gistfile1.rb

class AccountsController < ApplicationController
  
  skip_before_filter :find_account, :only => [:new,:create]
  skip_before_filter :authenticate_user!, :only => [:new,:create]
  
  before_filter :ensure_user_authorised, :except => [:new,:create]
  
  layout 'application', :only => [:show,:edit,:update,:destroy]
  layout 'site', :only => :create
  layout 'signup', :only => :new
  
  def new
    @account = Account.new
  end

  def create
    @account = Account.new(params[:account])
    if @account.save
      redirect_to root_url
    else
      flash[:error] = "Account not created. Please try again."
      redirect_to new_account_path
    end
  end

  #TODO: Add option to set leave year on show page

  def show
    @account = Account.find(params[:id])
    @department = @account.departments.new
  end

  def edit
    @account = Account.find(params[:id])
  end

  def update
    @account = Account.find(params[:id])
    @account.update_attributes(params[:account])
    if @account.save
      flash[:notice] = "Your changes have been saved"
      redirect_to root_path
    else
      flash[:error] = "Could not update your account at this time"
      redirect_to edit_account_path(@account)
    end
  end

  def destroy
  end
  
  private
  
  def ensure_user_authorised
    unless current_user.account.id == params[:id].to_i
      flash[:error] = "Invalid Request"
      redirect_to root_url
    end
  end

end