
-
-      # Set the response. In production, the rack result is returned
-      # from Warden::Manager#call, which the following is modelled on.
-      case result
-      when Array
-        if result.first == 401 && intercept_401?(env) # does this happen during testing?
-          _process_unauthenticated(env)
-        else
-          result
-        end
-      when Hash
-        _process_unauthenticated(env, result)
-      else
-        result
-      end
-    end
-
-    def _process_unauthenticated(env, options = {})
-      options[:action] ||= :unauthenticated
-      proxy = env['warden']
-      result = options[:result] || proxy.result
-
-      ret = case result
-      when :redirect
-        body = proxy.message || "You are being redirected to #{proxy.headers['Location']}"
-        [proxy.status, proxy.headers, [body]]
-      when :custom
-        proxy.custom_response
-      else
-        env["PATH_INFO"] = "/#{options[:action]}"
-        env["warden.options"] = options
-        Warden::Manager._run_callbacks(:before_failure, env, options)
-
-        status, headers, response = Devise.warden_config[:failure_app].call(env).to_a
-        @controller.response.headers.merge!(headers)
-        r_opts = { status: status, content_type: headers["Content-Type"], location: headers["Location"] }
-        r_opts[Rails.version.start_with?('5') ? :body : :text] = response.body
-        @controller.send :render, r_opts
-        nil # causes process return @response
-      end
-
-      # ensure that the controller response is set up. In production, this is
-      # not necessary since warden returns the results to rack. However, at
-      # testing time, we want the response to be available to the testing
-      # framework to verify what would be returned to rack.
-      if ret.is_a?(Array)
-        # ensure the controller response is set to our response.
-        @controller.response ||= @response
-        @response.status = ret.first
-        @response.headers.clear
-        ret.second.each { |k,v| @response[k] = v }
-        @response.body = ret.third
-      end
-
-      ret
-    end
  end
 end
--- a/lib/generators/templates/README
+++ b/lib/generators/templates/README
@@ -21,14 +21,7 @@ Some setup you must do manually if you haven't yet:
       <p class="notice"><%= notice %></p>
       <p class="alert"><%= alert %></p>

-  4. If you are deploying on Heroku with Rails 3.2 only, you may want to set:
-
-       config.assets.initialize_on_precompile = false
-
-     On config/application.rb forcing your application to not access the DB
-     or load models when precompiling your assets.
-
-  5. You can copy Devise views (for customization) to your app by running:
+  4. You can copy Devise views (for customization) to your app by running:

       rails g devise:views

--- a/lib/generators/templates/devise.rb
+++ b/lib/generators/templates/devise.rb
@@ -90,6 +90,12 @@ Devise.setup do |config|
  # from the server. You can disable this option at your own risk.
  # config.clean_up_csrf_token_on_authentication = true

+  # When false, Devise will not attempt to reload routes on eager load.
+  # This can reduce the time taken to boot the app but if your application
+  # requires the Devise mappings to be loaded during boot time the application
+  # won't boot properly.
+  # config.reload_routes = true
+
  # ==> Configuration for :database_authenticatable
  # For bcrypt, this is the cost for hashing the password and defaults to 11. If
  # using other algorithms, it sets how many times you want the password to be hashed.
--- a/test/controllers/custom_registrations_controller_test.rb
+++ b/test/controllers/custom_registrations_controller_test.rb
@@ -3,7 +3,7 @@ require 'test_helper'
 class CustomRegistrationsControllerTest < Devise::ControllerTestCase
  tests Custom::RegistrationsController

-  include Devise::TestHelpers
+  include Devise::Test::ControllerHelpers

  setup do
    request.env["devise.mapping"] = Devise.mappings[:user]
--- a/test/controllers/custom_strategy_test.rb
+++ b/test/controllers/custom_strategy_test.rb
@@ -27,7 +27,7 @@ end
 class CustomStrategyTest < Devise::ControllerTestCase
  tests CustomStrategyController

-  include Devise::TestHelpers
+  include Devise::Test::ControllerHelpers

  setup do
    Warden::Strategies.add(:custom_strategy, CustomStrategy)
--- a/test/controllers/helpers_test.rb
+++ b/test/controllers/helpers_test.rb
@@ -96,7 +96,7 @@ class ControllerAuthenticatableTest < Devise::ControllerTestCase

  test 'proxy admin_signed_in? to authenticatewith admin scope' do
    @mock_warden.expects(:authenticate).with(scope: :admin)
-    assert_not @controller.admin_signed_in?
+    refute @controller.admin_signed_in?
  end

  test 'proxy publisher_account_signed_in? to authenticate with namespaced publisher account scope' do
@@ -150,11 +150,11 @@ class ControllerAuthenticatableTest < Devise::ControllerTestCase
    @controller.sign_in(user, force: true)
  end

-  test 'sign in accepts bypass as option' do
+  test 'bypass the sign in' do
    user = User.new
    @mock_warden.expects(:session_serializer).returns(serializer = mock())
    serializer.expects(:store).with(user, :user)
-    @controller.sign_in(user, bypass: true)
+    @controller.bypass_sign_in(user)
  end

  test 'sign out clears up any signed in user from all scopes' do
@@ -311,6 +311,6 @@ class ControllerAuthenticatableTest < Devise::ControllerTestCase
  end

  test 'is not a devise controller' do
-    assert_not @controller.devise_controller?
+    refute @controller.devise_controller?
  end
 end
--- a/test/controllers/internal_helpers_test.rb
+++ b/test/controllers/internal_helpers_test.rb
@@ -119,7 +119,7 @@ class HelpersTest < Devise::ControllerTestCase
    MyController.send(:public, :navigational_formats)

    swap Devise, navigational_formats: ['*/*', :html] do
-      assert_not @controller.navigational_formats.include?("*/*")
+      refute @controller.navigational_formats.include?("*/*")
    end

    MyController.send(:protected, :navigational_formats)
--- a/test/controllers/passwords_controller_test.rb
+++ b/test/controllers/passwords_controller_test.rb
@@ -2,7 +2,7 @@ require 'test_helper'

 class PasswordsControllerTest < Devise::ControllerTestCase
  tests Devise::PasswordsController
-  include Devise::TestHelpers
+  include Devise::Test::ControllerHelpers

  setup do
    request.env["devise.mapping"] = Devise.mappings[:user]
--- a/test/controllers/sessions_controller_test.rb
+++ b/test/controllers/sessions_controller_test.rb
@@ -2,7 +2,7 @@ require 'test_helper'

 class SessionsControllerTest < Devise::ControllerTestCase
  tests Devise::SessionsController
-  include Devise::TestHelpers
+  include Devise::Test::ControllerHelpers

  test "#create doesn't raise unpermitted params when sign in fails" do
    begin
--- a/test/devise_test.rb
+++ b/test/devise_test.rb
@@ -69,8 +69,8 @@ class DeviseTest < ActiveSupport::TestCase
  test 'add new module using the helper method' do
    assert_nothing_raised(Exception) { Devise.add_module(:coconut) }
    assert_equal 1, Devise::ALL.select { |v| v == :coconut }.size
-    assert_not Devise::STRATEGIES.include?(:coconut)
-    assert_not defined?(Devise::Models::Coconut)
+    refute Devise::STRATEGIES.include?(:coconut)
+    refute defined?(Devise::Models::Coconut)
    Devise::ALL.delete(:coconut)

    assert_nothing_raised(Exception) { Devise.add_module(:banana, strategy: :fruits) }
@@ -86,11 +86,11 @@ class DeviseTest < ActiveSupport::TestCase

  test 'should complain when comparing empty or different sized passes' do
    [nil, ""].each do |empty|
-      assert_not Devise.secure_compare(empty, "something")
-      assert_not Devise.secure_compare("something", empty)
-      assert_not Devise.secure_compare(empty, empty)
+      refute Devise.secure_compare(empty, "something")
+      refute Devise.secure_compare("something", empty)
+      refute Devise.secure_compare(empty, empty)
    end
-    assert_not Devise.secure_compare("size_1", "size_four")
+    refute Devise.secure_compare("size_1", "size_four")
  end

  test 'Devise.email_regexp should match valid email addresses' do
--- a/test/integration/authenticatable_test.rb
+++ b/test/integration/authenticatable_test.rb
@@ -10,13 +10,13 @@ class AuthenticationSanityTest < Devise::IntegrationTest
  test 'sign in as user should not authenticate admin scope' do
    sign_in_as_user
    assert warden.authenticated?(:user)
-    assert_not warden.authenticated?(:admin)
+    refute warden.authenticated?(:admin)
  end

  test 'sign in as admin should not authenticate user scope' do
    sign_in_as_admin
    assert warden.authenticated?(:admin)
-    assert_not warden.authenticated?(:user)
+    refute warden.authenticated?(:user)
  end

  test 'sign in as both user and admin at same time' do
@@ -31,7 +31,7 @@ class AuthenticationSanityTest < Devise::IntegrationTest
      sign_in_as_user
      sign_in_as_admin
      delete destroy_user_session_path
-      assert_not warden.authenticated?(:user)
+      refute warden.authenticated?(:user)
      assert warden.authenticated?(:admin)
    end
  end
@@ -42,7 +42,7 @@ class AuthenticationSanityTest < Devise::IntegrationTest
      sign_in_as_admin

      delete destroy_admin_session_path
-      assert_not warden.authenticated?(:admin)
+      refute warden.authenticated?(:admin)
      assert warden.authenticated?(:user)
    end
  end
@@ -53,8 +53,8 @@ class AuthenticationSanityTest < Devise::IntegrationTest
      sign_in_as_admin

      delete destroy_user_session_path
-      assert_not warden.authenticated?(:user)
-      assert_not warden.authenticated?(:admin)
+      refute warden.authenticated?(:user)
+      refute warden.authenticated?(:admin)
    end
  end

@@ -64,21 +64,21 @@ class AuthenticationSanityTest < Devise::IntegrationTest
      sign_in_as_admin

      delete destroy_admin_session_path
-      assert_not warden.authenticated?(:admin)
-      assert_not warden.authenticated?(:user)
+      refute warden.authenticated?(:admin)
+      refute warden.authenticated?(:user)
    end
  end

  test 'not signed in as admin should not be able to access admins actions' do
    get admins_path
    assert_redirected_to new_admin_session_path
-    assert_not warden.authenticated?(:admin)
+    refute warden.authenticated?(:admin)
  end

  test 'signed in as user should not be able to access admins actions' do
    sign_in_as_user
    assert warden.authenticated?(:user)
-    assert_not warden.authenticated?(:admin)
+    refute warden.authenticated?(:admin)

    get admins_path
    assert_redirected_to new_admin_session_path
@@ -87,7 +87,7 @@ class AuthenticationSanityTest < Devise::IntegrationTest
  test 'signed in as admin should be able to access admin actions' do
    sign_in_as_admin
    assert warden.authenticated?(:admin)
-    assert_not warden.authenticated?(:user)
+    refute warden.authenticated?(:user)

    get admins_path

@@ -115,7 +115,7 @@ class AuthenticationSanityTest < Devise::IntegrationTest

    get root_path
    assert_contain 'Signed out successfully'
-    assert_not warden.authenticated?(:admin)
+    refute warden.authenticated?(:admin)
  end

  test 'unauthenticated admin set message on sign out' do
@@ -138,13 +138,13 @@ class AuthenticationRoutesRestrictions < Devise::IntegrationTest
  test 'not signed in should not be able to access private route (authenticate denied)' do
    get private_path
    assert_redirected_to new_admin_session_path
-    assert_not warden.authenticated?(:admin)
+    refute warden.authenticated?(:admin)
  end

  test 'signed in as user should not be able to access private route restricted to admins (authenticate denied)' do
    sign_in_as_user
    assert warden.authenticated?(:user)
-    assert_not warden.authenticated?(:admin)
+    refute warden.authenticated?(:admin)
    get private_path
    assert_redirected_to new_admin_session_path
  end
@@ -152,7 +152,7 @@ class AuthenticationRoutesRestrictions < Devise::IntegrationTest
  test 'signed in as admin should be able to access private route restricted to admins (authenticate accepted)' do
    sign_in_as_admin
    assert warden.authenticated?(:admin)
-    assert_not warden.authenticated?(:user)
+    refute warden.authenticated?(:user)

    get private_path

@@ -164,7 +164,7 @@ class AuthenticationRoutesRestrictions < Devise::IntegrationTest
  test 'signed in as inactive admin should not be able to access private/active route restricted to active admins (authenticate denied)' do
    sign_in_as_admin(active: false)
    assert warden.authenticated?(:admin)
-    assert_not warden.authenticated?(:user)
+    refute warden.authenticated?(:user)

    assert_raises ActionController::RoutingError do
      get "/private/active"
@@ -174,7 +174,7 @@ class AuthenticationRoutesRestrictions < Devise::IntegrationTest
  test 'signed in as active admin should be able to access private/active route restricted to active admins (authenticate accepted)' do
    sign_in_as_admin(active: true)
    assert warden.authenticated?(:admin)
-    assert_not warden.authenticated?(:user)
+    refute warden.authenticated?(:user)

    get private_active_path

@@ -186,7 +186,7 @@ class AuthenticationRoutesRestrictions < Devise::IntegrationTest
  test 'signed in as admin should get admin dashboard (authenticated accepted)' do
    sign_in_as_admin
    assert warden.authenticated?(:admin)
-    assert_not warden.authenticated?(:user)
+    refute warden.authenticated?(:user)

    get dashboard_path

@@ -198,7 +198,7 @@ class AuthenticationRoutesRestrictions < Devise::IntegrationTest
  test 'signed in as user should get user dashboard (authenticated accepted)' do
    sign_in_as_user
    assert warden.authenticated?(:user)
-    assert_not warden.authenticated?(:admin)
+    refute warden.authenticated?(:admin)

    get dashboard_path

@@ -216,7 +216,7 @@ class AuthenticationRoutesRestrictions < Devise::IntegrationTest
  test 'signed in as inactive admin should not be able to access dashboard/active route restricted to active admins (authenticated denied)' do
    sign_in_as_admin(active: false)
    assert warden.authenticated?(:admin)
-    assert_not warden.authenticated?(:user)
+    refute warden.authenticated?(:user)

    assert_raises ActionController::RoutingError do
      get "/dashboard/active"
@@ -226,7 +226,7 @@ class AuthenticationRoutesRestrictions < Devise::IntegrationTest
  test 'signed in as active admin should be able to access dashboard/active route restricted to active admins (authenticated accepted)' do
    sign_in_as_admin(active: true)
    assert warden.authenticated?(:admin)
-    assert_not warden.authenticated?(:user)
+    refute warden.authenticated?(:user)

    get dashboard_active_path

@@ -238,7 +238,7 @@ class AuthenticationRoutesRestrictions < Devise::IntegrationTest
  test 'signed in user should not see unauthenticated page (unauthenticated denied)' do
    sign_in_as_user
    assert warden.authenticated?(:user)
-    assert_not warden.authenticated?(:admin)
+    refute warden.authenticated?(:admin)

    assert_raises ActionController::RoutingError do
      get join_path
@@ -404,13 +404,13 @@ class AuthenticationOthersTest < Devise::IntegrationTest
  test 'handles unverified requests gets rid of caches' do
    swap ApplicationController, allow_forgery_protection: true do
      post exhibit_user_url(1)
-      assert_not warden.authenticated?(:user)
+      refute warden.authenticated?(:user)

      sign_in_as_user
      assert warden.authenticated?(:user)

      post exhibit_user_url(1)
-      assert_not warden.authenticated?(:user)
+      refute warden.authenticated?(:user)
      assert_equal "User is not authenticated", response.body
    end
  end
@@ -473,7 +473,7 @@ class AuthenticationOthersTest < Devise::IntegrationTest
  test 'uses the mapping from router' do
    sign_in_as_user visit: "/as/sign_in"
    assert warden.authenticated?(:user)
-    assert_not warden.authenticated?(:admin)
+    refute warden.authenticated?(:admin)
  end

  test 'sign in with xml format returns xml response' do
@@ -515,14 +515,14 @@ class AuthenticationOthersTest < Devise::IntegrationTest
    sign_in_as_user
    delete destroy_user_session_path(format: 'xml')
    assert_response :no_content
-    assert_not warden.authenticated?(:user)
+    refute warden.authenticated?(:user)
  end

  test 'sign out with json format returns no content' do
    sign_in_as_user
    delete destroy_user_session_path(format: 'json')
    assert_response :no_content
-    assert_not warden.authenticated?(:user)
+    refute warden.authenticated?(:user)
  end

  test 'sign out with non-navigational format via XHR does not redirect' do
@@ -530,7 +530,7 @@ class AuthenticationOthersTest < Devise::IntegrationTest
      sign_in_as_admin
      get destroy_sign_out_via_get_session_path, xhr: true, headers: { "HTTP_ACCEPT" => "application/json,text/javascript,*/*" } # NOTE: Bug is triggered by combination of XHR and */*.
      assert_response :no_content
-      assert_not warden.authenticated?(:user)
+      refute warden.authenticated?(:user)
    end
  end

@@ -540,7 +540,7 @@ class AuthenticationOthersTest < Devise::IntegrationTest
      sign_in_as_user
      delete destroy_user_session_path, xhr: true, headers: { "HTTP_ACCEPT" => "text/html,*/*" }
      assert_response :redirect
-      assert_not warden.authenticated?(:user)
+      refute warden.authenticated?(:user)
    end
  end
 end
@@ -550,7 +550,7 @@ class AuthenticationKeysTest < Devise::IntegrationTest
    swap Devise, authentication_keys: [:subdomain] do
      sign_in_as_user
      assert_contain "Invalid Subdomain or password."
-      assert_not warden.authenticated?(:user)
+      refute warden.authenticated?(:user)
    end
  end

@@ -579,7 +579,7 @@ class AuthenticationRequestKeysTest < Devise::IntegrationTest
        sign_in_as_user
      end

-      assert_not warden.authenticated?(:user)
+      refute warden.authenticated?(:user)
    end
  end

@@ -589,7 +589,7 @@ class AuthenticationRequestKeysTest < Devise::IntegrationTest
    swap Devise, request_keys: [:subdomain] do
      sign_in_as_user
      assert_contain "Invalid Email or password."
-      assert_not warden.authenticated?(:user)
+      refute warden.authenticated?(:user)
    end
  end

@@ -612,7 +612,7 @@ class AuthenticationSignOutViaTest < Devise::IntegrationTest
  test 'allow sign out via delete when sign_out_via provides only delete' do
    sign_in!(:sign_out_via_delete)
    delete destroy_sign_out_via_delete_session_path
-    assert_not warden.authenticated?(:sign_out_via_delete)
+    refute warden.authenticated?(:sign_out_via_delete)
  end

  test 'do not allow sign out via get when sign_out_via provides only delete' do
@@ -626,7 +626,7 @@ class AuthenticationSignOutViaTest < Devise::IntegrationTest
  test 'allow sign out via post when sign_out_via provides only post' do
    sign_in!(:sign_out_via_post)
    post destroy_sign_out_via_post_session_path
-    assert_not warden.authenticated?(:sign_out_via_post)
+    refute warden.authenticated?(:sign_out_via_post)
  end

  test 'do not allow sign out via get when sign_out_via provides only post' do
@@ -640,13 +640,13 @@ class AuthenticationSignOutViaTest < Devise::IntegrationTest
  test 'allow sign out via delete when sign_out_via provides delete and post' do
    sign_in!(:sign_out_via_delete_or_post)
    delete destroy_sign_out_via_delete_or_post_session_path
-    assert_not warden.authenticated?(:sign_out_via_delete_or_post)
+    refute warden.authenticated?(:sign_out_via_delete_or_post)
  end

  test 'allow sign out via post when sign_out_via provides delete and post' do
    sign_in!(:sign_out_via_delete_or_post)
    post destroy_sign_out_via_delete_or_post_session_path
-    assert_not warden.authenticated?(:sign_out_via_delete_or_post)
+    refute warden.authenticated?(:sign_out_via_delete_or_post)
  end

  test 'do not allow sign out via get when sign_out_via provides delete and post' do
--- a/test/integration/confirmable_test.rb
+++ b/test/integration/confirmable_test.rb
@@ -41,12 +41,12 @@ class ConfirmationTest < Devise::IntegrationTest
  test 'user with valid confirmation token should not be able to confirm an account after the token has expired' do
    swap Devise, confirm_within: 3.days do
      user = create_user(confirm: false, confirmation_sent_at: 4.days.ago)
-      assert_not user.confirmed?
+      refute user.confirmed?
      visit_user_confirmation_with_token(user.raw_confirmation_token)

      assert_have_selector '#error_explanation'
      assert_contain %r{needs to be confirmed within 3 days}
-      assert_not user.reload.confirmed?
+      refute user.reload.confirmed?
      assert_current_url "/users/confirmation?confirmation_token=#{user.raw_confirmation_token}"
    end
  end
@@ -84,7 +84,7 @@ class ConfirmationTest < Devise::IntegrationTest
  test 'user with valid confirmation token should be able to confirm an account before the token has expired' do
    swap Devise, confirm_within: 3.days do
      user = create_user(confirm: false, confirmation_sent_at: 2.days.ago)
-      assert_not user.confirmed?
+      refute user.confirmed?
      visit_user_confirmation_with_token(user.raw_confirmation_token)

      assert_contain 'Your email address has been successfully confirmed.'
@@ -130,7 +130,7 @@ class ConfirmationTest < Devise::IntegrationTest
      sign_in_as_user(confirm: false)

      assert_contain 'You have to confirm your email address before continuing'
-      assert_not warden.authenticated?(:user)
+      refute warden.authenticated?(:user)
    end
  end

@@ -141,7 +141,7 @@ class ConfirmationTest < Devise::IntegrationTest
      end

      assert_contain 'Invalid Email or password'
-      assert_not warden.authenticated?(:user)
+      refute warden.authenticated?(:user)
    end
  end

@@ -284,7 +284,7 @@ class ConfirmationOnChangeTest < Devise::IntegrationTest
    assert_contain 'Your email address has been successfully confirmed.'
    assert_current_url '/admin_area/sign_in'
    assert admin.reload.confirmed?
-    assert_not admin.reload.pending_reconfirmation?
+    refute admin.reload.pending_reconfirmation?
  end

  test 'admin with previously valid confirmation token should not be able to confirm email after email changed again' do
@@ -306,7 +306,7 @@ class ConfirmationOnChangeTest < Devise::IntegrationTest
    assert_contain 'Your email address has been successfully confirmed.'
    assert_current_url '/admin_area/sign_in'
    assert admin.reload.confirmed?
-    assert_not admin.reload.pending_reconfirmation?
+    refute admin.reload.pending_reconfirmation?
  end

  test 'admin email should be unique also within unconfirmed_email' do
--- a/test/integration/database_authenticatable_test.rb
+++ b/test/integration/database_authenticatable_test.rb
@@ -19,7 +19,7 @@ class DatabaseAuthenticationTest < Devise::IntegrationTest
        fill_in 'email', with: 'foo@bar.com'
      end

-      assert_not warden.authenticated?(:user)
+      refute warden.authenticated?(:user)
    end
  end

@@ -41,14 +41,14 @@ class DatabaseAuthenticationTest < Devise::IntegrationTest
        fill_in 'email', with: ' foo@bar.com '
      end

-      assert_not warden.authenticated?(:user)
+      refute warden.authenticated?(:user)
    end
  end

  test 'sign in should not authenticate if not using proper authentication keys' do
    swap Devise, authentication_keys: [:username] do
      sign_in_as_user
-      assert_not warden.authenticated?(:user)
+      refute warden.authenticated?(:user)
    end
  end

@@ -59,7 +59,7 @@ class DatabaseAuthenticationTest < Devise::IntegrationTest
      end

      assert_contain 'Invalid email address'
-      assert_not warden.authenticated?(:admin)
+      refute warden.authenticated?(:admin)
    end
  end

@@ -69,7 +69,7 @@ class DatabaseAuthenticationTest < Devise::IntegrationTest
    end

    assert_contain 'Invalid Email or password'
-    assert_not warden.authenticated?(:admin)
+    refute warden.authenticated?(:admin)
  end

  test 'error message is configurable by resource name' do
--- a/test/integration/http_authenticatable_test.rb
+++ b/test/integration/http_authenticatable_test.rb
@@ -65,7 +65,7 @@ class HttpAuthenticationTest < Devise::IntegrationTest
  end

  test 'it uses appropriate authentication_keys when configured with hash' do
-    swap Devise, authentication_keys: ActiveSupport::OrderedHash[:username, false, :email, false] do
+    swap Devise, authentication_keys: { username: false, email: false } do
      sign_in_as_new_user_with_http("usertest")
      assert_response :success
      assert_match '<email>user@test.com</email>', response.body
@@ -74,7 +74,7 @@ class HttpAuthenticationTest < Devise::IntegrationTest
  end

  test 'it uses the appropriate key when configured explicitly' do
-    swap Devise, authentication_keys: ActiveSupport::OrderedHash[:email, false, :username, false], http_authentication_key: :username do
+    swap Devise, authentication_keys: { email: false, username: false }, http_authentication_key: :username do
      sign_in_as_new_user_with_http("usertest")
      assert_response :success
      assert_match '<email>user@test.com</email>', response.body
--- a/test/integration/lockable_test.rb
+++ b/test/integration/lockable_test.rb
@@ -85,7 +85,7 @@ class LockTest < Devise::IntegrationTest

    assert_current_url "/users/sign_in"
    assert_contain 'Your account has been unlocked successfully. Please sign in to continue.'
-    assert_not user.reload.access_locked?
+    refute user.reload.access_locked?
  end

  test "user should not send a new e-mail if already locked" do
--- a/test/integration/omniauthable_test.rb
+++ b/test/integration/omniauthable_test.rb
@@ -71,7 +71,7 @@ class OmniauthableIntegrationTest < Devise::IntegrationTest
    assert_current_url "/"
    assert_contain "You have signed up successfully."
    assert_contain "Hello User user@example.com"
-    assert_not session["devise.facebook_data"]
+    refute session["devise.facebook_data"]
  end

  test "cleans up session on cancel" do
--- a/test/integration/recoverable_test.rb
+++ b/test/integration/recoverable_test.rb
@@ -10,7 +10,7 @@ class PasswordTest < Devise::IntegrationTest
  def request_forgot_password(&block)
    visit_new_password_path
    assert_response :success
-    assert_not warden.authenticated?(:user)
+    refute warden.authenticated?(:user)

    fill_in 'email', with: 'user@test.com'
    yield if block_given?
@@ -147,7 +147,7 @@ class PasswordTest < Devise::IntegrationTest
    assert_current_url '/users/password'
    assert_have_selector '#error_explanation'
    assert_contain %r{Reset password token(.*)invalid}
-    assert_not user.reload.valid_password?('987654321')
+    refute user.reload.valid_password?('987654321')
  end

  test 'not authenticated user with valid reset password token but invalid password should not be able to change their password' do
@@ -161,7 +161,7 @@ class PasswordTest < Devise::IntegrationTest
    assert_current_url '/users/password'
    assert_have_selector '#error_explanation'
    assert_contain "Password confirmation doesn't match Password"
-    assert_not user.reload.valid_password?('987654321')
+    refute user.reload.valid_password?('987654321')
  end

  test 'not authenticated user with valid data should be able to change their password' do
@@ -181,7 +181,7 @@ class PasswordTest < Devise::IntegrationTest
    reset_password {  fill_in 'Confirm new password', with: 'other_password' }
    assert_response :success
    assert_have_selector '#error_explanation'
-    assert_not user.reload.valid_password?('987654321')
+    refute user.reload.valid_password?('987654321')

    reset_password visit: false
    assert_contain 'Your password has been changed successfully.'
--- a/test/integration/registerable_test.rb
+++ b/test/integration/registerable_test.rb
@@ -64,11 +64,11 @@ class RegistrationTest < Devise::IntegrationTest
    assert_not_contain 'You have to confirm your account before continuing'
    assert_current_url "/"

-    assert_not warden.authenticated?(:user)
+    refute warden.authenticated?(:user)

    user = User.to_adapter.find_first(order: [:id, :desc])
    assert_equal user.email, 'new_user@test.com'
-    assert_not user.confirmed?
+    refute user.confirmed?
  end

  test 'a guest user should receive the confirmation instructions from the default mailer' do
@@ -92,7 +92,7 @@ class RegistrationTest < Devise::IntegrationTest
    click_button 'Sign up'

    assert_current_url "/?custom=1"
-    assert_not warden.authenticated?(:user)
+    refute warden.authenticated?(:user)
  end

  test 'a guest user cannot sign up with invalid information' do
@@ -114,7 +114,7 @@ class RegistrationTest < Devise::IntegrationTest
    assert_contain "2 errors prohibited"
    assert_nil User.to_adapter.find_first

-    assert_not warden.authenticated?(:user)
+    refute warden.authenticated?(:user)
  end

  test 'a guest should not sign up with email/password that already exists' do
@@ -133,7 +133,7 @@ class RegistrationTest < Devise::IntegrationTest
    assert_current_url '/users'
    assert_contain(/Email.*already.*taken/)

-    assert_not warden.authenticated?(:user)
+    refute warden.authenticated?(:user)
  end

  test 'a guest should not be able to change account' do
@@ -217,7 +217,13 @@ class RegistrationTest < Devise::IntegrationTest
    click_button 'Update'

    assert_contain "Password confirmation doesn't match Password"
-    assert_not User.to_adapter.find_first.valid_password?('pas123')
+    refute User.to_adapter.find_first.valid_password?('pas123')
+  end
+  
+  test 'a signed in user should see a warning about minimum password length' do
+    sign_in_as_user
+    get edit_user_registration_path
+    assert_contain 'characters minimum'
  end

  test 'a signed in user should be able to cancel their account' do
--- a/test/integration/rememberable_test.rb
+++ b/test/integration/rememberable_test.rb
@@ -33,12 +33,12 @@ class RememberMeTest < Devise::IntegrationTest
  test 'handle unverified requests gets rid of caches' do
    swap ApplicationController, allow_forgery_protection: true do
      post exhibit_user_url(1)
-      assert_not warden.authenticated?(:user)
+      refute warden.authenticated?(:user)

      create_user_and_remember
      post exhibit_user_url(1)
      assert_equal "User is not authenticated", response.body
-      assert_not warden.authenticated?(:user)
+      refute warden.authenticated?(:user)
    end
  end

@@ -51,8 +51,8 @@ class RememberMeTest < Devise::IntegrationTest
          authenticity_token: "oops",
          user: { email: "jose.valim@gmail.com", password: "123456", remember_me: "1" }
        }
-      assert_not warden.authenticated?(:user)
-      assert_not request.cookies['remember_user_token']
+      refute warden.authenticated?(:user)
+      refute request.cookies['remember_user_token']
    end
  end

@@ -158,13 +158,13 @@ class RememberMeTest < Devise::IntegrationTest
    get root_path
    assert_response :success
    assert warden.authenticated?(:user)
-    assert_not warden.authenticated?(:admin)
+    refute warden.authenticated?(:admin)
  end

  test 'do not remember with invalid token' do
    create_user_and_remember('add')
    get users_path
-    assert_not warden.authenticated?(:user)
+    refute warden.authenticated?(:user)
    assert_redirected_to new_user_session_path
  end

@@ -172,7 +172,7 @@ class RememberMeTest < Devise::IntegrationTest
    create_user_and_remember
    swap Devise, remember_for: 0.days do
      get users_path
-      assert_not warden.authenticated?(:user)
+      refute warden.authenticated?(:user)
      assert_redirected_to new_user_session_path
    end
  end
@@ -183,11 +183,11 @@ class RememberMeTest < Devise::IntegrationTest
    assert warden.authenticated?(:user)

    delete destroy_user_session_path
-    assert_not warden.authenticated?(:user)
+    refute warden.authenticated?(:user)
    assert_nil warden.cookies['remember_user_token']

    get users_path
-    assert_not warden.authenticated?(:user)
+    refute warden.authenticated?(:user)
  end

  test 'changing user password expires remember me token' do
@@ -197,7 +197,7 @@ class RememberMeTest < Devise::IntegrationTest
    user.save!

    get users_path
-    assert_not warden.authenticated?(:user)
+    refute warden.authenticated?(:user)
  end

  test 'valid sign in calls after_remembered callback' do
--- a/test/integration/timeoutable_test.rb
+++ b/test/integration/timeoutable_test.rb
@@ -56,7 +56,7 @@ class SessionTimeoutTest < Devise::IntegrationTest

      get users_path
      assert_redirected_to users_path
-      assert_not warden.authenticated?(:user)
+      refute warden.authenticated?(:user)
      assert warden.authenticated?(:admin)
    end
  end
@@ -70,8 +70,8 @@ class SessionTimeoutTest < Devise::IntegrationTest
      assert_not_nil last_request_at

      get root_path
-      assert_not warden.authenticated?(:user)
-      assert_not warden.authenticated?(:admin)
+      refute warden.authenticated?(:user)
+      refute warden.authenticated?(:admin)
    end
  end

@@ -108,7 +108,7 @@ class SessionTimeoutTest < Devise::IntegrationTest

    assert_response :success
    assert_contain 'Sign in'
-    assert_not warden.authenticated?(:user)
+    refute warden.authenticated?(:user)
  end

  test 'time out is not triggered on sign in' do
@@ -134,7 +134,7 @@ class SessionTimeoutTest < Devise::IntegrationTest
      get expire_user_path(user)
      get users_path
      assert_redirected_to users_path
-      assert_not warden.authenticated?(:user)
+      refute warden.authenticated?(:user)
    end
  end

--- a/test/mapping_test.rb
+++ b/test/mapping_test.rb
@@ -115,7 +115,7 @@ class MappingTest < ActiveSupport::TestCase
    assert mapping.authenticatable?
    assert mapping.recoverable?
    assert mapping.lockable?
-    assert_not mapping.omniauthable?
+    refute mapping.omniauthable?
  end

  test 'find mapping by path' do
--- a/test/models/confirmable_test.rb
+++ b/test/models/confirmable_test.rb
@@ -28,9 +28,9 @@ class ConfirmableTest < ActiveSupport::TestCase
  end

  test 'should verify whether a user is confirmed or not' do
-    assert_not new_user.confirmed?
+    refute new_user.confirmed?
    user = create_user
-    assert_not user.confirmed?
+    refute user.confirmed?
    user.confirm
    assert user.confirmed?
  end
@@ -40,7 +40,7 @@ class ConfirmableTest < ActiveSupport::TestCase
    assert user.confirm
    assert_blank user.errors[:email]

-    assert_not user.confirm
+    refute user.confirm
    assert_equal "was already confirmed, please try signing in", user.errors[:email].join
  end

@@ -54,13 +54,13 @@ class ConfirmableTest < ActiveSupport::TestCase

  test 'should return a new record with errors when a invalid token is given' do
    confirmed_user = User.confirm_by_token('invalid_confirmation_token')
-    assert_not confirmed_user.persisted?
+    refute confirmed_user.persisted?
    assert_equal "is invalid", confirmed_user.errors[:confirmation_token].join
  end

  test 'should return a new record with errors when a blank token is given' do
    confirmed_user = User.confirm_by_token('')
-    assert_not confirmed_user.persisted?
+    refute confirmed_user.persisted?
    assert_equal "can't be blank", confirmed_user.errors[:confirmation_token].join
  end

@@ -114,7 +114,7 @@ class ConfirmableTest < ActiveSupport::TestCase

    assert_email_not_sent do
      user.save!
-      assert_not user.confirmed?
+      refute user.confirmed?
    end
  end

@@ -134,7 +134,7 @@ class ConfirmableTest < ActiveSupport::TestCase

  test 'should return a new user if no email was found' do
    confirmation_user = User.send_confirmation_instructions(email: "invalid@example.com")
-    assert_not confirmation_user.persisted?
+    refute confirmation_user.persisted?
  end

  test 'should add error to new user email if no email was found' do
@@ -181,7 +181,7 @@ class ConfirmableTest < ActiveSupport::TestCase
  test 'should not be able to send instructions if the user is already confirmed' do
    user = create_user
    user.confirm
-    assert_not user.resend_confirmation_instructions
+    refute user.resend_confirmation_instructions
    assert user.confirmed?
    assert_equal 'was already confirmed, please try signing in', user.errors[:email].join
  end
@@ -190,7 +190,7 @@ class ConfirmableTest < ActiveSupport::TestCase
    swap Devise, allow_unconfirmed_access_for: 1.day do
      user = create_user
      user.confirmation_sent_at = 2.days.ago
-      assert_not user.active_for_authentication?
+      refute user.active_for_authentication?

      Devise.allow_unconfirmed_access_for = 3.days
      assert user.active_for_authentication?
@@ -206,14 +206,14 @@ class ConfirmableTest < ActiveSupport::TestCase
      assert user.active_for_authentication?

      user.confirmation_sent_at = 5.days.ago
-      assert_not user.active_for_authentication?
+      refute user.active_for_authentication?
    end
  end

  test 'should be active when already confirmed' do
    user = create_user
-    assert_not user.confirmed?
-    assert_not user.active_for_authentication?
+    refute user.confirmed?
+    refute user.active_for_authentication?

    user.confirm
    assert user.confirmed?
@@ -224,7 +224,7 @@ class ConfirmableTest < ActiveSupport::TestCase
    Devise.allow_unconfirmed_access_for = 0.days
    user = create_user
    user.confirmation_sent_at = Time.zone.today
-    assert_not user.active_for_authentication?
+    refute user.active_for_authentication?
  end

  test 'should be active when we set allow_unconfirmed_access_for to nil' do
@@ -239,7 +239,7 @@ class ConfirmableTest < ActiveSupport::TestCase
    user = create_user
    user.confirmation_sent_at = nil
    user.save
-    assert_not user.reload.active_for_authentication?
+    refute user.reload.active_for_authentication?
  end

  test 'should be active without confirmation when confirmation is not required' do
@@ -272,7 +272,7 @@ class ConfirmableTest < ActiveSupport::TestCase
    swap Devise, confirmation_keys: [:username, :email] do
      user = create_user
      confirm_user = User.send_confirmation_instructions(email: user.email)
-      assert_not confirm_user.persisted?
+      refute confirm_user.persisted?
      assert_equal "can't be blank", confirm_user.errors[:username].join
    end
  end
@@ -297,7 +297,7 @@ class ConfirmableTest < ActiveSupport::TestCase

  test 'should not accept confirmation email token after 4 days when expiration is set to 3 days' do
    swap Devise, confirm_within: 3.days do
-      assert_not confirm_user_by_token_with_confirmation_sent_at(4.days.ago)
+      refute confirm_user_by_token_with_confirmation_sent_at(4.days.ago)
    end
  end

@@ -337,14 +337,14 @@ class ConfirmableTest < ActiveSupport::TestCase
      self.username = self.username.to_s + 'updated'
    end
    old = user.username
-    assert_not user.confirm
+    refute user.confirm
    assert_equal user.username, old
  end

  test 'should always perform validations upon confirm when ensure valid true' do
    admin = create_admin
    admin.stubs(:valid?).returns(false)
-    assert_not admin.confirm(ensure_valid: true)
+    refute admin.confirm(ensure_valid: true)
  end
 end

@@ -370,7 +370,7 @@ class ReconfirmableTest < ActiveSupport::TestCase
    admin.skip_reconfirmation!
    assert admin.update_attributes(email: 'new_test@example.com')
    assert admin.confirmed?
-    assert_not admin.pending_reconfirmation?
+    refute admin.pending_reconfirmation?
    assert_equal original_token, admin.confirmation_token
  end

@@ -461,7 +461,7 @@ class ReconfirmableTest < ActiveSupport::TestCase

  test 'should return a new admin if no email or unconfirmed_email was found' do
    confirmation_admin = Admin.send_confirmation_instructions(email: "invalid@email.com")
-    assert_not confirmation_admin.persisted?
+    refute confirmation_admin.persisted?
  end

  test 'should add error to new admin email if no email or unconfirmed_email was found' do
@@ -479,18 +479,18 @@ class ReconfirmableTest < ActiveSupport::TestCase
  end

  test 'required_fields should contain the fields that Devise uses' do
-    assert_same_content Devise::Models::Confirmable.required_fields(User), [
-      :confirmation_sent_at,
+    assert_equal Devise::Models::Confirmable.required_fields(User), [
      :confirmation_token,
-      :confirmed_at
+      :confirmed_at,
+      :confirmation_sent_at
    ]
  end

  test 'required_fields should also contain unconfirmable when reconfirmable_email is true' do
-    assert_same_content Devise::Models::Confirmable.required_fields(Admin), [
-      :confirmation_sent_at,
+    assert_equal Devise::Models::Confirmable.required_fields(Admin), [
      :confirmation_token,
      :confirmed_at,
+      :confirmation_sent_at,
      :unconfirmed_email
    ]
  end
--- a/test/models/database_authenticatable_test.rb
+++ b/test/models/database_authenticatable_test.rb
@@ -124,7 +124,7 @@ class DatabaseAuthenticatableTest < ActiveSupport::TestCase
  test 'should test for a valid password' do
    user = create_user
    assert user.valid_password?('12345678')
-    assert_not user.valid_password?('654321')
+    refute user.valid_password?('654321')
  end

  test 'should not raise error with an empty password' do
@@ -136,7 +136,7 @@ class DatabaseAuthenticatableTest < ActiveSupport::TestCase
  test 'should be an invalid password if the user has an empty password' do
    user = create_user
    user.encrypted_password = ''
-    assert_not user.valid_password?('654321')
+    refute user.valid_password?('654321')
  end

  test 'should respond to current password' do
@@ -152,7 +152,7 @@ class DatabaseAuthenticatableTest < ActiveSupport::TestCase

  test 'should add an error to current password when it is invalid' do
    user = create_user
-    assert_not user.update_with_password(current_password: 'other',
+    refute user.update_with_password(current_password: 'other',
      password: 'pass4321', password_confirmation: 'pass4321')
    assert user.reload.valid_password?('12345678')
    assert_match "is invalid", user.errors[:current_password].join
@@ -160,7 +160,7 @@ class DatabaseAuthenticatableTest < ActiveSupport::TestCase

  test 'should add an error to current password when it is blank' do
    user = create_user
-    assert_not user.update_with_password(password: 'pass4321',
+    refute user.update_with_password(password: 'pass4321',
      password_confirmation: 'pass4321')
    assert user.reload.valid_password?('12345678')
    assert_match "can't be blank", user.errors[:current_password].join
@@ -170,7 +170,7 @@ class DatabaseAuthenticatableTest < ActiveSupport::TestCase
    user = UserWithValidation.create!(valid_attributes)
    user.save
    assert user.persisted?
-    assert_not user.update_with_password(username: "")
+    refute user.update_with_password(username: "")
    assert_match "usertest", user.reload.username
    assert_match "can't be blank", user.errors[:username].join
  end
@@ -183,14 +183,14 @@ class DatabaseAuthenticatableTest < ActiveSupport::TestCase

  test 'should not update password with invalid confirmation' do
    user = create_user
-    assert_not user.update_with_password(current_password: '12345678',
+    refute user.update_with_password(current_password: '12345678',
      password: 'pass4321', password_confirmation: 'other')
    assert user.reload.valid_password?('12345678')
  end

  test 'should clean up password fields on failure' do
    user = create_user
-    assert_not user.update_with_password(current_password: '12345678',
+    refute user.update_with_password(current_password: '12345678',
      password: 'pass4321', password_confirmation: 'other')
    assert user.password.blank?
    assert user.password_confirmation.blank?
@@ -217,14 +217,14 @@ class DatabaseAuthenticatableTest < ActiveSupport::TestCase

  test 'should not destroy user with invalid password' do
    user = create_user
-    assert_not user.destroy_with_password('other')
+    refute user.destroy_with_password('other')
    assert user.persisted?
    assert_match "is invalid", user.errors[:current_password].join
  end

  test 'should not destroy user with blank password' do
    user = create_user
-    assert_not user.destroy_with_password(nil)
+    refute user.destroy_with_password(nil)
    assert user.persisted?
    assert_match "can't be blank", user.errors[:current_password].join
  end
@@ -252,15 +252,15 @@ class DatabaseAuthenticatableTest < ActiveSupport::TestCase
  end

  test 'required_fields should be encryptable_password and the email field by default' do
-    assert_same_content Devise::Models::DatabaseAuthenticatable.required_fields(User), [
-      :email,
-      :encrypted_password
+    assert_equal Devise::Models::DatabaseAuthenticatable.required_fields(User), [
+      :encrypted_password,
+      :email
    ]
  end

  test 'required_fields should be encryptable_password and the login when the login is on authentication_keys' do
    swap Devise, authentication_keys: [:login] do
-      assert_same_content Devise::Models::DatabaseAuthenticatable.required_fields(User), [
+      assert_equal Devise::Models::DatabaseAuthenticatable.required_fields(User), [
        :encrypted_password,
        :login
      ]
--- a/test/models/lockable_test.rb
+++ b/test/models/lockable_test.rb
@@ -46,7 +46,7 @@ class LockableTest < ActiveSupport::TestCase

  test "should verify whether a user is locked or not" do
    user = create_user
-    assert_not user.access_locked?
+    refute user.access_locked?
    user.lock_access!
    assert user.access_locked?
  end
@@ -56,7 +56,7 @@ class LockableTest < ActiveSupport::TestCase
    user.confirm
    assert user.active_for_authentication?
    user.lock_access!
-    assert_not user.active_for_authentication?
+    refute user.active_for_authentication?
  end

  test "should unlock a user by cleaning locked_at, failed_attempts and unlock_token" do
@@ -72,7 +72,7 @@ class LockableTest < ActiveSupport::TestCase
  end

  test "new user should not be locked and should have zero failed_attempts" do
-    assert_not new_user.access_locked?
+    refute new_user.access_locked?
    assert_equal 0, create_user.failed_attempts
  end

@@ -83,7 +83,7 @@ class LockableTest < ActiveSupport::TestCase
      assert user.access_locked?

      Devise.unlock_in = 1.hour
-      assert_not user.access_locked?
+      refute user.access_locked?
    end
  end

@@ -162,18 +162,18 @@ class LockableTest < ActiveSupport::TestCase
    raw  = user.send_unlock_instructions
    locked_user = User.unlock_access_by_token(raw)
    assert_equal locked_user, user
-    assert_not user.reload.access_locked?
+    refute user.reload.access_locked?
  end

  test 'should return a new record with errors when a invalid token is given' do
    locked_user = User.unlock_access_by_token('invalid_token')
-    assert_not locked_user.persisted?
+    refute locked_user.persisted?
    assert_equal "is invalid", locked_user.errors[:unlock_token].join
  end

  test 'should return a new record with errors when a blank token is given' do
    locked_user = User.unlock_access_by_token('')
-    assert_not locked_user.persisted?
+    refute locked_user.persisted?
    assert_equal "can't be blank", locked_user.errors[:unlock_token].join
  end

@@ -186,7 +186,7 @@ class LockableTest < ActiveSupport::TestCase

  test 'should return a new user if no email was found' do
    unlock_user = User.send_unlock_instructions(email: "invalid@example.com")
-    assert_not unlock_user.persisted?
+    refute unlock_user.persisted?
  end

  test 'should add error to new user email if no email was found' do
@@ -206,23 +206,23 @@ class LockableTest < ActiveSupport::TestCase
    swap Devise, unlock_keys: [:username, :email] do
      user = create_user
      unlock_user = User.send_unlock_instructions(email: user.email)
-      assert_not unlock_user.persisted?
+      refute unlock_user.persisted?
      assert_equal "can't be blank", unlock_user.errors[:username].join
    end
  end

  test 'should not be able to send instructions if the user is not locked' do
    user = create_user
-    assert_not user.resend_unlock_instructions
-    assert_not user.access_locked?
+    refute user.resend_unlock_instructions
+    refute user.access_locked?
    assert_equal 'was not locked', user.errors[:email].join
  end

  test 'should not be able to send instructions if the user if not locked and have username as unlock key' do
    swap Devise, unlock_keys: [:username] do
      user = create_user
-      assert_not user.resend_unlock_instructions
-      assert_not user.access_locked?
+      refute user.resend_unlock_instructions
+      refute user.access_locked?
      assert_equal 'was not locked', user.errors[:username].join
    end
  end
@@ -257,7 +257,7 @@ class LockableTest < ActiveSupport::TestCase
  test 'required_fields should contain the all the fields when all the strategies are enabled' do
    swap Devise, unlock_strategy: :both do
      swap Devise, lock_strategy: :failed_attempts do
-        assert_same_content Devise::Models::Lockable.required_fields(User), [
+        assert_equal Devise::Models::Lockable.required_fields(User), [
         :failed_attempts,
         :locked_at,
         :unlock_token
@@ -269,7 +269,7 @@ class LockableTest < ActiveSupport::TestCase
  test 'required_fields should contain only failed_attempts and locked_at when the strategies are time and failed_attempts are enabled' do
    swap Devise, unlock_strategy: :time do
      swap Devise, lock_strategy: :failed_attempts do
-        assert_same_content Devise::Models::Lockable.required_fields(User), [
+        assert_equal Devise::Models::Lockable.required_fields(User), [
         :failed_attempts,
         :locked_at
        ]
@@ -280,7 +280,7 @@ class LockableTest < ActiveSupport::TestCase
  test 'required_fields should contain only failed_attempts and unlock_token when the strategies are token and failed_attempts are enabled' do
    swap Devise, unlock_strategy: :email do
      swap Devise, lock_strategy: :failed_attempts do
-        assert_same_content Devise::Models::Lockable.required_fields(User), [
+        assert_equal Devise::Models::Lockable.required_fields(User), [
         :failed_attempts,
         :unlock_token
        ]
--- a/test/models/omniauthable_test.rb
+++ b/test/models/omniauthable_test.rb
@@ -2,6 +2,6 @@ require 'test_helper'

 class OmniauthableTest < ActiveSupport::TestCase
  test 'required_fields should contain the fields that Devise uses' do
-    assert_same_content Devise::Models::Omniauthable.required_fields(User), []
+    assert_equal Devise::Models::Omniauthable.required_fields(User), []
  end
 end
--- a/test/models/recoverable_test.rb
+++ b/test/models/recoverable_test.rb
@@ -92,14 +92,14 @@ class RecoverableTest < ActiveSupport::TestCase
    user = create_user
    user.send_reset_password_instructions
    assert_present user.reset_password_token
-    assert_not user.reset_password('123456789', '987654321')
+    refute user.reset_password('123456789', '987654321')
    assert_present user.reset_password_token
  end

  test 'should not reset password with invalid data' do
    user = create_user
    user.stubs(:valid?).returns(false)
-    assert_not user.reset_password('123456789', '987654321')
+    refute user.reset_password('123456789', '987654321')
  end

  test 'should reset reset password token and send instructions by email' do
@@ -119,7 +119,7 @@ class RecoverableTest < ActiveSupport::TestCase

  test 'should return a new record with errors if user was not found by e-mail' do
    reset_password_user = User.send_reset_password_instructions(email: "invalid@example.com")
-    assert_not reset_password_user.persisted?
+    refute reset_password_user.persisted?
    assert_equal "not found", reset_password_user.errors[:email].join
  end

@@ -135,7 +135,7 @@ class RecoverableTest < ActiveSupport::TestCase
      swap Devise, reset_password_keys: [:username, :email] do
          user = create_user
          reset_password_user = User.send_reset_password_instructions(email: user.email)
-          assert_not reset_password_user.persisted?
+          refute reset_password_user.persisted?
          assert_equal "can't be blank", reset_password_user.errors[:username].join
      end
  end
@@ -164,13 +164,13 @@ class RecoverableTest < ActiveSupport::TestCase

  test 'should return a new record with errors if no reset_password_token is found' do
    reset_password_user = User.reset_password_by_token(reset_password_token: 'invalid_token')
-    assert_not reset_password_user.persisted?
+    refute reset_password_user.persisted?
    assert_equal "is invalid", reset_password_user.errors[:reset_password_token].join
  end

  test 'should return a new record with errors if reset_password_token is blank' do
    reset_password_user = User.reset_password_by_token(reset_password_token: '')
-    assert_not reset_password_user.persisted?
+    refute reset_password_user.persisted?
    assert_match "can't be blank", reset_password_user.errors[:reset_password_token].join
  end

@@ -179,7 +179,7 @@ class RecoverableTest < ActiveSupport::TestCase
    raw  = user.send_reset_password_instructions

    reset_password_user = User.reset_password_by_token(reset_password_token: raw, password: '')
-    assert_not reset_password_user.errors.empty?
+    refute reset_password_user.errors.empty?
    assert_match "can't be blank", reset_password_user.errors[:password].join
    assert_equal raw, reset_password_user.reset_password_token
  end
@@ -197,7 +197,7 @@ class RecoverableTest < ActiveSupport::TestCase
    assert_nil reset_password_user.reset_password_token

    user.reload
-    assert_not user.valid_password?(old_password)
+    refute user.valid_password?(old_password)
    assert user.valid_password?('new_password')
    assert_nil user.reset_password_token
  end
@@ -219,13 +219,13 @@ class RecoverableTest < ActiveSupport::TestCase
      user.reload

      assert user.valid_password?(old_password)
-      assert_not user.valid_password?('new_password')
+      refute user.valid_password?('new_password')
      assert_equal "has expired, please request a new one", reset_password_user.errors[:reset_password_token].join
    end
  end

  test 'required_fields should contain the fields that Devise uses' do
-    assert_same_content Devise::Models::Recoverable.required_fields(User), [
+    assert_equal Devise::Models::Recoverable.required_fields(User), [
      :reset_password_sent_at,
      :reset_password_token
    ]
--- a/test/models/registerable_test.rb
+++ b/test/models/registerable_test.rb
@@ -2,6 +2,6 @@ require 'test_helper'

 class RegisterableTest < ActiveSupport::TestCase
  test 'required_fields should contain the fields that Devise uses' do
-    assert_same_content Devise::Models::Registerable.required_fields(User), []
+    assert_equal Devise::Models::Registerable.required_fields(User), []
  end
 end
--- a/test/models/rememberable_test.rb
+++ b/test/models/rememberable_test.rb
@@ -16,6 +16,18 @@ class RememberableTest < ActiveSupport::TestCase
    assert user.remember_created_at
  end

+  test 'remember_me should not generate a new token if valid token exists' do
+    user = create_user
+    user.singleton_class.send(:attr_accessor, :remember_token)
+    User.to_adapter.expects(:find_first).returns(nil)
+
+    user.remember_me!
+    existing_token = user.remember_token
+
+    user.remember_me!
+    assert_equal existing_token, user.remember_token
+  end
+
  test 'forget_me should not clear remember token if using salt' do
    user = create_user
    user.remember_me!
@@ -150,7 +162,7 @@ class RememberableTest < ActiveSupport::TestCase
  end

  test 'should have the required_fields array' do
-    assert_same_content Devise::Models::Rememberable.required_fields(User), [
+    assert_equal Devise::Models::Rememberable.required_fields(User), [
      :remember_created_at
    ]
  end
--- a/test/models/timeoutable_test.rb
+++ b/test/models/timeoutable_test.rb
@@ -7,11 +7,11 @@ class TimeoutableTest < ActiveSupport::TestCase
  end

  test 'should not be expired' do
-    assert_not new_user.timedout?(29.minutes.ago)
+    refute new_user.timedout?(29.minutes.ago)
  end

  test 'should not be expired when params is nil' do
-    assert_not new_user.timedout?(nil)
+    refute new_user.timedout?(nil)
  end

  test 'should use timeout_in method' do
@@ -19,29 +19,29 @@ class TimeoutableTest < ActiveSupport::TestCase
    user.instance_eval { def timeout_in; 10.minutes end }

    assert user.timedout?(12.minutes.ago)
-    assert_not user.timedout?(8.minutes.ago)
+    refute user.timedout?(8.minutes.ago)
  end

  test 'should not be expired when timeout_in method returns nil' do
    user = new_user
    user.instance_eval { def timeout_in; nil end }
-    assert_not user.timedout?(10.hours.ago)
+    refute user.timedout?(10.hours.ago)
  end

  test 'fallback to Devise config option' do
    swap Devise, timeout_in: 1.minute do
      user = new_user
      assert user.timedout?(2.minutes.ago)
-      assert_not user.timedout?(30.seconds.ago)
+      refute user.timedout?(30.seconds.ago)

      Devise.timeout_in = 5.minutes
-      assert_not user.timedout?(2.minutes.ago)
+      refute user.timedout?(2.minutes.ago)
      assert user.timedout?(6.minutes.ago)
    end
  end

  test 'required_fields should contain the fields that Devise uses' do
-    assert_same_content Devise::Models::Timeoutable.required_fields(User), []
+    assert_equal Devise::Models::Timeoutable.required_fields(User), []
  end

  test 'should not raise error if remember_created_at is not empty and rememberable is disabled' do
--- a/test/models/trackable_test.rb
+++ b/test/models/trackable_test.rb
@@ -2,7 +2,7 @@ require 'test_helper'

 class TrackableTest < ActiveSupport::TestCase
  test 'required_fields should contain the fields that Devise uses' do
-    assert_same_content Devise::Models::Trackable.required_fields(User), [
+    assert_equal Devise::Models::Trackable.required_fields(User), [
      :current_sign_in_at,
      :current_sign_in_ip,
      :last_sign_in_at,
--- a/test/models/validatable_test.rb
+++ b/test/models/validatable_test.rb
@@ -97,7 +97,7 @@ class ValidatableTest < ActiveSupport::TestCase

    user.password_confirmation = 'confirmation'
    assert user.invalid?
-    assert_not (user.errors[:password].join =~ /is too long/)
+    refute (user.errors[:password].join =~ /is too long/)
  end

  test 'should complain about length even if password is not required' do
--- a/test/models_test.rb
+++ b/test/models_test.rb
@@ -13,7 +13,7 @@ class ActiveRecordTest < ActiveSupport::TestCase
    end

    (Devise::ALL - modules).each do |mod|
-      assert_not include_module?(klass, mod)
+      refute include_module?(klass, mod)
    end
  end

--- a/test/parameter_sanitizer_test.rb
+++ b/test/parameter_sanitizer_test.rb
@@ -73,59 +73,3 @@ class ParameterSanitizerTest < ActiveSupport::TestCase
    assert_equal({ 'username' => 'jose' }, sanitized)
  end
 end
-
-class DeprecatedParameterSanitizerAPITest < ActiveSupport::TestCase
-  class CustomSanitizer < Devise::ParameterSanitizer
-    def sign_in
-      default_params.permit(:username)
-    end
-  end
-
-  def sanitizer(params)
-    params = ActionController::Parameters.new(params)
-    Devise::ParameterSanitizer.new(User, :user, params)
-  end
-
-  test 'overriding instance methods have precedence over the default sanitized attributes' do
-    assert_deprecated do
-      params =  ActionController::Parameters.new(user: { "username" => "jose", "name" => "Jose" })
-      sanitizer = CustomSanitizer.new(User, :user, params)
-
-      sanitized = sanitizer.sanitize(:sign_in)
-
-      assert_equal({ "username" => "jose" }, sanitized)
-    end
-  end
-
-  test 'adding new parameters by mutating the Array' do
-    assert_deprecated do
-      sanitizer = sanitizer('user' => { 'username' => 'jose' })
-      sanitizer.for(:sign_in) << :username
-      sanitized = sanitizer.sanitize(:sign_in)
-
-      assert_equal({ 'username' => 'jose' }, sanitized)
-    end
-  end
-
-   test 'adding new parameters with a block' do
-     assert_deprecated do
-       sanitizer = sanitizer('user' => { 'username' => 'jose' })
-       sanitizer.for(:sign_in) { |user| user.permit(:username) }
-
-       sanitized = sanitizer.sanitize(:sign_in)
-
-       assert_equal({ 'username' => 'jose' }, sanitized)
-     end
-   end
-
-  test 'removing multiple default parameters' do
-    assert_deprecated do
-      sanitizer = sanitizer('user' => { 'email' => 'jose', 'password' => 'invalid', 'remember_me' => '1' })
-      sanitizer.for(:sign_in).delete(:email)
-      sanitizer.for(:sign_in).delete(:password)
-      sanitized = sanitizer.sanitize(:sign_in)
-
-      assert_equal({ 'remember_me' => '1' }, sanitized)
-    end
-  end
-end
--- a/test/support/assertions.rb
+++ b/test/support/assertions.rb
@@ -1,10 +1,6 @@
 require 'active_support/test_case'

 class ActiveSupport::TestCase
-  def assert_not(assertion)
-    assert !assertion
-  end
-
  def assert_blank(assertion)
    assert assertion.blank?
  end
@@ -24,13 +20,6 @@ class ActiveSupport::TestCase
    assert_no_difference('ActionMailer::Base.deliveries.size', &block)
  end

-  def assert_same_content(result, expected)
-    assert expected.size == result.size, "the arrays doesn't have the same size"
-    expected.each do |element|
-      assert result.include?(element), "The array doesn't include '#{element}'."
-    end
-  end
-
  def assert_raise_with_message(exception_klass, message, &block)
    exception = assert_raise exception_klass, &block
    assert_equal exception.message, message,
--- a/test/test/controller_helpers_test.rb
+++ b/test/test/controller_helpers_test.rb
@@ -1,8 +1,8 @@
 require 'test_helper'

-class TestHelpersTest < Devise::ControllerTestCase
+class TestControllerHelpersTest < Devise::ControllerTestCase
  tests UsersController
-  include Devise::TestHelpers
+  include Devise::Test::ControllerHelpers

  test "redirects if attempting to access a page unauthenticated" do
    get :index
--- a/test/test/integration_helpers_test.rb
+++ b/test/test/integration_helpers_test.rb
@@ -0,0 +1,32 @@
+require 'test_helper'
+
+class TestIntegrationsHelpersTest < Devise::IntegrationTest
+  include Devise::Test::IntegrationHelpers
+
+  test '#sign_in signs in the resource directly' do
+    sign_in(create_user)
+
+    visit '/'
+    assert warden.authenticated?(:user)
+  end
+
+  test '#sign_outs signs out in the resource directly' do
+    user = create_user
+    sign_in user
+    sign_out user
+
+    visit '/'
+    refute warden.authenticated?(:user)
+  end
+
+  test '#sign_out does not signs out other scopes' do
+    sign_in(create_user)
+    sign_in(create_admin)
+    sign_out :user
+
+    visit '/'
+
+    refute warden.authenticated?(:user)
+    assert warden.authenticated?(:admin)
+  end
+end
Author	SHA1	Message	Date
Lucas Mazza	b68b400235	Test against JRuby.	2016-05-21 12:10:30 -03:00
Lucas Mazza	593ae41f9d	Update existing Gemfiles.	2016-05-18 13:59:06 -03:00
Lucas Mazza	e9770fd434	Update Rails 5 Gemfile.	2016-05-18 13:50:07 -03:00
Lucas Mazza	53f6785e11	Fix Rails version reference on README.md [ci skip]	2016-05-18 13:42:31 -03:00
Lucas Mazza	1b48fd0abe	Fix syntax highlight on README [ci skip]	2016-05-18 09:39:04 -03:00
Lucas Mazza	b835059baf	Merge pull request #4118 from kamipo/patch-2 Fix release date in CHANGELOG.md	2016-05-17 10:05:48 -03:00
Ryuta Kamizono	f7359d6d96	Fix release date in CHANGELOG.md	2016-05-17 22:00:22 +09:00
Lucas Mazza	4924dd68ae	Raise a more informative error when `request.env['warden']` is `nil`. Previously, a `NoMethodError` exception would be raised from here when the middleware stack isn't present and Warden wasn't injected as expected (like in a controller test). To foolproof ourselves, we now raise a more informative error when `request.env['warden']` is `nil` so developers can figure this out on their own instead of reaching to the issue tracker for guidance.	2016-05-16 15:23:25 -03:00
Lucas Mazza	02ed166f51	Update CHANGELOG [ci skip]	2016-05-16 14:45:30 -03:00
Lucas Mazza	9a11586a72	Merge pull request #4071 from plataformatec/lm-test-helpers Introduce `IntegrationHelpers` and deprecate `Devise::TestHelpers`.	2016-05-16 14:39:22 -03:00
Lucas Mazza	b5a5bae09c	Tidy up `ControllerHelpers` implementation a bit.	2016-05-15 19:55:24 -03:00
Lucas Mazza	e757543323	Revisit docs on test helpers on README.md	2016-05-15 19:47:42 -03:00
Lucas Mazza	7b000390a0	Add `Devise::Test::IntegrationHelpers`.	2016-05-15 19:36:41 -03:00
Lucas Mazza	3f3ec236bb	Move `Devise::TestHelpers` to `Devise::Test::ControllerHelpers`.	2016-05-15 19:36:41 -03:00
Lucas Mazza	22dd3b489d	Merge pull request #4115 from wbotelhos/patch-1 removes bugfix, from unreleased, already shipped	2016-05-15 19:35:35 -03:00
Lucas Mazza	0d45142845	`CONTRIBUTING.md` edits * Wrap lines to around ~80 characters. * Suggest reporting issues with fresh apps that replicate the issue. * Mention our policy regarding internationalizing Devise views.	2016-05-15 19:30:14 -03:00
Lucas Mazza	62d6b5afb7	Mention the bug report test case on `CONTRIBUTING.md.`	2016-05-15 19:24:59 -03:00
Lucas Mazza	934fe45cfe	Drop `_master` suffix as the bug template doesnt use Rails/Devise master.	2016-05-15 19:21:50 -03:00
Lucas Mazza	675ae4d802	Lock devise version on the bug report template.	2016-05-15 19:20:32 -03:00
Lucas Mazza	48251f236f	Use single quotes consistently through the integration test example.	2016-05-15 19:19:27 -03:00
Lucas Mazza	8e6e70eaa7	Merge pull request #4087 from leonardoprg/master fix #3958 adding helper test to report bugs	2016-05-15 19:16:26 -03:00
Washington Botelho	4925ffda31	removes bugfix, from unreleased, already shipped	2016-05-15 13:51:41 -03:00
Ulisses Almeida	f89921e153	📝 Update with minor patch releases	2016-05-15 12:22:45 -03:00
Ulisses Almeida	863b811167	📝 Update CHANGELOG	2016-05-15 11:58:02 -03:00
Lucas Mazza	d1f8884ee6	Merge pull request #4105 from giedriusr/features/update_example_in_authenticatable Update example code in authenticatable model	2016-05-15 11:49:02 -03:00
Ralin Chimev	9caf07dd4f	Fix overwriting the remember_token when a valid one already exists (#4101 ) The remember_token should not get overwritten when a user is signing in and a valid token already exists. Fixes #3950.	2016-05-15 11:48:12 -03:00
Ulisses Almeida	2044fffa25	Deprecate the bypass option of sign_in (#4078 ) The sign_in method permits the bypass option that ignore the others options used. This behavior has lead some users to a misconfusion what the method really does. This change deprecate the bypass option in favor of a method that only does the sign in with bypass. Closes #3981	2016-05-15 11:46:48 -03:00
Giedrius Rimkus	2e442d81f7	Update example code in authenticatable model	2016-05-12 15:47:04 +03:00
Steven Spiel	28f0e3281a	Consistency of quotation marks in README (#4103 ) * Change double to single quotes in ruby code blocks For consistency, I switched some of the double quotes to single quotes in the ruby code blocks.	2016-05-11 23:06:40 -03:00
Lucas Mazza	6a0d881554	Merge pull request #4104 from LucasAU/fix-omniauth-changeog Fix suggested omniauth path	2016-05-11 22:37:32 -03:00
Lucas Nelson	4a9eee5a1c	Fix suggested omniauth path The suggested omniauth path noted in the CHANGELOG.md under 4.0.0.rc2 did not work. It was missing an `_omniauth` in the middle of the method name. user_github_authorize_path => user_github_omniauth_authorize_path	2016-05-12 10:24:47 +10:00
Vasiliy Ermolovich	a4d3b9f14a	Merge pull request #4100 from shinyaK14/update_readme Update README.md	2016-05-11 09:19:26 +03:00
Shinya Kitamura	1beac93961	Update README.md	2016-05-10 22:11:12 +08:00
Maarten van Vliet	8286325fd0	Remove reference to Rails 3.2 in post-install text (#4094 )	2016-05-08 13:41:46 -03:00
Lucas Mazza	228f24c491	Merge pull request #4092 from bogdanvlviv/patch-5 Update .travis.yml	2016-05-06 22:11:57 -03:00
bogdanvlviv	cff78eec23	Update .travis.yml	2016-05-06 23:05:03 +03:00
Leonardo	20d786d7ca	fix #3958 adding helper test to report bugs	2016-05-05 23:13:00 +01:00
Lucas Mazza	0c1b1a896f	Update CHANGELOG [ci skip].	2016-05-05 17:23:19 -03:00
Lucas Mazza	db8e247aa5	Document `reload_routes` on the app file template.	2016-05-05 17:23:05 -03:00
Lucas Mazza	e01fdba557	Merge pull request #4053 from sidonath/make-route-reloading-configurable Make reloading of routes optional	2016-05-05 17:18:43 -03:00
Lucas Mazza	0a1e55f11c	Update CHANGELOG [ci skip].	2016-05-05 17:17:48 -03:00
Matt Yanchek	85bcbdf18b	Set minimum password length for edit and new views (#4068 ) * Set minimum password length for edit and new views * Update edit.html.erb * Update registerable_test.rb	2016-05-05 17:16:41 -03:00
Lucas Mazza	a45c4c0ac4	Update CHANGELOG.md.	2016-05-05 17:14:27 -03:00
Lucas Mazza	d293e00ef5	Merge pull request #4083 from plataformatec/lm-rm-deprecations Remove deprecated APIs	2016-05-05 17:07:53 -03:00
Lucas Mazza	201a4f92c2	Remove deprecated `Devise::Models::Recoverable#after_password_reset` method.	2016-05-03 18:33:08 -03:00
Lucas Mazza	71f90c0d6e	Remove deprecated `Devise::Models::Recoverable#reset_password!` method.	2016-05-03 18:33:08 -03:00
Lucas Mazza	26e22d8e95	Remove deprecated `Devise::Models::Confirmable#confirm!` method.	2016-05-03 18:33:08 -03:00
Lucas Mazza	9805728964	Remove deprecated `Devise.bcrypt` method.	2016-05-03 18:32:56 -03:00
Lucas Mazza	f64022a57b	Remove deprecated OmniAuth URL helpers.	2016-05-03 18:32:56 -03:00
Lucas Mazza	e79201aef8	Remove deprecated `ParameterSanitizer` API.	2016-05-03 18:32:47 -03:00
Lucas Mazza	a2498074f1	Replace custom `Array` assertion with `assert_equal`.	2016-05-03 14:18:35 -03:00
Lucas Mazza	536279b05b	Replace homemade `assert_not` matcher in favor of `refute`.	2016-05-03 13:57:10 -03:00
Lucas Mazza	031351224a	Remove usage of `ActiveSupport::Dependencies` 3.x API.	2016-05-03 13:52:33 -03:00
Lucas Mazza	74ab3e9a05	Remove references to `ActiveSupport::OrderedHash`. We no longer support legacy rubies where hashes aren't ordered, so we don't need to use this class for it.	2016-05-03 13:48:42 -03:00
Damir Zekic	eba2527b8e	Make reloading of routes optional As has been seen in a previous pull request, some applications require routes to be loaded before the code is eagerly loaded, which implies that all Rails applications using Devise need to have routes reloaded twice: https://github.com/plataformatec/devise/pull/3241 This can incur a very significant slowdown for large apps that have a lot of routes or a lot of controllers, so reloading should be optional.	2016-04-21 00:10:17 -03:00