devise 1.1.9 → 1.2.rc

data/test/integration/timeoutable_test.rb

@@ -76,5 +76,14 @@ class SessionTimeoutTest < ActionController::IntegrationTest
       assert_contain 'Session expired!'
     end
   end
-
+  
+  test 'time out not triggered if remembered' do
+    user = sign_in_as_user :remember_me => true
+    get expire_user_path(user)
+    assert_not_nil last_request_at
+    
+    get users_path
+    assert_response :success
+    assert warden.authenticated?(:user)
+  end
 end

data/test/integration/token_authenticatable_test.rb

@@ -7,12 +7,23 @@ class TokenAuthenticationTest < ActionController::IntegrationTest
       sign_in_as_new_user_with_token
 
       assert_response :success
-      assert_template 'users/index'
+      assert_current_url "/users?secret_token=#{VALID_AUTHENTICATION_TOKEN}"
       assert_contain 'Welcome'
       assert warden.authenticated?(:user)
     end
   end
 
+  test 'authenticate with valid authentication token key but does not store if stateless' do
+    swap Devise, :token_authentication_key => :secret_token, :stateless_token => true do
+      sign_in_as_new_user_with_token
+      assert warden.authenticated?(:user)
+
+      get users_path
+      assert_redirected_to new_user_session_path
+      assert_not warden.authenticated?(:user)
+    end
+  end
+
   test 'authenticate with valid authentication token key and value through http' do
     swap Devise, :token_authentication_key => :secret_token do
       sign_in_as_new_user_with_token(:http_auth => true)
@@ -65,22 +76,6 @@ class TokenAuthenticationTest < ActionController::IntegrationTest
     end
   end
 
-  test 'should not be subject to injection' do
-    swap Devise, :token_authentication_key => :secret_token do
-      user1 = create_user()
-
-      # Clean up user cache
-      @user = nil
-
-      user2 = create_user(:email => "another@test.com")
-      user2.update_attribute(:authentication_token, "ANOTHERTOKEN")
-
-      assert_not_equal user1, user2
-      visit users_path(Devise.token_authentication_key.to_s + '[$ne]' => user1.authentication_token)
-      assert_nil warden.user(:user) 
-    end
-  end
-
   private
 
     def sign_in_as_new_user_with_token(options = {})

data/test/mailers/confirmation_instructions_test.rb

@@ -35,6 +35,10 @@ class ConfirmationInstructionsTest < ActionMailer::TestCase
     assert_equal ['test@example.com'], mail.from
   end
 
+  test 'setup reply to as copy from sender' do
+    assert_equal ['test@example.com'], mail.reply_to
+  end
+
   test 'setup subject from I18n' do
     store_translations :en, :devise => { :mailer => { :confirmation_instructions => { :subject => 'Account Confirmation' } } } do
       assert_equal 'Account Confirmation', mail.subject

data/test/mailers/reset_password_instructions_test.rb

@@ -38,6 +38,10 @@ class ResetPasswordInstructionsTest < ActionMailer::TestCase
     assert_equal ['test@example.com'], mail.from
   end
 
+  test 'setup reply to as copy from sender' do
+    assert_equal ['test@example.com'], mail.reply_to
+  end
+
   test 'setup subject from I18n' do
     store_translations :en, :devise => { :mailer => { :reset_password_instructions => { :subject => 'Reset instructions' } } } do
       assert_equal 'Reset instructions', mail.subject

data/test/mailers/unlock_instructions_test.rb

@@ -38,6 +38,10 @@ class UnlockInstructionsTest < ActionMailer::TestCase
     assert_equal ['test@example.com'], mail.from
   end
 
+  test 'setup reply to as copy from sender' do
+    assert_equal ['test@example.com'], mail.reply_to
+  end
+
   test 'setup subject from I18n' do
     store_translations :en, :devise => { :mailer => { :unlock_instructions =>  { :subject => 'Yo unlock instructions' } } } do
       assert_equal 'Yo unlock instructions', mail.subject

data/test/mapping_test.rb

@@ -12,22 +12,42 @@ class MappingTest < ActiveSupport::TestCase
     mapping = Devise.mappings[:user]
     assert_equal User,                mapping.to
     assert_equal User.devise_modules, mapping.modules
-    assert_equal :users,              mapping.plural
+    assert_equal "users",             mapping.scoped_path
     assert_equal :user,               mapping.singular
     assert_equal "users",             mapping.path
+    assert_equal "/users",            mapping.fullpath
+  end
+
+  test 'store options with namespace' do
+    mapping = Devise.mappings[:publisher_account]
+    assert_equal Admin,                 mapping.to
+    assert_equal "publisher/accounts",  mapping.scoped_path
+    assert_equal :publisher_account,    mapping.singular
+    assert_equal "accounts",            mapping.path
+    assert_equal "/publisher/accounts", mapping.fullpath
   end
 
   test 'allows path to be given' do
     assert_equal "admin_area", Devise.mappings[:admin].path
   end
 
+  test 'sign_out_via defaults to :get' do
+    assert_equal :get, Devise.mappings[:user].sign_out_via
+  end
+
+  test 'allows custom sign_out_via to be given' do
+    assert_equal :delete,          Devise.mappings[:sign_out_via_delete].sign_out_via
+    assert_equal :post,            Devise.mappings[:sign_out_via_post].sign_out_via
+    assert_equal [:delete, :post], Devise.mappings[:sign_out_via_delete_or_post].sign_out_via
+  end
+
   test 'allows custom singular to be given' do
     assert_equal "accounts", Devise.mappings[:manager].path
   end
 
   test 'has strategies depending on the model declaration' do
     assert_equal [:rememberable, :token_authenticatable, :database_authenticatable], Devise.mappings[:user].strategies
-    assert_equal [:database_authenticatable], Devise.mappings[:admin].strategies
+    assert_equal [:rememberable, :database_authenticatable], Devise.mappings[:admin].strategies
   end
 
   test 'find scope for a given object' do
@@ -80,6 +100,20 @@ class MappingTest < ActiveSupport::TestCase
     assert mapping.recoverable?
     assert mapping.lockable?
     assert_not mapping.confirmable?
-    assert_not mapping.rememberable?
+    assert_not mapping.omniauthable?
   end
+  
+  test 'find mapping by path' do
+    assert_raise RuntimeError do
+      Devise::Mapping.find_by_path!('/accounts/facebook/callback')
+    end
+    
+    assert_nothing_raised do
+      Devise::Mapping.find_by_path!('/:locale/accounts/login')
+    end
+
+    assert_nothing_raised do
+      Devise::Mapping.find_by_path!('/accounts/facebook/callback', :path)
+    end
+  end  
 end

data/test/models/confirmable_test.rb

@@ -48,7 +48,7 @@ class ConfirmableTest < ActiveSupport::TestCase
     assert_blank user.errors[:email]
 
     assert_not user.confirm!
-    assert_equal "was already confirmed", user.errors[:email].join
+    assert_equal "was already confirmed, please try signing in", user.errors[:email].join
   end
 
   test 'should find and confirm an user automatically' do
@@ -76,7 +76,7 @@ class ConfirmableTest < ActiveSupport::TestCase
     user.save
     confirmed_user = User.confirm_by_token(user.confirmation_token)
     assert confirmed_user.confirmed?
-    assert_equal "was already confirmed", confirmed_user.errors[:email].join
+    assert_equal "was already confirmed, please try signing in", confirmed_user.errors[:email].join
   end
 
   test 'should send confirmation instructions by email' do
@@ -160,7 +160,7 @@ class ConfirmableTest < ActiveSupport::TestCase
     user.confirm!
     assert_not user.resend_confirmation_token
     assert user.confirmed?
-    assert_equal 'was already confirmed', user.errors[:email].join
+    assert_equal 'was already confirmed, please try signing in', user.errors[:email].join
   end
 
   test 'confirm time should fallback to devise confirm in default configuration' do

data/test/models/database_authenticatable_test.rb

@@ -2,53 +2,31 @@ require 'test_helper'
 require 'digest/sha1'
 
 class DatabaseAuthenticatableTest < ActiveSupport::TestCase
-
-  def encrypt_password(user, pepper=User.pepper, stretches=User.stretches, encryptor=User.encryptor_class)
-    encryptor.digest('123456', stretches, user.password_salt, pepper)
-  end
-
-  def swap_with_encryptor(klass, encryptor, options={})
-    klass.instance_variable_set(:@encryptor_class, nil)
-
-    swap klass, options.merge(:encryptor => encryptor) do
-      begin
-        yield
-      ensure
-        klass.instance_variable_set(:@encryptor_class, nil)
-      end
-    end
+  test 'should downcase case insensitive keys when saving' do
+    # case_insensitive_keys is set to :email by default.
+    email = 'Foo@Bar.com'
+    user = new_user(:email => email)
+    
+    assert_equal email, user.email
+    user.save!
+    assert_equal email.downcase, user.email
   end
-
+  
   test 'should respond to password and password confirmation' do
     user = new_user
     assert user.respond_to?(:password)
     assert user.respond_to?(:password_confirmation)
   end
 
-  test 'should generate encrypted password and salt while setting password' do
+  test 'should generate encrypted password while setting password' do
     user = new_user
-    assert_present user.password_salt
     assert_present user.encrypted_password
   end
 
-  test 'should not change password salt when updating' do
-    user = create_user
-    salt = user.password_salt
-    user.expects(:password_salt=).never
-    user.save!
-    assert_equal salt, user.password_salt
-  end
-
-  test 'should generate a base64 hash using SecureRandom for password salt' do
-    swap_with_encryptor User, :sha1 do
-      ActiveSupport::SecureRandom.expects(:base64).with(15).returns('friendly_token')
-      assert_equal 'friendly_token', new_user.password_salt
-    end
-  end
-
-  test 'should not generate salt if password is blank' do
-    assert_blank new_user(:password => nil).password_salt
-    assert_blank new_user(:password => '').password_salt
+  test 'allow authenticatable_salt to work even with nil encrypted password' do
+    user = User.new
+    user.encrypted_password = nil
+    assert_nil user.authenticatable_salt
   end
 
   test 'should not generate encrypted password if password is blank' do
@@ -64,47 +42,12 @@ class DatabaseAuthenticatableTest < ActiveSupport::TestCase
     assert_not_equal encrypted_password, user.encrypted_password
   end
 
-  test 'should fallback to sha1 as default encryption' do
-    user = new_user
-    assert_equal encrypt_password(user), user.encrypted_password
-  end
-
-  test 'should fallback to devise pepper default configuration' do
-    begin
-      Devise.pepper = ''
-      user = new_user
-      assert_equal encrypt_password(user), user.encrypted_password
-      assert_not_equal encrypt_password(user, 'another_pepper'), user.encrypted_password
-
-      Devise.pepper = 'new_pepper'
-      user = new_user
-      assert_equal encrypt_password(user, 'new_pepper'), user.encrypted_password
-      assert_not_equal encrypt_password(user, 'another_pepper'), user.encrypted_password
-    ensure
-      Devise.pepper = nil
-    end
-  end
-
-  test 'should respect encryptor configuration' do
-    swap_with_encryptor User, :sha512 do
-      user = create_user
-      assert_equal user.encrypted_password, encrypt_password(user, User.pepper, User.stretches, ::Devise::Encryptors::Sha512)
-    end
-  end
-
   test 'should test for a valid password' do
     user = create_user
     assert user.valid_password?('123456')
     assert_not user.valid_password?('654321')
   end
 
-  test 'should not validate password when salt is nil' do
-    admin = create_admin
-    admin.password_salt = nil
-    admin.save
-    assert_not admin.valid_password?('123456')
-  end
-
   test 'should respond to current password' do
     assert new_user.respond_to?(:current_password)
   end

data/test/models/encryptable_test.rb

@@ -0,0 +1,65 @@
+require 'test_helper'
+
+class EncryptableTest < ActiveSupport::TestCase
+  def encrypt_password(admin, pepper=Admin.pepper, stretches=Admin.stretches, encryptor=Admin.encryptor_class)
+    encryptor.digest('123456', stretches, admin.password_salt, pepper)
+  end
+
+  def swap_with_encryptor(klass, encryptor, options={})
+    klass.instance_variable_set(:@encryptor_class, nil)
+
+    swap klass, options.merge(:encryptor => encryptor) do
+      begin
+        yield
+      ensure
+        klass.instance_variable_set(:@encryptor_class, nil)
+      end
+    end
+  end
+
+  test 'should generate salt while setting password' do
+    assert_present create_admin.password_salt
+  end
+
+  test 'should not change password salt when updating' do
+    admin = create_admin
+    salt = admin.password_salt
+    admin.expects(:password_salt=).never
+    admin.save!
+    assert_equal salt, admin.password_salt
+  end
+
+  test 'should generate a base64 hash using SecureRandom for password salt' do
+    swap_with_encryptor Admin, :sha1 do
+      ActiveSupport::SecureRandom.expects(:base64).with(44).returns('friendly_token')
+      assert_equal 'friendly_token', create_admin.password_salt
+    end
+  end
+
+  test 'should not generate salt if password is blank' do
+    assert_blank create_admin(:password => nil).password_salt
+    assert_blank create_admin(:password => '').password_salt
+  end
+
+  test 'should encrypt password again if password has changed' do
+    admin = create_admin
+    encrypted_password = admin.encrypted_password
+    admin.password = admin.password_confirmation = 'new_password'
+    admin.save!
+    assert_not_equal encrypted_password, admin.encrypted_password
+  end
+
+  test 'should respect encryptor configuration' do
+    swap_with_encryptor Admin, :sha512 do
+      admin = create_admin
+      assert_equal admin.encrypted_password, encrypt_password(admin, Admin.pepper, Admin.stretches, ::Devise::Encryptors::Sha512)
+    end
+  end
+
+  test 'should not validate password when salt is nil' do
+    admin = create_admin
+    admin.password_salt = nil
+    admin.save
+    assert_not admin.valid_password?('123456')
+  end
+end

data/test/models/lockable_test.rb

@@ -178,11 +178,27 @@ class LockableTest < ActiveSupport::TestCase
     assert_equal 'not found', unlock_user.errors[:email].join
   end
 
+  test 'should find a user to send unlock instructions by authentication_keys' do
+    swap Devise, :authentication_keys => [:username, :email] do
+      user = create_user
+      unlock_user = User.send_unlock_instructions(:email => user.email, :username => user.username)
+      assert_equal unlock_user, user
+    end
+  end
+
+  test 'should require all authentication_keys' do
+    swap Devise, :authentication_keys => [:username, :email] do
+      user = create_user
+      unlock_user = User.send_unlock_instructions(:email => user.email)
+      assert_not unlock_user.persisted?
+      assert_equal "can't be blank", unlock_user.errors[:username].join
+    end
+  end
+
   test 'should not be able to send instructions if the user is not locked' do
     user = create_user
     assert_not user.resend_unlock_token
     assert_not user.access_locked?
     assert_equal 'was not locked', user.errors[:email].join
   end
-
 end

data/test/models/recoverable_test.rb

@@ -85,6 +85,23 @@ class RecoverableTest < ActiveSupport::TestCase
     assert_not reset_password_user.persisted?
     assert_equal "not found", reset_password_user.errors[:email].join
   end
+  
+  test 'should find a user to send instructions by authentication_keys' do
+    swap Devise, :authentication_keys => [:username, :email] do
+      user = create_user
+      reset_password_user = User.send_reset_password_instructions(:email => user.email, :username => user.username)
+      assert_equal reset_password_user, user
+    end
+  end
+  
+  test 'should require all authentication_keys' do
+    swap Devise, :authentication_keys => [:username, :email] do
+      user = create_user
+      reset_password_user = User.send_reset_password_instructions(:email => user.email)
+      assert_not reset_password_user.persisted?
+      assert_equal "can't be blank", reset_password_user.errors[:username].join
+    end
+  end
 
   test 'should reset reset_password_token before send the reset instructions email' do
     user = create_user

data/test/models/rememberable_test.rb

@@ -1,218 +1,279 @@
 require 'test_helper'
 
-class RememberableTest < ActiveSupport::TestCase
-  test 'should respond to remember_me attribute' do
-    user = new_user
-    assert user.respond_to?(:remember_me)
-  end
+module SharedRememberableTest
+  extend ActiveSupport::Testing::Declarative
 
-  test 'remember_me should generate a new token and save the record without validating' do
-    user = create_user
-    user.expects(:valid?).never
-    token = user.remember_token
-    user.remember_me!
-    assert_not_equal token, user.remember_token
-    assert_not user.changed?
-  end
-
-  test 'forget_me should clear remember token and save the record without validating' do
-    user = create_user
-    user.remember_me!
-    assert_not user.remember_token.nil?
-    user.expects(:valid?).never
-    user.forget_me!
-    assert user.remember_token.nil?
-    assert_not user.changed?
+  test 'should respond to remember_me attribute' do
+    assert resource_class.new.respond_to?(:remember_me)
+    assert resource_class.new.respond_to?(:remember_me=)
   end
 
   test 'forget_me should clear remember_created_at' do
-    user = create_user
-    user.remember_me!
-    assert_not user.remember_created_at.nil?
-    user.forget_me!
-    assert user.remember_created_at.nil?
+    resource = create_resource
+    resource.remember_me!
+    assert_not resource.remember_created_at.nil?
+    resource.forget_me!
+    assert resource.remember_created_at.nil?
   end
 
-  test 'forget should do nothing if no remember token exists' do
-    user = create_user
-    user.expects(:save).never
-    user.forget_me!
+  test 'remember is expired if not created at timestamp is set' do
+    assert create_resource.remember_expired?
   end
 
-  test 'serialize into cookie' do
-    user = create_user
-    user.remember_me!
-    assert_equal [user.id, user.remember_token], User.serialize_into_cookie(user)
-  end
-
-  test 'serialize from cookie' do
-    user = create_user
-    user.remember_me!
-    assert_equal user, User.serialize_from_cookie(user.id, user.remember_token)
+  test 'serialize should return nil if no resource is found' do
+    assert_nil resource_class.serialize_from_cookie([0], "123")
   end
 
-  test 'serialize should return nil if no user is found' do
-    assert_nil User.serialize_from_cookie(0, "123")
-  end
-
-  test 'remember me return nil if is a valid user with invalid token' do
-    user = create_user
-    assert_nil User.serialize_from_cookie(user.id, "123")
+  test 'remember me return nil if is a valid resource with invalid token' do
+    resource = create_resource
+    assert_nil resource_class.serialize_from_cookie([resource.id], "123")
   end
 
   test 'remember for should fallback to devise remember for default configuration' do
     swap Devise, :remember_for => 1.day do
-      user = create_user
-      user.remember_me!
-      assert_not user.remember_expired?
+      resource = create_resource
+      resource.remember_me!
+      assert_not resource.remember_expired?
     end
   end
 
   test 'remember expires at should sum date of creation with remember for configuration' do
     swap Devise, :remember_for => 3.days do
-      user = create_user
-      user.remember_me!
-      assert_equal 3.days.from_now.to_date, user.remember_expires_at.to_date
+      resource = create_resource
+      resource.remember_me!
+      assert_equal 3.days.from_now.to_date, resource.remember_expires_at.to_date
 
       Devise.remember_for = 5.days
-      assert_equal 5.days.from_now.to_date, user.remember_expires_at.to_date
+      assert_equal 5.days.from_now.to_date, resource.remember_expires_at.to_date
     end
   end
 
   test 'remember should be expired if remember_for is zero' do
     swap Devise, :remember_for => 0.days do
       Devise.remember_for = 0.days
-      user = create_user
-      user.remember_me!
-      assert user.remember_expired?
+      resource = create_resource
+      resource.remember_me!
+      assert resource.remember_expired?
     end
   end
 
   test 'remember should be expired if it was created before limit time' do
     swap Devise, :remember_for => 1.day do
-      user = create_user
-      user.remember_me!
-      user.remember_created_at = 2.days.ago
-      user.save
-      assert user.remember_expired?
+      resource = create_resource
+      resource.remember_me!
+      resource.remember_created_at = 2.days.ago
+      resource.save
+      assert resource.remember_expired?
     end
   end
 
   test 'remember should not be expired if it was created whitin the limit time' do
     swap Devise, :remember_for => 30.days do
-      user = create_user
-      user.remember_me!
-      user.remember_created_at = (30.days.ago + 2.minutes)
-      user.save
-      assert_not user.remember_expired?
+      resource = create_resource
+      resource.remember_me!
+      resource.remember_created_at = (30.days.ago + 2.minutes)
+      resource.save
+      assert_not resource.remember_expired?
     end
   end
 
   test 'if extend_remember_period is false, remember_me! should generate a new timestamp if expired' do
     swap Devise, :remember_for => 5.minutes do
-      user = create_user
-      user.remember_me!(false)
-      assert user.remember_created_at
+      resource = create_resource
+      resource.remember_me!(false)
+      assert resource.remember_created_at
 
-      user.remember_created_at = old = 10.minutes.ago
-      user.save
+      resource.remember_created_at = old = 10.minutes.ago
+      resource.save
 
-      user.remember_me!(false)
-      assert_not_equal old.to_i, user.remember_created_at.to_i
+      resource.remember_me!(false)
+      assert_not_equal old.to_i, resource.remember_created_at.to_i
     end
   end
 
   test 'if extend_remember_period is false, remember_me! should not generate a new timestamp' do
     swap Devise, :remember_for => 1.year do
-      user = create_user
-      user.remember_me!(false)
-      assert user.remember_created_at
+      resource = create_resource
+      resource.remember_me!(false)
+      assert resource.remember_created_at
 
-      user.remember_created_at = old = 10.minutes.ago.utc
-      user.save
+      resource.remember_created_at = old = 10.minutes.ago.utc
+      resource.save
 
-      user.remember_me!(false)
-      assert_equal old.to_i, user.remember_created_at.to_i
+      resource.remember_me!(false)
+      assert_equal old.to_i, resource.remember_created_at.to_i
     end
   end
 
   test 'if extend_remember_period is true, remember_me! should always generate a new timestamp' do
     swap Devise, :remember_for => 1.year do
-      user = create_user
-      user.remember_me!(true)
-      assert user.remember_created_at
+      resource = create_resource
+      resource.remember_me!(true)
+      assert resource.remember_created_at
 
-      user.remember_created_at = old = 10.minutes.ago
-      user.save
+      resource.remember_created_at = old = 10.minutes.ago
+      resource.save
 
-      user.remember_me!(true)
-      assert_not_equal old, user.remember_created_at
+      resource.remember_me!(true)
+      assert_not_equal old, resource.remember_created_at
     end
   end
+end
+
+class RememberableTest < ActiveSupport::TestCase
+  include SharedRememberableTest
+
+  def resource_class
+    Admin
+  end
+
+  def create_resource
+    create_admin
+  end
+
+  test 'remember_me should generate a new token and save the record without validating' do
+    admin = create_admin
+    admin.expects(:valid?).never
+    token = admin.remember_token
+    admin.remember_me!
+    assert_not_equal token, admin.remember_token
+    assert_not admin.changed?
+  end
+
+  test 'forget_me should clear remember token and save the record without validating' do
+    admin = create_admin
+    admin.remember_me!
+    assert_not admin.remember_token.nil?
+    admin.expects(:valid?).never
+    admin.forget_me!
+    assert admin.remember_token.nil?
+    assert_not admin.changed?
+  end
+
+  test 'serialize into cookie' do
+    admin = create_admin
+    admin.remember_me!
+    assert_equal [admin.to_key, admin.remember_token], Admin.serialize_into_cookie(admin)
+  end
+
+  test 'serialize from cookie' do
+    admin = create_admin
+    admin.remember_me!
+    assert_equal admin, Admin.serialize_from_cookie(admin.to_key, admin.remember_token)
+  end
 
   test 'if remember_across_browsers is true, remember_me! should create a new token if no token exists' do
     swap Devise, :remember_across_browsers => true, :remember_for => 1.year do
-      user = create_user
-      assert_equal nil, user.remember_token
-      user.remember_me!
-      assert_not_equal nil, user.remember_token
+      admin = create_admin
+      assert_equal nil, admin.remember_token
+      admin.remember_me!
+      assert_not_equal nil, admin.remember_token
     end
   end
 
   test 'if remember_across_browsers is true, remember_me! should create a new token if a token exists but has expired' do
     swap Devise, :remember_across_browsers => true, :remember_for => 1.day do
-      user = create_user
-      user.remember_me!
-      user.remember_created_at = 2.days.ago
-      user.save
-      token = user.remember_token
-      user.remember_me!
-      assert_not_equal token, user.remember_token
+      admin = create_admin
+      admin.remember_me!
+      admin.remember_created_at = 2.days.ago
+      admin.save
+      token = admin.remember_token
+      admin.remember_me!
+      assert_not_equal token, admin.remember_token
     end
   end
 
   test 'if remember_across_browsers is true, remember_me! should not create a new token if a token exists and has not expired' do
     swap Devise, :remember_across_browsers => true, :remember_for => 2.days do
-      user = create_user
-      user.remember_me!
-      user.remember_created_at = 1.day.ago
-      user.save
-      token = user.remember_token
-      user.remember_me!
-      assert_equal token, user.remember_token
+      admin = create_admin
+      admin.remember_me!
+      admin.remember_created_at = 1.day.ago
+      admin.save
+      token = admin.remember_token
+      admin.remember_me!
+      assert_equal token, admin.remember_token
     end
   end
 
   test 'if remember_across_browsers is false, remember_me! should create a new token if no token exists' do
     swap Devise, :remember_across_browsers => false do
-      user = create_user
-      assert_equal nil, user.remember_token
-      user.remember_me!
-      assert_not_equal nil, user.remember_token
+      admin = create_admin
+      assert_equal nil, admin.remember_token
+      admin.remember_me!
+      assert_not_equal nil, admin.remember_token
     end
   end
 
   test 'if remember_across_browsers is false, remember_me! should create a new token if a token exists but has expired' do
     swap Devise, :remember_across_browsers => false, :remember_for => 1.day do
-      user = create_user
-      user.remember_me!
-      user.remember_created_at = 2.days.ago
-      user.save
-      token = user.remember_token
-      user.remember_me!
-      assert_not_equal token, user.remember_token
+      admin = create_admin
+      admin.remember_me!
+      admin.remember_created_at = 2.days.ago
+      admin.save
+      token = admin.remember_token
+      admin.remember_me!
+      assert_not_equal token, admin.remember_token
     end
   end
 
   test 'if remember_across_browsers is false, remember_me! should create a new token if a token exists and has not expired' do
     swap Devise, :remember_across_browsers => false, :remember_for => 2.days do
-      user = create_user
-      user.remember_me!
-      user.remember_created_at = 1.day.ago
-      user.save
-      token = user.remember_token
-      user.remember_me!
-      assert_not_equal token, user.remember_token
+      admin = create_admin
+      admin.remember_me!
+      admin.remember_created_at = 1.day.ago
+      admin.save
+      token = admin.remember_token
+      admin.remember_me!
+      assert_not_equal token, admin.remember_token
+    end
+  end
+end
+
+class WithSaltRememberableTest < ActiveSupport::TestCase
+  include SharedRememberableTest
+
+  setup do
+    assert_not User.new.respond_to?(:remember_token)
+  end
+
+  def resource_class
+    User
+  end
+
+  def create_resource
+    create_user
+  end
+
+  test 'remember_me should not generate a new token if using salt' do
+    user = create_user
+    user.expects(:valid?).never
+    user.remember_me!
+  end
+
+  test 'forget_me should not clear remember token if using salt' do
+    user = create_user
+    user.remember_me!
+    user.expects(:valid?).never
+    user.forget_me!
+  end
+
+  test 'serialize into cookie' do
+    user = create_user
+    user.remember_me!
+    assert_equal [user.to_key, user.authenticatable_salt], User.serialize_into_cookie(user)
+  end
+
+  test 'serialize from cookie' do
+    user = create_user
+    user.remember_me!
+    assert_equal user, User.serialize_from_cookie(user.to_key, user.authenticatable_salt)
+  end
+
+  test 'raises a RuntimeError if authenticatable_salt is nil' do
+    user = User.new
+    user.encrypted_password = nil
+    assert_raise RuntimeError do
+      user.rememberable_value
     end
   end
 end