devise 1.5.3 → 2.0.0

data/lib/generators/templates/simple_form_for/sessions/new.html.erb

@@ -12,4 +12,4 @@
   </div>
 <% end %>
 
-<%= render :partial => "devise/shared/links" %>
+<%= render "links" %>

data/lib/generators/templates/simple_form_for/unlocks/new.html.erb

@@ -12,4 +12,4 @@
   </div>
 <% end %>
 
-<%= render :partial => "devise/shared/links" %>
+<%= render "links" %>

data/test/controllers/internal_helpers_test.rb

@@ -1,7 +1,6 @@
 require 'test_helper'
 
-class MyController < ApplicationController
-  include Devise::Controllers::InternalHelpers
+class MyController < DeviseController
 end
 
 class HelpersTest < ActionController::TestCase
@@ -45,10 +44,12 @@ class HelpersTest < ActionController::TestCase
     @controller.send :require_no_authentication
   end
 
-  test 'require no authentication skips if no inputs are available' do
+  test 'require no authentication only checks if already authenticated if no inputs strategies are available' do
     Devise.mappings[:user].expects(:no_input_strategies).returns([])
     @mock_warden.expects(:authenticate?).never
-    @controller.expects(:redirect_to).never
+    @mock_warden.expects(:authenticated?).with(:user).once.returns(true)
+    @mock_warden.expects(:user).with(:user).returns(User.new)
+    @controller.expects(:redirect_to).with(root_path)
     @controller.send :require_no_authentication
   end
 

data/test/devise_test.rb

@@ -12,8 +12,8 @@ end
 
 class DeviseTest < ActiveSupport::TestCase
   test 'model options can be configured through Devise' do
-    swap Devise, :confirm_within => 113, :pepper => "foo" do
-      assert_equal 113, Devise.confirm_within
+    swap Devise, :allow_unconfirmed_access_for => 113, :pepper => "foo" do
+      assert_equal 113, Devise.allow_unconfirmed_access_for
       assert_equal "foo", Devise.pepper
     end
   end

data/test/failure_app_test.rb

@@ -3,7 +3,9 @@ require 'ostruct'
 
 class FailureTest < ActiveSupport::TestCase
   class RootFailureApp < Devise::FailureApp
-    undef_method :new_user_session_path
+    def fake_app
+      Object.new
+    end
   end
 
   def self.context(name, &block)
@@ -41,15 +43,17 @@ class FailureTest < ActiveSupport::TestCase
     end
 
     test 'return to the root path if no session path is available' do
-      call_failure :app => RootFailureApp
-      assert_equal 302, @response.first
-      assert_equal 'You need to sign in or sign up before continuing.', @request.flash[:alert]
-      assert_equal 'http://test.host/', @response.second['Location']
+      swap Devise, :router_name => :fake_app do
+        call_failure :app => RootFailureApp
+        assert_equal 302, @response.first
+        assert_equal 'You need to sign in or sign up before continuing.', @request.flash[:alert]
+        assert_equal 'http://test.host/', @response.second['Location']
+      end
     end
 
     test 'uses the proxy failure message as symbol' do
-      call_failure('warden' => OpenStruct.new(:message => :test))
-      assert_equal 'test', @request.flash[:alert]
+      call_failure('warden' => OpenStruct.new(:message => :invalid))
+      assert_equal 'Invalid email or password.', @request.flash[:alert]
       assert_equal 'http://test.host/users/sign_in', @response.second["Location"]
     end
 
@@ -73,14 +77,14 @@ class FailureTest < ActiveSupport::TestCase
 
     test 'works for any navigational format' do
       swap Devise, :navigational_formats => [:xml] do
-        call_failure('formats' => :xml)
+        call_failure('formats' => Mime::XML)
         assert_equal 302, @response.first
       end
     end
 
     test 'redirects the correct format if it is a non-html format request' do
       swap Devise, :navigational_formats => [:js] do
-        call_failure('formats' => :js)
+        call_failure('formats' => Mime::JS)
         assert_equal 'http://test.host/users/sign_in.js', @response.second["Location"]
       end
     end
@@ -88,18 +92,18 @@ class FailureTest < ActiveSupport::TestCase
 
   context 'For HTTP request' do
     test 'return 401 status' do
-      call_failure('formats' => :xml)
+      call_failure('formats' => Mime::XML)
       assert_equal 401, @response.first
     end
 
     test 'return appropriate body for xml' do
-      call_failure('formats' => :xml)
+      call_failure('formats' => Mime::XML)
       result = %(<?xml version="1.0" encoding="UTF-8"?>\n<errors>\n  <error>You need to sign in or sign up before continuing.</error>\n</errors>\n)
       assert_equal result, @response.last.body
     end
 
     test 'return appropriate body for json' do
-      call_failure('formats' => :json)
+      call_failure('formats' => Mime::JSON)
       result = %({"error":"You need to sign in or sign up before continuing."})
       assert_equal result, @response.last.body
     end
@@ -110,26 +114,26 @@ class FailureTest < ActiveSupport::TestCase
     end
 
     test 'return WWW-authenticate headers if model allows' do
-      call_failure('formats' => :xml)
+      call_failure('formats' => Mime::XML)
       assert_equal 'Basic realm="Application"', @response.second["WWW-Authenticate"]
     end
 
     test 'does not return WWW-authenticate headers if model does not allow' do
       swap Devise, :http_authenticatable => false do
-        call_failure('formats' => :xml)
+        call_failure('formats' => Mime::XML)
         assert_nil @response.second["WWW-Authenticate"]
       end
     end
 
     test 'works for any non navigational format' do
       swap Devise, :navigational_formats => [] do
-        call_failure('formats' => :html)
+        call_failure('formats' => Mime::HTML)
         assert_equal 401, @response.first
       end
     end
 
     test 'uses the failure message as response body' do
-      call_failure('formats' => :xml, 'warden' => OpenStruct.new(:message => :invalid))
+      call_failure('formats' => Mime::XML, 'warden' => OpenStruct.new(:message => :invalid))
       assert_match '<error>Invalid email or password.</error>', @response.third.body
     end
 
@@ -137,7 +141,7 @@ class FailureTest < ActiveSupport::TestCase
       context 'when http_authenticatable_on_xhr is false' do
         test 'dont return 401 with navigational formats' do
           swap Devise, :http_authenticatable_on_xhr => false do
-            call_failure('formats' => :html, 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest')
+            call_failure('formats' => Mime::HTML, 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest')
             assert_equal 302, @response.first
             assert_equal 'http://test.host/users/sign_in', @response.second["Location"]
           end
@@ -145,7 +149,7 @@ class FailureTest < ActiveSupport::TestCase
 
         test 'dont return 401 with non navigational formats' do
           swap Devise, :http_authenticatable_on_xhr => false do
-            call_failure('formats' => :json, 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest')
+            call_failure('formats' => Mime::JSON, 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest')
             assert_equal 302, @response.first
             assert_equal 'http://test.host/users/sign_in.json', @response.second["Location"]
           end
@@ -155,14 +159,14 @@ class FailureTest < ActiveSupport::TestCase
       context 'when http_authenticatable_on_xhr is true' do
         test 'return 401' do
           swap Devise, :http_authenticatable_on_xhr => true do
-            call_failure('formats' => :html, 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest')
+            call_failure('formats' => Mime::HTML, 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest')
             assert_equal 401, @response.first
           end
         end
 
         test 'skip WWW-Authenticate header' do
           swap Devise, :http_authenticatable_on_xhr => true do
-            call_failure('formats' => :html, 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest')
+            call_failure('formats' => Mime::HTML, 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest')
             assert_nil @response.second['WWW-Authenticate']
           end
         end

data/test/generators/active_record_generator_test.rb

@@ -8,20 +8,10 @@ if DEVISE_ORM == :active_record
     destination File.expand_path("../../tmp", __FILE__)
     setup :prepare_destination
 
-    test "all files are properly created" do
-      with_rails_version :MAJOR => 3, :MINOR => 0 do
-        run_generator %w(monster)
-        assert_file "app/models/monster.rb", /devise/, /attr_accessible (:[a-z_]+(, )?)+/
-        assert_migration "db/migrate/devise_create_monsters.rb", /def self\.up/
-      end
-    end
-
     test "all files are properly created with rails31 migration syntax" do
-      with_rails_version :MAJOR => 3, :MINOR => 1 do
-        run_generator %w(monster)
-        assert_file "app/models/monster.rb", /devise/, /attr_accessible (:[a-z_]+(, )?)+/
-        assert_migration "db/migrate/devise_create_monsters.rb", /def change/
-      end
+      run_generator %w(monster)
+      assert_file "app/models/monster.rb", /devise/, /attr_accessible (:[a-z_]+(, )?)+/
+      assert_migration "db/migrate/devise_create_monsters.rb", /def change/
     end
 
     test "update model migration when model exists" do

data/test/generators/views_generator_test.rb

@@ -46,7 +46,7 @@ class ViewsGeneratorTest < Rails::Generators::TestCase
     assert_file "app/views/#{scope}/registrations/new.html.erb"
     assert_file "app/views/#{scope}/registrations/edit.html.erb"
     assert_file "app/views/#{scope}/sessions/new.html.erb"
-    assert_file "app/views/#{scope}/shared/_links.erb"
     assert_file "app/views/#{scope}/unlocks/new.html.erb"
+    assert_file "app/views/#{scope}/_links.erb"
   end
 end

data/test/integration/authenticatable_test.rb

@@ -407,7 +407,10 @@ class AuthenticationOthersTest < ActionController::IntegrationTest
 
   test 'sign in stub in xml format' do
     get new_user_session_path(:format => 'xml')
-    assert_equal "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<user>\n  <email></email>\n  <password nil=\"true\"></password>\n</user>\n", response.body
+    assert_match '<?xml version="1.0" encoding="UTF-8"?>', response.body
+    assert_match /<user>.*<\/user>/m, response.body
+    assert_match '<email></email>', response.body
+    assert_match '<password nil="true"></password>', response.body
   end
 
   test 'sign in stub in json format' do
@@ -432,12 +435,6 @@ class AuthenticationOthersTest < ActionController::IntegrationTest
     assert_not warden.authenticated?(:admin)
   end
 
-  test 'uses the mapping from nested devise_for call' do
-    sign_in_as_user :visit => "/devise_for/sign_in"
-    assert warden.authenticated?(:user)
-    assert_not warden.authenticated?(:admin)
-  end
-
   test 'sign in with xml format returns xml response' do
     create_user
     post user_session_path(:format => 'xml'), :user => {:email => "user@test.com", :password => '123456'}

data/test/integration/confirmable_test.rb

@@ -98,7 +98,7 @@ class ConfirmationTest < ActionController::IntegrationTest
   end
 
   test 'not confirmed user with setup to block without confirmation should not be able to sign in' do
-    swap Devise, :confirm_within => 0.days do
+    swap Devise, :allow_unconfirmed_access_for => 0.days do
       sign_in_as_user(:confirm => false)
 
       assert_contain 'You have to confirm your account before continuing'
@@ -107,7 +107,7 @@ class ConfirmationTest < ActionController::IntegrationTest
   end
 
   test 'not confirmed user should not see confirmation message if invalid credentials are given' do
-    swap Devise, :confirm_within => 0.days do
+    swap Devise, :allow_unconfirmed_access_for => 0.days do
       sign_in_as_user(:confirm => false) do
         fill_in 'password', :with => 'invalid'
       end
@@ -118,7 +118,7 @@ class ConfirmationTest < ActionController::IntegrationTest
   end
 
   test 'not confirmed user but configured with some days to confirm should be able to sign in' do
-    swap Devise, :confirm_within => 1.day do
+    swap Devise, :allow_unconfirmed_access_for => 1.day do
       sign_in_as_user(:confirm => false)
 
       assert_response :success
@@ -201,3 +201,55 @@ class ConfirmationTest < ActionController::IntegrationTest
     end
   end
 end
+
+class ConfirmationOnChangeTest < ActionController::IntegrationTest
+  def create_second_admin(options={})
+    @admin = nil
+    create_admin(options)
+  end
+
+  def visit_admin_confirmation_with_token(confirmation_token)
+    visit admin_confirmation_path(:confirmation_token => confirmation_token)
+  end
+
+  test 'admin should be able to request a new confirmation after email changed' do
+    admin = create_admin
+    admin.update_attributes(:email => 'new_test@example.com')
+
+    visit new_admin_session_path
+    click_link "Didn't receive confirmation instructions?"
+
+    fill_in 'email', :with => admin.unconfirmed_email
+    assert_difference "ActionMailer::Base.deliveries.size" do
+      click_button 'Resend confirmation instructions'
+    end
+
+    assert_current_url '/admin_area/sign_in'
+    assert_contain 'You will receive an email with instructions about how to confirm your account in a few minutes'
+  end
+
+  test 'admin with valid confirmation token should be able to confirm email after email changed' do
+    admin = create_admin
+    admin.update_attributes(:email => 'new_test@example.com')
+    assert_equal 'new_test@example.com', admin.unconfirmed_email
+    visit_admin_confirmation_with_token(admin.confirmation_token)
+
+    assert_contain 'Your account was successfully confirmed.'
+    assert_current_url '/admin_area/home'
+    assert admin.reload.confirmed?
+    assert_not admin.reload.pending_reconfirmation?
+  end
+
+  test 'admin email should be unique also within unconfirmed_email' do
+    admin = create_admin
+    admin.update_attributes(:email => 'new_admin_test@example.com')
+    assert_equal 'new_admin_test@example.com', admin.unconfirmed_email
+
+    create_second_admin(:email => "new_admin_test@example.com")
+
+    visit_admin_confirmation_with_token(admin.confirmation_token)
+    assert_have_selector '#error_explanation'
+    assert_contain /Email.*already.*taken/
+    assert admin.reload.pending_reconfirmation?
+  end
+end

data/test/integration/http_authenticatable_test.rb

@@ -4,7 +4,7 @@ class HttpAuthenticationTest < ActionController::IntegrationTest
   test 'handles unverified requests gets rid of caches but continues signed in' do
     swap UsersController, :allow_forgery_protection => true do
       create_user
-      post exhibit_user_url(1), {}, "HTTP_AUTHORIZATION" => "Basic #{ActiveSupport::Base64.encode64("user@test.com:123456")}"
+      post exhibit_user_url(1), {}, "HTTP_AUTHORIZATION" => "Basic #{Base64.encode64("user@test.com:123456")}"
       assert warden.authenticated?(:user)
       assert_equal "User is authenticated", response.body
     end
@@ -12,9 +12,24 @@ class HttpAuthenticationTest < ActionController::IntegrationTest
 
   test 'sign in should authenticate with http' do
     sign_in_as_new_user_with_http
-    assert_response :success
+    assert_response 200
     assert_match '<email>user@test.com</email>', response.body
     assert warden.authenticated?(:user)
+
+    get users_path(:format => :xml)
+    assert_response 200
+  end
+
+  test 'sign in should authenticate with http but not emit a cookie if skipping session storage' do
+    swap Devise, :skip_session_storage => [:http_auth] do
+      sign_in_as_new_user_with_http
+      assert_response 200
+      assert_match '<email>user@test.com</email>', response.body
+      assert warden.authenticated?(:user)
+
+      get users_path(:format => :xml)
+      assert_response 401
+    end
   end
 
   test 'returns a custom response with www-authenticate header on failures' do
@@ -59,7 +74,7 @@ class HttpAuthenticationTest < ActionController::IntegrationTest
     token = "token_containing_so_many_characters_that_the_base64_encoding_will_wrap"
     user = create_user
     user.update_attribute :authentication_token, token
-    get users_path(:format => :xml), {}, "HTTP_AUTHORIZATION" => "Basic #{ActiveSupport::Base64.encode64("#{token}:x")}"
+    get users_path(:format => :xml), {}, "HTTP_AUTHORIZATION" => "Basic #{Base64.encode64("#{token}:x")}"
     assert_response :success
     assert_match "<email>user@test.com</email>", response.body
     assert warden.authenticated?(:user)
@@ -69,14 +84,14 @@ class HttpAuthenticationTest < ActionController::IntegrationTest
 
     def sign_in_as_new_user_with_http(username="user@test.com", password="123456")
       user = create_user
-      get users_path(:format => :xml), {}, "HTTP_AUTHORIZATION" => "Basic #{ActiveSupport::Base64.encode64("#{username}:#{password}")}"
+      get users_path(:format => :xml), {}, "HTTP_AUTHORIZATION" => "Basic #{Base64.encode64("#{username}:#{password}")}"
       user
     end
 
     # Sign in with oauth2 token. This is just to test that it isn't misinterpreted as basic authentication
     def add_oauth2_header
       user = create_user
-      get users_path(:format => :xml), {}, "HTTP_AUTHORIZATION" => "OAuth #{ActiveSupport::Base64.encode64("#{user.email}:123456")}"
+      get users_path(:format => :xml), {}, "HTTP_AUTHORIZATION" => "OAuth #{Base64.encode64("#{user.email}:123456")}"
     end
 
 end

data/test/integration/lockable_test.rb

@@ -80,22 +80,15 @@ class LockTest < ActionController::IntegrationTest
 
     visit_user_unlock_with_token(user.unlock_token)
 
-    assert_current_url '/'
-    assert_contain 'Your account was successfully unlocked.'
+    assert_current_url "/users/sign_in"
+    assert_contain 'Your account has been unlocked successfully. Please sign in to continue.'
 
     assert_not user.reload.access_locked?
   end
 
-  test "sign in user automatically after unlocking its account" do
+  test "redirect user to sign in page after unlocking its account" do
     user = create_user(:locked => true)
     visit_user_unlock_with_token(user.unlock_token)
-    assert warden.authenticated?(:user)
-  end
-
-  test "user should not be able to sign in when locked" do
-    user = sign_in_as_user(:locked => true)
-    assert_template 'sessions/new'
-    assert_contain 'Your account is locked.'
     assert_not warden.authenticated?(:user)
   end
 
@@ -113,10 +106,29 @@ class LockTest < ActionController::IntegrationTest
 
   test 'error message is configurable by resource name' do
     store_translations :en, :devise => {
-      :failure => { :user => { :locked => "You are locked!" } }
+        :failure => {:user => {:locked => "You are locked!"}}
     } do
-      user = sign_in_as_user(:locked => true)
-      assert_contain 'You are locked!'
+
+      user = create_user(:locked => true)
+      user.failed_attempts = User.maximum_attempts + 1
+      user.save!
+
+      sign_in_as_user(:password => "invalid")
+      assert_contain "You are locked!"
+    end
+  end
+
+  test "user should not be able to sign in when locked" do
+    store_translations :en, :devise => {
+        :failure => {:user => {:locked => "You are locked!"}}
+    } do
+
+      user = create_user(:locked => true)
+      user.failed_attempts = User.maximum_attempts + 1
+      user.save!
+
+      sign_in_as_user(:password => "123456")
+      assert_contain "You are locked!"
     end
   end
 
@@ -157,7 +169,7 @@ class LockTest < ActionController::IntegrationTest
 
   test "when using json to ask a unlock request, should not return the user" do
     user = create_user(:locked => true)
-    post  user_unlock_path(:format => "json", :user => {:email => user.email})
+    post user_unlock_path(:format => "json", :user => {:email => user.email})
     assert_response :success
     assert_equal response.body, {}.to_json
   end

data/test/integration/registerable_test.rb

@@ -13,7 +13,7 @@ class RegistrationTest < ActionController::IntegrationTest
     fill_in 'password confirmation', :with => 'new_user123'
     click_button 'Sign up'
 
-    assert_contain 'Welcome! You have signed up successfully.'
+    assert_contain 'You have signed up successfully'
     assert warden.authenticated?(:admin)
     assert_current_url "/admin_area/home"
 
@@ -50,7 +50,7 @@ class RegistrationTest < ActionController::IntegrationTest
   test 'a guest user should be able to sign up successfully and be blocked by confirmation' do
     user_sign_up
 
-    assert_contain 'You have signed up successfully. However, we could not sign you in because your account is unconfirmed.'
+    assert_contain 'A message with a confirmation link has been sent to your email address. Please open the link to activate your account.'
     assert_not_contain 'You have to confirm your account before continuing'
     assert_current_url "/"
 
@@ -291,3 +291,34 @@ class RegistrationTest < ActionController::IntegrationTest
     assert_equal User.count, 0
   end
 end
+
+class ReconfirmableRegistrationTest < ActionController::IntegrationTest
+  test 'a signed in admin should see a more appropriate flash message when editing his account if reconfirmable is enabled' do
+    sign_in_as_admin
+    get edit_admin_registration_path
+
+    fill_in 'email', :with => 'admin.new@example.com'
+    fill_in 'current password', :with => '123456'
+    click_button 'Update'
+
+    assert_current_url '/admin_area/home'
+    assert_contain 'but we need to verify your new email address'
+
+    assert_equal "admin.new@example.com", Admin.first.unconfirmed_email
+  end
+
+  test 'a signed in admin should not see a reconfirmation message if they did not change their password' do
+    sign_in_as_admin
+    get edit_admin_registration_path
+
+    fill_in 'password', :with => 'pas123'
+    fill_in 'password confirmation', :with => 'pas123'
+    fill_in 'current password', :with => '123456'
+    click_button 'Update'
+
+    assert_current_url '/admin_area/home'
+    assert_contain 'You updated your account successfully.'
+
+    assert Admin.first.valid_password?('pas123')
+  end
+end

data/test/integration/rememberable_test.rb

@@ -9,14 +9,6 @@ class RememberMeTest < ActionController::IntegrationTest
     user
   end
 
-  def create_admin_and_remember
-    admin = create_admin
-    admin.remember_me!
-    raw_cookie = Admin.serialize_into_cookie(admin)
-    cookies['remember_admin_token'] = generate_signed_cookie(raw_cookie)
-    admin
-  end
-
   def generate_signed_cookie(raw_cookie)
     request = ActionDispatch::TestRequest.new
     request.cookie_jar.signed['raw_cookie'] = raw_cookie
@@ -117,34 +109,6 @@ class RememberMeTest < ActionController::IntegrationTest
     end
   end
 
-  test 'if both extend_remember_period and remember_across_browsers are true, sends the same token with a new expire date' do
-    swap Devise, :remember_across_browsers => true, :extend_remember_period => true, :remember_for => 1.year do
-      admin = create_admin_and_remember
-      token = admin.remember_token
-
-      admin.remember_created_at = old = 10.minutes.ago
-      admin.save!
-
-      get root_path
-      assert (cookie_expires("remember_admin_token") - 1.year) > (old + 5.minutes)
-      assert_equal token, signed_cookie("remember_admin_token").last
-    end
-  end
-
-  test 'if both extend_remember_period and remember_across_browsers are false, sends a new token with old expire date' do
-    swap Devise, :remember_across_browsers => false, :extend_remember_period => false, :remember_for => 1.year do
-      admin = create_admin_and_remember
-      token = admin.remember_token
-
-      admin.remember_created_at = old = 10.minutes.ago
-      admin.save!
-
-      get root_path
-      assert (cookie_expires("remember_admin_token") - 1.year) < (old + 5.minutes)
-      assert_not_equal token, signed_cookie("remember_admin_token").last
-    end
-  end
-
   test 'do not remember other scopes' do
     user = create_user_and_remember
     get root_path
@@ -182,20 +146,6 @@ class RememberMeTest < ActionController::IntegrationTest
     assert_not warden.authenticated?(:user)
   end
 
-  test 'do not remember the admin anymore after forget' do
-    admin = create_admin_and_remember
-    get root_path
-    assert warden.authenticated?(:admin)
-
-    get destroy_admin_session_path
-    assert_not warden.authenticated?(:admin)
-    assert_nil admin.reload.remember_token
-    assert_nil warden.cookies['remember_admin_token']
-
-    get root_path
-    assert_not warden.authenticated?(:admin)
-  end
-
   test 'changing user password expires remember me token' do
     user = create_user_and_remember
     user.password = "another_password"

data/test/integration/timeoutable_test.rb

@@ -41,7 +41,7 @@ class SessionTimeoutTest < ActionController::IntegrationTest
     assert_not_nil last_request_at
 
     get users_path
-    assert_redirected_to new_user_session_path
+    assert_redirected_to users_path
     assert_not warden.authenticated?(:user)
   end
 
@@ -68,12 +68,25 @@ class SessionTimeoutTest < ActionController::IntegrationTest
 
       get expire_user_path(user)
       get users_path
-      assert_redirected_to new_user_session_path
+      assert_redirected_to users_path
       assert_not warden.authenticated?(:user)
     end
   end
 
   test 'error message with i18n' do
+    store_translations :en, :devise => {
+      :failure => { :user => { :timeout => 'Session expired!' } }
+    } do
+      user = sign_in_as_user
+
+      get expire_user_path(user)
+      get root_path
+      follow_redirect!
+      assert_contain 'Session expired!'
+    end
+  end
+
+  test 'error message with i18n with double redirect' do
     store_translations :en, :devise => {
       :failure => { :user => { :timeout => 'Session expired!' } }
     } do
@@ -82,15 +95,16 @@ class SessionTimeoutTest < ActionController::IntegrationTest
       get expire_user_path(user)
       get users_path
       follow_redirect!
+      follow_redirect!
       assert_contain 'Session expired!'
     end
   end
-  
+
   test 'time out not triggered if remembered' do
     user = sign_in_as_user :remember_me => true
     get expire_user_path(user)
     assert_not_nil last_request_at
-    
+
     get users_path
     assert_response :success
     assert warden.authenticated?(:user)