devise 1.0.11 → 1.1.0

data/CHANGELOG.rdoc

@@ -1,25 +1,72 @@
-== 1.0.11
+== 1.1.0
+
+* enhancements
+  * Rememberable module allows user to be remembered across browsers and is enabled by default (by github.com/trevorturk)
+  * Rememberable module allows you to activate the period the remember me token is extended (by github.com/trevorturk)
+  * devise_for can now be used together with scope method in routes but with a few limitations (check the documentation)
+  * Support `as` or `devise_scope` in the router to specify controller access scope
+  * HTTP Basic Auth can now be disabled/enabled for xhr(ajax) requests using http_authenticatable_on_xhr option (by github.com/pellja)
 
 * bug fix
-  * Make sure xhr requests do not store urls for redirect
-  * Squeeze break lines from cookies to avoid duplicated break lines
+  * Fix a bug in Devise::TestHelpers where current_user was returning a Response object for non active accounts
+  * Devise should respect script_name and path_info contracts
+  * Fix a bug when accessing a path with (.:format) (by github.com/klacointe)
+  * Do not add unlock routes unless unlock strategy is email or both
+  * Email should be case insensitive
+  * Store classes as string in session, to avoid serialization and stale data issues
+
+* deprecations
+  * use_default_scope is deprecated and has no effect. Use :as or :devise_scope in the router instead
+
+== 1.1.rc2
 
-== 1.0.10
+* enhancements
+  * Allow to set cookie domain for the remember token. (by github.com/mantas)
+  * Added navigational formats to specify when it should return a 302 and when a 401.
+  * Added authenticate(scope) support in routes (by github.com/wildchild)
+  * Added after_update_path_for to registrations controller (by github.com/thedelchop)
+  * Allow the mailer object to be replaced through config.mailer = "MyOwnMailer"
 
 * bug fix
-  * Use secure compare when comparing passwords
-  * Improve email regexp
-  * Implement handle_unverified_request for Rails 2.3.11
+  * Fix a bug where session was timing out on sign out
 
-== 1.0.9
+* deprecations
+  * bcrypt is now the default encryptor
+  * devise.mailer.confirmations_instructions now should be devise.mailer.confirmations_instructions.subject
+  * devise.mailer.user.confirmations_instructions now should be devise.mailer.confirmations_instructions.user_subject
+  * Generators now use Rails 3 syntax (devise:install) instead of devise_install
+
+== 1.1.rc1
 
 * enhancements
-  * Extracted redirect path from Devise failure app to a new method, allowing override in custom failure apps
-  * Added sign_out_via
+  * Rails 3 compatibility
+  * All controllers and views are namespaced, for example: Devise::SessionsController and "devise/sessions"
+  * Devise.orm is deprecated. This reduces the required API to hook your ORM with devise
+  * Use metal for failure app
+  * HTML e-mails now have proper formatting
+  * Allow to give :skip and :controllers in routes
+  * Move trackable logic to the model
+  * E-mails now use any template available in the filesystem. Easy to create multipart e-mails
+  * E-mails asks headers_for in the model to set the proper headers
+  * Allow to specify haml in devise_views
+  * Compatibility with Mongoid
+  * Make config.devise available on config/application.rb
+  * TokenAuthenticatable now works with HTTP Basic Auth
+  * Allow :unlock_strategy to be :none and add :lock_strategy which can be :failed_attempts or none. Setting those values to :none means that you want to handle lock and unlocking by yourself
+  * No need to append ?unauthenticated=true in URLs anymore since Flash was moved to a middleware in Rails 3
+  * :activatable is included by default in your models
 
 * bug fix
-  * Email is now case insensitive
-  * Avoid session fixation attacks
+  * Fix a bug with STI
+
+* deprecations
+  * Rails 3 compatible only
+  * Removed support for MongoMapper
+  * Scoped views are no longer "sessions/users/new". Now use "users/sessions/new"
+  * Devise.orm is deprecated, just require "devise/orm/YOUR_ORM" instead
+  * Devise.default_url_options is deprecated, just modify ApplicationController.default_url_options
+  * All messages under devise.sessions, except :signed_in and :signed_out, should be moved to devise.failure
+  * :as and :scope in routes is deprecated. Use :path and :singular instead
 
 == 1.0.8
 
@@ -93,7 +140,6 @@
   * Added Http Basic Authentication support
   * Allow scoped_views to be customized per controller/mailer class
   * [#99] Allow authenticatable to used in change_table statements
-  * Add mailer_content_type configuration parameter (by github.com/glennr)
 
 == 0.9.2
 

data/Gemfile

@@ -0,0 +1,23 @@
+source "http://rubygems.org"
+
+if File.exist? File.expand_path('../../rails', __FILE__)
+  gem "rails", :path => "../rails"
+else
+  gem "rails", :git => "git://github.com/rails/rails.git"
+end
+
+gem "warden", "0.10.7"
+gem "sqlite3-ruby"
+gem "webrat", "0.7.0"
+gem "mocha", :require => false
+gem "bcrypt-ruby", :require => "bcrypt"
+
+if RUBY_VERSION < '1.9'
+  gem "ruby-debug", ">= 0.10.3"
+end
+
+group :mongoid do
+  gem "mongo"
+  gem "mongoid", :git => "git://github.com/durran/mongoid.git"
+  gem "bson_ext"
+end

data/Gemfile.lock

@@ -0,0 +1,118 @@
+GIT
+  remote: git://github.com/durran/mongoid.git
+  revision: a5abe21
+  specs:
+    mongoid (2.0.0.beta9)
+      activemodel (~> 3.0.0.beta)
+      bson (~> 1.0.3)
+      mongo (~> 1.0.3)
+      tzinfo (~> 0.3.22)
+      will_paginate (~> 3.0.pre)
+
+PATH
+  remote: /Users/jose/Work/github/rails
+  specs:
+    actionmailer (3.0.0.beta4)
+      actionpack (= 3.0.0.beta4)
+      mail (~> 2.2.5)
+    actionpack (3.0.0.beta4)
+      activemodel (= 3.0.0.beta4)
+      activesupport (= 3.0.0.beta4)
+      builder (~> 2.1.2)
+      erubis (~> 2.6.6)
+      i18n (~> 0.4.1)
+      rack (~> 1.2.1)
+      rack-mount (~> 0.6.9)
+      rack-test (~> 0.5.4)
+      tzinfo (~> 0.3.22)
+    activemodel (3.0.0.beta4)
+      activesupport (= 3.0.0.beta4)
+      builder (~> 2.1.2)
+      i18n (~> 0.4.1)
+    activerecord (3.0.0.beta4)
+      activemodel (= 3.0.0.beta4)
+      activesupport (= 3.0.0.beta4)
+      arel (~> 0.4.0)
+      tzinfo (~> 0.3.22)
+    activeresource (3.0.0.beta4)
+      activemodel (= 3.0.0.beta4)
+      activesupport (= 3.0.0.beta4)
+    activesupport (3.0.0.beta4)
+    rails (3.0.0.beta4)
+      actionmailer (= 3.0.0.beta4)
+      actionpack (= 3.0.0.beta4)
+      activerecord (= 3.0.0.beta4)
+      activeresource (= 3.0.0.beta4)
+      activesupport (= 3.0.0.beta4)
+      bundler (>= 1.0.0.beta.10)
+      railties (= 3.0.0.beta4)
+    railties (3.0.0.beta4)
+      actionpack (= 3.0.0.beta4)
+      activesupport (= 3.0.0.beta4)
+      rake (>= 0.8.3)
+      thor (~> 0.14.0)
+
+GEM
+  remote: http://rubygems.org/
+  specs:
+    abstract (1.0.0)
+    arel (0.4.0)
+      activesupport (>= 3.0.0.beta)
+    bcrypt-ruby (2.1.2)
+    bson (1.0.4)
+    bson_ext (1.0.4)
+    builder (2.1.2)
+    columnize (0.3.1)
+    erubis (2.6.6)
+      abstract (>= 1.0.0)
+    i18n (0.4.1)
+    linecache (0.43)
+    mail (2.2.5)
+      activesupport (>= 2.3.6)
+      mime-types
+      treetop (>= 1.4.5)
+    mime-types (1.16)
+    mocha (0.9.8)
+      rake
+    mongo (1.0.5)
+      bson (>= 1.0.4)
+    nokogiri (1.4.2)
+    polyglot (0.3.1)
+    rack (1.2.1)
+    rack-mount (0.6.9)
+      rack (>= 1.0.0)
+    rack-test (0.5.4)
+      rack (>= 1.0)
+    rake (0.8.7)
+    ruby-debug (0.10.3)
+      columnize (>= 0.1)
+      ruby-debug-base (~> 0.10.3.0)
+    ruby-debug-base (0.10.3)
+      linecache (>= 0.3)
+    sqlite3-ruby (1.3.1)
+    thor (0.14.0)
+    treetop (1.4.8)
+      polyglot (>= 0.3.1)
+    tzinfo (0.3.22)
+    warden (0.10.7)
+      rack (>= 1.0.0)
+    webrat (0.7.0)
+      nokogiri (>= 1.2.0)
+      rack (>= 1.0)
+      rack-test (>= 0.5.3)
+    will_paginate (3.0.pre)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  bcrypt-ruby
+  bson_ext
+  mocha
+  mongo
+  mongoid!
+  rails!
+  ruby-debug (>= 0.10.3)
+  sqlite3-ruby
+  warden (= 0.10.7)
+  webrat (= 0.7.0)

data/README.rdoc

@@ -7,67 +7,82 @@ Devise is a flexible authentication solution for Rails based on Warden. It:
 * Allows you to have multiple roles (or models/scopes) signed in at the same time;
 * Is based on a modularity concept: use just what you really need.
 
-Right now it's composed of 12 modules:
+Right now it's composed of 11 modules:
+
+* Database Authenticatable: encrypts and stores a password in the database to validate the authenticity of an user while signing in. The authentication can be done both through POST requests or HTTP Basic Authentication.
+* Token Authenticatable: signs in an user based on an authentication token (also known as "single access token"). The token can be given both through query string or HTTP Basic Authentication.
+* Confirmable: sends emails with confirmation instructions and verifies whether an account is already confirmed during sign in.
+* Recoverable: resets the user password and sends reset instructions.
+* Registerable: handles signing up users through a registration process, also allowing them to edit and destroy their account.
+* Rememberable: manages generating and clearing a token for remembering the user from a saved cookie.
+* Trackable: tracks sign in count, timestamps and IP address.
+* Timeoutable: expires sessions that have no activity in a specified period of time.
+* Validatable: provides validations of email and password. It's optional and can be customized, so you're able to define your own validations.
+* Lockable: locks an account after a specified number of failed sign-in attempts. Can unlock via email or after a specified time period.
 
-* Database Authenticatable: responsible for encrypting password and validating authenticity of a user while signing in.
-* Token Authenticatable: validates authenticity of a user while signing in using an authentication token (also known as "single access token").
-* HttpAuthenticatable: sign in users using basic HTTP authentication.
-* Confirmable: responsible for verifying whether an account is already confirmed to sign in, and to send emails with confirmation instructions.
-* Recoverable: takes care of reseting the user password and send reset instructions.
-* Registerable: handles signing up users through a registration process.
-* Rememberable: manages generating and clearing token for remember the user from a saved cookie.
-* Trackable: tracks sign in count, timestamps and ip.
-* Timeoutable: expires sessions without activity in a certain period of time.
-* Validatable: creates all needed validations for email and password. It's totally optional, so you're able to to customize validations by yourself.
-* Lockable: takes care of locking an account based on the number of failed sign in attempts. Handles unlock via expire and email.
-* Activatable: if you need to activate accounts by other means, which are not through confirmation, use this module.
+== Installation
 
-There's an example application using Devise at http://github.com/plataformatec/devise_example .
+Devise 1.1 supports Rails 3 and is NOT backward compatible. You can use the latest Rails 3 beta gem with Devise latest gem:
 
-== Dependencies
+  gem install devise --version=1.1.rc2
 
-Devise is based on Warden (http://github.com/hassox/warden), a Rack Authentication Framework so you need to install it as a gem. Please ensure you have it installed in order to use devise (see installation below).
+If you want to use Rails master (from git repository) you need to use Devise from git repository and vice-versa.
 
-== Installation
+After you install Devise and add it to your Gemfile, you need to run the generator:
+
+  rails generate devise:install
+
+The generator will install an initializer which describes ALL Devise's configuration options and you MUST take a look at it. When you are done, you are ready to add Devise to any of your models using the generator:
+
+  rails generate devise MODEL
+
+Replace MODEL by the class name you want to add devise, like User, Admin, etc. This will create a model (if one does not exist) and configure it with default Devise modules. The generator will also create a migration file (if your ORM support them) and configure your routes. Continue reading this file to understand exactly what the generator produces and how to use it.
+
+== Rails 2.3
 
-Install warden gem if you don't have it installed:
+If you want to use the Rails 2.3.x version, you should do:
 
-  gem install warden
+  gem install devise --version=1.0.8
 
-Install devise gem:
+And please check the README at the v1.0 branch since this one is based on Rails 3:
 
-  gem install devise --version=1.0.10
+  http://github.com/plataformatec/devise/tree/v1.0
 
-Configure warden and devise gems inside your app:
+== Ecosystem
 
-  config.gem 'warden'
-  config.gem 'devise'
+Devise ecosystem is growing solid day after day. If you just need a walkthrough about setting up Devise, this README will work great. But if you need more documentation and resources, please check both the wiki and rdoc:
 
-Run the generator:
+* http://rdoc.info/projects/plataformatec/devise
+* http://wiki.github.com/plataformatec/devise
 
-	ruby script/generate devise_install
+Both links above are for Devise with Rails 3. If you need to use Devise with Rails 2.3, you can always run `gem server` from the command line after you install the gem to access the old documentation.
 
-And you're ready to go. The generator will install an initializer which describes ALL Devise's configuration options, so be sure to take a look at it and the documentation as well:
+Another great way to learn Devise are Ryan Bates' screencasts:
 
-  http://rdoc.info/projects/plataformatec/devise
+* http://railscasts.com/episodes/209-introducing-devise
+* http://railscasts.com/episodes/210-customizing-devise
 
-If you want to use Devise with bundler on Rails 2.3, you need to follow the instructions here:
+And a few example applications:
 
-  http://github.com/carlhuda/bundler/issues/issue/83
+* Rails 2.3 app using Devise at http://github.com/plataformatec/devise_example
+* Rails 2.3 app using Devise with subdomains at http://github.com/fortuity/subdomain-authentication
+* Rails 3.0 app with Mongoid at http://github.com/fortuity/rails3-mongoid-devise
+
+Finally, Devise also has several extensions built by the community. Don't forget to check them at the end of this README. If you want to write an extension on your own, you should also check Warden (http://github.com/hassox/warden), a Rack Authentication Framework which Devise depends on.
 
 == Basic Usage
 
-This is a walkthrough with all steps you need to setup a devise resource, including model, migration, route files, and optional configuration. You MUST also check out the *Generators* section below to help you start.
+This is a walkthrough with all steps you need to setup a devise resource, including model, migration, route files, and optional configuration.
 
-Devise must be set up within the model (or models) you want to use, and devise routes must be created inside your config/routes.rb file.
+Devise must be set up within the model (or models) you want to use. Devise routes must be created inside your config/routes.rb file.
 
-We're assuming here you want a User model with some modules, as outlined below:
+We're assuming here you want a User model with some Devise modules, as outlined below:
 
   class User < ActiveRecord::Base
     devise :database_authenticatable, :confirmable, :recoverable, :rememberable, :trackable, :validatable
   end
 
-After you choose which modules to use, you need to setup your migrations. Luckily, devise has some helpers to save you from this boring work:
+After you choose which modules to use, you need to set up your migrations. Luckily, Devise has some helpers to save you from this boring work:
 
   create_table :users do |t|
     t.database_authenticatable
@@ -78,66 +93,67 @@ After you choose which modules to use, you need to setup your migrations. Luckil
     t.timestamps
   end
 
-Remember that Devise don't rely on _attr_accessible_ or _attr_protected_ inside its modules, so be sure to setup what attributes are accessible or protected in your model.
+Devise doesn't use _attr_accessible_ or _attr_protected_ inside its modules, so be sure to define attributes as accessible or protected in your model.
 
-The next setup after setting up your model is to configure your routes. You do this by opening up your config/routes.rb and adding:
+Configure your routes after setting up your model. Open your config/routes.rb file and add:
 
-  map.devise_for :users
+  devise_for :users
 
-This is going to look inside you User model and create a set of needed routes (you can see them by running `rake routes`).
+This will use your User model to create a set of needed routes (you can see them by running `rake routes`).
 
-There are also some options available for configuring your routes, as :class_name (to set the class for that route), :path_prefix, :as and :path_names, where the last two have the same meaning as in common routes. The available :path_names are:
+Options for configuring your routes include :class_name (to set the class for that route), :path_prefix, :path and :path_names, where the last two have the same meaning as in common routes. The available :path_names are:
 
-  map.devise_for :users, :as => "usuarios", :path_names => { :sign_in => 'login', :sign_out => 'logout', :password => 'secret', :confirmation => 'verification', :unlock => 'unblock' }
+  devise_for :users, :path => "usuarios", :path_names => { :sign_in => 'login', :sign_out => 'logout', :password => 'secret', :confirmation => 'verification', :unlock => 'unblock', :registration => 'register', :sign_up => 'cmon_let_me_in' }
 
-Be sure to check devise_for documentation for detailed description.
+Be sure to check devise_for documentation for details.
 
-After this steps, run your migrations, and you are ready to go! But don't finish reading, we still have a lot to tell you:
+This exactly what the devise generator produces for you: model, routes and migrations. Don't forget to run rake db:migrate and you are ready to go! But don't stop reading here, we still have a lot to tell you.
 
 == Controller filters and helpers
 
-Devise is gonna create some helpers to use inside your controllers and views. To setup a controller that needs user authentication, just add this before_filter:
+Devise will create some helpers to use inside your controllers and views. To set up a controller with user authentication, just add this before_filter:
 
   before_filter :authenticate_user!
 
-To verify if a user is signed in, you have the following helper:
+To verify if a user is signed in, use the following helper:
 
   user_signed_in?
 
-And to get the current signed in user this helper is available:
+For the current signed-in user, this helper is available:
 
   current_user
 
-You have also access to the session for this scope:
+You can access the session for this scope:
 
   user_session
 
-After signing in a user, confirming it's account or updating it's password, devise will look for a scoped root path to redirect. Example: For a :user resource, it will use user_root_path if it exists, otherwise default root_path will be used. This means that you need to set the root inside your routes:
+After signing in a user, confirming the account or updating the password, Devise will look for a scoped root path to redirect. Example: For a :user resource, it will use user_root_path if it exists, otherwise default root_path will be used. This means that you need to set the root inside your routes:
 
-  map.root :controller => 'home'
+  root :to => "home"
 
-You can also overwrite after_sign_in_path_for and after_sign_out_path_for to customize better your redirect hooks.
+You can also overwrite after_sign_in_path_for and after_sign_out_path_for to customize your redirect hooks.
 
-Finally, you also need to setup default url options for the mailer in each environment. Here's is the configuration for config/environments/development.rb:
+Finally, you need to set up default url options for the mailer in each environment. Here is the configuration for config/environments/development.rb:
 
   config.action_mailer.default_url_options = { :host => 'localhost:3000' }
 
 == Tidying up
 
-Devise let's you setup as many roles as you want, so let's say you already have this User model and also want an Admin model with just authentication, trackable, lockable and timeoutable stuff and none of confirmation or password recovery. Just follow the same steps:
+Devise allows you to set up as many roles as you want. For example, you may have a User model and also want an Admin model with just authentication, trackable, lockable and timeoutable features and no confirmation or password-recovery features. Just follow these steps:
 
   # Create a migration with the required fields
   create_table :admins do |t|
     t.database_authenticatable
     t.lockable
     t.trackable
+    t.timestamps
   end
 
   # Inside your Admin model
   devise :database_authenticatable, :trackable, :timeoutable, :lockable
 
   # Inside your routes
-  map.devise_for :admin
+  devise_for :admins
 
   # Inside your protected controller
   before_filter :authenticate_admin!
@@ -147,41 +163,46 @@ Devise let's you setup as many roles as you want, so let's say you already have
   current_admin
   admin_session
 
-== Generators
+== Model configuration
 
-Devise comes with some generators to help you start:
+The devise method in your models also accepts some options to configure its modules. For example, you can choose which encryptor to use in database_authenticatable:
 
-  ruby script/generate devise_install
+  devise :database_authenticatable, :confirmable, :recoverable, :encryptor => :bcrypt
 
-This will generate an initializer, with a description of all configuration values. You can also generate models through:
+Besides :encryptor, you can define :pepper, :stretches, :confirm_within, :remember_for, :timeout_in, :unlock_in and other values. For details, see the initializer file that was created when you invoked the "devise:install" generator described above.
 
-  ruby script/generate devise Model
+== Configuring views
 
-A model configured with all devise modules and attr_accessible for default fields will be created. The generator will also create the migration and configure your routes for devise.
+We built Devise to help you quickly develop an application that uses authentication. However, we don't want to be in your way when you need to customize it.
 
-== Model configuration
+Since Devise is an engine, all its views are packaged inside the gem. These views will help you get started, but after sometime you may want to change them. If this is the case, you just need to invoke the following generator, and it will copy all views to your application:
 
-The devise method in your models also accept some options to configure its modules. For example, you can chose which encryptor to use in database_authenticatable:
+  rails generate devise:views
 
-  devise :database_authenticatable, :confirmable, :recoverable, :encryptor => :bcrypt
+However, if you have more than one role in your application (such as "User" and "Admin"), you will notice that Devise uses the same views for all roles. Fortunately, Devise offers an easy way to customize views. All you need to do is set "config.scoped_views = true" inside "config/initializers/devise.rb".
 
-Besides :encryptor, you can provide :pepper, :stretches, :confirm_within, :remember_for, :timeout_in, :unlock_in and others. All those are describer in the initializer created when you invoke the devise_install generator describer above.
+After doing so, you will be able to have views based on the role like "users/sessions/new" and "admins/sessions/new". If no view is found within the scope, Devise will use the default view at "devise/sessions/new".
 
-== Views
+== Configuring controllers
 
-Since devise is an engine, it has all default views inside the gem. They are good to get you started, but you will want to customize them at some point. And Devise has a generator to make copy them all to your application:
+If the customization at the views level is not enough, you can customize each controller by following these steps:
 
-  ruby script/generate devise_views
+1) Create your custom controller, for example a Admins::SessionsController:
 
-By default Devise will use the same views for all roles you have. But what if you need so different views to each of them? Devise also has an easy way to accomplish it: just setup config.scoped_views to true inside "config/initializers/devise.rb".
+    class Admins::SessionsController < Devise::SessionsController
+    end
 
-After doing so you will be able to have views based on the scope like 'sessions/users/new' and 'sessions/admin/new'. If no view is found within the scope, Devise will fallback to the default view.
+2) Tell the router to use this controller:
 
-Devise uses flash messages to let users know if their login is successful or not. Devise expects your application to call 'flash[:notice]' and 'flash[:alert]' as appropriate.
+    devise_for :admins, :controllers => { :sessions => "admin/sessions" }
+
+3) And since we changed the controller, it won't use the "devise/sessions" views, so remember to copy "devise/sessions" to "admin/sessions".
+
+Remember that Devise uses flash messages to let users know if sign in was successful or failed. Devise expects your application to call "flash[:notice]" and "flash[:alert]" as appropriate.
 
 == I18n
 
-Devise uses flash messages with I18n with the flash keys :success and :failure. To customize your app, you can setup your locale file this way:
+Devise uses flash messages with I18n with the flash keys :success and :failure. To customize your app, you can set up your locale file:
 
   en:
     devise:
@@ -198,7 +219,7 @@ You can also create distinct messages based on the resource you've configured us
         admin:
           signed_in: 'Hello admin!'
 
-Devise mailer uses the same pattern to create subject messages:
+The Devise mailer uses the same pattern to create subject messages:
 
   en:
     devise:
@@ -226,15 +247,29 @@ You can include the Devise Test Helpers in all of your tests by adding the follo
     include Devise::TestHelpers
   end
 
-Do not use such helpers for integration tests like Cucumber, Webrat... Just fill in the form or explicitly set the user in session. For more tips, check the wiki (http://wiki.github.com/plataformatec/devise).
+Do not use such helpers for integration tests such as Cucumber or Webrat. Instead, fill in the form or explicitly set the user in session. For more tips, check the wiki (http://wiki.github.com/plataformatec/devise).
 
 == Migrating from other solutions
 
-Devise implements encryption strategies for Clearance, Authlogic and Restful-Authentication. To make use of it set the desired encryptor in the encryptor initializer config option. You might also need to rename your encrypted password and salt columns to match Devises's one (encrypted_password and password_salt).
+Devise implements encryption strategies for Clearance, Authlogic and Restful-Authentication. To make use of these strategies, set the desired encryptor in the encryptor initializer config option. You might also need to rename your encrypted password and salt columns to match Devise's fields (encrypted_password and password_salt).
 
 == Other ORMs
 
-Devise supports both ActiveRecord (default) and MongoMapper, and has experimental Datamapper supports (in a sense that Devise test suite does not run completely with Datamapper). To choose other ORM, you just need to configure it in the initializer file.
+Devise supports ActiveRecord (by default) and Mongoid. We offer experimental Datamapper support (with the limitation that the Devise test suite does not run completely with Datamapper). To choose other ORM, you just need to configure it in the initializer file.
+
+== Extensions
+
+Devise also has extensions created by the community:
+
+* http://github.com/scambra/devise_invitable adds support to Devise for sending invitations by email.
+
+* http://github.com/grimen/devise_facebook_connectable adds support for Facebook Connect authentication, and optionally fetching user info from Facebook in the same step.
+
+* http://github.com/joshk/devise_imapable adds support for imap based authentication, excellent for internal apps when an LDAP server isn't available.
+
+* http://github.com/cschiewek/devise_ldap_authenticatable adds support for LDAP authentication via simple bind.
+
+Please consult their respective documentation for more information and requirements.
 
 == TODO
 
@@ -257,16 +292,20 @@ Being able to reproduce the bug is the first step to fix it. Thanks for your und
 
 == Contributors
 
-We have a long running list of contributors. Check them all here:
+We have a long list of valued contributors. Check them all at:
 
 http://github.com/plataformatec/devise/contributors
 
 == Bugs and Feedback
 
-If you discover any bugs or want to drop a line, feel free to create an issue on
-GitHub or send an e-mail to the mailing list.
+If you discover any bugs, please create an issue on GitHub.
 
 http://github.com/plataformatec/devise/issues
+
+For support, send an e-mail to the mailing list.
+
 http://groups.google.com/group/plataformatec-devise
 
-MIT License. Copyright 2009 Plataforma Tecnologia. http://blog.plataformatec.com.br
+== License
+
+MIT License. Copyright 2010 Plataforma Tecnologia. http://blog.plataformatec.com.br

data/Rakefile

@@ -43,8 +43,10 @@ begin
     s.homepage = "http://github.com/plataformatec/devise"
     s.description = "Flexible authentication solution for Rails with Warden"
     s.authors = ['José Valim', 'Carlos Antônio']
-    s.files =  FileList["[A-Z]*", "{app,config,generators,lib}/**/*", "rails/init.rb"]
-    s.add_dependency("warden", "~> 0.10.3")
+    s.files =  FileList["[A-Z]*", "{app,config,lib}/**/*"]
+    s.extra_rdoc_files = FileList["[A-Z]*"] - %w(Gemfile Rakefile)
+    s.add_dependency("warden", "~> 0.10.7")
+    s.add_dependency("bcrypt-ruby", "~> 2.1.2")
   end
 
   Jeweler::GemcutterTasks.new

data/TODO

@@ -1,2 +1,3 @@
-* Make test run with DataMapper
-* Extract Activatable tests from Confirmable
+* Move integration tests to Capybara
+* Better ORM integration
+* Extract activatable models tests from confirmable

data/app/controllers/{confirmations_controller.rb → devise/confirmations_controller.rb}

@@ -1,4 +1,4 @@
-class ConfirmationsController < ApplicationController
+class Devise::ConfirmationsController < ApplicationController
   include Devise::Controllers::InternalHelpers
 
   # GET /resource/confirmation/new

data/app/controllers/{passwords_controller.rb → devise/passwords_controller.rb}

@@ -1,4 +1,4 @@
-class PasswordsController < ApplicationController
+class Devise::PasswordsController < ApplicationController
   prepend_before_filter :require_no_authentication
   include Devise::Controllers::InternalHelpers