gistfile1.rb

class JobsController < ApplicationController

  before_filter :require_user, :except => [ :index, :show ]
  
  def index    
    @listings = Job.find_by_complex_search(current_user, params).paginate({ :page => params[:page], :per_page => CONFIG['per_page'] })
    flash.now[:notice] = "Sorry, there were no records found." if @listings.blank?
    
    respond_to do |format|
      format.html # index.html.erb
    end
  end

  def show
    @listing = Job.find(params[:id])
    raise ResourceNotFound unless @listing.is_showable_by?(current_user)
    @listing.record_impression!(current_user)
    
    respond_to do |format|
      format.html # show.html.erb
    end
  end

  def create
    @listing = Job.new(params[:job])
    raise NoPermission unless @listing.is_createable_by?(current_user)
    
    respond_to do |format|
      if @listing.save
        flash[:notice] = flash_for_created_resource(@listing)
        format.html { redirect_to(@listing) }
      else
        format.html { render :action => "new" }
      end
    end
  end

  def update
    @listing = Job.find(params[:id])
    raise NoPermission unless @listing.is_editable_by?(current_user)   
    @listing.current_user = current_user
     
    respond_to do |format|
      if @listing.update_attributes(params[:job])
        flash[:notice] = 'Job was successfully updated.'
        format.html { redirect_to(@listing) }
      else
        format.html { render :action => "edit" }
      end
    end
  end
  
  # etc ...

end


class Job < ActiveRecord::Base
  
  default_scope :order => 'jobs.created_at DESC'
  
  include Listable
  include Categorizable
  include Statusable
  include Impressionable
  include Attachable
  include Mappable
  include Fulltextable # must come last
  
  # access rules -------------------------------------------------------------

  def is_createable_by?(current_user)
    return true if current_user.try(:has_role?, 'admin')
    return true if current_user.active? 
    return false
  end

  def is_showable_by?(current_user)
    return true if current_user.try(:has_role?, 'admin')
    return true if owner.is_a?(User) and owner.eql?(current_user) and !destroyed?
    return true if owner.is_a?(Affiliate) and owner.users.include?(current_user) and !destroyed?
    return true if approved?
    return false 
  end

  def is_editable_by?(current_user)
    return true if current_user.try(:has_role?, 'admin')
    return true if owner.is_a?(User) and owner.eql?(current_user) and !destroyed?
    return true if owner.is_a?(Affiliate) and owner.users.include?(current_user) and !destroyed?
    return false 
  end

  def is_destroyable_by?(current_user)
    return true if current_user.try(:has_role?, 'admin')
    return false 
  end
  
end