Refactoring confirmable callbacks and updating TODO

TODO

@@ -1,18 +1,16 @@
-* Add remember me (with customizable time frame)
+* Clear perishable_token in :confirmable and :recoverable
-
+* Remove perishable token and create attributes for confirmation_token and reset_password_token
+* Add confirmation_sent_at for confirmable
 * Store session[:return_to] in session
-
+* Use sign_in and sign_out in SessionsController
-* Add confirmable filters
 
 * Use path_names in routes
-
+* Add remember me (with customizable time frame)
-* Use sign_in and sign_out in SessionsController
+* Add confirmable filters
 
 * Create generators
 * Allow stretches and pepper per model
 * Mailer subjects namespaced by model
-
-* Clear perishable_token in :confirmable and :recoverable
 * Use request_ip in session cookies
 
 * Devise::BruteForceProtection
@@ -35,4 +33,3 @@
 * devise :authenticable, :confirmable, :recoverable
 * Allow multiple models per controller
 * Add mappings
-

lib/devise/models/confirmable.rb

@@ -25,11 +25,8 @@ module Devise
         base.class_eval do
           extend ClassMethods
 
-          after_create  :send_confirmation_instructions
+          before_save :reset_confirmation, :if => :email_changed?
-          before_update :reset_confirmation, :if => :email_changed?
+          after_save  :send_confirmation_instructions, :if => :email_changed?
-          after_update  :send_confirmation_instructions, :if => :email_changed?
-
-          before_create :reset_perishable_token
         end
       end
 
@@ -61,7 +58,7 @@ module Devise
       def reset_confirmation!
         unless_confirmed do
           reset_confirmation
-          reset_perishable_token!
+          save(false)
           send_confirmation_instructions
         end
       end
@@ -72,6 +69,7 @@ module Devise
         # email, it won't be able to sign in without confirming it.
         #
         def reset_confirmation
+          reset_perishable_token
           self.confirmed_at = nil
         end
 

test/models/confirmable_test.rb

@@ -149,6 +149,14 @@ class ConfirmableTest < ActiveSupport::TestCase
     assert_not user.reload.confirmed?
   end
 
+  test 'should reset perishable token when updating email' do
+    user = create_user
+    token = user.perishable_token
+    user.email = 'new_test@example.com'
+    user.save!
+    assert_not_equal token, user.reload.perishable_token
+  end
+
   test 'should not be able to send instructions if the user is already confirmed' do
     user = create_user
     user.confirm!