# Sets @authenticated_user if the user provides valid
# credentials. THis may be used to deny access or customise the view
def authenticate
@authenticated_user = nil
authenticate_with_http_basic do |user, password|
@authenticated_user = User.authenticate(user, password)
end
return true
end
#Filter for actions that _require_ authentication. Unless client
authenticated
# as some user, takes over the request and sends a response code of
401.
def must_authenticate
if @authenticated_user && (@user_is_viewing_themselves != false)
return true
else
request_http_basic_authentication
return false
end
end
# A filter for controllers beneath /users/{login}.
# Transforms {login} into user ID. Sends a 404 response code
# if the user does not exist.
def must_specify_user
if params[:id]
@user = User.find_by_permalink(params[:id])
if_found(@user) {params[:user_id] = @user.id}
return false unless @user
end
# for limiting view to authenticated user
@user_is_viewing_themselves = (@authenticated_user == @user)
return true
end
in my orders_controller i use before_filter :must_authenticate and
before_filter:must_specify_user