before filters.rb

class ThingsController < ApplicationController

  before_filter :get_thing!, :only => [:show]
  before_filter :friends_only!, :only => [:show]


  def show
    render @thing
  end

protected

  # I'd just call this "get_thing" if it used find_by_{id,login} 
  # or other methods which don't raise exceptions
  def get_thing!
    @thing = Thing.find(params[:id])
  end

  def friends_only!
    if current_user && @user && current_user.friends_with?(@user)
      # OK
      # do nothing
    else
      # Fail
      render :text => "not friends", :status => 403
    end
  end

end