Release 4.0.0.rc1.

Prep for 4.0.0.rc1 release.
Merge pull request #3859 from twalpole/unsafe_h
2026-01-13 08:48:00 -05:00 · 2016-02-01 09:20:42 -02:00 · 2016-01-31 17:05:16 -02:00 · 2016-01-31 16:56:10 -02:00 · 2016-01-31 16:23:31 -02:00 · 2016-01-30 18:08:50 -02:00
91 changed files with 1292 additions and 2482 deletions
--- a/.travis.yml
+++ b/.travis.yml
@@ -1,23 +1,22 @@
 language: ruby

 rvm:
-  - 1.9.3
-  - 2.0.0
-  - 2.1
-  - 2.2
+  - 2.1.5
+  - 2.2.4
+  - 2.3.0

 gemfile:
  - gemfiles/Gemfile.rails-4.2-stable
  - gemfiles/Gemfile.rails-4.1-stable
-  - gemfiles/Gemfile.rails-4.0-stable
-  - gemfiles/Gemfile.rails-3.2-stable
+  - gemfiles/Gemfile.rails-5.0-beta
  - Gemfile

 matrix:
  exclude:
-    - rvm: 2.2
-      gemfile: gemfiles/Gemfile.rails-3.2-stable
-
+    - rvm: 2.1.5
+      gemfile: gemfiles/Gemfile.rails-5.0-beta
+    - env: DEVISE_ORM=mongoid
+      gemfile: gemfiles/Gemfile.rails-5.0-beta
 services:
  - mongodb

@@ -39,6 +38,7 @@ script: "bundle exec rake test"
 notifications:
  email: false
  slack:
+    on_pull_requests: false
    on_success: change
    on_failure: always
    secure: Q3M+kmude3FjisibEeeGe0wSMXgvwLH+vL7Zrx9//q4QtkfnrQ/BBMvY9KXxPEsNF+eys4YopYjTkJ8uRmeboUATW/oQ4Jrv3+u3zkIHK2sFn/Q2cQWpK5w+CbgEnHPjKYnUu34b09njXTgDlr/mqtbPqrKeZ1dLlpKXCB/q4GY=
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1,12 +1,11 @@
 PATH
  remote: .
  specs:
-    devise (3.5.3)
+    devise (4.0.0.rc1)
      bcrypt (~> 3.0)
      orm_adapter (~> 0.1)
-      railties (>= 3.2.6, < 5)
+      railties (>= 4.1.0, < 5.1)
      responders
-      thread_safe (~> 0.1)
      warden (~> 1.2.3)

 GEM
@@ -47,28 +46,29 @@ GEM
      minitest (~> 5.1)
      thread_safe (~> 0.3, >= 0.3.4)
      tzinfo (~> 1.1)
-    arel (6.0.0)
+    arel (6.0.3)
    bcrypt (3.1.10)
-    bson (3.1.2)
+    bson (3.2.6)
    builder (3.2.2)
+    concurrent-ruby (1.0.0)
    connection_pool (2.2.0)
    erubis (2.7.0)
-    faraday (0.9.1)
+    faraday (0.9.2)
      multipart-post (>= 1.2, < 3)
-    globalid (0.3.5)
+    globalid (0.3.6)
      activesupport (>= 4.1.0)
-    hashie (3.4.0)
+    hashie (3.4.3)
    i18n (0.7.0)
    json (1.8.3)
-    jwt (1.4.1)
-    loofah (2.0.2)
+    jwt (1.5.2)
+    loofah (2.0.3)
      nokogiri (>= 1.5.9)
    mail (2.6.3)
      mime-types (>= 1.16, < 3)
    metaclass (0.0.4)
-    mime-types (2.6.1)
-    mini_portile (0.6.2)
-    minitest (5.7.0)
+    mime-types (2.99)
+    mini_portile2 (2.0.0)
+    minitest (5.8.4)
    mocha (1.1.0)
      metaclass (~> 0.0.1)
    mongoid (4.0.2)
@@ -76,15 +76,15 @@ GEM
      moped (~> 2.0.0)
      origin (~> 2.1)
      tzinfo (>= 0.3.37)
-    moped (2.0.6)
+    moped (2.0.7)
      bson (~> 3.0)
      connection_pool (~> 2.0)
      optionable (~> 0.2.0)
-    multi_json (1.11.1)
+    multi_json (1.11.2)
    multi_xml (0.5.5)
    multipart-post (2.0.0)
-    nokogiri (1.6.6.2)
-      mini_portile (~> 0.6.0)
+    nokogiri (1.6.7.2)
+      mini_portile2 (~> 2.0.0.rc2)
    oauth2 (0.9.4)
      faraday (>= 0.8, < 0.10)
      jwt (~> 1.0)
@@ -105,9 +105,9 @@ GEM
      omniauth (~> 1.0)
      rack-openid (~> 1.3.1)
    optionable (0.2.0)
-    origin (2.1.1)
+    origin (2.2.0)
    orm_adapter (0.5.0)
-    rack (1.6.2)
+    rack (1.6.4)
    rack-openid (1.3.1)
      rack (>= 1.1.0)
      ruby-openid (>= 2.1.8)
@@ -126,34 +126,35 @@ GEM
      sprockets-rails
    rails-deprecated_sanitizer (1.0.3)
      activesupport (>= 4.2.0.alpha)
-    rails-dom-testing (1.0.6)
+    rails-dom-testing (1.0.7)
      activesupport (>= 4.2.0.beta, < 5.0)
      nokogiri (~> 1.6.0)
      rails-deprecated_sanitizer (>= 1.0.1)
-    rails-html-sanitizer (1.0.2)
+    rails-html-sanitizer (1.0.3)
      loofah (~> 2.0)
    railties (4.2.2)
      actionpack (= 4.2.2)
      activesupport (= 4.2.2)
      rake (>= 0.8.7)
      thor (>= 0.18.1, < 2.0)
-    rake (10.4.2)
-    rdoc (4.2.0)
-    responders (2.1.0)
-      railties (>= 4.2.0, < 5)
+    rake (10.5.0)
+    rdoc (4.2.1)
+    responders (2.1.1)
+      railties (>= 4.2.0, < 5.1)
    ruby-openid (2.7.0)
-    sprockets (3.2.0)
-      rack (~> 1.0)
-    sprockets-rails (2.3.1)
-      actionpack (>= 3.0)
-      activesupport (>= 3.0)
-      sprockets (>= 2.8, < 4.0)
-    sqlite3 (1.3.10)
+    sprockets (3.5.2)
+      concurrent-ruby (~> 1.0)
+      rack (> 1, < 3)
+    sprockets-rails (3.0.0)
+      actionpack (>= 4.0)
+      activesupport (>= 4.0)
+      sprockets (>= 3.0.0)
+    sqlite3 (1.3.11)
    thor (0.19.1)
    thread_safe (0.3.5)
    tzinfo (1.2.2)
      thread_safe (~> 0.1)
-    warden (1.2.4)
+    warden (1.2.6)
      rack (>= 1.0)
    webrat (0.7.3)
      nokogiri (>= 1.2.0)
@@ -180,4 +181,4 @@ DEPENDENCIES
  webrat (= 0.7.3)

 BUNDLED WITH
-   1.10.6
+   1.11.2
--- a/2
+++ b/2
@@ -1,4 +1,4 @@
-Copyright 2009-2015 Plataformatec. http://plataformatec.com.br
+Copyright 2009-2016 Plataformatec. http://plataformatec.com.br

 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the
--- a/README.md
+++ b/README.md
@@ -92,7 +92,7 @@ Once you have solidified your understanding of Rails and authentication mechanis

 ## Getting started

-Devise 3.0 works with Rails 3.2 onwards. You can add it to your Gemfile with:
+Devise 4.0 works with Rails 4.2 onwards. You can add it to your Gemfile with:

 ```ruby
 gem 'devise'
@@ -184,6 +184,10 @@ Besides `:stretches`, you can define `:pepper`, `:encryptor`, `:confirm_within`,

 ### Strong Parameters

+![The Parameter Sanitizer API has changed for Devise 4](http://messages.hellobits.com/warning.svg?message=The%20Parameter%20Sanitizer%20API%20has%20changed%20for%20Devise%204)
+
+*For previous Devise versions see https://github.com/plataformatec/devise/tree/3-stable#strong-parameters*
+
 When you customize your own views, you may end up adding new attributes to forms. Rails 4 moved the parameter sanitization from the model to the controller, causing Devise to handle this concern at the controller as well.

 There are just three actions in Devise that allow any set of parameters to be passed down to the model, therefore requiring sanitization. Their names and the permitted parameters by default are:
@@ -201,7 +205,7 @@ class ApplicationController < ActionController::Base
  protected

  def configure_permitted_parameters
-    devise_parameter_sanitizer.for(:sign_up) << :username
+    devise_parameter_sanitizer.permit(:sign_up, keys: [:username])
  end
 end
 ```
@@ -212,7 +216,9 @@ To permit simple scalar values for username and email, use this

 ```ruby
 def configure_permitted_parameters
-  devise_parameter_sanitizer.for(:sign_in) { |u| u.permit(:username, :email) }
+  devise_parameter_sanitizer.permit(:sign_in) do |user_params|
+    user_params.permit(:username, :email)
+  end
 end
 ```

@@ -220,7 +226,9 @@ If you have some checkboxes that express the roles a user may take on registrati

 ```ruby
 def configure_permitted_parameters
-  devise_parameter_sanitizer.for(:sign_up) { |u| u.permit({ roles: [] }, :email, :password, :password_confirmation) }
+  devise_parameter_sanitizer.permit(:sign_up) do |user_params|
+    user_params.permit({ roles: [] }, :email, :password, :password_confirmation)
+  end
 end
 ```
 For the list of permitted scalars, and how to declare permitted keys in nested hashes and arrays, see
@@ -231,8 +239,9 @@ If you have multiple Devise models, you may want to set up a different parameter

 ```ruby
 class User::ParameterSanitizer < Devise::ParameterSanitizer
-  def sign_in
-    default_params.permit(:username, :email)
+  def initialize(*)
+    super
+    permit(:sign_up, keys: [:username, :email])
  end
 end
 ```
@@ -347,7 +356,7 @@ Devise also ships with default routes. If you need to customize them, you should
 devise_for :users, path: "auth", path_names: { sign_in: 'login', sign_out: 'logout', password: 'secret', confirmation: 'verification', unlock: 'unblock', registration: 'register', sign_up: 'cmon_let_me_in' }
 ```

-Be sure to check `devise_for` documentation for details.
+Be sure to check `devise_for` [documentation](http://www.rubydoc.info/github/plataformatec/devise/master/ActionDispatch/Routing/Mapper%3Adevise_for) for details.

 If you have the need for more deep customization, for instance to also allow "/sign_in" besides "/users/sign_in", all you need to do is create your routes normally and wrap them in a `devise_scope` block in the router:

@@ -416,6 +425,7 @@ If you're using RSpec, you can put the following inside a file named `spec/suppo
 ```ruby
 RSpec.configure do |config|
  config.include Devise::TestHelpers, type: :controller
+  config.include Devise::TestHelpers, type: :view
 end
 ```

@@ -433,7 +443,7 @@ sign_out @user         # sign_out(resource)

 There are two things that are important to keep in mind:

-1. These helpers are not going to work for integration tests driven by Capybara or Webrat. They are meant to be used with functional tests only. Instead, fill in the form or explicitly set the user in session;
+1. These helpers are not going to work for integration tests driven by Capybara or Webrat. They are meant to be used with functional tests only. It is undesirable even to include `Devise::TestHelpers` during integration tests. Instead, fill in the form or explicitly set the user in session;

 2. If you are testing Devise internal controllers or a controller that inherits from Devise's, you need to tell Devise which mapping should be used before a request. This is necessary because Devise gets this information from the router, but since functional tests do not pass through the router, it needs to be stated explicitly. For example, if you are testing the user scope, simply use:

@@ -477,7 +487,7 @@ devise :database_authenticatable, :timeoutable
 devise_for :admins

 # Inside your protected controller
-before_filter :authenticate_admin!
+before_action :authenticate_admin!

 # Inside your controllers and views
 admin_signed_in?
@@ -545,6 +555,6 @@ https://github.com/plataformatec/devise/graphs/contributors

 ## License

-MIT License. Copyright 2009-2015 Plataformatec. http://plataformatec.com.br
+MIT License. Copyright 2009-2016 Plataformatec. http://plataformatec.com.br

 You are not granted rights or licenses to the trademarks of Plataformatec, including without limitation the Devise name or logo.
--- a/app/controllers/devise/omniauth_callbacks_controller.rb
+++ b/app/controllers/devise/omniauth_callbacks_controller.rb
@@ -1,5 +1,5 @@
 class Devise::OmniauthCallbacksController < DeviseController
-  prepend_before_filter { request.env["devise.skip_timeout"] = true }
+  prepend_before_action { request.env["devise.skip_timeout"] = true }

  def passthru
    render status: 404, text: "Not found. Authentication passthru."
@@ -13,14 +13,14 @@ class Devise::OmniauthCallbacksController < DeviseController
  protected

  def failed_strategy
-    env["omniauth.error.strategy"]
+    request.respond_to?(:get_header) ? request.get_header("omniauth.error.strategy") : env["omniauth.error.strategy"]
  end

  def failure_message
-    exception = env["omniauth.error"]
+    exception = request.respond_to?(:get_header) ? request.get_header("omniauth.error") : env["omniauth.error"]
    error   = exception.error_reason if exception.respond_to?(:error_reason)
    error ||= exception.error        if exception.respond_to?(:error)
-    error ||= env["omniauth.error.type"].to_s
+    error ||= (request.respond_to?(:get_header) ? request.get_header("omniauth.error.type") : env["omniauth.error.type"]).to_s
    error.to_s.humanize if error
  end

--- a/app/controllers/devise/passwords_controller.rb
+++ b/app/controllers/devise/passwords_controller.rb
@@ -1,7 +1,7 @@
 class Devise::PasswordsController < DeviseController
-  prepend_before_filter :require_no_authentication
+  prepend_before_action :require_no_authentication
  # Render the #edit only if coming from a reset password email link
-  append_before_filter :assert_reset_token_passed, only: :edit
+  append_before_action :assert_reset_token_passed, only: :edit

  # GET /resource/password/new
  def new
--- a/app/controllers/devise/registrations_controller.rb
+++ b/app/controllers/devise/registrations_controller.rb
@@ -1,6 +1,6 @@
 class Devise::RegistrationsController < DeviseController
-  prepend_before_filter :require_no_authentication, only: [:new, :create, :cancel]
-  prepend_before_filter :authenticate_scope!, only: [:edit, :update, :destroy]
+  prepend_before_action :require_no_authentication, only: [:new, :create, :cancel]
+  prepend_before_action :authenticate_scope!, only: [:edit, :update, :destroy]

  # GET /resource/sign_up
  def new
--- a/app/controllers/devise/sessions_controller.rb
+++ b/app/controllers/devise/sessions_controller.rb
@@ -1,8 +1,8 @@
 class Devise::SessionsController < DeviseController
-  prepend_before_filter :require_no_authentication, only: [:new, :create]
-  prepend_before_filter :allow_params_authentication!, only: :create
-  prepend_before_filter :verify_signed_out_user, only: :destroy
-  prepend_before_filter only: [:create, :destroy] { request.env["devise.skip_timeout"] = true }
+  prepend_before_action :require_no_authentication, only: [:new, :create]
+  prepend_before_action :allow_params_authentication!, only: :create
+  prepend_before_action :verify_signed_out_user, only: :destroy
+  prepend_before_action only: [:create, :destroy] { request.env["devise.skip_timeout"] = true }

  # GET /resource/sign_in
  def new
--- a/app/controllers/devise/unlocks_controller.rb
+++ b/app/controllers/devise/unlocks_controller.rb
@@ -1,5 +1,5 @@
 class Devise::UnlocksController < DeviseController
-  prepend_before_filter :require_no_authentication
+  prepend_before_action :require_no_authentication

  # GET /resource/unlock/new
  def new
--- a/app/controllers/devise_controller.rb
+++ b/app/controllers/devise_controller.rb
@@ -2,13 +2,17 @@
 class DeviseController < Devise.parent_controller.constantize
  include Devise::Controllers::ScopedViews

-  helper DeviseHelper
+  if respond_to?(:helper)
+    helper DeviseHelper
+  end

-  helpers = %w(resource scope_name resource_name signed_in_resource
-               resource_class resource_params devise_mapping)
-  helper_method(*helpers)
+  if respond_to?(:helper_method)
+    helpers = %w(resource scope_name resource_name signed_in_resource
+                 resource_class resource_params devise_mapping)
+    helper_method(*helpers)
+  end

-  prepend_before_filter :assert_is_devise_resource!
+  prepend_before_action :assert_is_devise_resource!
  respond_to :html if mimes_for_respond_to.empty?

  # Override prefixes to consider the scoped view.
@@ -89,10 +93,10 @@ MESSAGE
    instance_variable_set(:"@#{resource_name}", new_resource)
  end

-  # Helper for use in before_filters where no authentication is required.
+  # Helper for use in before_actions where no authentication is required.
  #
  # Example:
-  #   before_filter :require_no_authentication, only: :new
+  #   before_action :require_no_authentication, only: :new
  def require_no_authentication
    assert_is_devise_resource!
    return unless is_navigational_format?
--- a/devise.gemspec
+++ b/devise.gemspec
@@ -16,12 +16,11 @@ Gem::Specification.new do |s|
  s.files         = `git ls-files`.split("\n")
  s.test_files    = `git ls-files -- test/*`.split("\n")
  s.require_paths = ["lib"]
-  s.required_ruby_version = '>= 1.9.3'
+  s.required_ruby_version = '>= 2.1.0'

  s.add_dependency("warden", "~> 1.2.3")
  s.add_dependency("orm_adapter", "~> 0.1")
  s.add_dependency("bcrypt", "~> 3.0")
-  s.add_dependency("thread_safe", "~> 0.1")
-  s.add_dependency("railties", ">= 3.2.6", "< 5")
+  s.add_dependency("railties", ">= 4.1.0", "< 5.1")
  s.add_dependency("responders")
 end
--- a/gemfiles/Gemfile.rails-3.2-stable
+++ b/gemfiles/Gemfile.rails-3.2-stable
@@ -1,29 +0,0 @@
-source "https://rubygems.org"
-
-gemspec path: '..'
-
-gem "rails", github: 'rails/rails', branch: '3-2-stable'
-gem "omniauth", "~> 1.2.0"
-gem "omniauth-oauth2", "~> 1.1.0"
-gem "rdoc"
-
-group :test do
-  gem "omniauth-facebook"
-  gem "omniauth-openid", "~> 1.0.1"
-  gem "webrat", "0.7.3", require: false
-  gem "mocha", "~> 1.1", require: false
-end
-
-platforms :jruby do
-  gem "activerecord-jdbc-adapter"
-  gem "activerecord-jdbcsqlite3-adapter"
-  gem "jruby-openssl"
-end
-
-platforms :ruby do
-  gem "sqlite3"
-end
-
-group :mongoid do
-  gem "mongoid", "~> 3.0"
-end
--- a/gemfiles/Gemfile.rails-3.2-stable.lock
+++ b/gemfiles/Gemfile.rails-3.2-stable.lock
@@ -1,172 +0,0 @@
-GIT
-  remote: git://github.com/rails/rails.git
-  revision: b344986bc3d94ca7821fc5e0eef1874882ac6cbb
-  branch: 3-2-stable
-  specs:
-    actionmailer (3.2.21)
-      actionpack (= 3.2.21)
-      mail (~> 2.5.4)
-    actionpack (3.2.21)
-      activemodel (= 3.2.21)
-      activesupport (= 3.2.21)
-      builder (~> 3.0.0)
-      erubis (~> 2.7.0)
-      journey (~> 1.0.4)
-      rack (~> 1.4.5)
-      rack-cache (~> 1.2)
-      rack-test (~> 0.6.1)
-      sprockets (~> 2.2.1)
-    activemodel (3.2.21)
-      activesupport (= 3.2.21)
-      builder (~> 3.0.0)
-    activerecord (3.2.21)
-      activemodel (= 3.2.21)
-      activesupport (= 3.2.21)
-      arel (~> 3.0.2)
-      tzinfo (~> 0.3.29)
-    activeresource (3.2.21)
-      activemodel (= 3.2.21)
-      activesupport (= 3.2.21)
-    activesupport (3.2.21)
-      i18n (~> 0.6, >= 0.6.4)
-      multi_json (~> 1.0)
-    rails (3.2.21)
-      actionmailer (= 3.2.21)
-      actionpack (= 3.2.21)
-      activerecord (= 3.2.21)
-      activeresource (= 3.2.21)
-      activesupport (= 3.2.21)
-      bundler (~> 1.0)
-      railties (= 3.2.21)
-    railties (3.2.21)
-      actionpack (= 3.2.21)
-      activesupport (= 3.2.21)
-      rack-ssl (~> 1.3.2)
-      rake (>= 0.8.7)
-      rdoc (~> 3.4)
-      thor (>= 0.14.6, < 2.0)
-
-PATH
-  remote: ..
-  specs:
-    devise (3.5.3)
-      bcrypt (~> 3.0)
-      orm_adapter (~> 0.1)
-      railties (>= 3.2.6, < 5)
-      responders
-      thread_safe (~> 0.1)
-      warden (~> 1.2.3)
-
-GEM
-  remote: https://rubygems.org/
-  specs:
-    arel (3.0.3)
-    bcrypt (3.1.10)
-    builder (3.0.4)
-    erubis (2.7.0)
-    faraday (0.9.1)
-      multipart-post (>= 1.2, < 3)
-    hashie (3.4.0)
-    hike (1.2.3)
-    i18n (0.7.0)
-    journey (1.0.4)
-    json (1.8.2)
-    jwt (1.4.1)
-    mail (2.5.4)
-      mime-types (~> 1.16)
-      treetop (~> 1.4.8)
-    metaclass (0.0.4)
-    mime-types (1.25.1)
-    mini_portile (0.6.2)
-    mocha (1.1.0)
-      metaclass (~> 0.0.1)
-    mongoid (3.1.6)
-      activemodel (~> 3.2)
-      moped (~> 1.4)
-      origin (~> 1.0)
-      tzinfo (~> 0.3.29)
-    moped (1.5.2)
-    multi_json (1.11.0)
-    multi_xml (0.5.5)
-    multipart-post (2.0.0)
-    nokogiri (1.6.6.2)
-      mini_portile (~> 0.6.0)
-    oauth2 (0.9.4)
-      faraday (>= 0.8, < 0.10)
-      jwt (~> 1.0)
-      multi_json (~> 1.3)
-      multi_xml (~> 0.5)
-      rack (~> 1.2)
-    omniauth (1.2.2)
-      hashie (>= 1.2, < 4)
-      rack (~> 1.0)
-    omniauth-facebook (1.6.0)
-      omniauth-oauth2 (~> 1.1)
-    omniauth-oauth2 (1.1.2)
-      faraday (>= 0.8, < 0.10)
-      multi_json (~> 1.3)
-      oauth2 (~> 0.9.3)
-      omniauth (~> 1.2)
-    omniauth-openid (1.0.1)
-      omniauth (~> 1.0)
-      rack-openid (~> 1.3.1)
-    origin (1.1.0)
-    orm_adapter (0.5.0)
-    polyglot (0.3.5)
-    rack (1.4.5)
-    rack-cache (1.2)
-      rack (>= 0.4)
-    rack-openid (1.3.1)
-      rack (>= 1.1.0)
-      ruby-openid (>= 2.1.8)
-    rack-ssl (1.3.4)
-      rack
-    rack-test (0.6.3)
-      rack (>= 1.0)
-    rake (10.4.2)
-    rdoc (3.12.2)
-      json (~> 1.4)
-    responders (1.1.2)
-      railties (>= 3.2, < 4.2)
-    ruby-openid (2.7.0)
-    sprockets (2.2.3)
-      hike (~> 1.2)
-      multi_json (~> 1.0)
-      rack (~> 1.0)
-      tilt (~> 1.1, != 1.3.0)
-    sqlite3 (1.3.10)
-    thor (0.19.1)
-    thread_safe (0.3.5)
-    tilt (1.4.1)
-    treetop (1.4.15)
-      polyglot
-      polyglot (>= 0.3.1)
-    tzinfo (0.3.43)
-    warden (1.2.4)
-      rack (>= 1.0)
-    webrat (0.7.3)
-      nokogiri (>= 1.2.0)
-      rack (>= 1.0)
-      rack-test (>= 0.5.3)
-
-PLATFORMS
-  ruby
-
-DEPENDENCIES
-  activerecord-jdbc-adapter
-  activerecord-jdbcsqlite3-adapter
-  devise!
-  jruby-openssl
-  mocha (~> 1.1)
-  mongoid (~> 3.0)
-  omniauth (~> 1.2.0)
-  omniauth-facebook
-  omniauth-oauth2 (~> 1.1.0)
-  omniauth-openid (~> 1.0.1)
-  rails!
-  rdoc
-  sqlite3
-  webrat (= 0.7.3)
-
-BUNDLED WITH
-   1.10.6
--- a/gemfiles/Gemfile.rails-4.0-stable
+++ b/gemfiles/Gemfile.rails-4.0-stable
@@ -1,29 +0,0 @@
-source "https://rubygems.org"
-
-gemspec path: '..'
-
-gem "rails", github: 'rails/rails', branch: '4-0-stable'
-gem "omniauth", "~> 1.2.0"
-gem "omniauth-oauth2", "~> 1.1.0"
-gem "rdoc"
-
-group :test do
-  gem "omniauth-facebook"
-  gem "omniauth-openid", "~> 1.0.1"
-  gem "webrat", "0.7.3", require: false
-  gem "mocha", "~> 1.1", require: false
-end
-
-platforms :jruby do
-  gem "activerecord-jdbc-adapter"
-  gem "activerecord-jdbcsqlite3-adapter"
-  gem "jruby-openssl"
-end
-
-platforms :ruby do
-  gem "sqlite3"
-end
-
-group :mongoid do
-  gem "mongoid", "~> 4.0.0"
-end
--- a/gemfiles/Gemfile.rails-4.0-stable.lock
+++ b/gemfiles/Gemfile.rails-4.0-stable.lock
@@ -1,166 +0,0 @@
-GIT
-  remote: git://github.com/rails/rails.git
-  revision: 7ec9c9635bf4d57009135ed11e89d8bf32306d73
-  branch: 4-0-stable
-  specs:
-    actionmailer (4.0.13)
-      actionpack (= 4.0.13)
-      mail (~> 2.5, >= 2.5.4)
-    actionpack (4.0.13)
-      activesupport (= 4.0.13)
-      builder (~> 3.1.0)
-      erubis (~> 2.7.0)
-      rack (~> 1.5.2)
-      rack-test (~> 0.6.2)
-    activemodel (4.0.13)
-      activesupport (= 4.0.13)
-      builder (~> 3.1.0)
-    activerecord (4.0.13)
-      activemodel (= 4.0.13)
-      activerecord-deprecated_finders (~> 1.0.2)
-      activesupport (= 4.0.13)
-      arel (~> 4.0.0)
-    activesupport (4.0.13)
-      i18n (~> 0.6, >= 0.6.9)
-      minitest (~> 4.2)
-      multi_json (~> 1.3)
-      thread_safe (~> 0.1)
-      tzinfo (~> 0.3.37)
-    rails (4.0.13)
-      actionmailer (= 4.0.13)
-      actionpack (= 4.0.13)
-      activerecord (= 4.0.13)
-      activesupport (= 4.0.13)
-      bundler (>= 1.3.0, < 2.0)
-      railties (= 4.0.13)
-      sprockets-rails (~> 2.0)
-    railties (4.0.13)
-      actionpack (= 4.0.13)
-      activesupport (= 4.0.13)
-      rake (>= 0.8.7)
-      thor (>= 0.18.1, < 2.0)
-
-PATH
-  remote: ..
-  specs:
-    devise (3.5.3)
-      bcrypt (~> 3.0)
-      orm_adapter (~> 0.1)
-      railties (>= 3.2.6, < 5)
-      responders
-      thread_safe (~> 0.1)
-      warden (~> 1.2.3)
-
-GEM
-  remote: https://rubygems.org/
-  specs:
-    activerecord-deprecated_finders (1.0.3)
-    arel (4.0.2)
-    bcrypt (3.1.10)
-    bson (2.3.0)
-    builder (3.1.4)
-    connection_pool (2.1.3)
-    erubis (2.7.0)
-    faraday (0.9.1)
-      multipart-post (>= 1.2, < 3)
-    hashie (3.4.0)
-    hike (1.2.3)
-    i18n (0.7.0)
-    jwt (1.4.1)
-    mail (2.6.3)
-      mime-types (>= 1.16, < 3)
-    metaclass (0.0.4)
-    mime-types (2.4.3)
-    mini_portile (0.6.2)
-    minitest (4.7.5)
-    mocha (1.1.0)
-      metaclass (~> 0.0.1)
-    mongoid (4.0.2)
-      activemodel (~> 4.0)
-      moped (~> 2.0.0)
-      origin (~> 2.1)
-      tzinfo (>= 0.3.37)
-    moped (2.0.4)
-      bson (~> 2.2)
-      connection_pool (~> 2.0)
-      optionable (~> 0.2.0)
-    multi_json (1.11.0)
-    multi_xml (0.5.5)
-    multipart-post (2.0.0)
-    nokogiri (1.6.6.2)
-      mini_portile (~> 0.6.0)
-    oauth2 (0.9.4)
-      faraday (>= 0.8, < 0.10)
-      jwt (~> 1.0)
-      multi_json (~> 1.3)
-      multi_xml (~> 0.5)
-      rack (~> 1.2)
-    omniauth (1.2.2)
-      hashie (>= 1.2, < 4)
-      rack (~> 1.0)
-    omniauth-facebook (1.6.0)
-      omniauth-oauth2 (~> 1.1)
-    omniauth-oauth2 (1.1.2)
-      faraday (>= 0.8, < 0.10)
-      multi_json (~> 1.3)
-      oauth2 (~> 0.9.3)
-      omniauth (~> 1.2)
-    omniauth-openid (1.0.1)
-      omniauth (~> 1.0)
-      rack-openid (~> 1.3.1)
-    optionable (0.2.0)
-    origin (2.1.1)
-    orm_adapter (0.5.0)
-    rack (1.5.2)
-    rack-openid (1.3.1)
-      rack (>= 1.1.0)
-      ruby-openid (>= 2.1.8)
-    rack-test (0.6.3)
-      rack (>= 1.0)
-    rake (10.4.2)
-    rdoc (4.2.0)
-    responders (1.1.2)
-      railties (>= 3.2, < 4.2)
-    ruby-openid (2.7.0)
-    sprockets (2.12.3)
-      hike (~> 1.2)
-      multi_json (~> 1.0)
-      rack (~> 1.0)
-      tilt (~> 1.1, != 1.3.0)
-    sprockets-rails (2.2.4)
-      actionpack (>= 3.0)
-      activesupport (>= 3.0)
-      sprockets (>= 2.8, < 4.0)
-    sqlite3 (1.3.10)
-    thor (0.19.1)
-    thread_safe (0.3.5)
-    tilt (1.4.1)
-    tzinfo (0.3.43)
-    warden (1.2.4)
-      rack (>= 1.0)
-    webrat (0.7.3)
-      nokogiri (>= 1.2.0)
-      rack (>= 1.0)
-      rack-test (>= 0.5.3)
-
-PLATFORMS
-  ruby
-
-DEPENDENCIES
-  activerecord-jdbc-adapter
-  activerecord-jdbcsqlite3-adapter
-  devise!
-  jruby-openssl
-  mocha (~> 1.1)
-  mongoid (~> 4.0.0)
-  omniauth (~> 1.2.0)
-  omniauth-facebook
-  omniauth-oauth2 (~> 1.1.0)
-  omniauth-openid (~> 1.0.1)
-  rails!
-  rdoc
-  sqlite3
-  webrat (= 0.7.3)
-
-BUNDLED WITH
-   1.10.6
--- a/gemfiles/Gemfile.rails-4.1-stable.lock
+++ b/gemfiles/Gemfile.rails-4.1-stable.lock
@@ -1,59 +1,58 @@
 GIT
  remote: git://github.com/rails/rails.git
-  revision: bf32ec7b8611e6b4c7e9398f7d297a1f0221e9b9
+  revision: e8eda76893479a29ace8d85cf4e4cfc67cd6fd4b
  branch: 4-1-stable
  specs:
-    actionmailer (4.1.10)
-      actionpack (= 4.1.10)
-      actionview (= 4.1.10)
+    actionmailer (4.1.14.1)
+      actionpack (= 4.1.14.1)
+      actionview (= 4.1.14.1)
      mail (~> 2.5, >= 2.5.4)
-    actionpack (4.1.10)
-      actionview (= 4.1.10)
-      activesupport (= 4.1.10)
+    actionpack (4.1.14.1)
+      actionview (= 4.1.14.1)
+      activesupport (= 4.1.14.1)
      rack (~> 1.5.2)
      rack-test (~> 0.6.2)
-    actionview (4.1.10)
-      activesupport (= 4.1.10)
+    actionview (4.1.14.1)
+      activesupport (= 4.1.14.1)
      builder (~> 3.1)
      erubis (~> 2.7.0)
-    activemodel (4.1.10)
-      activesupport (= 4.1.10)
+    activemodel (4.1.14.1)
+      activesupport (= 4.1.14.1)
      builder (~> 3.1)
-    activerecord (4.1.10)
-      activemodel (= 4.1.10)
-      activesupport (= 4.1.10)
+    activerecord (4.1.14.1)
+      activemodel (= 4.1.14.1)
+      activesupport (= 4.1.14.1)
      arel (~> 5.0.0)
-    activesupport (4.1.10)
+    activesupport (4.1.14.1)
      i18n (~> 0.6, >= 0.6.9)
      json (~> 1.7, >= 1.7.7)
      minitest (~> 5.1)
      thread_safe (~> 0.1)
      tzinfo (~> 1.1)
-    rails (4.1.10)
-      actionmailer (= 4.1.10)
-      actionpack (= 4.1.10)
-      actionview (= 4.1.10)
-      activemodel (= 4.1.10)
-      activerecord (= 4.1.10)
-      activesupport (= 4.1.10)
+    rails (4.1.14.1)
+      actionmailer (= 4.1.14.1)
+      actionpack (= 4.1.14.1)
+      actionview (= 4.1.14.1)
+      activemodel (= 4.1.14.1)
+      activerecord (= 4.1.14.1)
+      activesupport (= 4.1.14.1)
      bundler (>= 1.3.0, < 2.0)
-      railties (= 4.1.10)
+      railties (= 4.1.14.1)
      sprockets-rails (~> 2.0)
-    railties (4.1.10)
-      actionpack (= 4.1.10)
-      activesupport (= 4.1.10)
+    railties (4.1.14.1)
+      actionpack (= 4.1.14.1)
+      activesupport (= 4.1.14.1)
      rake (>= 0.8.7)
      thor (>= 0.18.1, < 2.0)

 PATH
  remote: ..
  specs:
-    devise (3.5.3)
+    devise (4.0.0.rc1)
      bcrypt (~> 3.0)
      orm_adapter (~> 0.1)
-      railties (>= 3.2.6, < 5)
+      railties (>= 4.1.0, < 5.1)
      responders
-      thread_safe (~> 0.1)
      warden (~> 1.2.3)

 GEM
@@ -61,23 +60,23 @@ GEM
  specs:
    arel (5.0.1.20140414130214)
    bcrypt (3.1.10)
-    bson (2.3.0)
+    bson (3.2.6)
    builder (3.2.2)
-    connection_pool (2.1.3)
+    concurrent-ruby (1.0.0)
+    connection_pool (2.2.0)
    erubis (2.7.0)
-    faraday (0.9.1)
+    faraday (0.9.2)
      multipart-post (>= 1.2, < 3)
-    hashie (3.4.0)
-    hike (1.2.3)
+    hashie (3.4.3)
    i18n (0.7.0)
-    json (1.8.2)
-    jwt (1.4.1)
+    json (1.8.3)
+    jwt (1.5.2)
    mail (2.6.3)
      mime-types (>= 1.16, < 3)
    metaclass (0.0.4)
-    mime-types (2.4.3)
-    mini_portile (0.6.2)
-    minitest (5.5.1)
+    mime-types (2.99)
+    mini_portile2 (2.0.0)
+    minitest (5.8.4)
    mocha (1.1.0)
      metaclass (~> 0.0.1)
    mongoid (4.0.2)
@@ -85,15 +84,15 @@ GEM
      moped (~> 2.0.0)
      origin (~> 2.1)
      tzinfo (>= 0.3.37)
-    moped (2.0.4)
-      bson (~> 2.2)
+    moped (2.0.7)
+      bson (~> 3.0)
      connection_pool (~> 2.0)
      optionable (~> 0.2.0)
-    multi_json (1.11.0)
+    multi_json (1.11.2)
    multi_xml (0.5.5)
    multipart-post (2.0.0)
-    nokogiri (1.6.6.2)
-      mini_portile (~> 0.6.0)
+    nokogiri (1.6.7.2)
+      mini_portile2 (~> 2.0.0.rc2)
    oauth2 (0.9.4)
      faraday (>= 0.8, < 0.10)
      jwt (~> 1.0)
@@ -114,35 +113,32 @@ GEM
      omniauth (~> 1.0)
      rack-openid (~> 1.3.1)
    optionable (0.2.0)
-    origin (2.1.1)
+    origin (2.2.0)
    orm_adapter (0.5.0)
-    rack (1.5.2)
+    rack (1.5.5)
    rack-openid (1.3.1)
      rack (>= 1.1.0)
      ruby-openid (>= 2.1.8)
    rack-test (0.6.3)
      rack (>= 1.0)
-    rake (10.4.2)
-    rdoc (4.2.0)
+    rake (10.5.0)
+    rdoc (4.2.1)
    responders (1.1.2)
      railties (>= 3.2, < 4.2)
    ruby-openid (2.7.0)
-    sprockets (2.12.3)
-      hike (~> 1.2)
-      multi_json (~> 1.0)
-      rack (~> 1.0)
-      tilt (~> 1.1, != 1.3.0)
-    sprockets-rails (2.2.4)
+    sprockets (3.5.2)
+      concurrent-ruby (~> 1.0)
+      rack (> 1, < 3)
+    sprockets-rails (2.3.3)
      actionpack (>= 3.0)
      activesupport (>= 3.0)
      sprockets (>= 2.8, < 4.0)
-    sqlite3 (1.3.10)
+    sqlite3 (1.3.11)
    thor (0.19.1)
    thread_safe (0.3.5)
-    tilt (1.4.1)
    tzinfo (1.2.2)
      thread_safe (~> 0.1)
-    warden (1.2.4)
+    warden (1.2.6)
      rack (>= 1.0)
    webrat (0.7.3)
      nokogiri (>= 1.2.0)
@@ -169,4 +165,4 @@ DEPENDENCIES
  webrat (= 0.7.3)

 BUNDLED WITH
-   1.10.6
+   1.11.2
--- a/gemfiles/Gemfile.rails-4.2-stable.lock
+++ b/gemfiles/Gemfile.rails-4.2-stable.lock
@@ -1,97 +1,96 @@
 GIT
  remote: git://github.com/rails/rails.git
-  revision: f12ff8ddab7b199707ec36d72bd72f206f142c8b
+  revision: acf654b1c4a1ffe2a90d6ea63a0b989d656bb87d
  branch: 4-2-stable
  specs:
-    actionmailer (4.2.1)
-      actionpack (= 4.2.1)
-      actionview (= 4.2.1)
-      activejob (= 4.2.1)
+    actionmailer (4.2.5.1)
+      actionpack (= 4.2.5.1)
+      actionview (= 4.2.5.1)
+      activejob (= 4.2.5.1)
      mail (~> 2.5, >= 2.5.4)
      rails-dom-testing (~> 1.0, >= 1.0.5)
-    actionpack (4.2.1)
-      actionview (= 4.2.1)
-      activesupport (= 4.2.1)
+    actionpack (4.2.5.1)
+      actionview (= 4.2.5.1)
+      activesupport (= 4.2.5.1)
      rack (~> 1.6)
      rack-test (~> 0.6.2)
      rails-dom-testing (~> 1.0, >= 1.0.5)
      rails-html-sanitizer (~> 1.0, >= 1.0.2)
-    actionview (4.2.1)
-      activesupport (= 4.2.1)
+    actionview (4.2.5.1)
+      activesupport (= 4.2.5.1)
      builder (~> 3.1)
      erubis (~> 2.7.0)
      rails-dom-testing (~> 1.0, >= 1.0.5)
      rails-html-sanitizer (~> 1.0, >= 1.0.2)
-    activejob (4.2.1)
-      activesupport (= 4.2.1)
+    activejob (4.2.5.1)
+      activesupport (= 4.2.5.1)
      globalid (>= 0.3.0)
-    activemodel (4.2.1)
-      activesupport (= 4.2.1)
+    activemodel (4.2.5.1)
+      activesupport (= 4.2.5.1)
      builder (~> 3.1)
-    activerecord (4.2.1)
-      activemodel (= 4.2.1)
-      activesupport (= 4.2.1)
+    activerecord (4.2.5.1)
+      activemodel (= 4.2.5.1)
+      activesupport (= 4.2.5.1)
      arel (~> 6.0)
-    activesupport (4.2.1)
+    activesupport (4.2.5.1)
      i18n (~> 0.7)
      json (~> 1.7, >= 1.7.7)
      minitest (~> 5.1)
      thread_safe (~> 0.3, >= 0.3.4)
      tzinfo (~> 1.1)
-    rails (4.2.1)
-      actionmailer (= 4.2.1)
-      actionpack (= 4.2.1)
-      actionview (= 4.2.1)
-      activejob (= 4.2.1)
-      activemodel (= 4.2.1)
-      activerecord (= 4.2.1)
-      activesupport (= 4.2.1)
+    rails (4.2.5.1)
+      actionmailer (= 4.2.5.1)
+      actionpack (= 4.2.5.1)
+      actionview (= 4.2.5.1)
+      activejob (= 4.2.5.1)
+      activemodel (= 4.2.5.1)
+      activerecord (= 4.2.5.1)
+      activesupport (= 4.2.5.1)
      bundler (>= 1.3.0, < 2.0)
-      railties (= 4.2.1)
+      railties (= 4.2.5.1)
      sprockets-rails
-    railties (4.2.1)
-      actionpack (= 4.2.1)
-      activesupport (= 4.2.1)
+    railties (4.2.5.1)
+      actionpack (= 4.2.5.1)
+      activesupport (= 4.2.5.1)
      rake (>= 0.8.7)
      thor (>= 0.18.1, < 2.0)

 PATH
  remote: ..
  specs:
-    devise (3.5.3)
+    devise (4.0.0.rc1)
      bcrypt (~> 3.0)
      orm_adapter (~> 0.1)
-      railties (>= 3.2.6, < 5)
+      railties (>= 4.1.0, < 5.1)
      responders
-      thread_safe (~> 0.1)
      warden (~> 1.2.3)

 GEM
  remote: https://rubygems.org/
  specs:
-    arel (6.0.0)
+    arel (6.0.3)
    bcrypt (3.1.10)
-    bson (2.3.0)
+    bson (3.2.6)
    builder (3.2.2)
-    connection_pool (2.1.3)
+    concurrent-ruby (1.0.0)
+    connection_pool (2.2.0)
    erubis (2.7.0)
-    faraday (0.9.1)
+    faraday (0.9.2)
      multipart-post (>= 1.2, < 3)
-    globalid (0.3.3)
+    globalid (0.3.6)
      activesupport (>= 4.1.0)
-    hashie (3.4.0)
-    hike (1.2.3)
+    hashie (3.4.3)
    i18n (0.7.0)
-    json (1.8.2)
-    jwt (1.4.1)
-    loofah (2.0.1)
+    json (1.8.3)
+    jwt (1.5.2)
+    loofah (2.0.3)
      nokogiri (>= 1.5.9)
    mail (2.6.3)
      mime-types (>= 1.16, < 3)
    metaclass (0.0.4)
-    mime-types (2.4.3)
-    mini_portile (0.6.2)
-    minitest (5.5.1)
+    mime-types (2.99)
+    mini_portile2 (2.0.0)
+    minitest (5.8.4)
    mocha (1.1.0)
      metaclass (~> 0.0.1)
    mongoid (4.0.2)
@@ -99,15 +98,15 @@ GEM
      moped (~> 2.0.0)
      origin (~> 2.1)
      tzinfo (>= 0.3.37)
-    moped (2.0.4)
-      bson (~> 2.2)
+    moped (2.0.7)
+      bson (~> 3.0)
      connection_pool (~> 2.0)
      optionable (~> 0.2.0)
-    multi_json (1.11.0)
+    multi_json (1.11.2)
    multi_xml (0.5.5)
    multipart-post (2.0.0)
-    nokogiri (1.6.6.2)
-      mini_portile (~> 0.6.0)
+    nokogiri (1.6.7.2)
+      mini_portile2 (~> 2.0.0.rc2)
    oauth2 (1.0.0)
      faraday (>= 0.8, < 0.10)
      jwt (~> 1.0)
@@ -117,7 +116,7 @@ GEM
    omniauth (1.2.2)
      hashie (>= 1.2, < 4)
      rack (~> 1.0)
-    omniauth-facebook (2.0.1)
+    omniauth-facebook (3.0.0)
      omniauth-oauth2 (~> 1.2)
    omniauth-oauth2 (1.2.0)
      faraday (>= 0.8, < 0.10)
@@ -128,9 +127,9 @@ GEM
      omniauth (~> 1.0)
      rack-openid (~> 1.3.1)
    optionable (0.2.0)
-    origin (2.1.1)
+    origin (2.2.0)
    orm_adapter (0.5.0)
-    rack (1.6.0)
+    rack (1.6.4)
    rack-openid (1.3.1)
      rack (>= 1.1.0)
      ruby-openid (>= 2.1.8)
@@ -138,33 +137,30 @@ GEM
      rack (>= 1.0)
    rails-deprecated_sanitizer (1.0.3)
      activesupport (>= 4.2.0.alpha)
-    rails-dom-testing (1.0.6)
+    rails-dom-testing (1.0.7)
      activesupport (>= 4.2.0.beta, < 5.0)
      nokogiri (~> 1.6.0)
      rails-deprecated_sanitizer (>= 1.0.1)
-    rails-html-sanitizer (1.0.2)
+    rails-html-sanitizer (1.0.3)
      loofah (~> 2.0)
-    rake (10.4.2)
-    rdoc (4.2.0)
-    responders (2.1.0)
-      railties (>= 4.2.0, < 5)
+    rake (10.5.0)
+    rdoc (4.2.1)
+    responders (2.1.1)
+      railties (>= 4.2.0, < 5.1)
    ruby-openid (2.7.0)
-    sprockets (2.12.3)
-      hike (~> 1.2)
-      multi_json (~> 1.0)
-      rack (~> 1.0)
-      tilt (~> 1.1, != 1.3.0)
-    sprockets-rails (2.2.4)
-      actionpack (>= 3.0)
-      activesupport (>= 3.0)
-      sprockets (>= 2.8, < 4.0)
-    sqlite3 (1.3.10)
+    sprockets (3.5.2)
+      concurrent-ruby (~> 1.0)
+      rack (> 1, < 3)
+    sprockets-rails (3.0.0)
+      actionpack (>= 4.0)
+      activesupport (>= 4.0)
+      sprockets (>= 3.0.0)
+    sqlite3 (1.3.11)
    thor (0.19.1)
    thread_safe (0.3.5)
-    tilt (1.4.1)
    tzinfo (1.2.2)
      thread_safe (~> 0.1)
-    warden (1.2.4)
+    warden (1.2.6)
      rack (>= 1.0)
    webrat (0.7.3)
      nokogiri (>= 1.2.0)
@@ -191,4 +187,4 @@ DEPENDENCIES
  webrat (= 0.7.3)

 BUNDLED WITH
-   1.10.6
+   1.11.2
--- a/gemfiles/Gemfile.rails-5.0-beta
+++ b/gemfiles/Gemfile.rails-5.0-beta
@@ -0,0 +1,37 @@
+source 'https://rubygems.org'
+
+gemspec path: '..'
+
+gem 'rails', '5.0.0.beta1.1'
+gem 'omniauth', '~>1.3.1'
+gem 'oauth2', github: 'intridea/oauth2', branch: 'master'
+gem 'omniauth-oauth2', '>= 1.2.0', '< 1.5.0'
+gem 'rdoc'
+
+gem 'activemodel-serializers-xml', github: 'rails/activemodel-serializers-xml'
+
+gem 'rails-controller-testing'
+
+gem 'responders', '~>2.1.1'
+
+group :test do
+  gem 'omniauth-facebook'
+  gem 'omniauth-openid', '~> 1.0.1'
+  gem 'webrat', '0.7.3', require: false
+  gem 'mocha', '~> 1.1', require: false
+end
+
+platforms :jruby do
+  gem 'activerecord-jdbc-adapter'
+  gem 'activerecord-jdbcsqlite3-adapter'
+  gem 'jruby-openssl'
+end
+
+platforms :ruby do
+  gem 'sqlite3'
+end
+
+# TODO:
+# group :mongoid do
+#   gem 'mongoid', '~> 4.0.0'
+# end
--- a/gemfiles/Gemfile.rails-5.0-beta.lock
+++ b/gemfiles/Gemfile.rails-5.0-beta.lock
@@ -0,0 +1,242 @@
+GIT
+  remote: git://github.com/intridea/oauth2.git
+  revision: 43e1fdd87e95a5b02438d5cce6a67e411afb5fec
+  branch: master
+  specs:
+    oauth2 (1.0.0)
+      faraday (>= 0.8, < 0.10)
+      jwt (~> 1.0, < 1.5.2)
+      multi_json (~> 1.3)
+      multi_xml (~> 0.5)
+      rack (>= 1.2, < 3)
+
+GIT
+  remote: git://github.com/rails/activemodel-serializers-xml.git
+  revision: 1f72d9507c91b1cda10d1d20eac2b74dd6d9d4b9
+  specs:
+    activemodel-serializers-xml (0.1.0)
+      activemodel
+      activerecord
+      activesupport
+
+PATH
+  remote: ..
+  specs:
+    devise (4.0.0.rc1)
+      bcrypt (~> 3.0)
+      orm_adapter (~> 0.1)
+      railties (>= 4.1.0, < 5.1)
+      responders
+      warden (~> 1.2.3)
+
+GEM
+  remote: https://rubygems.org/
+  specs:
+    actioncable (5.0.0.beta1.1)
+      actionpack (= 5.0.0.beta1.1)
+      celluloid (~> 0.17.2)
+      coffee-rails (~> 4.1.0)
+      em-hiredis (~> 0.3.0)
+      faye-websocket (~> 0.10.0)
+      redis (~> 3.0)
+      websocket-driver (~> 0.6.1)
+    actionmailer (5.0.0.beta1.1)
+      actionpack (= 5.0.0.beta1.1)
+      actionview (= 5.0.0.beta1.1)
+      activejob (= 5.0.0.beta1.1)
+      mail (~> 2.5, >= 2.5.4)
+      rails-dom-testing (~> 1.0, >= 1.0.5)
+    actionpack (5.0.0.beta1.1)
+      actionview (= 5.0.0.beta1.1)
+      activesupport (= 5.0.0.beta1.1)
+      rack (~> 2.x)
+      rack-test (~> 0.6.3)
+      rails-dom-testing (~> 1.0, >= 1.0.5)
+      rails-html-sanitizer (~> 1.0, >= 1.0.2)
+    actionview (5.0.0.beta1.1)
+      activesupport (= 5.0.0.beta1.1)
+      builder (~> 3.1)
+      erubis (~> 2.7.0)
+      rails-dom-testing (~> 1.0, >= 1.0.5)
+      rails-html-sanitizer (~> 1.0, >= 1.0.2)
+    activejob (5.0.0.beta1.1)
+      activesupport (= 5.0.0.beta1.1)
+      globalid (>= 0.3.6)
+    activemodel (5.0.0.beta1.1)
+      activesupport (= 5.0.0.beta1.1)
+      builder (~> 3.1)
+    activerecord (5.0.0.beta1.1)
+      activemodel (= 5.0.0.beta1.1)
+      activesupport (= 5.0.0.beta1.1)
+      arel (~> 7.0)
+    activesupport (5.0.0.beta1.1)
+      concurrent-ruby (~> 1.0)
+      i18n (~> 0.7)
+      json (~> 1.7, >= 1.7.7)
+      method_source
+      minitest (~> 5.1)
+      tzinfo (~> 1.1)
+    arel (7.0.0)
+    bcrypt (3.1.10)
+    builder (3.2.2)
+    celluloid (0.17.3)
+      celluloid-essentials
+      celluloid-extras
+      celluloid-fsm
+      celluloid-pool
+      celluloid-supervision
+      timers (>= 4.1.1)
+    celluloid-essentials (0.20.5)
+      timers (>= 4.1.1)
+    celluloid-extras (0.20.5)
+      timers (>= 4.1.1)
+    celluloid-fsm (0.20.5)
+      timers (>= 4.1.1)
+    celluloid-pool (0.20.5)
+      timers (>= 4.1.1)
+    celluloid-supervision (0.20.5)
+      timers (>= 4.1.1)
+    coffee-rails (4.1.1)
+      coffee-script (>= 2.2.0)
+      railties (>= 4.0.0, < 5.1.x)
+    coffee-script (2.4.1)
+      coffee-script-source
+      execjs
+    coffee-script-source (1.10.0)
+    concurrent-ruby (1.0.0)
+    em-hiredis (0.3.0)
+      eventmachine (~> 1.0)
+      hiredis (~> 0.5.0)
+    erubis (2.7.0)
+    eventmachine (1.0.9.1)
+    execjs (2.6.0)
+    faraday (0.9.2)
+      multipart-post (>= 1.2, < 3)
+    faye-websocket (0.10.2)
+      eventmachine (>= 0.12.0)
+      websocket-driver (>= 0.5.1)
+    globalid (0.3.6)
+      activesupport (>= 4.1.0)
+    hashie (3.4.3)
+    hiredis (0.5.2)
+    hitimes (1.2.3)
+    i18n (0.7.0)
+    json (1.8.3)
+    jwt (1.5.1)
+    loofah (2.0.3)
+      nokogiri (>= 1.5.9)
+    mail (2.6.3)
+      mime-types (>= 1.16, < 3)
+    metaclass (0.0.4)
+    method_source (0.8.2)
+    mime-types (2.99)
+    mini_portile2 (2.0.0)
+    minitest (5.8.4)
+    mocha (1.1.0)
+      metaclass (~> 0.0.1)
+    multi_json (1.11.2)
+    multi_xml (0.5.5)
+    multipart-post (2.0.0)
+    nokogiri (1.6.7.2)
+      mini_portile2 (~> 2.0.0.rc2)
+    omniauth (1.3.1)
+      hashie (>= 1.2, < 4)
+      rack (>= 1.0, < 3)
+    omniauth-facebook (3.0.0)
+      omniauth-oauth2 (~> 1.2)
+    omniauth-oauth2 (1.4.0)
+      oauth2 (~> 1.0)
+      omniauth (~> 1.2)
+    omniauth-openid (1.0.1)
+      omniauth (~> 1.0)
+      rack-openid (~> 1.3.1)
+    orm_adapter (0.5.0)
+    rack (2.0.0.alpha)
+      json
+    rack-openid (1.3.1)
+      rack (>= 1.1.0)
+      ruby-openid (>= 2.1.8)
+    rack-test (0.6.3)
+      rack (>= 1.0)
+    rails (5.0.0.beta1.1)
+      actioncable (= 5.0.0.beta1.1)
+      actionmailer (= 5.0.0.beta1.1)
+      actionpack (= 5.0.0.beta1.1)
+      actionview (= 5.0.0.beta1.1)
+      activejob (= 5.0.0.beta1.1)
+      activemodel (= 5.0.0.beta1.1)
+      activerecord (= 5.0.0.beta1.1)
+      activesupport (= 5.0.0.beta1.1)
+      bundler (>= 1.3.0, < 2.0)
+      railties (= 5.0.0.beta1.1)
+      sprockets-rails (>= 2.0.0)
+    rails-controller-testing (0.0.3)
+      rails (>= 4.2)
+    rails-deprecated_sanitizer (1.0.3)
+      activesupport (>= 4.2.0.alpha)
+    rails-dom-testing (1.0.7)
+      activesupport (>= 4.2.0.beta, < 5.0)
+      nokogiri (~> 1.6.0)
+      rails-deprecated_sanitizer (>= 1.0.1)
+    rails-html-sanitizer (1.0.3)
+      loofah (~> 2.0)
+    railties (5.0.0.beta1.1)
+      actionpack (= 5.0.0.beta1.1)
+      activesupport (= 5.0.0.beta1.1)
+      method_source
+      rake (>= 0.8.7)
+      thor (>= 0.18.1, < 2.0)
+    rake (10.5.0)
+    rdoc (4.2.1)
+    redis (3.2.2)
+    responders (2.1.1)
+      railties (>= 4.2.0, < 5.1)
+    ruby-openid (2.7.0)
+    sprockets (3.5.2)
+      concurrent-ruby (~> 1.0)
+      rack (> 1, < 3)
+    sprockets-rails (3.0.0)
+      actionpack (>= 4.0)
+      activesupport (>= 4.0)
+      sprockets (>= 3.0.0)
+    sqlite3 (1.3.11)
+    thor (0.19.1)
+    thread_safe (0.3.5)
+    timers (4.1.1)
+      hitimes
+    tzinfo (1.2.2)
+      thread_safe (~> 0.1)
+    warden (1.2.6)
+      rack (>= 1.0)
+    webrat (0.7.3)
+      nokogiri (>= 1.2.0)
+      rack (>= 1.0)
+      rack-test (>= 0.5.3)
+    websocket-driver (0.6.3)
+      websocket-extensions (>= 0.1.0)
+    websocket-extensions (0.1.2)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  activemodel-serializers-xml!
+  activerecord-jdbc-adapter
+  activerecord-jdbcsqlite3-adapter
+  devise!
+  jruby-openssl
+  mocha (~> 1.1)
+  oauth2!
+  omniauth (~> 1.3.1)
+  omniauth-facebook
+  omniauth-oauth2 (>= 1.2.0, < 1.5.0)
+  omniauth-openid (~> 1.0.1)
+  rails (= 5.0.0.beta1.1)
+  rails-controller-testing
+  rdoc
+  responders (~> 2.1.1)
+  sqlite3
+  webrat (= 0.7.3)
+
+BUNDLED WITH
+   1.11.2
--- a/lib/devise.rb
+++ b/lib/devise.rb
@@ -12,19 +12,18 @@ module Devise
  autoload :FailureApp,         'devise/failure_app'
  autoload :OmniAuth,           'devise/omniauth'
  autoload :ParameterFilter,    'devise/parameter_filter'
-  autoload :BaseSanitizer,      'devise/parameter_sanitizer'
  autoload :ParameterSanitizer, 'devise/parameter_sanitizer'
  autoload :TestHelpers,        'devise/test_helpers'
  autoload :TimeInflector,      'devise/time_inflector'
  autoload :TokenGenerator,     'devise/token_generator'

  module Controllers
-    autoload :Helpers, 'devise/controllers/helpers'
-    autoload :Rememberable, 'devise/controllers/rememberable'
-    autoload :ScopedViews, 'devise/controllers/scoped_views'
-    autoload :SignInOut, 'devise/controllers/sign_in_out'
-    autoload :StoreLocation, 'devise/controllers/store_location'
-    autoload :UrlHelpers, 'devise/controllers/url_helpers'
+    autoload :Helpers,        'devise/controllers/helpers'
+    autoload :Rememberable,   'devise/controllers/rememberable'
+    autoload :ScopedViews,    'devise/controllers/scoped_views'
+    autoload :SignInOut,      'devise/controllers/sign_in_out'
+    autoload :StoreLocation,  'devise/controllers/store_location'
+    autoload :UrlHelpers,     'devise/controllers/url_helpers'
  end

  module Hooks
@@ -36,7 +35,7 @@ module Devise
  end

  module Strategies
-    autoload :Base, 'devise/strategies/base'
+    autoload :Base,            'devise/strategies/base'
    autoload :Authenticatable, 'devise/strategies/authenticatable'
  end

@@ -116,6 +115,7 @@ module Devise
  mattr_accessor :remember_for
  @@remember_for = 2.weeks

+  # TODO: extend_remember_period is no longer used
  # If true, extends the user's remember period when remembered via cookie.
  mattr_accessor :extend_remember_period
  @@extend_remember_period = false
--- a/lib/devise/controllers/helpers.rb
+++ b/lib/devise/controllers/helpers.rb
@@ -30,8 +30,8 @@ module Devise
        #     current_bloggers       # Currently signed in user and admin
        #
        #   Use:
-        #     before_filter :authenticate_blogger!              # Redirects unless either a user or an admin are authenticated
-        #     before_filter ->{ authenticate_blogger! :admin }  # Redirects to the admin login page
+        #     before_action :authenticate_blogger!              # Redirects unless either a user or an admin are authenticated
+        #     before_action ->{ authenticate_blogger! :admin }  # Redirects to the admin login page
        #     current_blogger :user                             # Preferably returns a User if one is signed in
        #
        def devise_group(group_name, opts={})
@@ -84,7 +84,7 @@ module Devise
      end

      # Define authentication filters and accessor helpers based on mappings.
-      # These filters should be used inside the controllers as before_filters,
+      # These filters should be used inside the controllers as before_actions,
      # so you can control the scope of the user who should be signed in to
      # access that specific controller/action.
      # Example:
@@ -104,8 +104,8 @@ module Devise
      #     admin_session       # Session data available only to the admin scope
      #
      #   Use:
-      #     before_filter :authenticate_user!  # Tell devise to use :user map
-      #     before_filter :authenticate_admin! # Tell devise to use :admin map
+      #     before_action :authenticate_user!  # Tell devise to use :user map
+      #     before_action :authenticate_admin! # Tell devise to use :admin map
      #
      def self.define_helpers(mapping) #:nodoc:
        mapping = mapping.name
@@ -145,7 +145,7 @@ module Devise
      # the controllers defined inside devise. Useful if you want to apply a before
      # filter to all controllers, except the ones in devise:
      #
-      #   before_filter :my_filter, unless: :devise_controller?
+      #   before_action :my_filter, unless: :devise_controller?
      def devise_controller?
        is_a?(::DeviseController)
      end
@@ -154,11 +154,7 @@ module Devise
      # lib/devise/parameter_sanitizer.rb for more info. Override this
      # method in your application controller to use your own parameter sanitizer.
      def devise_parameter_sanitizer
-        @devise_parameter_sanitizer ||= if defined?(ActionController::StrongParameters)
-          Devise::ParameterSanitizer.new(resource_class, resource_name, params)
-        else
-          Devise::BaseSanitizer.new(resource_class, resource_name, params)
-        end
+        @devise_parameter_sanitizer ||= Devise::ParameterSanitizer.new(resource_class, resource_name, params)
      end

      # Tell warden that params authentication is allowed for that specific page.
--- a/lib/devise/controllers/rememberable.rb
+++ b/lib/devise/controllers/rememberable.rb
@@ -9,11 +9,18 @@ module Devise
        Rails.configuration.session_options.slice(:path, :domain, :secure)
      end

+      def remember_me_is_active?(resource)
+        return false unless resource.respond_to?(:remember_me)
+        scope = Devise::Mapping.find_scope!(resource)
+        _, token, generated_at = cookies.signed[remember_key(resource, scope)]
+        resource.remember_me?(token, generated_at)
+      end
+
      # Remembers the given resource by setting up a cookie
      def remember_me(resource)
        return if env["devise.skip_storage"]
        scope = Devise::Mapping.find_scope!(resource)
-        resource.remember_me!(resource.extend_remember_period)
+        resource.remember_me!
        cookies.signed[remember_key(resource, scope)] = remember_cookie_values(resource)
      end

--- a/lib/devise/failure_app.rb
+++ b/lib/devise/failure_app.rb
@@ -6,7 +6,6 @@ module Devise
  # page based on current scope and mapping. If no scope is given, redirect
  # to the default_url.
  class FailureApp < ActionController::Metal
-    include ActionController::RackDelegation
    include ActionController::UrlFor
    include ActionController::Redirecting

@@ -22,7 +21,7 @@ module Devise
      @respond.call(env)
    end

-    # Try retrieving the URL options from the parent controller (usually 
+    # Try retrieving the URL options from the parent controller (usually
    # ApplicationController). Instance methods are not supported at the moment,
    # so only the class-level attribute is used.
    def self.default_url_options(*args)
@@ -53,18 +52,27 @@ module Devise
    def recall
      config = Rails.application.config

-      if config.try(:relative_url_root)
+      header_info = if config.try(:relative_url_root)
        base_path = Pathname.new(config.relative_url_root)
        full_path = Pathname.new(attempted_path)

-        env["SCRIPT_NAME"] = config.relative_url_root
-        env["PATH_INFO"] = '/' + full_path.relative_path_from(base_path).to_s
+        { "SCRIPT_NAME" => config.relative_url_root,
+          "PATH_INFO" => '/' + full_path.relative_path_from(base_path).to_s }
      else
-        env["PATH_INFO"]  = attempted_path
+        { "PATH_INFO" => attempted_path }
+      end
+
+      header_info.each do | var, value|
+        if request.respond_to?(:set_header)
+          request.set_header(var, value)
+        else
+          env[var]  = value
+        end
      end

      flash.now[:alert] = i18n_message(:invalid) if is_flashing_format?
-      self.response = recall_app(warden_options[:recall]).call(env)
+      # self.response = recall_app(warden_options[:recall]).call(env)
+      self.response = recall_app(warden_options[:recall]).call(request.env)
    end

    def redirect
@@ -199,11 +207,11 @@ module Devise
    end

    def warden
-      env['warden']
+      request.respond_to?(:get_header) ? request.get_header("warden") : env["warden"]
    end

    def warden_options
-      env['warden.options']
+      request.respond_to?(:get_header) ? request.get_header("warden.options") : env["warden.options"]
    end

    def warden_message
--- a/lib/devise/hooks/timeoutable.rb
+++ b/lib/devise/hooks/timeoutable.rb
@@ -19,9 +19,10 @@ Warden::Manager.after_set_user do |record, warden, options|

    proxy = Devise::Hooks::Proxy.new(warden)

-    if record.timedout?(last_request_at) && !env['devise.skip_timeout']
+    if record.timedout?(last_request_at) &&
+        !env['devise.skip_timeout'] &&
+        !proxy.remember_me_is_active?(record)
      Devise.sign_out_all_scopes ? proxy.sign_out : proxy.sign_out(scope)
-
      throw :warden, scope: scope, message: :timeout
    end

--- a/lib/devise/models/authenticatable.rb
+++ b/lib/devise/models/authenticatable.rb
@@ -253,7 +253,11 @@ module Devise

        # Find or initialize a record with group of attributes based on a list of required attributes.
        def find_or_initialize_with_errors(required_attributes, attributes, error=:invalid) #:nodoc:
-          attributes = attributes.slice(*required_attributes).with_indifferent_access
+          attributes = if attributes.respond_to? :permit
+            attributes.slice(*required_attributes).permit!.to_h.with_indifferent_access
+          else
+            attributes.with_indifferent_access.slice(*required_attributes)
+          end
          attributes.delete_if { |key, value| value.blank? }

          if attributes.size == required_attributes.size
--- a/lib/devise/models/confirmable.rb
+++ b/lib/devise/models/confirmable.rb
@@ -40,7 +40,6 @@ module Devise
    #
    module Confirmable
      extend ActiveSupport::Concern
-      include ActionView::Helpers::DateHelper

      included do
        before_create :generate_confirmation_token, if: :confirmation_required?
@@ -254,7 +253,7 @@ module Devise
        end

        def postpone_email_change?
-          postpone = self.class.reconfirmable && email_changed? && !@bypass_confirmation_postpone && self.email.present?
+          postpone = self.class.reconfirmable && email_changed? && email_was.present? && !@bypass_confirmation_postpone && self.email.present?
          @bypass_confirmation_postpone = false
          postpone
        end
@@ -315,6 +314,7 @@ module Devise

        # Find a record for confirmation by unconfirmed email field
        def find_by_unconfirmed_email_with_errors(attributes = {})
+          attributes = attributes.slice(*confirmation_keys).permit!.to_h if attributes.respond_to? :permit
          unconfirmed_required_attributes = confirmation_keys.map { |k| k == :email ? :unconfirmed_email : k }
          unconfirmed_attributes = attributes.symbolize_keys
          unconfirmed_attributes[:unconfirmed_email] = unconfirmed_attributes.delete(:email)
--- a/lib/devise/models/database_authenticatable.rb
+++ b/lib/devise/models/database_authenticatable.rb
@@ -39,6 +39,7 @@ module Devise

      # Generates password encryption based on the given value.
      def password=(new_password)
+        attribute_will_change! 'password'
        @password = new_password
        self.encrypted_password = password_digest(@password) if @password.present?
      end
--- a/lib/devise/models/recoverable.rb
+++ b/lib/devise/models/recoverable.rb
@@ -83,7 +83,7 @@ module Devise
      #   reset_password_period_valid?   # will always return false
      #
      def reset_password_period_valid?
-        reset_password_sent_at && reset_password_sent_at.utc >= self.class.reset_password_within.ago
+        reset_password_sent_at && reset_password_sent_at.utc >= self.class.reset_password_within.ago.utc
      end

      protected
--- a/lib/devise/models/rememberable.rb
+++ b/lib/devise/models/rememberable.rb
@@ -45,11 +45,11 @@ module Devise
        [:remember_created_at]
      end

-      # Generate a new remember token and save the record without validations
-      # if remember expired (token is no longer valid) or extend_remember_period is true
-      def remember_me!(extend_period=false)
-        self.remember_token = self.class.remember_token if generate_remember_token?
-        self.remember_created_at = Time.now.utc if generate_remember_timestamp?(extend_period)
+      # TODO: We were used to receive a extend period argument but we no longer do.
+      # Remove this for Devise 4.0.
+      def remember_me!(*)
+        self.remember_token = self.class.remember_token if respond_to?(:remember_token)
+        self.remember_created_at ||= Time.now.utc
        save(validate: false) if self.changed?
      end

@@ -57,19 +57,13 @@ module Devise
      # it exists), and save the record without validations.
      def forget_me!
        return unless persisted?
-        self.remember_token = nil if respond_to?(:remember_token=)
+        self.remember_token = nil if respond_to?(:remember_token)
        self.remember_created_at = nil if self.class.expire_all_remember_me_on_sign_out
        save(validate: false)
      end

-      # Remember token should be expired if expiration time not overpass now.
-      def remember_expired?
-        remember_created_at.nil? || (remember_expires_at <= Time.now.utc)
-      end
-
-      # Remember token expires at created time + remember_for configuration
      def remember_expires_at
-        remember_created_at + self.class.remember_for
+        self.class.remember_for.from_now
      end

      def rememberable_value
@@ -102,29 +96,47 @@ module Devise
      def after_remembered
      end

-    protected
+      def remember_me?(token, generated_at)
+        # TODO: Normalize the JSON type coercion along with the Timeoutable hook
+        # in a single place https://github.com/plataformatec/devise/blob/ffe9d6d406e79108cf32a2c6a1d0b3828849c40b/lib/devise/hooks/timeoutable.rb#L14-L18
+        if generated_at.is_a?(String)
+          generated_at = time_from_json(generated_at)
+        end

-      def generate_remember_token? #:nodoc:
-        respond_to?(:remember_token) && remember_expired?
+        # The token is only valid if:
+        # 1. we have a date
+        # 2. the current time does not pass the expiry period
+        # 3. the record has a remember_created_at date
+        # 4. the token date is bigger than the remember_created_at
+        # 5. the token matches
+        generated_at.is_a?(Time) &&
+         (self.class.remember_for.ago < generated_at) &&
+         (generated_at > (remember_created_at || Time.now).utc) &&
+         Devise.secure_compare(rememberable_value, token)
      end

-      # Generate a timestamp if extend_remember_period is true, if no remember_token
-      # exists, or if an existing remember token has expired.
-      def generate_remember_timestamp?(extend_period) #:nodoc:
-        extend_period || remember_expired?
+      private
+
+      def time_from_json(value)
+        if value =~ /\A\d+\.\d+\Z/
+          Time.at(value.to_f)
+        else
+          Time.parse(value) rescue nil
+        end
      end

      module ClassMethods
        # Create the cookie key using the record id and remember_token
        def serialize_into_cookie(record)
-          [record.to_key, record.rememberable_value]
+          [record.to_key, record.rememberable_value, Time.now.utc.to_f.to_s]
        end

        # Recreate the user based on the stored cookie
-        def serialize_from_cookie(id, remember_token)
+        def serialize_from_cookie(*args)
+          id, token, generated_at = *args
+
          record = to_adapter.get(id)
-          record if record && !record.remember_expired? &&
-                    Devise.secure_compare(record.rememberable_value, remember_token)
+          record if record && record.remember_me?(token, generated_at)
        end

        # Generate a token checking if one does not already exist in the database.
@@ -135,6 +147,9 @@ module Devise
          end
        end

+        private
+
+        # TODO: extend_remember_period is no longer used
        Devise::Models.config(self, :remember_for, :extend_remember_period, :rememberable_options, :expire_all_remember_me_on_sign_out)
      end
    end
--- a/lib/devise/models/timeoutable.rb
+++ b/lib/devise/models/timeoutable.rb
@@ -26,7 +26,6 @@ module Devise

      # Checks whether the user session has expired based on configured time.
      def timedout?(last_access)
-        return false if remember_exists_and_not_expired?
        !timeout_in.nil? && last_access && last_access <= timeout_in.ago
      end

@@ -36,11 +35,6 @@ module Devise

      private

-      def remember_exists_and_not_expired?
-        return false unless respond_to?(:remember_created_at) && respond_to?(:remember_expired?)
-        remember_created_at && !remember_expired?
-      end
-
      module ClassMethods
        Devise::Models.config(self, :timeout_in)
      end
--- a/lib/devise/parameter_sanitizer.rb
+++ b/lib/devise/parameter_sanitizer.rb
@@ -1,99 +1,214 @@
 module Devise
-  class BaseSanitizer
-    attr_reader :params, :resource_name, :resource_class
+  # The +ParameterSanitizer+ deals with permitting specific parameters values
+  # for each +Devise+ scope in the application.
+  #
+  # The sanitizer knows about Devise default parameters (like +password+ and
+  # +password_confirmation+ for the `RegistrationsController`), and you can
+  # extend or change the permitted parameters list on your controllers.
+  #
+  # === Permitting new parameters
+  #
+  # You can add new parameters to the permitted list using the +permit+ method
+  # in a +before_action+ method, for instance.
+  #
+  #    class ApplicationController < ActionController::Base
+  #      before_action :configure_permitted_parameters, if: :devise_controller?
+  #
+  #      protected
+  #
+  #      def configure_permitted_parameters
+  #        # Permit the `subscribe_newsletter` parameter along with the other
+  #        # sign up parameters.
+  #        devise_parameter_sanitizer.permit(:sign_up, keys: [:subscribe_newsletter])
+  #      end
+  #    end
+  #
+  # Using a block yields an +ActionController::Parameters+ object so you can
+  # permit nested parameters and have more control over how the parameters are
+  # permitted in your controller.
+  #
+  #    def configure_permitted_parameters
+  #      devise_parameter_sanitizer.permit(:sign_up) do |user|
+  #        user.permit(newsletter_preferences: [])
+  #      end
+  #    end
+  class ParameterSanitizer
+    DEFAULT_PERMITTED_ATTRIBUTES = {
+      sign_in: [:password, :remember_me],
+      sign_up: [:password, :password_confirmation],
+      account_update: [:password, :password_confirmation, :current_password]
+    }

    def initialize(resource_class, resource_name, params)
-      @resource_class = resource_class
-      @resource_name  = resource_name
+      @auth_keys      = extract_auth_keys(resource_class)
      @params         = params
-      @blocks         = Hash.new
-    end
+      @resource_name  = resource_name
+      @permitted      = {}

-    def for(kind, &block)
-      if block_given?
-        @blocks[kind] = block
-      else
-        default_for(kind)
+      DEFAULT_PERMITTED_ATTRIBUTES.each_pair do |action, keys|
+        permit(action, keys: keys)
      end
    end

-    def sanitize(kind)
-      if block = @blocks[kind]
-        block.call(default_params)
+    # Sanitize the parameters for a specific +action+.
+    #
+    # === Arguments
+    #
+    # * +action+ - A +Symbol+ with the action that the controller is
+    #   performing, like +sign_up+, +sign_in+, etc.
+    #
+    # === Examples
+    #
+    #    # Inside the `RegistrationsController#create` action.
+    #    resource = build_resource(devise_parameter_sanitizer.sanitize(:sign_up))
+    #    resource.save
+    #
+    # Returns an +ActiveSupport::HashWithIndifferentAccess+ with the permitted
+    # attributes.
+    def sanitize(action)
+      permissions = @permitted[action]
+
+      # DEPRECATED: Remove this branch on Devise 4.1.
+      if respond_to?(action, true)
+        deprecate_instance_method_sanitization(action)
+        return cast_to_hash send(action)
+      end
+
+      if permissions.respond_to?(:call)
+        cast_to_hash permissions.call(default_params)
+      elsif permissions.present?
+        cast_to_hash permit_keys(default_params, permissions)
      else
-        default_sanitize(kind)
+        unknown_action!(action)
+      end
+    end
+
+    # Add or remove new parameters to the permitted list of an +action+.
+    #
+    # === Arguments
+    #
+    # * +action+ - A +Symbol+ with the action that the controller is
+    #   performing, like +sign_up+, +sign_in+, etc.
+    # * +keys:+     - An +Array+ of keys that also should be permitted.
+    # * +except:+   - An +Array+ of keys that shouldn't be permitted.
+    # * +block+     - A block that should be used to permit the action
+    #   parameters instead of the +Array+ based approach. The block will be
+    #   called with an +ActionController::Parameters+ instance.
+    #
+    # === Examples
+    #
+    #   # Adding new parameters to be permitted in the `sign_up` action.
+    #   devise_parameter_sanitizer.permit(:sign_up, keys: [:subscribe_newsletter])
+    #
+    #   # Removing the `password` parameter from the `account_update` action.
+    #   devise_parameter_sanitizer.permit(:account_update, except: [:password])
+    #
+    #   # Using the block form to completely override how we permit the
+    #   # parameters for the `sign_up` action.
+    #   devise_parameter_sanitizer.permit(:sign_up) do |user|
+    #     user.permit(:email, :password, :password_confirmation)
+    #   end
+    #
+    #
+    # Returns nothing.
+    def permit(action, keys: nil, except: nil, &block)
+      if block_given?
+        @permitted[action] = block
+      end
+
+      if keys.present?
+        @permitted[action] ||= @auth_keys.dup
+        @permitted[action].concat(keys)
+      end
+
+      if except.present?
+        @permitted[action] ||= @auth_keys.dup
+        @permitted[action] = @permitted[action] - except
+      end
+    end
+
+    # DEPRECATED: Remove this method on Devise 4.1.
+    def for(action, &block) # :nodoc:
+      if block_given?
+        deprecate_for_with_block(action)
+        permit(action, &block)
+      else
+        deprecate_for_without_block(action)
+        @permitted[action] or unknown_action!(action)
      end
    end

    private

-    def default_for(kind)
-      raise ArgumentError, "a block is expected in Devise base sanitizer"
-    end
-
-    def default_sanitize(kind)
-      default_params
+    # Cast a sanitized +ActionController::Parameters+ to a +HashWithIndifferentAccess+
+    # that can be used elsewhere.
+    #
+    # Returns an +ActiveSupport::HashWithIndifferentAccess+.
+    def cast_to_hash(params)
+      # TODO: Remove the `with_indifferent_access` method call when we only support Rails 5+.
+      params && params.to_h.with_indifferent_access
    end

    def default_params
-      params.fetch(resource_name, {})
-    end
-  end
-
-  class ParameterSanitizer < BaseSanitizer
-    def initialize(*)
-      super
-      @permitted = Hash.new { |h,k| h[k] = attributes_for(k) }
+      @params.fetch(@resource_name, {})
    end

-    def sign_in
-      permit self.for(:sign_in)
+    def permit_keys(parameters, keys)
+      parameters.permit(*keys)
    end

-    def sign_up
-      permit self.for(:sign_up)
+    def extract_auth_keys(klass)
+      auth_keys = klass.authentication_keys
+
+      auth_keys.respond_to?(:keys) ? auth_keys.keys : auth_keys
    end

-    def account_update
-      permit self.for(:account_update)
+    def unknown_action!(action)
+      raise NotImplementedError, <<-MESSAGE.strip_heredoc
+        "Devise doesn't know how to sanitize parameters for '#{action}'".
+        If you want to define a new set of parameters to be sanitized use the
+        `permit` method first:
+
+          devise_parameter_sanitizer.permit(:#{action}, keys: [:param1, param2, param3])
+      MESSAGE
    end

-    private
+    def deprecate_for_with_block(action)
+      ActiveSupport::Deprecation.warn(<<-MESSAGE.strip_heredoc)
+        [Devise] Changing the sanitized parameters through "#{self.class.name}#for(#{action}) is deprecated and it will be removed from Devise 4.1.
+        Please use the `permit` method:

-    # TODO: We do need to flatten so it works with strong_parameters
-    # gem. We should drop it once we move to Rails 4 only support.
-    def permit(keys)
-      default_params.permit(*Array(keys))
+          devise_parameter_sanitizer.permit(:#{action}) do |user|
+            # Your block here.
+          end
+      MESSAGE
    end

-    # Change for(kind) to return the values in the @permitted
-    # hash, allowing the developer to customize at runtime.
-    def default_for(kind)
-      @permitted[kind] || raise("No sanitizer provided for #{kind}")
+    def deprecate_for_without_block(action)
+      ActiveSupport::Deprecation.warn(<<-MESSAGE.strip_heredoc)
+        [Devise] Changing the sanitized parameters through "#{self.class.name}#for(#{action}) is deprecated and it will be removed from Devise 4.1.
+        Please use the `permit` method to add or remove any key:
+
+          To add any new key, use the `keys` keyword argument:
+          devise_parameter_sanitizer.permit(:#{action}, keys: [:param1, :param2, :param3])
+
+          To remove any existing key, use the `except` keyword argument:
+          devise_parameter_sanitizer.permit(:#{action}, except: [:email])
+      MESSAGE
    end

-    def default_sanitize(kind)
-      if respond_to?(kind, true)
-        send(kind)
-      else
-        raise NotImplementedError, "Devise doesn't know how to sanitize parameters for #{kind}"
-      end
-    end
+    def deprecate_instance_method_sanitization(action)
+      ActiveSupport::Deprecation.warn(<<-MESSAGE.strip_heredoc)
+        [Devise] Parameter sanitization through a "#{self.class.name}##{action}" method is deprecated and it will be removed from Devise 4.1.
+        Please use the `permit` method on your sanitizer `initialize` method.

-    def attributes_for(kind)
-      case kind
-      when :sign_in
-        auth_keys + [:password, :remember_me]
-      when :sign_up
-        auth_keys + [:password, :password_confirmation]
-      when :account_update
-        auth_keys + [:password, :password_confirmation, :current_password]
-      end
-    end
-
-    def auth_keys
-      @auth_keys ||= @resource_class.authentication_keys.respond_to?(:keys) ?
-                       @resource_class.authentication_keys.keys : @resource_class.authentication_keys
+          class #{self.class.name} < Devise::ParameterSanitizer
+            def initialize(*)
+              super
+              permit(:#{action}, keys: [:param1, :param2, :param3])
+            end
+          end
+      MESSAGE
    end
  end
 end
--- a/lib/devise/rails.rb
+++ b/lib/devise/rails.rb
@@ -39,18 +39,9 @@ module Devise
      Devise.token_generator ||=
        if secret_key = Devise.secret_key
          Devise::TokenGenerator.new(
-            Devise::CachingKeyGenerator.new(Devise::KeyGenerator.new(secret_key))
+            ActiveSupport::CachingKeyGenerator.new(ActiveSupport::KeyGenerator.new(secret_key))
          )
        end
    end
-
-    initializer "devise.fix_routes_proxy_missing_respond_to_bug" do
-      # Deprecate: Remove once we move to Rails 4 only.
-      ActionDispatch::Routing::RoutesProxy.class_eval do
-        def respond_to?(method, include_private = false)
-          super || routes.url_helpers.respond_to?(method)
-        end
-      end
-    end
  end
 end
--- a/lib/devise/rails/routes.rb
+++ b/lib/devise/rails/routes.rb
@@ -1,13 +1,10 @@
 require "active_support/core_ext/object/try"
 require "active_support/core_ext/hash/slice"

-module ActionDispatch::Routing
-  class RouteSet #:nodoc:
-    # Ensure Devise modules are included only after loading routes, because we
-    # need devise_for mappings already declared to create filters and helpers.
-    def finalize_with_devise!
-      result = finalize_without_devise!
-
+module Devise
+  module RouteSet
+    def finalize!
+      result = super
      @devise_finalized ||= begin
        if Devise.router_name.nil? && defined?(@devise_finalized) && self != Rails.application.try(:routes)
          warn "[DEVISE] We have detected that you are using devise_for inside engine routes. " \
@@ -21,10 +18,16 @@ module ActionDispatch::Routing
        Devise.regenerate_helpers!
        true
      end
-
      result
    end
-    alias_method_chain :finalize!, :devise
+  end
+end
+
+module ActionDispatch::Routing
+  class RouteSet #:nodoc:
+    # Ensure Devise modules are included only after loading routes, because we
+    # need devise_for mappings already declared to create filters and helpers.
+    prepend Devise::RouteSet
  end

  class Mapper
@@ -105,7 +108,7 @@ module ActionDispatch::Routing
    #      end
    #
    #      class ManagerController < ApplicationController
-    #        before_filter authenticate_manager!
+    #        before_action authenticate_manager!
    #
    #        def show
    #          @manager = current_manager
@@ -428,8 +431,12 @@ options to another `devise_for` call outside the scope. Here is an example:
    end
 ERROR
        end
-
-        path, @scope[:path] = @scope[:path], nil
+        current_scope = @scope.dup
+        if @scope.respond_to? :new
+          @scope = @scope.new path: nil
+        else
+          @scope[:path] = nil
+        end
        path_prefix = Devise.omniauth_path_prefix || "/#{mapping.fullpath}/auth".squeeze("/")

        set_omniauth_path_prefix!(path_prefix)
@@ -448,7 +455,7 @@ ERROR
          as: :omniauth_callback,
          via: [:get, :post]
      ensure
-        @scope[:path] = path
+        @scope = current_scope
      end

      def with_devise_exclusive_scope(new_path, new_as, options) #:nodoc:
@@ -457,7 +464,11 @@ ERROR
        exclusive = { as: new_as, path: new_path, module: nil }
        exclusive.merge!(options.slice(:constraints, :defaults, :options))

-        exclusive.each_pair { |key, value| @scope[key] = value }
+        if @scope.respond_to? :new
+          @scope = @scope.new exclusive
+        else
+          exclusive.each_pair { |key, value| @scope[key] = value }
+        end
        yield
      ensure
        @scope = current_scope
--- a/lib/devise/rails/warden_compat.rb
+++ b/lib/devise/rails/warden_compat.rb
@@ -3,17 +3,8 @@ module Warden::Mixins::Common
    @request ||= ActionDispatch::Request.new(env)
  end

-  # Deprecate: Remove this check once we move to Rails 4 only.
-  NULL_STORE =
-    defined?(ActionController::RequestForgeryProtection::ProtectionMethods::NullSession::NullSessionHash) ?
-      ActionController::RequestForgeryProtection::ProtectionMethods::NullSession::NullSessionHash : nil
-
  def reset_session!
-    # Calling reset_session on NULL_STORE causes it fail.
-    # This is a bug that needs to be fixed in Rails.
-    unless NULL_STORE && request.session.is_a?(NULL_STORE)
-      request.reset_session
-    end
+    request.reset_session
  end

  def cookies
--- a/lib/devise/test_helpers.rb
+++ b/lib/devise/test_helpers.rb
@@ -16,7 +16,10 @@ module Devise
    # Override process to consider warden.
    def process(*)
      # Make sure we always return @response, a la ActionController::TestCase::Behaviour#process, even if warden interrupts
-      _catch_warden { super } || @response
+      _catch_warden { super } # || @response  # _catch_warden will setup the @response object
+
+      # process needs to return the ActionDispath::TestResponse object
+      @response
    end

    # We need to setup the environment variables and the response in the controller.
@@ -109,8 +112,9 @@ module Devise

        status, headers, response = Devise.warden_config[:failure_app].call(env).to_a
        @controller.response.headers.merge!(headers)
-        @controller.send :render, status: status, text: response.body,
-          content_type: headers["Content-Type"], location: headers["Location"]
+        r_opts = { status: status, content_type: headers["Content-Type"], location: headers["Location"] }
+        r_opts[Rails.version.start_with?('5') ? :body : :text] = response.body
+        @controller.send :render, r_opts
        nil # causes process return @response
      end

@@ -122,7 +126,8 @@ module Devise
        # ensure the controller response is set to our response.
        @controller.response ||= @response
        @response.status = ret.first
-        @response.headers = ret.second
+        @response.headers.clear
+        ret.second.each { |k,v| @response[k] = v }
        @response.body = ret.third
      end

--- a/lib/devise/token_generator.rb
+++ b/lib/devise/token_generator.rb
@@ -1,11 +1,8 @@
-# Deprecate: Copied verbatim from Rails source, remove once we move to Rails 4 only.
-require 'thread_safe'
 require 'openssl'
-require 'securerandom'

 module Devise
  class TokenGenerator
-    def initialize(key_generator, digest="SHA256")
+    def initialize(key_generator, digest = "SHA256")
      @key_generator = key_generator
      @digest = digest
    end
@@ -30,41 +27,4 @@ module Devise
      @key_generator.generate_key("Devise #{column}")
    end
  end
-
-  # KeyGenerator is a simple wrapper around OpenSSL's implementation of PBKDF2
-  # It can be used to derive a number of keys for various purposes from a given secret.
-  # This lets Rails applications have a single secure secret, but avoid reusing that
-  # key in multiple incompatible contexts.
-  class KeyGenerator
-    def initialize(secret, options = {})
-      @secret = secret
-      # The default iterations are higher than required for our key derivation uses
-      # on the off chance someone uses this for password storage
-      @iterations = options[:iterations] || 2**16
-    end
-
-    # Returns a derived key suitable for use.  The default key_size is chosen
-    # to be compatible with the default settings of ActiveSupport::MessageVerifier.
-    # i.e. OpenSSL::Digest::SHA1#block_length
-    def generate_key(salt, key_size=64)
-      OpenSSL::PKCS5.pbkdf2_hmac_sha1(@secret, salt, @iterations, key_size)
-    end
-  end
-
-  # CachingKeyGenerator is a wrapper around KeyGenerator which allows users to avoid
-  # re-executing the key generation process when it's called using the same salt and
-  # key_size
-  class CachingKeyGenerator
-    def initialize(key_generator)
-      @key_generator = key_generator
-      @cache_keys = ThreadSafe::Cache.new
-    end
-
-    # Returns a derived key suitable for use.  The default key_size is chosen
-    # to be compatible with the default settings of ActiveSupport::MessageVerifier.
-    # i.e. OpenSSL::Digest::SHA1#block_length
-    def generate_key(salt, key_size=64)
-      @cache_keys["#{salt}#{key_size}"] ||= @key_generator.generate_key(salt, key_size)
-    end
-  end
 end
--- a/lib/devise/version.rb
+++ b/lib/devise/version.rb
@@ -1,3 +1,3 @@
 module Devise
-  VERSION = "3.5.3".freeze
+  VERSION = "4.0.0.rc1".freeze
 end
--- a/lib/generators/active_record/devise_generator.rb
+++ b/lib/generators/active_record/devise_generator.rb
@@ -75,11 +75,11 @@ RUBY
      end

      def inet?
-        rails4? && postgresql?
+        postgresql?
      end

-      def rails4?
-        Rails.version.start_with? '4'
+      def rails5?
+        Rails.version.start_with? '5'
      end

      def postgresql?
--- a/lib/generators/active_record/templates/migration.rb
+++ b/lib/generators/active_record/templates/migration.rb
@@ -1,6 +1,6 @@
 class DeviseCreate<%= table_name.camelize %> < ActiveRecord::Migration
  def change
-    create_table(:<%= table_name %>) do |t|
+    create_table :<%= table_name %> do |t|
 <%= migration_data -%>

 <% attributes.each  do |attribute| -%>
--- a/lib/generators/active_record/templates/migration_existing.rb
+++ b/lib/generators/active_record/templates/migration_existing.rb
@@ -1,6 +1,6 @@
 class AddDeviseTo<%= table_name.camelize %> < ActiveRecord::Migration
  def self.up
-    change_table(:<%= table_name %>) do |t|
+    change_table :<%= table_name %> do |t|
 <%= migration_data -%>

 <% attributes.each  do |attribute| -%>
--- a/lib/generators/devise/orm_helpers.rb
+++ b/lib/generators/devise/orm_helpers.rb
@@ -8,27 +8,10 @@ module Devise
  devise :database_authenticatable, :registerable,
         :recoverable, :rememberable, :trackable, :validatable

-CONTENT
-        buffer += <<-CONTENT if needs_attr_accessible?
-  # Setup accessible (or protected) attributes for your model
-  attr_accessible :email, :password, :password_confirmation, :remember_me
-
 CONTENT
        buffer
      end

-      def needs_attr_accessible?
-        rails_3? && !strong_parameters_enabled?
-      end
-
-      def rails_3?
-        Rails::VERSION::MAJOR == 3
-      end
-
-      def strong_parameters_enabled?
-        defined?(ActionController::StrongParameters)
-      end
-
      private

      def model_exists?
--- a/lib/generators/templates/controllers/registrations_controller.rb
+++ b/lib/generators/templates/controllers/registrations_controller.rb
@@ -1,6 +1,6 @@
 class <%= @scope_prefix %>RegistrationsController < Devise::RegistrationsController
-# before_filter :configure_sign_up_params, only: [:create]
-# before_filter :configure_account_update_params, only: [:update]
+# before_action :configure_sign_up_params, only: [:create]
+# before_action :configure_account_update_params, only: [:update]

  # GET /resource/sign_up
  # def new
@@ -40,12 +40,12 @@ class <%= @scope_prefix %>RegistrationsController < Devise::RegistrationsControl

  # If you have extra params to permit, append them to the sanitizer.
  # def configure_sign_up_params
-  #   devise_parameter_sanitizer.for(:sign_up) << :attribute
+  #   devise_parameter_sanitizer.permit(:sign_up, keys: [:attribute])
  # end

  # If you have extra params to permit, append them to the sanitizer.
  # def configure_account_update_params
-  #   devise_parameter_sanitizer.for(:account_update) << :attribute
+  #   devise_parameter_sanitizer.permit(:account_update, keys: [:attribute])
  # end

  # The path used after sign up.
--- a/lib/generators/templates/controllers/sessions_controller.rb
+++ b/lib/generators/templates/controllers/sessions_controller.rb
@@ -1,5 +1,5 @@
 class <%= @scope_prefix %>SessionsController < Devise::SessionsController
-# before_filter :configure_sign_in_params, only: [:create]
+# before_action :configure_sign_in_params, only: [:create]

  # GET /resource/sign_in
  # def new
@@ -20,6 +20,6 @@ class <%= @scope_prefix %>SessionsController < Devise::SessionsController

  # If you have extra params to permit, append them to the sanitizer.
  # def configure_sign_in_params
-  #   devise_parameter_sanitizer.for(:sign_in) << :attribute
+  #   devise_parameter_sanitizer.permit(:sign_in, keys: [:attribute])
  # end
 end
--- a/lib/generators/templates/devise.rb
+++ b/lib/generators/templates/devise.rb
@@ -4,13 +4,9 @@ Devise.setup do |config|
  # The secret key used by Devise. Devise uses this key to generate
  # random tokens. Changing this key will render invalid all existing
  # confirmation, reset password and unlock tokens in the database.
-  # Devise will use the `secret_key_base` on Rails 4+ applications as its `secret_key`
+  # Devise will use the `secret_key_base` as its `secret_key`
  # by default. You can change it below and use your own secret key.
-<% if  rails_4? -%>
  # config.secret_key = '<%= SecureRandom.hex(64) %>'
-<% else -%>
-  config.secret_key = '<%= SecureRandom.hex(64) %>'
-<% end -%>

  # ==> Mailer Configuration
  # Configure the e-mail address which will be shown in Devise::Mailer,
@@ -21,6 +17,9 @@ Devise.setup do |config|
  # Configure the class responsible to send e-mails.
  # config.mailer = 'Devise::Mailer'

+  # Configure the parent class responsible to send e-mails.
+  # config.parent_mailer = 'ActionMailer::Base'
+
  # ==> ORM configuration
  # Load and configure the ORM. Supports :active_record (default) and
  # :mongoid (bson_ext recommended) by default. Other ORMs may be
--- a/script/cached-bundle
+++ b/script/cached-bundle
@@ -1,49 +0,0 @@
-#!/usr/bin/env bash
-# Usage: cached-bundle install --deployment
-#
-# After running `bundle`, caches the `vendor/bundle` directory to S3.
-# On the next run, restores the cached directory before running `bundle`.
-# When `Gemfile.lock` changes, the cache gets rebuilt.
-#
-# Requirements:
-# - Gemfile.lock
-# - TRAVIS_REPO_SLUG
-# - TRAVIS_RUBY_VERSION
-# - AMAZON_S3_BUCKET
-# - script/s3-put
-# - bundle
-# - curl
-#
-# Author: Mislav Marohnić
-
-set -e
-
-compute_md5() {
-  local output="$(openssl md5)"
-  echo "${output##* }"
-}
-
-download() {
-  curl --tcp-nodelay -qsfL "$1" -o "$2"
-}
-
-
-gemfile="${BUNDLE_GEMFILE:-Gemfile}"
-bundle_fullpath="$(dirname $gemfile)/vendor/bundle"
-bundle_path=${bundle_fullpath#$PWD/}
-gemfile_hash="$(compute_md5 <"${gemfile}.lock")"
-cache_name="${TRAVIS_RUBY_VERSION}-${gemfile_hash}.tgz"
-fetch_url="http://${AMAZON_S3_BUCKET}.s3.amazonaws.com/${TRAVIS_REPO_SLUG}/${cache_name}"
-
-if download "$fetch_url" "$cache_name"; then
-  echo "Reusing cached bundle ${cache_name}"
-  tar xzf "$cache_name"
-fi
-
-bundle "$@"
-
-if [ ! -f "$cache_name" ] && [ -n "$AMAZON_SECRET_ACCESS_KEY" ]; then
-  echo "Caching \`${bundle_path}' to S3"
-  tar czf "$cache_name" "$bundle_path"
-  script/s3-put "$cache_name" "${AMAZON_S3_BUCKET}:${TRAVIS_REPO_SLUG}/${cache_name}"
-fi
--- a/script/s3-put
+++ b/script/s3-put
@@ -1,71 +0,0 @@
-#!/usr/bin/env bash
-# Usage: s3-put <FILE> <S3_BUCKET>[:<PATH>] [<CONTENT_TYPE>]
-#
-# Uploads a file to the Amazon S3 service.
-# Outputs the URL for the newly uploaded file.
-#
-# Requirements:
-# - AMAZON_ACCESS_KEY_ID
-# - AMAZON_SECRET_ACCESS_KEY
-# - openssl
-# - curl
-#
-# Author: Mislav Marohnić
-
-set -e
-
-authorization() {
-  local signature="$(string_to_sign | hmac_sha1 | base64)"
-  echo "AWS ${AMAZON_ACCESS_KEY_ID?}:${signature}"
-}
-
-hmac_sha1() {
-  openssl dgst -binary -sha1 -hmac "${AMAZON_SECRET_ACCESS_KEY?}"
-}
-
-base64() {
-  openssl enc -base64
-}
-
-bin_md5() {
-  openssl dgst -binary -md5
-}
-
-string_to_sign() {
-  echo "$http_method"
-  echo "$content_md5"
-  echo "$content_type"
-  echo "$date"
-  echo "x-amz-acl:$acl"
-  printf "/$bucket/$remote_path"
-}
-
-date_string() {
-  LC_TIME=C date "+%a, %d %h %Y %T %z"
-}
-
-file="$1"
-bucket="${2%%:*}"
-remote_path="${2#*:}"
-content_type="$3"
-
-if [ -z "$remote_path" ] || [ "$remote_path" = "$bucket" ]; then
-  remote_path="${file##*/}"
-fi
-
-http_method=PUT
-acl="public-read"
-content_md5="$(bin_md5 < "$file" | base64)"
-date="$(date_string)"
-
-url="https://$bucket.s3.amazonaws.com/$remote_path"
-
-curl -qsSf -T "$file" \
-  -H "Authorization: $(authorization)" \
-  -H "x-amz-acl: $acl" \
-  -H "Date: $date" \
-  -H "Content-MD5: $content_md5" \
-  -H "Content-Type: $content_type" \
-  "$url"
-
-echo "$url"
--- a/test/controllers/custom_registrations_controller_test.rb
+++ b/test/controllers/custom_registrations_controller_test.rb
@@ -1,6 +1,6 @@
 require 'test_helper'

-class CustomRegistrationsControllerTest < ActionController::TestCase
+class CustomRegistrationsControllerTest < Devise::ControllerTestCase
  tests Custom::RegistrationsController

  include Devise::TestHelpers
@@ -12,24 +12,24 @@ class CustomRegistrationsControllerTest < ActionController::TestCase
  end

  test "yield resource to block on create success" do
-    post :create, { user: { email: "user@example.org", password: "password", password_confirmation: "password" } }
+    post :create, params: { user: { email: "user@example.org", password: "password", password_confirmation: "password" } }
    assert @controller.create_block_called?, "create failed to yield resource to provided block"
  end

  test "yield resource to block on create failure" do
-    post :create, { user: { } }
+    post :create, params: { user: { } }
    assert @controller.create_block_called?, "create failed to yield resource to provided block"
  end

  test "yield resource to block on update success" do
    sign_in @user
-    put :update, { user: { current_password: @password } }
+    put :update, params: { user: { current_password: @password } }
    assert @controller.update_block_called?, "update failed to yield resource to provided block"
  end

  test "yield resource to block on update failure" do
    sign_in @user
-    put :update, { user: { } }
+    put :update, params: { user: { } }
    assert @controller.update_block_called?, "update failed to yield resource to provided block"
  end

--- a/test/controllers/custom_strategy_test.rb
+++ b/test/controllers/custom_strategy_test.rb
@@ -24,7 +24,7 @@ class CustomStrategy < Warden::Strategies::Base
  end
 end

-class CustomStrategyTest < ActionController::TestCase
+class CustomStrategyTest < Devise::ControllerTestCase
  tests CustomStrategyController

  include Devise::TestHelpers
@@ -41,8 +41,9 @@ class CustomStrategyTest < ActionController::TestCase
    ret = get :new

    # check the returned rack array
-    assert ret.is_a?(Array)
-    assert_equal 400, ret.first
+    # assert ret.is_a?(Array)
+    # assert_equal 400, ret.first
+    assert ret.is_a?(ActionDispatch::TestResponse)

    # check the saved response as well. This is purely so that the response is available to the testing framework
    # for verification. In production, the above array would be delivered directly to Rack.
@@ -53,8 +54,9 @@ class CustomStrategyTest < ActionController::TestCase
    ret = get :new

    # check the returned rack array
-    assert ret.is_a?(Array)
-    assert_equal ret.third['X-FOO'], 'BAR'
+    # assert ret.is_a?(Array)
+    # assert_equal ret.third['X-FOO'], 'BAR'
+    assert ret.is_a?(ActionDispatch::TestResponse)

    # check the saved response headers as well.
    assert_equal response.headers['X-FOO'], 'BAR'
--- a/test/controllers/helper_methods_test.rb
+++ b/test/controllers/helper_methods_test.rb
@@ -4,14 +4,15 @@ class ApiController < ActionController::Metal
  include Devise::Controllers::Helpers
 end

-class HelperMethodsTest < ActionController::TestCase
+class HelperMethodsTest < Devise::ControllerTestCase
  tests ApiController

  test 'includes Devise::Controllers::Helpers' do
    assert_includes @controller.class.ancestors, Devise::Controllers::Helpers
  end

-  test 'does not respond_to helper_method' do
+  test 'does not respond_to helper or helper_method' do
+    refute_respond_to @controller.class, :helper
    refute_respond_to @controller.class, :helper_method
  end

--- a/test/controllers/helpers_test.rb
+++ b/test/controllers/helpers_test.rb
@@ -1,7 +1,7 @@
 require 'test_helper'
 require 'ostruct'

-class ControllerAuthenticatableTest < ActionController::TestCase
+class ControllerAuthenticatableTest < Devise::ControllerTestCase
  tests ApplicationController

  def setup
--- a/test/controllers/inherited_controller_i18n_messages_test.rb
+++ b/test/controllers/inherited_controller_i18n_messages_test.rb
@@ -14,7 +14,7 @@ class AnotherInheritedController < SessionsInheritedController
  end
 end

-class InheritedControllerTest < ActionController::TestCase
+class InheritedControllerTest < Devise::ControllerTestCase
  tests SessionsInheritedController

  def setup
@@ -32,7 +32,7 @@ class InheritedControllerTest < ActionController::TestCase
  end
 end

-class AnotherInheritedControllerTest < ActionController::TestCase
+class AnotherInheritedControllerTest < Devise::ControllerTestCase
  tests AnotherInheritedController

  def setup
--- a/test/controllers/internal_helpers_test.rb
+++ b/test/controllers/internal_helpers_test.rb
@@ -3,7 +3,7 @@ require 'test_helper'
 class MyController < DeviseController
 end

-class HelpersTest < ActionController::TestCase
+class HelpersTest < Devise::ControllerTestCase
  tests MyController

  def setup
@@ -36,18 +36,16 @@ class HelpersTest < ActionController::TestCase
  test 'get resource params from request params using resource name as key' do
    user_params = {'email' => 'shirley@templar.com'}

-    params = if Devise.rails4?
-      # Stub controller name so strong parameters can filter properly.
-      # DeviseController does not allow any parameters by default.
-      @controller.stubs(:controller_name).returns(:sessions_controller)
+    # Stub controller name so strong parameters can filter properly.
+    # DeviseController does not allow any parameters by default.
+    @controller.stubs(:controller_name).returns(:sessions_controller)
+
+    params = ActionController::Parameters.new({'user' => user_params})

-      ActionController::Parameters.new({'user' => user_params})
-    else
-      HashWithIndifferentAccess.new({'user' => user_params})
-    end
    @controller.stubs(:params).returns(params)

-    assert_equal user_params, @controller.send(:resource_params)
+    res_params = @controller.send(:resource_params).permit!.to_h
+    assert_equal user_params, res_params
  end

  test 'resources methods are not controller actions' do
--- a/test/controllers/load_hooks_controller_test.rb
+++ b/test/controllers/load_hooks_controller_test.rb
@@ -1,6 +1,6 @@
 require 'test_helper'

-class LoadHooksControllerTest < ActionController::TestCase
+class LoadHooksControllerTest < Devise::ControllerTestCase
  setup do
    ActiveSupport.on_load(:devise_controller) do
      define_method :defined_by_load_hook do
--- a/test/controllers/passwords_controller_test.rb
+++ b/test/controllers/passwords_controller_test.rb
@@ -1,6 +1,6 @@
 require 'test_helper'

-class PasswordsControllerTest < ActionController::TestCase
+class PasswordsControllerTest < Devise::ControllerTestCase
  tests Devise::PasswordsController
  include Devise::TestHelpers

@@ -11,8 +11,9 @@ class PasswordsControllerTest < ActionController::TestCase
  end

  def put_update_with_params
-    put :update, "user" => {
-      "reset_password_token" => @raw, "password" => "1234567", "password_confirmation" => "1234567"
+    put :update, params: { "user" => {
+        "reset_password_token" => @raw, "password" => "1234567", "password_confirmation" => "1234567"
+      }
    }
  end

--- a/test/controllers/sessions_controller_test.rb
+++ b/test/controllers/sessions_controller_test.rb
@@ -1,6 +1,6 @@
 require 'test_helper'

-class SessionsControllerTest < ActionController::TestCase
+class SessionsControllerTest < Devise::ControllerTestCase
  tests Devise::SessionsController
  include Devise::TestHelpers

@@ -12,9 +12,10 @@ class SessionsControllerTest < ActionController::TestCase
      request.env["devise.mapping"] = Devise.mappings[:user]
      request.session["user_return_to"] = 'foo.bar'
      create_user
-      post :create, user: {
-        email: "wrong@email.com",
-        password: "wrongpassword"
+      post :create, params: { user: {
+          email: "wrong@email.com",
+          password: "wrongpassword"
+        }
      }
      assert_equal 200, @response.status
    ensure
@@ -37,11 +38,11 @@ class SessionsControllerTest < ActionController::TestCase

    user = create_user
    user.confirm
-    post :create, user: {
-      email: user.email,
-      password: user.password
+    post :create, params: { user: {
+        email: user.email,
+        password: user.password
+      }
    }
-
    assert_nil request.session["user_return_to"]
  end

@@ -51,9 +52,10 @@ class SessionsControllerTest < ActionController::TestCase

    user = create_user
    user.confirm
-    post :create, format: 'json', user: {
-      email: user.email,
-      password: user.password
+    post :create, params: { format: 'json', user: {
+        email: user.email,
+        password: user.password
+      }
    }

    assert_equal 'foo.bar', request.session["user_return_to"]
@@ -61,9 +63,10 @@ class SessionsControllerTest < ActionController::TestCase

  test "#create doesn't raise exception after Warden authentication fails when TestHelpers included" do
    request.env["devise.mapping"] = Devise.mappings[:user]
-    post :create, user: {
-      email: "nosuchuser@example.com",
-      password: "wevdude"
+    post :create, params: { user: {
+        email: "nosuchuser@example.com",
+        password: "wevdude"
+      }
    }
    assert_equal 200, @response.status
    assert_template "devise/sessions/new"
@@ -73,11 +76,11 @@ class SessionsControllerTest < ActionController::TestCase
    request.env["devise.mapping"] = Devise.mappings[:user]
    user = create_user
    user.confirm
-    post :create, format: 'json', user: {
-      email: user.email,
-      password: user.password
+    post :create, params: { format: 'json', user: {
+        email: user.email,
+        password: user.password
+      }
    }
-
    delete :destroy, format: 'json'
    assert flash[:notice].blank?, "flash[:notice] should be blank, not #{flash[:notice].inspect}"
    assert_equal 204, @response.status
--- a/test/controllers/url_helpers_test.rb
+++ b/test/controllers/url_helpers_test.rb
@@ -1,6 +1,6 @@
 require 'test_helper'

-class RoutesTest < ActionController::TestCase
+class RoutesTest < Devise::ControllerTestCase
  tests ApplicationController

  def assert_path_and_url(name, prepend_path=nil)
--- a/test/failure_app_test.rb
+++ b/test/failure_app_test.rb
@@ -53,11 +53,16 @@ class FailureTest < ActiveSupport::TestCase
      'REQUEST_METHOD' => 'GET',
      'warden.options' => { scope: :user },
      'rack.session' => {},
-      'action_dispatch.request.formats' => Array(env_params.delete('formats') || Mime::HTML),
+      'action_dispatch.request.formats' => Array(env_params.delete('formats') || Mime[:html]),
      'rack.input' => "",
      'warden' => OpenStruct.new(message: nil)
    }.merge!(env_params)

+    # Passing nil for action_dispatch.request.formats prevents the default from being used in Rails 5, need to remove it
+    if env.has_key?('action_dispatch.request.formats') && env['action_dispatch.request.formats'].nil?
+      env.delete 'action_dispatch.request.formats' unless env['action_dispatch.request.formats']
+    end
+
    @response = (env.delete(:app) || Devise::FailureApp).call(env).to_a
    @request  = ActionDispatch::Request.new(env)
  end
@@ -164,14 +169,14 @@ class FailureTest < ActiveSupport::TestCase

    test 'works for any navigational format' do
      swap Devise, navigational_formats: [:xml] do
-        call_failure('formats' => Mime::XML)
+        call_failure('formats' => Mime[:xml])
        assert_equal 302, @response.first
      end
    end

    test 'redirects the correct format if it is a non-html format request' do
      swap Devise, navigational_formats: [:js] do
-        call_failure('formats' => Mime::JS)
+        call_failure('formats' => Mime[:js])
        assert_equal 'http://test.host/users/sign_in.js', @response.second["Location"]
      end
    end
@@ -179,18 +184,18 @@ class FailureTest < ActiveSupport::TestCase

  context 'For HTTP request' do
    test 'return 401 status' do
-      call_failure('formats' => Mime::XML)
+      call_failure('formats' => Mime[:xml])
      assert_equal 401, @response.first
    end

    test 'return appropriate body for xml' do
-      call_failure('formats' => Mime::XML)
+      call_failure('formats' => Mime[:xml])
      result = %(<?xml version="1.0" encoding="UTF-8"?>\n<errors>\n  <error>You need to sign in or sign up before continuing.</error>\n</errors>\n)
      assert_equal result, @response.last.body
    end

    test 'return appropriate body for json' do
-      call_failure('formats' => Mime::JSON)
+      call_failure('formats' => Mime[:json])
      result = %({"error":"You need to sign in or sign up before continuing."})
      assert_equal result, @response.last.body
    end
@@ -201,26 +206,26 @@ class FailureTest < ActiveSupport::TestCase
    end

    test 'return WWW-authenticate headers if model allows' do
-      call_failure('formats' => Mime::XML)
+      call_failure('formats' => Mime[:xml])
      assert_equal 'Basic realm="Application"', @response.second["WWW-Authenticate"]
    end

    test 'does not return WWW-authenticate headers if model does not allow' do
      swap Devise, http_authenticatable: false do
-        call_failure('formats' => Mime::XML)
+        call_failure('formats' => Mime[:xml])
        assert_nil @response.second["WWW-Authenticate"]
      end
    end

    test 'works for any non navigational format' do
      swap Devise, navigational_formats: [] do
-        call_failure('formats' => Mime::HTML)
+        call_failure('formats' => Mime[:html])
        assert_equal 401, @response.first
      end
    end

    test 'uses the failure message as response body' do
-      call_failure('formats' => Mime::XML, 'warden' => OpenStruct.new(message: :invalid))
+      call_failure('formats' => Mime[:xml], 'warden' => OpenStruct.new(message: :invalid))
      assert_match '<error>Invalid email or password.</error>', @response.third.body
    end

@@ -228,7 +233,7 @@ class FailureTest < ActiveSupport::TestCase
      context 'when http_authenticatable_on_xhr is false' do
        test 'dont return 401 with navigational formats' do
          swap Devise, http_authenticatable_on_xhr: false do
-            call_failure('formats' => Mime::HTML, 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest')
+            call_failure('formats' => Mime[:html], 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest')
            assert_equal 302, @response.first
            assert_equal 'http://test.host/users/sign_in', @response.second["Location"]
          end
@@ -236,7 +241,7 @@ class FailureTest < ActiveSupport::TestCase

        test 'dont return 401 with non navigational formats' do
          swap Devise, http_authenticatable_on_xhr: false do
-            call_failure('formats' => Mime::JSON, 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest')
+            call_failure('formats' => Mime[:json], 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest')
            assert_equal 302, @response.first
            assert_equal 'http://test.host/users/sign_in.json', @response.second["Location"]
          end
@@ -246,14 +251,14 @@ class FailureTest < ActiveSupport::TestCase
      context 'when http_authenticatable_on_xhr is true' do
        test 'return 401' do
          swap Devise, http_authenticatable_on_xhr: true do
-            call_failure('formats' => Mime::HTML, 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest')
+            call_failure('formats' => Mime[:html], 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest')
            assert_equal 401, @response.first
          end
        end

        test 'skip WWW-Authenticate header' do
          swap Devise, http_authenticatable_on_xhr: true do
-            call_failure('formats' => Mime::HTML, 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest')
+            call_failure('formats' => Mime[:html], 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest')
            assert_nil @response.second['WWW-Authenticate']
          end
        end
--- a/test/generators/active_record_generator_test.rb
+++ b/test/generators/active_record_generator_test.rb
@@ -69,7 +69,6 @@ if DEVISE_ORM == :active_record
    setup :prepare_destination

    test "all files are properly created in rails 4.0" do
-      ActiveRecord::Generators::DeviseGenerator.any_instance.stubs(:rails_3?).returns(false)
      simulate_inside_engine(RailsEngine::Engine, RailsEngine) do
        run_generator ["monster"]

@@ -80,30 +79,5 @@ if DEVISE_ORM == :active_record
      end
    end

-    test "all files are properly created in rails 3.2 when strong_parameters gem is not installed" do
-      ActiveRecord::Generators::DeviseGenerator.any_instance.stubs(:rails_3?).returns(true)
-      ActiveRecord::Generators::DeviseGenerator.any_instance.stubs(:strong_parameters_enabled?).returns(false)
-      simulate_inside_engine(RailsEngine::Engine, RailsEngine) do
-        run_generator ["monster"]
-
-        assert_file "app/models/rails_engine/monster.rb", /devise/
-        assert_file "app/models/rails_engine/monster.rb" do |content|
-          assert_match /attr_accessible :email/, content
-        end
-      end
-    end
-
-    test "all files are properly created in rails 3.2 when strong_parameters gem is installed" do
-      ActiveRecord::Generators::DeviseGenerator.any_instance.stubs(:rails_3?).returns(true)
-      ActiveRecord::Generators::DeviseGenerator.any_instance.stubs(:strong_parameters_enabled?).returns(true)
-      simulate_inside_engine(RailsEngine::Engine, RailsEngine) do
-        run_generator ["monster"]
-
-        assert_file "app/models/rails_engine/monster.rb", /devise/
-        assert_file "app/models/rails_engine/monster.rb" do |content|
-          assert_no_match /attr_accessible :email/, content
-        end
-      end
-    end
  end
 end
--- a/test/helpers/devise_helper_test.rb
+++ b/test/helpers/devise_helper_test.rb
@@ -1,6 +1,6 @@
 require 'test_helper'

-class DeviseHelperTest < ActionDispatch::IntegrationTest
+class DeviseHelperTest < Devise::IntegrationTest
  setup do
    model_labels = { models: { user: "the user" } }
    translations = {
--- a/test/integration/authenticatable_test.rb
+++ b/test/integration/authenticatable_test.rb
@@ -1,6 +1,6 @@
 require 'test_helper'

-class AuthenticationSanityTest < ActionDispatch::IntegrationTest
+class AuthenticationSanityTest < Devise::IntegrationTest
  test 'home should be accessible without sign in' do
    visit '/'
    assert_response :success
@@ -134,7 +134,7 @@ class AuthenticationSanityTest < ActionDispatch::IntegrationTest
  end
 end

-class AuthenticationRoutesRestrictions < ActionDispatch::IntegrationTest
+class AuthenticationRoutesRestrictions < Devise::IntegrationTest
  test 'not signed in should not be able to access private route (authenticate denied)' do
    get private_path
    assert_redirected_to new_admin_session_path
@@ -254,7 +254,7 @@ class AuthenticationRoutesRestrictions < ActionDispatch::IntegrationTest
  end
 end

-class AuthenticationRedirectTest < ActionDispatch::IntegrationTest
+class AuthenticationRedirectTest < Devise::IntegrationTest
  test 'redirect from warden shows sign in or sign up message' do
    get admins_path

@@ -300,7 +300,7 @@ class AuthenticationRedirectTest < ActionDispatch::IntegrationTest
  end

  test 'xml http requests does not store urls for redirect' do
-    get users_path, {}, 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest'
+    get users_path, headers: { 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest' }
    assert_equal 401, response.status
    assert_nil session[:"user_return_to"]
  end
@@ -317,7 +317,7 @@ class AuthenticationRedirectTest < ActionDispatch::IntegrationTest
  end
 end

-class AuthenticationSessionTest < ActionDispatch::IntegrationTest
+class AuthenticationSessionTest < Devise::IntegrationTest
  test 'destroyed account is signed out' do
    sign_in_as_user
    get '/users'
@@ -390,7 +390,7 @@ class AuthenticationSessionTest < ActionDispatch::IntegrationTest
  end
 end

-class AuthenticationWithScopedViewsTest < ActionDispatch::IntegrationTest
+class AuthenticationWithScopedViewsTest < Devise::IntegrationTest
  test 'renders the scoped view if turned on and view is available' do
    swap Devise, scoped_views: true do
      assert_raise Webrat::NotFoundError do
@@ -431,7 +431,7 @@ class AuthenticationWithScopedViewsTest < ActionDispatch::IntegrationTest
  end
 end

-class AuthenticationOthersTest < ActionDispatch::IntegrationTest
+class AuthenticationOthersTest < Devise::IntegrationTest
  test 'handles unverified requests gets rid of caches' do
    swap ApplicationController, allow_forgery_protection: true do
      post exhibit_user_url(1)
@@ -472,7 +472,7 @@ class AuthenticationOthersTest < ActionDispatch::IntegrationTest

  test 'sign in with script name' do
    assert_nothing_raised do
-      get new_user_session_path, {}, "SCRIPT_NAME" => "/omg"
+      get new_user_session_path, headers: { "SCRIPT_NAME" => "/omg" }
      fill_in "email", with: "user@test.com"
    end
  end
@@ -509,7 +509,7 @@ class AuthenticationOthersTest < ActionDispatch::IntegrationTest

  test 'sign in with xml format returns xml response' do
    create_user
-    post user_session_path(format: 'xml'), user: {email: "user@test.com", password: '12345678'}
+    post user_session_path(format: 'xml'), params: { user: {email: "user@test.com", password: '12345678'} }
    assert_response :success
    assert response.body.include? %(<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<user>)
  end
@@ -519,13 +519,13 @@ class AuthenticationOthersTest < ActionDispatch::IntegrationTest
    assert_response :success

    create_user
-    post user_session_path(format: 'xml'), user: {email: "user@test.com", password: '12345678'}
+    post user_session_path(format: 'xml'), params: { user: {email: "user@test.com", password: '12345678'} }
    assert_response :success

    get new_user_session_path(format: 'xml')
    assert_response :success

-    post user_session_path(format: 'xml'), user: {email: "user@test.com", password: '12345678'}
+    post user_session_path(format: 'xml'), params: { user: {email: "user@test.com", password: '12345678'} }
    assert_response :success
    assert response.body.include? %(<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<user>)
  end
@@ -559,7 +559,7 @@ class AuthenticationOthersTest < ActionDispatch::IntegrationTest
  test 'sign out with non-navigational format via XHR does not redirect' do
    swap Devise, navigational_formats: ['*/*', :html] do
      sign_in_as_user
-      xml_http_request :get, destroy_user_session_path, {}, { "HTTP_ACCEPT" => "application/json,text/javascript,*/*" } # NOTE: Bug is triggered by combination of XHR and */*.
+      get destroy_user_session_path, xhr: true, headers: { "HTTP_ACCEPT" => "application/json,text/javascript,*/*" } # NOTE: Bug is triggered by combination of XHR and */*.
      assert_response :no_content
      assert_not warden.authenticated?(:user)
    end
@@ -569,14 +569,14 @@ class AuthenticationOthersTest < ActionDispatch::IntegrationTest
  test 'sign out with navigational format via XHR does redirect' do
    swap Devise, navigational_formats: ['*/*', :html] do
      sign_in_as_user
-      xml_http_request :get, destroy_user_session_path, {}, { "HTTP_ACCEPT" => "text/html,*/*" }
+      get destroy_user_session_path, xhr: true, headers: { "HTTP_ACCEPT" => "text/html,*/*" }
      assert_response :redirect
      assert_not warden.authenticated?(:user)
    end
  end
 end

-class AuthenticationKeysTest < ActionDispatch::IntegrationTest
+class AuthenticationKeysTest < Devise::IntegrationTest
  test 'missing authentication keys cause authentication to abort' do
    swap Devise, authentication_keys: [:subdomain] do
      sign_in_as_user
@@ -593,7 +593,7 @@ class AuthenticationKeysTest < ActionDispatch::IntegrationTest
  end
 end

-class AuthenticationRequestKeysTest < ActionDispatch::IntegrationTest
+class AuthenticationRequestKeysTest < Devise::IntegrationTest
  test 'request keys are used on authentication' do
    host! 'foo.bar.baz'

@@ -634,7 +634,7 @@ class AuthenticationRequestKeysTest < ActionDispatch::IntegrationTest
  end
 end

-class AuthenticationSignOutViaTest < ActionDispatch::IntegrationTest
+class AuthenticationSignOutViaTest < Devise::IntegrationTest
  def sign_in!(scope)
    sign_in_as_admin(visit: send("new_#{scope}_session_path"))
    assert warden.authenticated?(scope)
@@ -689,7 +689,7 @@ class AuthenticationSignOutViaTest < ActionDispatch::IntegrationTest
  end
 end

-class DoubleAuthenticationRedirectTest < ActionDispatch::IntegrationTest
+class DoubleAuthenticationRedirectTest < Devise::IntegrationTest
  test 'signed in as user redirects when visiting user sign in page' do
    sign_in_as_user
    get new_user_session_path(format: :html)
@@ -712,7 +712,7 @@ class DoubleAuthenticationRedirectTest < ActionDispatch::IntegrationTest
  end
 end

-class DoubleSignOutRedirectTest < ActionDispatch::IntegrationTest
+class DoubleSignOutRedirectTest < Devise::IntegrationTest
  test 'sign out after already having signed out redirects to sign in' do
    sign_in_as_user

--- a/test/integration/confirmable_test.rb
+++ b/test/integration/confirmable_test.rb
@@ -1,6 +1,6 @@
 require 'test_helper'

-class ConfirmationTest < ActionDispatch::IntegrationTest
+class ConfirmationTest < Devise::IntegrationTest

  def visit_user_confirmation_with_token(confirmation_token)
    visit user_confirmation_path(confirmation_token: confirmation_token)
@@ -184,14 +184,14 @@ class ConfirmationTest < ActionDispatch::IntegrationTest

  test 'resent confirmation token with valid E-Mail in XML format should return valid response' do
    user = create_user(confirm: false)
-    post user_confirmation_path(format: 'xml'), user: { email: user.email }
+    post user_confirmation_path(format: 'xml'), params: { user: { email: user.email } }
    assert_response :success
    assert_equal response.body, {}.to_xml
  end

  test 'resent confirmation token with invalid E-Mail in XML format should return invalid response' do
    create_user(confirm: false)
-    post user_confirmation_path(format: 'xml'), user: { email: 'invalid.test@test.com' }
+    post user_confirmation_path(format: 'xml'), params: { user: { email: 'invalid.test@test.com' } }
    assert_response :unprocessable_entity
    assert response.body.include? %(<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<errors>)
  end
@@ -213,7 +213,7 @@ class ConfirmationTest < ActionDispatch::IntegrationTest
  test 'request an account confirmation account with JSON, should return an empty JSON' do
    user = create_user(confirm: false)

-    post user_confirmation_path, user: { email: user.email }, format: :json
+    post user_confirmation_path, params: { user: { email: user.email }, format: :json }
    assert_response :success
    assert_equal response.body, {}.to_json
  end
@@ -249,7 +249,7 @@ class ConfirmationTest < ActionDispatch::IntegrationTest
  end
 end

-class ConfirmationOnChangeTest < ActionDispatch::IntegrationTest
+class ConfirmationOnChangeTest < Devise::IntegrationTest
  def create_second_admin(options={})
    @admin = nil
    create_admin(options)
--- a/test/integration/database_authenticatable_test.rb
+++ b/test/integration/database_authenticatable_test.rb
@@ -1,6 +1,6 @@
 require 'test_helper'

-class DatabaseAuthenticationTest < ActionDispatch::IntegrationTest
+class DatabaseAuthenticationTest < Devise::IntegrationTest
  test 'sign in with email of different case should succeed when email is in the list of case insensitive keys' do
    create_user(email: 'Foo@Bar.com')

--- a/test/integration/http_authenticatable_test.rb
+++ b/test/integration/http_authenticatable_test.rb
@@ -1,10 +1,10 @@
 require 'test_helper'

-class HttpAuthenticationTest < ActionDispatch::IntegrationTest
+class HttpAuthenticationTest < Devise::IntegrationTest
  test 'handles unverified requests gets rid of caches but continues signed in' do
    swap ApplicationController, allow_forgery_protection: true do
      create_user
-      post exhibit_user_url(1), {}, "HTTP_AUTHORIZATION" => "Basic #{Base64.encode64("user@test.com:12345678")}"
+      post exhibit_user_url(1), headers: { "HTTP_AUTHORIZATION" => "Basic #{Base64.encode64("user@test.com:12345678")}" }
      assert warden.authenticated?(:user)
      assert_equal "User is authenticated", response.body
    end
@@ -89,17 +89,16 @@ class HttpAuthenticationTest < ActionDispatch::IntegrationTest
  end

  private
-
    def sign_in_as_new_user_with_http(username="user@test.com", password="12345678")
      user = create_user
-      get users_path(format: :xml), {}, "HTTP_AUTHORIZATION" => "Basic #{Base64.encode64("#{username}:#{password}")}"
+      get users_path(format: :xml), headers: { "HTTP_AUTHORIZATION" => "Basic #{Base64.encode64("#{username}:#{password}")}" }
      user
    end

    # Sign in with oauth2 token. This is just to test that it isn't misinterpreted as basic authentication
    def add_oauth2_header
      user = create_user
-      get users_path(format: :xml), {}, "HTTP_AUTHORIZATION" => "OAuth #{Base64.encode64("#{user.email}:12345678")}"
+      get users_path(format: :xml), headers: { "HTTP_AUTHORIZATION" => "OAuth #{Base64.encode64("#{user.email}:12345678")}" }
    end

 end
--- a/test/integration/lockable_test.rb
+++ b/test/integration/lockable_test.rb
@@ -1,6 +1,6 @@
 require 'test_helper'

-class LockTest < ActionDispatch::IntegrationTest
+class LockTest < Devise::IntegrationTest

  def visit_user_unlock_with_token(unlock_token)
    visit user_unlock_path(unlock_token: unlock_token)
@@ -132,9 +132,10 @@ class LockTest < ActionDispatch::IntegrationTest
    user = create_user(locked: true)
    ActionMailer::Base.deliveries.clear

-    post user_unlock_path(format: 'xml'), user: {email: user.email}
+    post user_unlock_path(format: 'xml'), params: { user: {email: user.email} }
    assert_response :success
    assert_equal response.body, {}.to_xml
+
    assert_equal 1, ActionMailer::Base.deliveries.size
  end

@@ -142,7 +143,7 @@ class LockTest < ActionDispatch::IntegrationTest
    user = create_user(locked: false)
    ActionMailer::Base.deliveries.clear

-    post user_unlock_path(format: 'xml'), user: {email: user.email}
+    post user_unlock_path(format: 'xml'), params: { user: {email: user.email} }
    assert_response :unprocessable_entity
    assert response.body.include? %(<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<errors>)
    assert_equal 0, ActionMailer::Base.deliveries.size
--- a/test/integration/omniauthable_test.rb
+++ b/test/integration/omniauthable_test.rb
@@ -1,7 +1,7 @@
 require 'test_helper'


-class OmniauthableIntegrationTest < ActionDispatch::IntegrationTest
+class OmniauthableIntegrationTest < Devise::IntegrationTest
  FACEBOOK_INFO = {
    "id" => '12345',
    "link" => 'http://facebook.com/josevalim',
--- a/test/integration/recoverable_test.rb
+++ b/test/integration/recoverable_test.rb
@@ -1,6 +1,6 @@
 require 'test_helper'

-class PasswordTest < ActionDispatch::IntegrationTest
+class PasswordTest < Devise::IntegrationTest

  def visit_new_password_path
    visit new_user_session_path
@@ -160,8 +160,7 @@ class PasswordTest < ActionDispatch::IntegrationTest
    assert_response :success
    assert_current_url '/users/password'
    assert_have_selector '#error_explanation'
-    assert_contain Devise.rails4? ?
-      "Password confirmation doesn't match Password" : "Password doesn't match confirmation"
+    assert_contain "Password confirmation doesn't match Password"
    assert_not user.reload.valid_password?('987654321')
  end

@@ -251,14 +250,14 @@ class PasswordTest < ActionDispatch::IntegrationTest

  test 'reset password request with valid E-Mail in XML format should return valid response' do
    create_user
-    post user_password_path(format: 'xml'), user: {email: "user@test.com"}
+    post user_password_path(format: 'xml'), params: { user: {email: "user@test.com"} }
    assert_response :success
    assert_equal response.body, { }.to_xml
  end

  test 'reset password request with invalid E-Mail in XML format should return valid response' do
    create_user
-    post user_password_path(format: 'xml'), user: {email: "invalid.test@test.com"}
+    post user_password_path(format: 'xml'), params: { user: {email: "invalid.test@test.com"} }
    assert_response :unprocessable_entity
    assert response.body.include? %(<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<errors>)
  end
@@ -266,7 +265,7 @@ class PasswordTest < ActionDispatch::IntegrationTest
  test 'reset password request with invalid E-Mail in XML format should return empty and valid response' do
    swap Devise, paranoid: true do
      create_user
-      post user_password_path(format: 'xml'), user: {email: "invalid@test.com"}
+      post user_password_path(format: 'xml'), params: { user: {email: "invalid@test.com"} }
      assert_response :success
      assert_equal response.body, { }.to_xml
    end
@@ -275,8 +274,9 @@ class PasswordTest < ActionDispatch::IntegrationTest
  test 'change password with valid parameters in XML format should return valid response' do
    create_user
    request_forgot_password
-    put user_password_path(format: 'xml'), user: {
+    put user_password_path(format: 'xml'), params: { user: {
      reset_password_token: 'abcdef', password: '987654321', password_confirmation: '987654321'
+      }
    }
    assert_response :success
    assert warden.authenticated?(:user)
@@ -285,7 +285,7 @@ class PasswordTest < ActionDispatch::IntegrationTest
  test 'change password with invalid token in XML format should return invalid response' do
    create_user
    request_forgot_password
-    put user_password_path(format: 'xml'), user: {reset_password_token: 'invalid.token', password: '987654321', password_confirmation: '987654321'}
+    put user_password_path(format: 'xml'), params: { user: {reset_password_token: 'invalid.token', password: '987654321', password_confirmation: '987654321'} }
    assert_response :unprocessable_entity
    assert response.body.include? %(<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<errors>)
  end
@@ -293,7 +293,7 @@ class PasswordTest < ActionDispatch::IntegrationTest
  test 'change password with invalid new password in XML format should return invalid response' do
    user = create_user
    request_forgot_password
-    put user_password_path(format: 'xml'), user: {reset_password_token: user.reload.reset_password_token, password: '', password_confirmation: '987654321'}
+    put user_password_path(format: 'xml'), params: { user: {reset_password_token: user.reload.reset_password_token, password: '', password_confirmation: '987654321'} }
    assert_response :unprocessable_entity
    assert response.body.include? %(<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<errors>)
  end
@@ -301,7 +301,7 @@ class PasswordTest < ActionDispatch::IntegrationTest
  test "when using json requests to ask a confirmable request, should not return the object" do
    user = create_user(confirm: false)

-    post user_password_path(format: :json), user: { email: user.email }
+    post user_password_path(format: :json), params: { user: { email: user.email } }

    assert_response :success
    assert_equal response.body, "{}"
--- a/test/integration/registerable_test.rb
+++ b/test/integration/registerable_test.rb
@@ -1,6 +1,6 @@
 require 'test_helper'

-class RegistrationTest < ActionDispatch::IntegrationTest
+class RegistrationTest < Devise::IntegrationTest

  test 'a guest admin should be able to sign in successfully' do
    get new_admin_session_path
@@ -110,8 +110,7 @@ class RegistrationTest < ActionDispatch::IntegrationTest
    assert_template 'registrations/new'
    assert_have_selector '#error_explanation'
    assert_contain "Email is invalid"
-    assert_contain Devise.rails4? ?
-      "Password confirmation doesn't match Password" : "Password doesn't match confirmation"
+    assert_contain "Password confirmation doesn't match Password"
    assert_contain "2 errors prohibited"
    assert_nil User.to_adapter.find_first

@@ -217,8 +216,7 @@ class RegistrationTest < ActionDispatch::IntegrationTest
    fill_in 'current password', with: '12345678'
    click_button 'Update'

-    assert_contain Devise.rails4? ?
-      "Password confirmation doesn't match Password" : "Password doesn't match confirmation"
+    assert_contain "Password confirmation doesn't match Password"
    assert_not User.to_adapter.find_first.valid_password?('pas123')
  end

@@ -259,7 +257,7 @@ class RegistrationTest < ActionDispatch::IntegrationTest
  end

  test 'an admin sign up with valid information in XML format should return valid response' do
-    post admin_registration_path(format: 'xml'), admin: { email: 'new_user@test.com', password: 'new_user123', password_confirmation: 'new_user123' }
+    post admin_registration_path(format: 'xml'), params: { admin: { email: 'new_user@test.com', password: 'new_user123', password_confirmation: 'new_user123' } }
    assert_response :success
    assert response.body.include? %(<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<admin>)

@@ -268,7 +266,7 @@ class RegistrationTest < ActionDispatch::IntegrationTest
  end

  test 'a user sign up with valid information in XML format should return valid response' do
-    post user_registration_path(format: 'xml'), user: { email: 'new_user@test.com', password: 'new_user123', password_confirmation: 'new_user123' }
+    post user_registration_path(format: 'xml'), params: { user: { email: 'new_user@test.com', password: 'new_user123', password_confirmation: 'new_user123' } }
    assert_response :success
    assert response.body.include? %(<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<user>)

@@ -277,21 +275,21 @@ class RegistrationTest < ActionDispatch::IntegrationTest
  end

  test 'a user sign up with invalid information in XML format should return invalid response' do
-    post user_registration_path(format: 'xml'), user: { email: 'new_user@test.com', password: 'new_user123', password_confirmation: 'invalid' }
+    post user_registration_path(format: 'xml'), params: { user: { email: 'new_user@test.com', password: 'new_user123', password_confirmation: 'invalid' } }
    assert_response :unprocessable_entity
    assert response.body.include? %(<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<errors>)
  end

  test 'a user update information with valid data in XML format should return valid response' do
    user = sign_in_as_user
-    put user_registration_path(format: 'xml'), user: { current_password: '12345678', email: 'user.new@test.com' }
+    put user_registration_path(format: 'xml'), params: { user: { current_password: '12345678', email: 'user.new@test.com' } }
    assert_response :success
    assert_equal user.reload.email, 'user.new@test.com'
  end

  test 'a user update information with invalid data in XML format should return invalid response' do
    user = sign_in_as_user
-    put user_registration_path(format: 'xml'), user: { current_password: 'invalid', email: 'user.new@test.com' }
+    put user_registration_path(format: 'xml'), params: { user: { current_password: 'invalid', email: 'user.new@test.com' } }
    assert_response :unprocessable_entity
    assert_equal user.reload.email, 'user@test.com'
  end
@@ -304,7 +302,7 @@ class RegistrationTest < ActionDispatch::IntegrationTest
  end
 end

-class ReconfirmableRegistrationTest < ActionDispatch::IntegrationTest
+class ReconfirmableRegistrationTest < Devise::IntegrationTest
  test 'a signed in admin should see a more appropriate flash message when editing their account if reconfirmable is enabled' do
    sign_in_as_admin
    get edit_admin_registration_path
--- a/test/integration/rememberable_test.rb
+++ b/test/integration/rememberable_test.rb
@@ -1,16 +1,16 @@
 require 'test_helper'

-class RememberMeTest < ActionDispatch::IntegrationTest
+class RememberMeTest < Devise::IntegrationTest
  def create_user_and_remember(add_to_token='')
    user = create_user
    user.remember_me!
-    raw_cookie = User.serialize_into_cookie(user).tap { |a| a.last << add_to_token }
+    raw_cookie = User.serialize_into_cookie(user).tap { |a| a[1] << add_to_token }
    cookies['remember_user_token'] = generate_signed_cookie(raw_cookie)
    user
  end

  def generate_signed_cookie(raw_cookie)
-    request = ActionDispatch::TestRequest.new
+    request = Devise.rails5? ? ActionDispatch::TestRequest.create : ActionDispatch::TestRequest.new
    request.cookie_jar.signed['raw_cookie'] = raw_cookie
    request.cookie_jar['raw_cookie']
  end
@@ -47,8 +47,10 @@ class RememberMeTest < ActionDispatch::IntegrationTest
      get new_user_session_path
      assert request.session[:_csrf_token]

-      post user_session_path, authenticity_token: "oops", user:
-           { email: "jose.valim@gmail.com", password: "123456", remember_me: "1" }
+      post user_session_path, params: {
+          authenticity_token: "oops",
+          user: { email: "jose.valim@gmail.com", password: "123456", remember_me: "1" }
+        }
      assert_not warden.authenticated?(:user)
      assert_not request.cookies['remember_user_token']
    end
@@ -135,7 +137,7 @@ class RememberMeTest < ActionDispatch::IntegrationTest

  test 'do not remember with expired token' do
    create_user_and_remember
-    swap Devise, remember_for: 0 do
+    swap Devise, remember_for: 0.days do
      get users_path
      assert_not warden.authenticated?(:user)
      assert_redirected_to new_user_session_path
--- a/test/integration/timeoutable_test.rb
+++ b/test/integration/timeoutable_test.rb
@@ -1,6 +1,6 @@
 require 'test_helper'

-class SessionTimeoutTest < ActionDispatch::IntegrationTest
+class SessionTimeoutTest < Devise::IntegrationTest

  def last_request_at
    @controller.user_session['last_request_at']
@@ -20,7 +20,7 @@ class SessionTimeoutTest < ActionDispatch::IntegrationTest
    old_last_request = last_request_at
    assert_not_nil last_request_at

-    get users_path, {}, 'devise.skip_trackable' => true
+    get users_path, headers: { 'devise.skip_trackable' => true }
    assert_equal old_last_request, last_request_at
  end

@@ -32,7 +32,7 @@ class SessionTimeoutTest < ActionDispatch::IntegrationTest
    new_time = 2.seconds.from_now
    Time.stubs(:now).returns(new_time)

-    get users_path, {}, 'devise.skip_timeoutable' => true
+    get users_path, headers: { 'devise.skip_timeoutable' => true }
    assert_equal old_last_request, last_request_at
  end

@@ -115,7 +115,7 @@ class SessionTimeoutTest < ActionDispatch::IntegrationTest
    user = sign_in_as_user
    get expire_user_path(user)

-    post "/users/sign_in", email: user.email, password: "123456"
+    post "/users/sign_in", params: { email: user.email, password: "123456" }

    assert_response :redirect
    follow_redirect!
@@ -175,7 +175,7 @@ class SessionTimeoutTest < ActionDispatch::IntegrationTest
    assert warden.authenticated?(:user)
  end

-  test 'does not crashes when the last_request_at is a String' do
+  test 'does not crash when the last_request_at is a String' do
    user = sign_in_as_user

    get edit_form_user_path(user, last_request_at: Time.now.utc.to_s)
--- a/test/integration/trackable_test.rb
+++ b/test/integration/trackable_test.rb
@@ -1,6 +1,6 @@
 require 'test_helper'

-class TrackableHooksTest < ActionDispatch::IntegrationTest
+class TrackableHooksTest < Devise::IntegrationTest

  test "current and last sign in timestamps are updated on each sign in" do
    user = create_user
--- a/test/models/confirmable_test.rb
+++ b/test/models/confirmable_test.rb
@@ -486,4 +486,18 @@ class ReconfirmableTest < ActiveSupport::TestCase
      :unconfirmed_email
    ]
  end
+
+  test 'should not require reconfirmation after creating a record' do
+    user = create_admin
+    assert !user.pending_reconfirmation?
+  end
+
+  test 'should not require reconfirmation after creating a record with #save called in callback' do
+    class Admin::WithSaveInCallback < Admin
+      after_create :save
+    end
+
+    user = Admin::WithSaveInCallback.create(valid_attributes.except(:username))
+    assert !user.pending_reconfirmation?
+  end
 end
--- a/test/models/rememberable_test.rb
+++ b/test/models/rememberable_test.rb
@@ -13,6 +13,7 @@ class RememberableTest < ActiveSupport::TestCase
    user = create_user
    user.expects(:valid?).never
    user.remember_me!
+    assert user.remember_created_at
  end

  test 'forget_me should not clear remember token if using salt' do
@@ -33,13 +34,57 @@ class RememberableTest < ActiveSupport::TestCase
  test 'serialize into cookie' do
    user = create_user
    user.remember_me!
-    assert_equal [user.to_key, user.authenticatable_salt], User.serialize_into_cookie(user)
+    id, token, date = User.serialize_into_cookie(user)
+    assert_equal id, user.to_key
+    assert_equal token, user.authenticatable_salt
+    assert date.is_a?(String)
  end

  test 'serialize from cookie' do
    user = create_user
    user.remember_me!
-    assert_equal user, User.serialize_from_cookie(user.to_key, user.authenticatable_salt)
+    assert_equal user, User.serialize_from_cookie(user.to_key, user.authenticatable_salt, Time.now.utc)
+  end
+
+  test 'serialize from cookie should accept a String with the datetime seconds and microseconds' do
+    user = create_user
+    user.remember_me!
+    assert_equal user, User.serialize_from_cookie(user.to_key, user.authenticatable_salt, Time.now.utc.to_f.to_json)
+  end
+
+  test 'serialize from cookie should return nil with invalid datetime' do
+    user = create_user
+    user.remember_me!
+    assert_nil User.serialize_from_cookie(user.to_key, user.authenticatable_salt, "2013")
+  end
+
+  test 'serialize from cookie should return nil if no resource is found' do
+    assert_nil resource_class.serialize_from_cookie([0], "123", Time.now.utc)
+  end
+
+  test 'serialize from cookie should return nil if no timestamp' do
+    user = create_user
+    user.remember_me!
+    assert_nil User.serialize_from_cookie(user.to_key, user.authenticatable_salt)
+  end
+
+  test 'serialize from cookie should return nil if timestamp is earlier than token creation' do
+    user = create_user
+    user.remember_me!
+    assert_nil User.serialize_from_cookie(user.to_key, user.authenticatable_salt, 1.day.ago)
+  end
+
+  test 'serialize from cookie should return nil if timestamp is older than remember_for' do
+    user = create_user
+    user.remember_created_at = 1.month.ago
+    user.remember_me!
+    assert_nil User.serialize_from_cookie(user.to_key, user.authenticatable_salt, 3.weeks.ago)
+  end
+
+  test 'serialize from cookie me return nil if is a valid resource with invalid token' do
+    user = create_user
+    user.remember_me!
+    assert_nil User.serialize_from_cookie(user.to_key, "123", Time.now.utc)
  end

  test 'raises a RuntimeError if authenticatable_salt is nil or empty' do
@@ -93,28 +138,7 @@ class RememberableTest < ActiveSupport::TestCase
    resource.forget_me!
  end

-  test 'remember is expired if not created at timestamp is set' do
-    assert create_resource.remember_expired?
-  end
-
-  test 'serialize should return nil if no resource is found' do
-    assert_nil resource_class.serialize_from_cookie([0], "123")
-  end
-
-  test 'remember me return nil if is a valid resource with invalid token' do
-    resource = create_resource
-    assert_nil resource_class.serialize_from_cookie([resource.id], "123")
-  end
-
-  test 'remember for should fallback to devise remember for default configuration' do
-    swap Devise, remember_for: 1.day do
-      resource = create_resource
-      resource.remember_me!
-      assert_not resource.remember_expired?
-    end
-  end
-
-  test 'remember expires at should sum date of creation with remember for configuration' do
+  test 'remember expires at uses remember for configuration' do
    swap Devise, remember_for: 3.days do
      resource = create_resource
      resource.remember_me!
@@ -125,77 +149,6 @@ class RememberableTest < ActiveSupport::TestCase
    end
  end

-  test 'remember should be expired if remember_for is zero' do
-    swap Devise, remember_for: 0.days do
-      Devise.remember_for = 0.days
-      resource = create_resource
-      resource.remember_me!
-      assert resource.remember_expired?
-    end
-  end
-
-  test 'remember should be expired if it was created before limit time' do
-    swap Devise, remember_for: 1.day do
-      resource = create_resource
-      resource.remember_me!
-      resource.remember_created_at = 2.days.ago
-      resource.save
-      assert resource.remember_expired?
-    end
-  end
-
-  test 'remember should not be expired if it was created within the limit time' do
-    swap Devise, remember_for: 30.days do
-      resource = create_resource
-      resource.remember_me!
-      resource.remember_created_at = (30.days.ago + 2.minutes)
-      resource.save
-      assert_not resource.remember_expired?
-    end
-  end
-
-  test 'if extend_remember_period is false, remember_me! should generate a new timestamp if expired' do
-    swap Devise, remember_for: 5.minutes do
-      resource = create_resource
-      resource.remember_me!(false)
-      assert resource.remember_created_at
-
-      resource.remember_created_at = old = 10.minutes.ago
-      resource.save
-
-      resource.remember_me!(false)
-      assert_not_equal old.to_i, resource.remember_created_at.to_i
-    end
-  end
-
-  test 'if extend_remember_period is false, remember_me! should not generate a new timestamp' do
-    swap Devise, remember_for: 1.year do
-      resource = create_resource
-      resource.remember_me!(false)
-      assert resource.remember_created_at
-
-      resource.remember_created_at = old = 10.minutes.ago.utc
-      resource.save
-
-      resource.remember_me!(false)
-      assert_equal old.to_i, resource.remember_created_at.to_i
-    end
-  end
-
-  test 'if extend_remember_period is true, remember_me! should always generate a new timestamp' do
-    swap Devise, remember_for: 1.year do
-      resource = create_resource
-      resource.remember_me!(true)
-      assert resource.remember_created_at
-
-      resource.remember_created_at = old = 10.minutes.ago
-      resource.save
-
-      resource.remember_me!(true)
-      assert_not_equal old, resource.remember_created_at
-    end
-  end
-
  test 'should have the required_fields array' do
    assert_same_content Devise::Models::Rememberable.required_fields(User), [
      :remember_created_at
--- a/test/models/validatable_test.rb
+++ b/test/models/validatable_test.rb
@@ -57,11 +57,7 @@ class ValidatableTest < ActiveSupport::TestCase
    user = new_user(password: 'new_password', password_confirmation: 'blabla')
    assert user.invalid?

-    if Devise.rails4?
-      assert_equal 'doesn\'t match Password', user.errors[:password_confirmation].join
-    else
-      assert_equal 'doesn\'t match confirmation', user.errors[:password].join
-    end
+    assert_equal 'doesn\'t match Password', user.errors[:password_confirmation].join
  end

  test 'should require password when updating/resetting password' do
@@ -79,11 +75,7 @@ class ValidatableTest < ActiveSupport::TestCase
    user.password_confirmation = 'another_password'
    assert user.invalid?

-    if Devise.rails4?
-      assert_equal 'doesn\'t match Password', user.errors[:password_confirmation].join
-    else
-      assert_equal 'doesn\'t match confirmation', user.errors[:password].join
-    end
+    assert_equal 'doesn\'t match Password', user.errors[:password_confirmation].join
  end

  test 'should require a password with minimum of 7 characters' do
--- a/test/omniauth/url_helpers_test.rb
+++ b/test/omniauth/url_helpers_test.rb
@@ -1,8 +1,7 @@
 require 'test_helper'

 class OmniAuthRoutesTest < ActionController::TestCase
-  ExpectedUrlGeneratiorError = Devise.rails4? ?
-    ActionController::UrlGenerationError : ActionController::RoutingError
+  ExpectedUrlGeneratiorError = ActionController::UrlGenerationError

  tests ApplicationController

--- a/test/orm/active_record.rb
+++ b/test/orm/active_record.rb
@@ -5,6 +5,11 @@ ActiveRecord::Base.include_root_in_json = true
 ActiveRecord::Migrator.migrate(File.expand_path("../../rails_app/db/migrate/", __FILE__))

 class ActiveSupport::TestCase
-  self.use_transactional_fixtures = true
+  if Rails.version >= '5.0.0'
+    self.use_transactional_tests = true
+  else
+    self.use_transactional_fixtures = true
+  end
+
  self.use_instantiated_fixtures  = false
 end
--- a/test/parameter_sanitizer_test.rb
+++ b/test/parameter_sanitizer_test.rb
@@ -1,81 +1,131 @@
 require 'test_helper'
 require 'devise/parameter_sanitizer'

-class BaseSanitizerTest < ActiveSupport::TestCase
+class ParameterSanitizerTest < ActiveSupport::TestCase
  def sanitizer(params)
-    Devise::BaseSanitizer.new(User, :user, params)
+    params = ActionController::Parameters.new(params)
+    Devise::ParameterSanitizer.new(User, :user, params)
  end

-  test 'returns chosen params' do
-    sanitizer = sanitizer(user: { "email" => "jose" })
-    assert_equal({ "email" => "jose" }, sanitizer.sanitize(:sign_in))
+  test 'permits the default parameters for sign in' do
+    sanitizer = sanitizer('user' => { 'email' => 'jose' })
+    sanitized = sanitizer.sanitize(:sign_in)
+
+    assert_equal({ 'email' => 'jose' }, sanitized)
+  end
+
+  test 'permits the default parameters for sign up' do
+    sanitizer = sanitizer('user' => { 'email' => 'jose', 'role' => 'invalid' })
+    sanitized = sanitizer.sanitize(:sign_up)
+
+    assert_equal({ 'email' => 'jose' }, sanitized)
+  end
+
+  test 'permits the default parameters for account update' do
+    sanitizer = sanitizer('user' => { 'email' => 'jose', 'role' => 'invalid' })
+    sanitized = sanitizer.sanitize(:account_update)
+
+    assert_equal({ 'email' => 'jose' }, sanitized)
+  end
+
+  test 'permits news parameters for an existing action' do
+    sanitizer = sanitizer('user' => { 'username' => 'jose' })
+    sanitizer.permit(:sign_in, keys: [:username])
+    sanitized = sanitizer.sanitize(:sign_in)
+
+    assert_equal({ 'username' => 'jose' }, sanitized)
+  end
+
+  test 'permits news parameters for an existing action with a block' do
+    sanitizer = sanitizer('user' => { 'username' => 'jose' })
+    sanitizer.permit(:sign_in) do |user|
+      user.permit(:username)
+    end
+
+    sanitized = sanitizer.sanitize(:sign_in)
+
+    assert_equal({ 'username' => 'jose' }, sanitized)
+  end
+
+  test 'permit parameters for new actions' do
+    sanitizer = sanitizer('user' => { 'email' => 'jose@omglol', 'name' => 'Jose' })
+    sanitizer.permit(:invite_user, keys: [:email, :name])
+
+    sanitized = sanitizer.sanitize(:invite_user)
+
+    assert_equal({ 'email' => 'jose@omglol', 'name' => 'Jose' }, sanitized)
+  end
+
+  test 'fails when we do not have any permitted parameters for the action' do
+    sanitizer = sanitizer('user' => { 'email' => 'jose', 'password' => 'invalid' })
+
+    assert_raise NotImplementedError do
+      sanitizer.sanitize(:unknown)
+    end
+  end
+
+  test 'removes permitted parameters' do
+    sanitizer = sanitizer('user' => { 'email' => 'jose@omglol', 'username' => 'jose' })
+
+    sanitizer.permit(:sign_in, keys: [:username], except: [:email])
+    sanitized = sanitizer.sanitize(:sign_in)
+
+    assert_equal({ 'username' => 'jose' }, sanitized)
  end
 end

-if defined?(ActionController::StrongParameters)
-  require 'active_model/forbidden_attributes_protection'
-
-  class ParameterSanitizerTest < ActiveSupport::TestCase
-    def sanitizer(params)
-      params = ActionController::Parameters.new(params)
-      Devise::ParameterSanitizer.new(User, :user, params)
+class DeprecatedParameterSanitizerAPITest < ActiveSupport::TestCase
+  class CustomSanitizer < Devise::ParameterSanitizer
+    def sign_in
+      default_params.permit(:username)
    end
+  end

-    test 'filters some parameters on sign in by default' do
-      sanitizer = sanitizer(user: { "email" => "jose", "password" => "invalid", "remember_me" => "1" })
-      assert_equal({ "email" => "jose", "password" => "invalid", "remember_me" => "1" }, sanitizer.sanitize(:sign_in))
+  def sanitizer(params)
+    params = ActionController::Parameters.new(params)
+    Devise::ParameterSanitizer.new(User, :user, params)
+  end
+
+  test 'overriding instance methods have precedence over the default sanitized attributes' do
+    assert_deprecated do
+      params =  ActionController::Parameters.new(user: { "username" => "jose", "name" => "Jose" })
+      sanitizer = CustomSanitizer.new(User, :user, params)
+
+      sanitized = sanitizer.sanitize(:sign_in)
+
+      assert_equal({ "username" => "jose" }, sanitized)
    end
+  end

-    test 'handles auth keys as a hash' do
-      swap Devise, authentication_keys: {email: true} do
-        sanitizer = sanitizer(user: { "email" => "jose", "password" => "invalid" })
-        assert_equal({ "email" => "jose", "password" => "invalid" }, sanitizer.sanitize(:sign_in))
-      end
+  test 'adding new parameters by mutating the Array' do
+    assert_deprecated do
+      sanitizer = sanitizer('user' => { 'username' => 'jose' })
+      sanitizer.for(:sign_in) << :username
+      sanitized = sanitizer.sanitize(:sign_in)
+
+      assert_equal({ 'username' => 'jose' }, sanitized)
    end
+  end

-    test 'filters some parameters on sign up by default' do
-      sanitizer = sanitizer(user: { "email" => "jose", "role" => "invalid" })
-      assert_equal({ "email" => "jose" }, sanitizer.sanitize(:sign_up))
-    end
+   test 'adding new parameters with a block' do
+     assert_deprecated do
+       sanitizer = sanitizer('user' => { 'username' => 'jose' })
+       sanitizer.for(:sign_in) { |user| user.permit(:username) }

-    test 'filters some parameters on account update by default' do
-      sanitizer = sanitizer(user: { "email" => "jose", "role" => "invalid" })
-      assert_equal({ "email" => "jose" }, sanitizer.sanitize(:account_update))
-    end
+       sanitized = sanitizer.sanitize(:sign_in)

-    test 'allows custom hooks' do
-      sanitizer = sanitizer(user: { "email" => "jose", "password" => "invalid" })
-      sanitizer.for(:sign_in) { |user| user.permit(:email, :password) }
-      assert_equal({ "email" => "jose", "password" => "invalid" }, sanitizer.sanitize(:sign_in))
-    end
+       assert_equal({ 'username' => 'jose' }, sanitized)
+     end
+   end

-    test 'adding multiple permitted parameters' do
-      sanitizer = sanitizer(user: { "email" => "jose", "username" => "jose1", "role" => "valid" })
-      sanitizer.for(:sign_in).concat([:username, :role])
-      assert_equal({ "email" => "jose", "username" => "jose1", "role" => "valid" }, sanitizer.sanitize(:sign_in))
-    end
-
-    test 'removing multiple default parameters' do
-      sanitizer = sanitizer(user: { "email" => "jose", "password" => "invalid", "remember_me" => "1" })
+  test 'removing multiple default parameters' do
+    assert_deprecated do
+      sanitizer = sanitizer('user' => { 'email' => 'jose', 'password' => 'invalid', 'remember_me' => '1' })
      sanitizer.for(:sign_in).delete(:email)
      sanitizer.for(:sign_in).delete(:password)
-      assert_equal({ "remember_me" => "1" }, sanitizer.sanitize(:sign_in))
-    end
+      sanitized = sanitizer.sanitize(:sign_in)

-    test 'raises on unknown hooks' do
-      sanitizer = sanitizer(user: { "email" => "jose", "password" => "invalid" })
-      assert_raise NotImplementedError do
-        sanitizer.sanitize(:unknown)
-      end
-    end
-
-    test 'passes parameters to filter as arguments to sanitizer' do
-      params = {user: stub}
-      sanitizer = Devise::ParameterSanitizer.new(User, :user, params)
-
-      params[:user].expects(:permit).with(kind_of(Symbol), kind_of(Symbol), kind_of(Symbol))
-
-      sanitizer.sanitize(:sign_in)
+      assert_equal({ 'remember_me' => '1' }, sanitized)
    end
  end
 end
--- a/test/rails_app/app/active_record/user.rb
+++ b/test/rails_app/app/active_record/user.rb
@@ -1,6 +1,9 @@
 require 'shared_user'
+require 'active_model/serializers/xml' if Devise.rails5?
+require 'active_model-serializers' if Devise.rails5?

 class User < ActiveRecord::Base
  include Shim
  include SharedUser
+  include ActiveModel::Serializers::Xml if Devise.rails5?
 end
--- a/test/rails_app/app/controllers/admins_controller.rb
+++ b/test/rails_app/app/controllers/admins_controller.rb
@@ -1,5 +1,5 @@
 class AdminsController < ApplicationController
-  before_filter :authenticate_admin!
+  before_action :authenticate_admin!

  def index
  end
--- a/test/rails_app/app/controllers/application_controller.rb
+++ b/test/rails_app/app/controllers/application_controller.rb
@@ -3,8 +3,8 @@

 class ApplicationController < ActionController::Base
  protect_from_forgery
-  before_filter :current_user, unless: :devise_controller?
-  before_filter :authenticate_user!, if: :devise_controller?
+  before_action :current_user, unless: :devise_controller?
+  before_action :authenticate_user!, if: :devise_controller?
  respond_to *Mime::SET.map(&:to_sym)

  devise_group :commenter, contains: [:user, :admin]
--- a/test/rails_app/app/controllers/home_controller.rb
+++ b/test/rails_app/app/controllers/home_controller.rb
@@ -20,6 +20,10 @@ class HomeController < ApplicationController
  end

  def unauthenticated
-    render text: "unauthenticated", status: :unauthorized
+    if Devise.rails5?
+      render body: "unauthenticated", status: :unauthorized
+    else
+      render text: "unauthenticated", status: :unauthorized
+    end
  end
 end
--- a/test/rails_app/app/controllers/users/omniauth_callbacks_controller.rb
+++ b/test/rails_app/app/controllers/users/omniauth_callbacks_controller.rb
@@ -1,6 +1,6 @@
 class Users::OmniauthCallbacksController < Devise::OmniauthCallbacksController
  def facebook
-    data = env["omniauth.auth"]
+    data = request.respond_to?(:get_header) ? request.get_header("omniauth.auth") : env["omniauth.auth"]
    session["devise.facebook_data"] = data["extra"]["user_hash"]
    render json: data
  end
@@ -9,6 +9,6 @@ class Users::OmniauthCallbacksController < Devise::OmniauthCallbacksController
    user = User.to_adapter.find_first(email: 'user@test.com')
    user.remember_me = true
    sign_in user
-    render text: ""
+    render (Devise.rails5? ? :body : :text) => ""
  end
 end
--- a/test/rails_app/app/controllers/users_controller.rb
+++ b/test/rails_app/app/controllers/users_controller.rb
@@ -1,6 +1,6 @@
 class UsersController < ApplicationController
-  prepend_before_filter :current_user, only: :exhibit
-  before_filter :authenticate_user!, except: [:accept, :exhibit]
+  prepend_before_action :current_user, only: :exhibit
+  before_action :authenticate_user!, except: [:accept, :exhibit]
  respond_to :html, :xml

  def index
@@ -13,7 +13,7 @@ class UsersController < ApplicationController
  end

  def update_form
-    render text: 'Update'
+    render (Devise.rails5? ? :body : :text) => 'Update'
  end

  def accept
@@ -21,11 +21,11 @@ class UsersController < ApplicationController
  end

  def exhibit
-    render text: current_user ? "User is authenticated" : "User is not authenticated"
+    render (Devise.rails5? ? :body : :text) => current_user ? "User is authenticated" : "User is not authenticated"
  end

  def expire
    user_session['last_request_at'] = 31.minutes.ago.utc
-    render text: 'User will be expired on next request'
+    render (Devise.rails5? ? :body : :text) => 'User will be expired on next request'
  end
 end
--- a/test/rails_app/config/application.rb
+++ b/test/rails_app/config/application.rb
@@ -28,7 +28,7 @@ module RailsApp

    # Configure sensitive parameters which will be filtered from the log file.
    config.filter_parameters << :password
-    config.assets.enabled = false
+    # config.assets.enabled = false

    config.action_mailer.default_url_options = { host: "localhost", port: 3000 }

--- a/test/rails_app/config/boot.rb
+++ b/test/rails_app/config/boot.rb
@@ -3,9 +3,9 @@ unless defined?(DEVISE_ORM)
 end

 module Devise
-  # Detection for minor differences between Rails 3.2 and 4 in tests.
-  def self.rails4?
-    Rails.version.start_with? '4'
+  # Detection for minor differences between Rails 4 and 5 in tests.
+  def self.rails5?
+    Rails.version.start_with? '5'
  end
 end

--- a/test/rails_app/config/environments/test.rb
+++ b/test/rails_app/config/environments/test.rb
@@ -19,7 +19,12 @@ RailsApp::Application.configure do
  else
    config.serve_static_assets = true
  end
-  config.static_cache_control = "public, max-age=3600"
+
+  if Rails.version >= "5.0.0"
+    config.public_file_server.headers = {'Cache-Control' => 'public, max-age=3600'}
+  else
+    config.static_cache_control = "public, max-age=3600"
+  end

  # Show full error reports and disable caching.
  config.consider_all_requests_local       = true
--- a/test/rails_app/config/initializers/secret_token.rb
+++ b/test/rails_app/config/initializers/secret_token.rb
@@ -1,8 +1,3 @@
 config = Rails.application.config

-if Devise.rails4?
-  config.secret_key_base = 'd588e99efff13a86461fd6ab82327823ad2f8feb5dc217ce652cdd9f0dfc5eb4b5a62a92d24d2574d7d51dfb1ea8dd453ea54e00cf672159a13104a135422a10'
-else
-  config.secret_token = 'ea942c41850d502f2c8283e26bdc57829f471bb18224ddff0a192c4f32cdf6cb5aa0d82b3a7a7adbeb640c4b06f3aa1cd5f098162d8240f669b39d6b49680571'
-  config.session_store :cookie_store, key: "_my_app"
-end
+config.secret_key_base = 'd588e99efff13a86461fd6ab82327823ad2f8feb5dc217ce652cdd9f0dfc5eb4b5a62a92d24d2574d7d51dfb1ea8dd453ea54e00cf672159a13104a135422a10'
--- a/test/routes_test.rb
+++ b/test/routes_test.rb
@@ -1,6 +1,6 @@
 require 'test_helper'

-ExpectedRoutingError = Devise.rails4? ? MiniTest::Assertion : ActionController::RoutingError
+ExpectedRoutingError = MiniTest::Assertion

 class DefaultRoutingTest < ActionController::TestCase
  test 'map new user session' do
@@ -202,37 +202,52 @@ class CustomizedRoutingTest < ActionController::TestCase
  end

  test 'map with format false for sessions' do
-    assert_recognizes({controller: 'devise/sessions', action: 'new'}, {path: '/htmlonly_admin/sign_in', method: :get})
+    expected_params = {controller: 'devise/sessions', action: 'new'}
+    expected_params[:format] = false if Devise.rails5?
+
+    assert_recognizes(expected_params, {path: '/htmlonly_admin/sign_in', method: :get})
    assert_raise ExpectedRoutingError do
-      assert_recognizes({controller: 'devise/sessions', action: 'new'}, {path: '/htmlonly_admin/sign_in.xml', method: :get})
+      assert_recognizes(expected_params, {path: '/htmlonly_admin/sign_in.xml', method: :get})
    end
  end

  test 'map with format false for passwords' do
-    assert_recognizes({controller: 'devise/passwords', action: 'create'}, {path: '/htmlonly_admin/password', method: :post})
+    expected_params = {controller: 'devise/passwords', action: 'create'}
+    expected_params[:format] = false if Devise.rails5?
+
+    assert_recognizes(expected_params, {path: '/htmlonly_admin/password', method: :post})
    assert_raise ExpectedRoutingError do
-      assert_recognizes({controller: 'devise/passwords', action: 'create'}, {path: '/htmlonly_admin/password.xml', method: :post})
+      assert_recognizes(expected_params, {path: '/htmlonly_admin/password.xml', method: :post})
    end
  end

  test 'map with format false for registrations' do
-    assert_recognizes({controller: 'devise/registrations', action: 'new'}, {path: '/htmlonly_admin/sign_up', method: :get})
+    expected_params = {controller: 'devise/registrations', action: 'new'}
+    expected_params[:format] = false if Devise.rails5?
+
+    assert_recognizes(expected_params, {path: '/htmlonly_admin/sign_up', method: :get})
    assert_raise ExpectedRoutingError do
-      assert_recognizes({controller: 'devise/registrations', action: 'new'}, {path: '/htmlonly_admin/sign_up.xml', method: :get})
+      assert_recognizes(expected_params, {path: '/htmlonly_admin/sign_up.xml', method: :get})
    end
  end

  test 'map with format false for confirmations' do
-    assert_recognizes({controller: 'devise/confirmations', action: 'show'}, {path: '/htmlonly_users/confirmation', method: :get})
+    expected_params = {controller: 'devise/confirmations', action: 'show'}
+    expected_params[:format] = false if Devise.rails5?
+
+    assert_recognizes(expected_params, {path: '/htmlonly_users/confirmation', method: :get})
    assert_raise ExpectedRoutingError do
-      assert_recognizes({controller: 'devise/confirmations', action: 'show'}, {path: '/htmlonly_users/confirmation.xml', method: :get})
+      assert_recognizes(expected_params, {path: '/htmlonly_users/confirmation.xml', method: :get})
    end
  end

  test 'map with format false for unlocks' do
-    assert_recognizes({controller: 'devise/unlocks', action: 'show'}, {path: '/htmlonly_users/unlock', method: :get})
+    expected_params = {controller: 'devise/unlocks', action: 'show'}
+    expected_params[:format] = false if Devise.rails5?
+
+    assert_recognizes(expected_params, {path: '/htmlonly_users/unlock', method: :get})
    assert_raise ExpectedRoutingError do
-      assert_recognizes({controller: 'devise/unlocks', action: 'show'}, {path: '/htmlonly_users/unlock.xml', method: :get})
+      assert_recognizes(expected_params, {path: '/htmlonly_users/unlock.xml', method: :get})
    end
  end

--- a/test/support/http_method_compatibility.rb
+++ b/test/support/http_method_compatibility.rb
@@ -0,0 +1,51 @@
+module Devise
+  class IntegrationTest < ActionDispatch::IntegrationTest
+    # %w( get post patch put head delete xml_http_request
+    #           xhr get_via_redirect post_via_redirect
+    #         ).each do |method|
+    %w( get post put ).each do |method|
+      if Rails.version >= '5.0.0'
+        define_method(method) do |url, options={}|
+          if options.empty?
+            super url
+          else
+            super url, options
+          end
+        end
+      else
+        define_method(method) do |url, options={}|
+          if options[:xhr]==true
+            xml_http_request  __method__, url, options[:params] || {}, options[:headers]
+          else
+            super url, options[:params] || {}, options[:headers]
+          end
+        end
+      end
+    end
+  end
+
+  class ControllerTestCase < ActionController::TestCase
+    # %w( get post patch put head delete xml_http_request
+    #           xhr get_via_redirect post_via_redirect
+    #         ).each do |method|
+    %w( get post put ).each do |method|
+      if Rails.version >= '5.0.0'
+        define_method(method) do |action, options={}|
+          if options.empty?
+            super action
+          else
+            super action, options
+          end
+        end
+      else
+        define_method(method) do |action, options={}|
+          if options[:xhr]==true
+            xml_http_request  __method__, action, options[:params] || {}, options[:headers]
+          else
+            super action, options[:params] || {}, options[:headers]
+          end
+        end
+      end
+    end
+  end
+end
--- a/test/support/webrat/integrations/rails.rb
+++ b/test/support/webrat/integrations/rails.rb
@@ -14,6 +14,15 @@ module Webrat
      ::Rails.logger
    end
  end
+
+  class RailsAdapter
+    protected
+
+    def do_request(http_method, url, data, headers)
+      update_protocol(url)
+      integration_session.send(http_method, normalize_url(url), params: data, headers: headers)
+    end
+  end
 end

 module ActionDispatch #:nodoc:
--- a/test/test_helpers_test.rb
+++ b/test/test_helpers_test.rb
@@ -1,6 +1,6 @@
 require 'test_helper'

-class TestHelpersTest < ActionController::TestCase
+class TestHelpersTest < Devise::ControllerTestCase
  tests UsersController
  include Devise::TestHelpers

@@ -27,7 +27,7 @@ class TestHelpersTest < ActionController::TestCase
      assert !user.active_for_authentication?

      sign_in user
-      get :accept, id: user
+      get :accept, params: { id: user }
      assert_nil assigns(:current_user)
    end
  end
@@ -163,7 +163,7 @@ class TestHelpersTest < ActionController::TestCase

  test "creates a new warden proxy if the request object has changed" do
    old_warden_proxy = warden
-    @request = ActionController::TestRequest.new
+    @request = Devise.rails5? ? ActionController::TestRequest.create : ActionController::TestRequest.new
    new_warden_proxy = warden

    assert_not_equal old_warden_proxy, new_warden_proxy
Author	SHA1	Message	Date
Lucas Mazza	aab7610808	Release 4.0.0.rc1.	2016-02-01 09:20:42 -02:00
Lucas Mazza	8edee143e8	Prep for 4.0.0.rc1 release.	2016-01-31 17:05:16 -02:00
Lucas Mazza	49cf804c62	Merge pull request #3859 from twalpole/unsafe_h Explicitly permit rather than using to_unsafe_h	2016-01-31 16:56:10 -02:00
Lucas Mazza	8ab738307e	Merge pull request #3927 from plataformatec/lm-cookie-fix Attempt to coerce the `generated_at` cookie to a `Time` object.	2016-01-31 16:23:31 -02:00
Carlos Antonio da Silva	9d9adc73cd	Merge pull request #3928 from gfvcastro/remove-optional-parenthesis Remove optional parenthesis.	2016-01-30 18:08:50 -02:00
Gustavo Villa	91f93b38ee	Remove optional parenthesis.	2016-01-30 14:20:32 -03:00
Lucas Mazza	7bff3be869	Attempt to coerce the `generated_at` cookie to a `Time` object. Time objects aren't properly coerced back when using the JSON cookie serialization, so we need to do it ourselves. To avoid any new JSON serialization issues, we now store the `generated_at` as an String with the timestamp seconds + miliseconds in the cookie but still the previous JSON encoded format. Thanks to @boblail at https://github.com/plataformatec/devise/pull/3917 for the initial patch.	2016-01-29 18:04:16 -02:00
Lucas Mazza	475599d4ab	Merge pull request #3926 from schneems/schneems/fix-version [close 3925] Fix version for older Bundler compat	2016-01-29 14:57:42 -02:00
schneems	7d81731d4f	[close 3925] Fix version for older Bundler compat	2016-01-29 10:56:13 -06:00
Lucas Mazza	ffe9d6d406	Fix Symbol syntax on ParameterSanitizer deprecation message.	2016-01-28 11:10:15 -02:00
Lucas Mazza	cf7c9be6b4	Merge pull request #3919 from twalpole/gemfiles switch to oauth2 home repository	2016-01-27 15:58:57 -02:00
Thomas Walpole	3e80c9a80f	switch to oauth2 home repository	2016-01-27 09:03:01 -08:00
Lucas Mazza	c6cf035037	Merge pull request #3918 from plataformatec/lm-serialized_in_cookie Refactor `Rememberable#serialized_in_cookie?` to split class/instance API	2016-01-27 14:44:12 -02:00
Lucas Mazza	6008885152	Refactor `Rememberable.serialized_in_cookie?` to split class/instance API. We now expose a `remember_me?` instance method as internal API for the controller layer check if the remember me cookie is still valid.	2016-01-27 14:11:26 -02:00
Lucas Mazza	0c7f8764c9	Bump `Gemfile` dependencies.	2016-01-27 13:52:37 -02:00
José Valim	d1d8c2f03d	Ensure generated_at is a Time Signed-off-by: José Valim <jose.valim@plataformatec.com.br>	2016-01-25 11:17:18 +01:00
José Valim	b97b3e6e3b	Do not timeout if remember me is enabled Signed-off-by: José Valim <jose.valim@plataformatec.com.br>	2016-01-22 16:19:10 +01:00
Lucas Mazza	cc02d06c58	Remove Rails 3.2 compatibility fix.	2016-01-18 13:59:27 -02:00
Lucas Mazza	b91bbb1590	Tweak `ParameterSanitizer` exception/deprecation messages.	2016-01-18 13:51:51 -02:00
José Valim	52b1ca2d80	Bump to dev version	2016-01-18 15:22:00 +01:00
José Valim	4ec7dc0f27	Store creation timestamp on remember cookies Signed-off-by: José Valim <jose.valim@plataformatec.com.br>	2016-01-18 15:17:25 +01:00
Lucas Mazza	0a4da78b22	Add a notice to README regarding the sanitizer API change.	2016-01-17 12:53:31 -02:00
José Valim	aa3f64976f	Merge pull request #3898 from kulte/master Consistent formatting of file arguments to autoload	2016-01-13 23:10:38 +01:00
Zachary Friedman	260fa1a2e2	It would appear that consistency with the indentation used in the top-level Devise module would dictate this formatting change	2016-01-13 14:03:21 -08:00
José Valim	a321282ccc	Merge pull request #3893 from retrospective5/updated-readme Add link to devise_for documentation	2016-01-07 22:37:30 +01:00
araa	6f91baf99c	Add link to devise_for documentation	2016-01-07 14:37:02 -05:00
José Valim	1a7f2195a2	Merge pull request #3891 from obduk/parent_mailer Add parent_mailer to lib/generators/templates/devise.rb	2016-01-06 14:08:26 +01:00
Owen Davies	e5797001a7	Add parent_mailer to lib/generators/templates/devise.rb	2016-01-06 13:00:54 +00:00
Lucas Mazza	f0b937c538	Test against Ruby 2.3.0.	2016-01-05 14:48:10 -02:00
Carlos Antonio da Silva	9639bf8cc1	Merge pull request #3883 from Atul9/master Update copyright notices to 2016 [ci skip]	2016-01-04 10:42:13 -02:00
José Valim	27e1588685	Merge pull request #3885 from dcmorse/master Documentation clarification to README.md	2016-01-04 09:59:23 +01:00
Dave Morse	42fac75e8e	Clarify previous clarification to README.md	2016-01-03 17:06:34 -05:00
Dave Morse	37b7e9b850	README.md: clarified how to include Devise::TestHelpers for :view tests. Also clarified that including Devise::TestHelpers during integration tests is a mistake. source: https://github.com/plataformatec/devise/issues/3881	2016-01-03 16:50:47 -05:00
Atul Bhosale	48e26c5d0a	Update copyright notices to 2016 [ci skip]	2016-01-03 15:58:16 +05:30
Lucas Mazza	1d77099861	Merge pull request #3875 from james/master Update controller generator templates for new ParameterSanitizer syntax	2015-12-27 22:53:01 -02:00
James Darling	924a989f37	Update controller generator templates for new ParameterSanitizer syntax Devise::ParameterSanitizer has a new syntax for permitting additional attributes to a model. This commit updates the generated controllers to reflect that.	2015-12-28 00:45:03 +00:00
Lucas Mazza	6431445846	Cast the result of deperecated sanitization calls to a HWIA as well.	2015-12-21 09:57:20 -02:00
Lucas Mazza	8d57a54b2d	✂️ Remove custom Travis cache scripts.	2015-12-21 09:46:11 -02:00
Lucas Mazza	280d12b81c	Merge pull request #3856 from plataformatec/lm-sanitizer-cleanup Remove `ParametersSanitizer` inheritance.	2015-12-21 09:40:59 -02:00
Lucas Mazza	00a0b8e516	Fix duplicated `exclude` entry.	2015-12-20 23:02:52 -02:00
Lucas Mazza	238ccb15b5	Test against the beta Rails release.	2015-12-20 22:56:13 -02:00
Lucas Mazza	ace7b55a1a	Merge pull request #3868 from twalpole/gemfile_update update rails 5 gemfile with compatbile gem releases	2015-12-20 21:03:06 -02:00
Thomas Walpole	97ab41728e	update rails 5 gemfile with compatbile gem releases	2015-12-20 12:31:51 -08:00
Lucas Mazza	acd9f84802	Merge pull request #3866 from plataformatec/lm-remove-key-generator Remove `KeyGenerator` implementation ported from Rails 4.x.	2015-12-18 15:18:15 -02:00
Lucas Mazza	a24ecc65f5	Remove `KeyGenerator` implementation ported from Rails 4.x.	2015-12-18 14:49:50 -02:00
Lucas Mazza	4e45a5fde4	Remove Rails version mention from the initializer template.	2015-12-18 14:47:32 -02:00
Lucas Mazza	9499736593	Remove safeguard against a previously broken `NullSessionHash#reset_session`. This behavior was fixed on https://github.com/rails/rails/pull/12279.	2015-12-18 14:47:32 -02:00
Lucas Mazza	df8b48646b	Remove `ParametersSanitizer` inheritance. We no longer need to support the `BaseSanitizer` implementation for apps without the Strong Parameters API, and this section is lacking a minimal set of docs to document the expected behavior besides the `README` section.	2015-12-18 11:39:03 -02:00
Lucas Mazza	b4904a4ba2	Merge pull request #3865 from djsegal/rails5 Add #3732 helper logic to devise controller	2015-12-18 10:53:14 -02:00
djsegal	2006f87b58	Add #3732 helper logic to devise controller: #3864	2015-12-18 04:05:30 -05:00
Thomas Walpole	5d9f6d892f	Explicitly permit rather than using to_unsafe_h	2015-12-16 14:14:15 -08:00
Lucas Mazza	1ac4bdd090	Merge pull request #3857 from twalpole/test_fix Fix Rails 5 test	2015-12-16 10:01:18 -02:00
Thomas Walpole	302c4e43bd	fix Rails 5 test	2015-12-15 10:32:24 -08:00
Lucas Mazza	f5926f6514	Do not send Travis notifications of Pull Requests.	2015-12-15 15:26:08 -02:00
Lucas Mazza	330e0f7165	Update lockfile.	2015-12-15 14:55:36 -02:00
Lucas Mazza	42376db763	Update Devise version on README [ci skip]	2015-12-15 11:52:26 -02:00
Lucas Mazza	1147badf7c	Update Rails dependency contrainst to support the stable `5.0.0` release.	2015-12-15 11:49:44 -02:00
Lucas Mazza	7b000390ac	Update CHANGELOG.md [ci skip]	2015-12-15 11:48:41 -02:00
Lucas Mazza	dd5de829c9	Merge pull request #3714 from twalpole/rails5 Rails 5 Support	2015-12-15 11:44:01 -02:00
Lucas Mazza	2f7834245b	Merge pull request #3835 from kv109/master test for save in after_create hook breaks devise confirmation [3787]	2015-12-15 11:36:47 -02:00
Lucas Mazza	78d2654fb4	Merge pull request #3793 from chrismacias/save_in_after_create_hook_breaks_devise_confirmation save in after_create hook breaks devise confirmation	2015-12-15 11:36:34 -02:00
José Valim	934dbd1f5a	Merge pull request #3854 from joshsoftware/reset_password_token_issue Comparing times in UTC	2015-12-15 11:55:24 +01:00
Siva Gollapalli	23933d2fb0	FIX# Comparing times in UTC	2015-12-15 15:17:11 +05:30
José Valim	76bbbb8ed5	Merge pull request #3853 from betesh/betesh-patch-1 Removed unnecessary module fixes #3852	2015-12-15 09:35:12 +01:00
betesh	8701a88c94	Removed unnecessary module	2015-12-15 02:52:17 -05:00
Thomas Walpole	2024fca4df	Rails 5 compatability. Remove rails < 4.1 and Ruby < 2.1	2015-12-11 09:47:30 -08:00
Kacper Walanus	a0cd4655ba	test for save in after_create hook breaks devise confirmation [3787]	2015-11-24 01:54:03 +01:00
Christian Macias	54bb30a1a4	changed email_was !='' to email_was.present?	2015-10-26 08:56:14 -07:00
Christian Macias	5ae6360e75	fix for #3787 , save in after_create hook breaks devise confirmation	2015-10-22 13:05:02 -07:00