gistfile1.rb

# Admin controller sets layout and has before filter requiring login
class ManualsController < AdminController
 
  # only allow admins unless index or show action
  padlock(:on_all_except => [:index, :show]) { current_user.admin? }
  
  # only allow admins or users with view privileges on the show action
  padlock(:on => :show) { current_user.admin? || current_user.can_view_manual?(Manual.find(params[:id])) }
  
  def index
    @manuals = manuals_scope.all
  end

  def show
    @pages = manuals_scope.find(params[:id])
  end

  def new
    @manual = Manual.new
  end

  def edit
    @manual = manuals_scope.find(params[:id])
  end

  def create
    @manual = Manual.new(params[:manual])
    if @manual.save
      flash[:notice] = 'Manual was successfully created.'
      redirect_to edit_manual_url(@manual)
    else
      render :action => "new"
    end

  end

  def update
    @manual = manuals_scope.find(params[:id])
    if @manual.update_attributes(params[:manual])
      flash[:notice] = 'Manual was successfully updated.'
      redirect_to edit_manual_url(@manual)
    else
      render :action => "edit"
    end
  end

  def destroy
    @manual = manuals_scope.find(params[:id])
    @manual.destroy
    redirect_to manuals_url
  end
  
  
  private
  
    def manuals_scope
      current_user.admin? ? Manual : Manual.send("#{current_user.level}_viewable")
    end

end