user.rb

  # quotes visible to a user
  def quotes(query_hsh)
    return [] if division_id.nil? || facility_id.nil?
    
    if authorized?('all_quotes')
      Quote.all(query_hsh)
    elsif authorized?('own_quotes')
      Quote.all({:user_id => id}.merge(query_hsh))
    end
  end