timeout_in option can be a Proc object

CHANGELOG.rdoc

@@ -2,6 +2,7 @@
 
 * enhancements
   * Add support for rails 3.1 new mass assignment conventions (by github.com/kirs)
+  * timeout_in option can be a Proc object (by github.com/lest)
 
 * bug fix
   * OmniAuth error message now shows the proper option (:strategy_class instead of :klass)

lib/devise/models/timeoutable.rb

@@ -24,7 +24,10 @@ module Devise
       def timedout?(last_access)
         return false if remember_exists_and_not_expired?
 
-        last_access && last_access <= self.class.timeout_in.ago
+        timeout_in = self.class.timeout_in
+        timeout_in = timeout_in.call(self) if timeout_in.respond_to?(:call)
+
+        !timeout_in.nil? && last_access && last_access <= timeout_in.ago
       end
 
       private

test/models/timeoutable_test.rb

@@ -14,6 +14,26 @@ class TimeoutableTest < ActiveSupport::TestCase
     assert_not new_user.timedout?(nil)
   end
 
+  test 'should accept timeout_in proc and provide user as argument' do
+    user = new_user
+
+    timeout_in = proc do |obj|
+      assert_equal user, obj
+      10.minutes
+    end
+
+    swap Devise, :timeout_in => timeout_in do
+      assert user.timedout?(12.minutes.ago)
+      assert_not user.timedout?(8.minutes.ago)
+    end
+  end
+
+  test 'should not be expired when timeout_in proc returns nil' do
+    swap Devise, :timeout_in => proc { nil } do
+      assert_not new_user.timedout?(10.hours.ago)
+    end
+  end
+
   test 'fallback to Devise config option' do
     swap Devise, :timeout_in => 1.minute do
       user = new_user