devise-token_authenticatable 0.4.6 → 0.4.9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 1a68ab4f5e9ea350298a644299de878c50077a96
-  data.tar.gz: c110e22709365cd6f0861b8703b224f0db7857a4
+  metadata.gz: 33ae1c06a79b20b7e886cdbc7795b776b78fc767
+  data.tar.gz: 175c959f673397ff325234ac4a23d673d6824f7f
 SHA512:
-  metadata.gz: dbb469bf9f93baa80bc069d2417c1cdca7d2d5ca975085d6b3a963d52cdcb7b99f3edb0b9e7ab8eb7e32e595b86024a23720a518469664023a12fa5f78e9b6e7
-  data.tar.gz: af936ee72ce7019d43cb86f70eeed9c6d11ff0b11cd8a4c825d3ade79112033230a1580039530dbaa23900cbf6c5938c5a2697992f3f295e25976397f32b5bc5
+  metadata.gz: be522497669564ea1abc605303c6df1e76a8cb84daeb9bf6366bdbbce48deb0dc669ec76370bc7c5365b13371974eae14094155e85bab4bb9445f5038eeb4176
+  data.tar.gz: e9404d5a0f635763fff3159df5e40cdf6cd7c716d9adcc8d8b4b4caee2ee905a68e150ddf40ee1e1d332c41f819ee148ec88240b95dce24cccfa0cfde644c79f

data/.travis.yml

@@ -1,16 +1,11 @@
 language: ruby
 rvm:
-  - 1.9.3
   - 2.0.0
-  - 2.1.2
-  - 2.2.0
-  - jruby-19mode
+  - 2.1.9
+  - 2.2.5
+  - 2.3.1
 
 before_install:
   - gem install bundler -v 1.11
 
-env:
-  global:
-    - "JRUBY_OPTS=-Xcext.enabled=true"
-
 script: bundle exec rspec

data/README.md

@@ -27,8 +27,8 @@ Or install it yourself as:
 `~> 0.1`                        | `~> 3.2.0`
 `~> 0.2`                        | `~> 3.3.0`
 `~> 0.3`                        | `~> 3.4.0`
-`~> 0.4`                        | `~> 3.5.0`
-`~> 0.4.6`                      | `~> 3.5.2`
+`~> 0.4.0`, `< 0.4.9`           | `~> 3.5.0`, `< 3.5.2`
+`~> 0.4.9`                      | `~> 3.5.2`
 
 ## Usage
 
@@ -46,10 +46,9 @@ This gem can be configured as shown in the following:
 
 ```ruby
 Devise::TokenAuthenticatable.setup do |config|
-  # enables the expiration of a token after a session timeout,
-  # only useful in connection with the devise timeoutable module,
-  # defaults to false
-  config.expire_auth_token_on_timeout = true
+  # enables the expiration of a token after a specified amount of time,
+  # defaults to nil
+  config.token_expires_in = 1.day
 
   # set the authentication key name used by this module,
   # defaults to :auth_token

data/lib/devise/token_authenticatable.rb

@@ -3,17 +3,14 @@ require "devise/token_authenticatable/strategy"
 module Devise
   module TokenAuthenticatable
 
-    # Authentication token expiration on timeout
-    #
-    # This option is only used if your model uses the Devise
-    # :timeoutable module.
-    mattr_accessor :expire_auth_token_on_timeout
-    @@expire_auth_token_on_timeout = false
-
     # Authentication token params key name of choice. E.g. /users/sign_in?some_key=...
     mattr_accessor :token_authentication_key
     @@token_authentication_key = :auth_token
 
+    # Token expiration period. E.g. 1.day
+    mattr_accessor :token_expires_in
+    @@token_expires_in = nil
+
     # Defines if the authentication token is reset before the model is saved.
     mattr_accessor :should_reset_authentication_token
     @@should_reset_authentication_token = false

data/lib/devise/token_authenticatable/model.rb

@@ -1,5 +1,3 @@
-require 'devise/token_authenticatable/hooks/timeoutable'
-
 module Devise
   module Models
     # The +TokenAuthenticatable+ module is responsible for generating an authentication token and
@@ -30,7 +28,7 @@ module Devise
         before_save :reset_authentication_token_before_save
         before_save :ensure_authentication_token_before_save
 
-        attr_writer :expire_auth_token_on_timeout
+        attr_writer :token_expires_in
       end
 
       module ClassMethods
@@ -55,12 +53,13 @@ module Devise
       end
 
       def self.required_fields(klass)
-        [:authentication_token]
+        [:authentication_token, :authentication_token_created_at]
       end
 
       # Generate new authentication token (a.k.a. "single access token").
       def reset_authentication_token
         self.authentication_token = self.class.authentication_token
+        self.authentication_token_created_at = Time.now
       end
 
       # Generate new authentication token and save the record.
@@ -83,12 +82,8 @@ module Devise
       def after_token_authentication
       end
 
-      def expire_auth_token_on_timeout
-        if @expire_auth_token_on_timeout
-          @expire_auth_token_on_timeout
-        else
-          Devise::TokenAuthenticatable.expire_auth_token_on_timeout
-        end
+      def token_expires_in
+        Devise::TokenAuthenticatable.token_expires_in
       end
 
       private

data/lib/devise/token_authenticatable/strategy.rb

@@ -36,6 +36,12 @@ module Devise
         resource = mapping.to.find_for_token_authentication(authentication_hash)
         return fail(:invalid_token) unless resource
 
+        unless token_expires_in.blank?
+          if Time.now > (resource.authentication_token_created_at + token_expires_in.to_i)
+            return fail(:expired_token)
+          end
+        end
+
         if validate(resource)
           resource.after_token_authentication
           success!(resource)
@@ -88,6 +94,10 @@ module Devise
       def authentication_keys
         @authentication_keys ||= [Devise::TokenAuthenticatable.token_authentication_key]
       end
+
+      def token_expires_in
+        @token_expires_in ||= Devise::TokenAuthenticatable.token_expires_in
+      end
     end
   end
 end

data/lib/devise/token_authenticatable/version.rb

@@ -1,5 +1,5 @@
 module Devise
   module TokenAuthenticatable
-    VERSION = "0.4.6".freeze
+    VERSION = '0.4.9'.freeze
   end
 end

data/spec/factories/user.rb

@@ -21,6 +21,12 @@ FactoryGirl.define do
 
     trait :with_authentication_token do
       authentication_token { SecureRandom.hex }
+      authentication_token_created_at { Time.now }
+    end
+
+    trait :with_day_old_token do
+      authentication_token { SecureRandom.hex }
+      authentication_token_created_at { Time.now - 1.day }
     end
   end
 end

data/spec/models/devise/token_authenticatable/model_spec.rb

@@ -8,72 +8,56 @@ require 'spec_helper'
 # See spec/factories/user.rb for an example.
 #
 shared_examples "token authenticatable" do
-
   context "instance methods" do
-
     describe "#reset_authentication_token" do
       let(:entity) { create(described_class.name.underscore.to_sym, :with_authentication_token) }
 
+      subject { entity.reset_authentication_token }
+
       it "should reset authentication token" do
-        expect { entity.reset_authentication_token }.to change { entity.authentication_token }
+        expect { subject }.to change { entity.authentication_token }
+      end
+
+      it "should reset token created at" do
+        expect { subject }.to change { entity.authentication_token_created_at }
       end
     end
 
     describe "#ensure_authentication_token" do
+      subject { entity.ensure_authentication_token }
 
       context "with existing authentication token" do
         let(:entity) { create(described_class.name.underscore.to_sym, :with_authentication_token) }
 
         it "should not change the authentication token" do
-          expect { entity.ensure_authentication_token }.to_not change { entity.authentication_token }
+          expect { subject }.to_not change { entity.authentication_token }
         end
-      end
-
-      context "without existing authentication token" do
-        let(:entity) { create(described_class.name.underscore.to_sym) }
 
-        it "should create an authentication token" do
-          entity.authentication_token = nil
-          expect { entity.ensure_authentication_token }.to change { entity.authentication_token }
+        it "should not change the authentication token created at" do
+          expect { subject }.to_not change { entity.authentication_token_created_at }
         end
       end
-    end
-
-    describe "#expire_auth_token_on_timeout" do
-      let(:entity) { create(described_class.name.underscore.to_sym) }
 
-      context "enabling expire_auth_token_on_timeout first" do
+      context "without existing authentication token and authentication token created at" do
+        let(:entity) { create(described_class.name.underscore.to_sym) }
 
         before :each do
-          entity.expire_auth_token_on_timeout = true
+          entity.authentication_token = nil
+          entity.authentication_token_created_at = nil
         end
 
-        it "should be true" do
-          expect(entity.expire_auth_token_on_timeout).to eq true
+        it "should set an authentication token" do
+          expect { subject }.to change { entity.authentication_token }
         end
 
-        it "should not use the default" do
-          expect(Devise::TokenAuthenticatable).to_not receive(:expire_auth_token_on_timeout)
-          
-          entity.expire_auth_token_on_timeout
+        it "should set authentication token created at" do
+          expect { subject }.to change { entity.authentication_token_created_at }
         end
-
-      end
-
-      context "not enabling expire_auth_token_on_timeout" do
-
-        it "should use the default" do
-          expect(Devise::TokenAuthenticatable).to receive(:expire_auth_token_on_timeout)
-          
-          entity.expire_auth_token_on_timeout
-        end
-
       end
     end
   end
 
   context "class methods" do
-
     describe "#find_for_authentication_token" do
       let(:entity) { create(described_class.name.underscore.to_sym, :with_authentication_token) }
 
@@ -97,7 +81,7 @@ shared_examples "token authenticatable" do
       end
 
       it "should not be subject to injection" do
-        entity2 = create(described_class.name.underscore.to_sym, :with_authentication_token)
+        create(described_class.name.underscore.to_sym, :with_authentication_token)
 
         authenticated_entity = described_class.find_for_token_authentication(auth_token: { '$ne' => entity.authentication_token })
         expect(authenticated_entity).to be_nil
@@ -105,23 +89,19 @@ shared_examples "token authenticatable" do
     end
 
     describe "#required_fields" do
-
       it "should contain the fields that Devise uses" do
         expect(Devise::Models::TokenAuthenticatable.required_fields(described_class)).to eq([
-          :authentication_token
+          :authentication_token, :authentication_token_created_at
         ])
       end
-
     end
 
   end
 
   context "before_save" do
-
     let(:entity) { create(described_class.name.underscore.to_sym, :with_authentication_token) }
 
     context "when the authentication token should be reset" do
-
       before :each do
         Devise::TokenAuthenticatable.setup do |config|
           config.should_reset_authentication_token = true
@@ -139,21 +119,17 @@ shared_examples "token authenticatable" do
 
         entity.update_attributes(created_at: Time.now)
       end
-
     end
 
     context "when the authentication token should not be reset" do
-
       it "does not reset the authentication token" do
         expect(entity).to_not receive(:reset_authentication_token)
 
         entity.update_attributes(created_at: Time.now)
       end
-
     end
 
     context "when the authentication token should be ensured" do
-
       before :each do
         Devise::TokenAuthenticatable.setup do |config|
           config.should_ensure_authentication_token = true
@@ -171,21 +147,16 @@ shared_examples "token authenticatable" do
 
         entity.update_attributes(created_at: Time.now)
       end
-
     end
 
     context "when the authentication token should not be ensured" do
-
       it "does not set the authentication token" do
         expect(entity).to_not receive(:ensure_authentication_token)
 
         entity.update_attributes(created_at: Time.now)
       end
-
     end
-
   end
-
 end
 
 describe User do

data/spec/requests/devise/token_authenticatable/strategy_spec.rb

@@ -1,11 +1,8 @@
 require 'spec_helper'
 
 describe Devise::Strategies::TokenAuthenticatable do
-
   context "with valid authentication token key and value" do
-
     context "through params" do
-
       it "should be a success" do
         swap Devise::TokenAuthenticatable, token_authentication_key: :secret_token do
           sign_in_as_new_user_with_token
@@ -59,7 +56,6 @@ describe Devise::Strategies::TokenAuthenticatable do
       end
 
       context "when request is stateless" do
-
         it 'should authenticate the user with use of authentication token' do
           swap Devise::TokenAuthenticatable, token_authentication_key: :secret_token do
             swap Devise, skip_session_storage: [:token_auth] do
@@ -92,13 +88,10 @@ describe Devise::Strategies::TokenAuthenticatable do
             end
           end
         end
-
       end
 
       context "when request is stateless and timeoutable" do
-
         context "on sign in" do
-
           it 'should authenticate the user' do
             swap Devise::TokenAuthenticatable, token_authentication_key: :secret_token do
               swap Devise, skip_session_storage: [:token_auth], timeout_in: (0.1).second do
@@ -107,11 +100,9 @@ describe Devise::Strategies::TokenAuthenticatable do
               end
             end
           end
-
         end
 
         context "on delayed access" do
-
           it 'should authenticate the user' do
             swap Devise::TokenAuthenticatable, token_authentication_key: :secret_token do
               swap Devise, skip_session_storage: [:token_auth], timeout_in: (0.1).second do
@@ -127,59 +118,10 @@ describe Devise::Strategies::TokenAuthenticatable do
               end
             end
           end
-
-        end
-
-      end
-
-      context "when expire_auth_token_on_timeout is set to true, timeoutable is enabled and we have a timed out session" do
-
-        context "on sign in" do
-
-          it 'should authenticate the user' do
-            swap Devise::TokenAuthenticatable, token_authentication_key: :secret_token, expire_auth_token_on_timeout: true do
-              swap Devise, timeout_in: (-1).minute do
-                sign_in_as_new_user_with_token
-                expect(warden).to be_authenticated(:user)
-              end
-            end
-          end
-
-        end
-
-        context "on re-sign in" do
-
-          it 'should not authenticate the user' do
-            swap Devise::TokenAuthenticatable, token_authentication_key: :secret_token, expire_auth_token_on_timeout: true do
-              swap Devise, timeout_in: (-1).minute do
-                user  = sign_in_as_new_user_with_token
-                token = user.authentication_token
-
-                sign_in_as_new_user_with_token(user: user)
-                expect(warden).to_not be_authenticated(:user)
-              end
-            end
-          end
-
-          it 'should reset the authentication token' do
-            swap Devise::TokenAuthenticatable, token_authentication_key: :secret_token, expire_auth_token_on_timeout: true do
-              swap Devise, timeout_in: (-1).minute do
-                user  = sign_in_as_new_user_with_token
-                token = user.authentication_token
-
-                sign_in_as_new_user_with_token(user: user)
-                user.reload
-                expect(token).to_not eq(user.authentication_token)
-              end
-            end
-          end
-
         end
-
       end
 
       context "when not configured" do
-
         it "should redirect to sign in page" do
           swap Devise::TokenAuthenticatable, token_authentication_key: :secret_token do
             swap Devise, params_authenticatable: [:database] do
@@ -203,7 +145,6 @@ describe Devise::Strategies::TokenAuthenticatable do
     end
 
     context "through http" do
-
       it "should be a success" do
         swap Devise::TokenAuthenticatable, token_authentication_key: :secret_token do
           swap Devise, http_authenticatable: true do
@@ -225,7 +166,6 @@ describe Devise::Strategies::TokenAuthenticatable do
       end
 
       context "when not configured" do
-
         it "should be an unauthorized" do
           swap Devise::TokenAuthenticatable, token_authentication_key: :secret_token do
             swap Devise, http_authenticatable: [:database] do
@@ -249,7 +189,6 @@ describe Devise::Strategies::TokenAuthenticatable do
     end
 
     context "through http header" do
-
       it "should redirect to root path" do
         swap Devise::TokenAuthenticatable, token_authentication_key: :secret_token do
           swap Devise, http_authenticatable: true do
@@ -325,7 +264,6 @@ describe Devise::Strategies::TokenAuthenticatable do
       end
 
       context "with denied token authorization" do
-
         it "should be an unauthorized" do
           swap Devise::TokenAuthenticatable, token_authentication_key: :secret_token do
             swap Devise, http_authenticatable: false do
@@ -345,14 +283,11 @@ describe Devise::Strategies::TokenAuthenticatable do
             end
           end
         end
-
       end
-
     end
   end
 
   context "with improper authentication token key" do
-
     it "should redirect to the sign in page" do
       swap Devise::TokenAuthenticatable, token_authentication_key: :donald_duck_token do
         sign_in_as_new_user_with_token(auth_token_key: :secret_token)
@@ -372,19 +307,16 @@ describe Devise::Strategies::TokenAuthenticatable do
     it "should not be subject to injection" do
       swap Devise::TokenAuthenticatable, token_authentication_key: :secret_token do
         user1 = create(:user, :with_authentication_token)
-        user2 = create(:user, :with_authentication_token)
+        create(:user, :with_authentication_token)
 
         get users_path(Devise::TokenAuthenticatable.token_authentication_key.to_s + '[$ne]' => user1.authentication_token)
         expect(warden).to_not be_authenticated(:user)
       end
     end
-
   end
 
   context "with improper authentication token value" do
-
     context "through params" do
-
       before { sign_in_as_new_user_with_token(auth_token: '*** INVALID TOKEN ***') }
 
       it "should redirect to the sign in page" do
@@ -397,7 +329,6 @@ describe Devise::Strategies::TokenAuthenticatable do
     end
 
     context "through http header" do
-
       before { sign_in_as_new_user_with_token(token_auth: true, auth_token: '*** INVALID TOKEN ***') }
 
       it "should be an unauthorized" do
@@ -409,4 +340,46 @@ describe Devise::Strategies::TokenAuthenticatable do
       end
     end
   end
+
+  context "with expired authentication token value" do
+    context "through params" do
+      it "should redirect to the sign in page" do
+        swap Devise::TokenAuthenticatable, token_expires_in: 1.hour do
+          sign_in_as_new_user_with_token(use: :with_day_old_token)
+
+          expect(response).to redirect_to new_user_session_path
+        end
+      end
+
+      it "should not authenticate user" do
+        swap Devise::TokenAuthenticatable, token_expires_in: 1.hour do
+          sign_in_as_new_user_with_token(use: :with_day_old_token)
+
+          expect(warden).to_not be_authenticated(:user)
+        end
+      end
+
+      context "through http header" do
+        it "should redirect to the sign in page" do
+          swap Devise::TokenAuthenticatable, token_expires_in: 1.hour do
+            swap Devise, http_authenticatable: true do
+              sign_in_as_new_user_with_token(http_auth: true, use: :with_day_old_token)
+
+              expect(response.status).to eq(401)
+            end
+          end
+        end
+
+        it "does not authenticate with expired authentication token value in header" do
+          swap Devise::TokenAuthenticatable, token_expires_in: 1.hour do
+            swap Devise, http_authenticatable: true do
+              sign_in_as_new_user_with_token(http_auth: true, use: :with_day_old_token)
+
+              expect(warden).to_not be_authenticated(:user)
+            end
+          end
+        end
+      end
+    end
+  end
 end

data/spec/support/rails_app/db/migrate/20100401102949_create_tables.rb

@@ -5,8 +5,8 @@ class CreateTables < ActiveRecord::Migration
       t.string :facebook_token
 
       ## Database authenticatable
-      t.string :email,              :null => false, :default => ""
-      t.string :encrypted_password, :null => false, :default => ""
+      t.string :email,              null: false, default: ""
+      t.string :encrypted_password, null: false, default: ""
 
       ## Recoverable
       t.string   :reset_password_token
@@ -16,7 +16,7 @@ class CreateTables < ActiveRecord::Migration
       t.datetime :remember_created_at
 
       ## Trackable
-      t.integer  :sign_in_count, :default => 0
+      t.integer  :sign_in_count, default: 0
       t.datetime :current_sign_in_at
       t.datetime :last_sign_in_at
       t.string   :current_sign_in_ip
@@ -29,20 +29,21 @@ class CreateTables < ActiveRecord::Migration
       # t.string   :unconfirmed_email # Only if using reconfirmable
 
       ## Lockable
-      t.integer  :failed_attempts, :default => 0 # Only if lock strategy is :failed_attempts
+      t.integer  :failed_attempts, default: 0 # Only if lock strategy is :failed_attempts
       t.string   :unlock_token # Only if unlock strategy is :email or :both
       t.datetime :locked_at
 
       ## Token authenticatable
       t.string :authentication_token
+      t.datetime :authentication_token_created_at, null: true
 
       t.timestamps
     end
 
     create_table :admins do |t|
       ## Database authenticatable
-      t.string :email,              :null => true
-      t.string :encrypted_password, :null => true
+      t.string :email,              null: true
+      t.string :encrypted_password, null: true
 
       ## Recoverable
       t.string   :reset_password_token
@@ -61,7 +62,7 @@ class CreateTables < ActiveRecord::Migration
       t.datetime :locked_at
 
       ## Attribute for testing route blocks
-      t.boolean :active, :default => false
+      t.boolean :active, default: false
 
       t.timestamps
     end

data/spec/support/rails_app/db/schema.rb

@@ -45,6 +45,7 @@ ActiveRecord::Schema.define(:version => 20100401102949) do
     t.string   "unlock_token"
     t.datetime "locked_at"
     t.string   "authentication_token"
+    t.datetime "authentication_token_created_at"
     t.datetime "created_at"
     t.datetime "updated_at"
   end

data/spec/support/session_helper.rb

@@ -7,7 +7,8 @@
 # a new one is created.
 #
 def sign_in_as_new_user_with_token(options = {})
-  user = options.delete(:user) || create(:user, :with_authentication_token)
+  trait = options[:use] ? options[:use] : :with_authentication_token
+  user = options.delete(:user) || create(:user, trait)
 
   options[:auth_token_key] ||= Devise::TokenAuthenticatable.token_authentication_key
   options[:auth_token]     ||= user.authentication_token

data/spec/token_authenticatable_spec.rb

@@ -1,18 +1,15 @@
 require 'spec_helper'
 
 describe Devise::TokenAuthenticatable do
-
-  context "configuring the expire_auth_token_on_timeout" do
-    let(:expire_auth_token_on_timeout) { true }
+  context "configuring the token_expires_in" do
+    let(:expire_time) { 1.hour }
 
     it "should set the configuration" do
       expect {
         Devise::TokenAuthenticatable.setup do |config|
-          config.expire_auth_token_on_timeout = expire_auth_token_on_timeout
+          config.token_expires_in = expire_time
         end
-      }.to change {
-        Devise::TokenAuthenticatable.expire_auth_token_on_timeout
-      }.from(false).to(expire_auth_token_on_timeout)
+      }.to change { Devise::TokenAuthenticatable.token_expires_in }.from(nil).to(expire_time)
     end
   end
 
@@ -51,5 +48,4 @@ describe Devise::TokenAuthenticatable do
       }.to change { Devise::TokenAuthenticatable.should_ensure_authentication_token }.from(false).to(should_ensure)
     end
   end
-
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: devise-token_authenticatable
 version: !ruby/object:Gem::Version
-  version: 0.4.6
+  version: 0.4.9
 platform: ruby
 authors:
 - Sebastian Oelke
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-03-11 00:00:00.000000000 Z
+date: 2016-05-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: devise
@@ -147,7 +147,6 @@ files:
 - devise-token_authenticatable.gemspec
 - lib/devise-token_authenticatable.rb
 - lib/devise/token_authenticatable.rb
-- lib/devise/token_authenticatable/hooks/timeoutable.rb
 - lib/devise/token_authenticatable/model.rb
 - lib/devise/token_authenticatable/strategy.rb
 - lib/devise/token_authenticatable/version.rb

data/lib/devise/token_authenticatable/hooks/timeoutable.rb

@@ -1,34 +0,0 @@
-# Each time a record is set we check whether its session has already timed out
-# or not, based on last request time. If so and :expire_auth_token_on_timeout
-# is set to true, the record's auth token is reset.
-
-# This is a backport of the functionality of expire_auth_token_on_timeout that
-# has been removed from devise in version 3.5.2.
-#
-# For the original version cf.
-# https://github.com/plataformatec/devise/blob/v3.5.1/lib/devise/hooks/timeoutable.rb.
-
-Warden::Manager.after_set_user do |record, warden, options|
-  scope = options[:scope]
-  env   = warden.request.env
-
-  if record && record.respond_to?(:timedout?) &&
-    warden.authenticated?(scope) &&
-    options[:store] != false     &&
-    !env['devise.skip_timeoutable']
-
-    last_request_at = warden.session(scope)['last_request_at']
-
-    if last_request_at.is_a? Integer
-      last_request_at = Time.at(last_request_at).utc
-    elsif last_request_at.is_a? String
-      last_request_at = Time.parse(last_request_at)
-    end
-
-    if record.timedout?(last_request_at) && !env['devise.skip_timeout']
-      if record.respond_to?(:expire_auth_token_on_timeout) && record.expire_auth_token_on_timeout
-        record.reset_authentication_token!
-      end
-    end
-  end
-end