timeout_in option can be a Proc object

CHANGELOG.rdoc

@@ -2,6 +2,7 @@
 
 * enhancements
   * Add support for rails 3.1 new mass assignment conventions (by github.com/kirs)
+  * timeout_in option can be a Proc object (by github.com/lest)
 
 * bug fix
   * OmniAuth error message now shows the proper option (:strategy_class instead of :klass)

lib/devise/models/timeoutable.rb

@@ -23,18 +23,21 @@ module Devise
       # Checks whether the user session has expired based on configured time.
       def timedout?(last_access)
         return false if remember_exists_and_not_expired?
-        
-        last_access && last_access <= self.class.timeout_in.ago
+
+        timeout_in = self.class.timeout_in
+        timeout_in = timeout_in.call(self) if timeout_in.respond_to?(:call)
+
+        !timeout_in.nil? && last_access && last_access <= timeout_in.ago
       end
-      
+
       private
-      
+
       def remember_exists_and_not_expired?
         return false unless respond_to?(:remember_expired?)
-        
+
         remember_created_at && !remember_expired?
       end
-      
+
       module ClassMethods
         Devise::Models.config(self, :timeout_in)
       end

test/models/timeoutable_test.rb

@@ -14,6 +14,26 @@ class TimeoutableTest < ActiveSupport::TestCase
     assert_not new_user.timedout?(nil)
   end
 
+  test 'should accept timeout_in proc and provide user as argument' do
+    user = new_user
+
+    timeout_in = proc do |obj|
+      assert_equal user, obj
+      10.minutes
+    end
+
+    swap Devise, :timeout_in => timeout_in do
+      assert user.timedout?(12.minutes.ago)
+      assert_not user.timedout?(8.minutes.ago)
+    end
+  end
+
+  test 'should not be expired when timeout_in proc returns nil' do
+    swap Devise, :timeout_in => proc { nil } do
+      assert_not new_user.timedout?(10.hours.ago)
+    end
+  end
+
   test 'fallback to Devise config option' do
     swap Devise, :timeout_in => 1.minute do
       user = new_user