# NOTE: current_user is a method that returns an object for the currently logged in user

## dashboard_controller.rb

class DashboardController < ApplicationController
  before_filter :login_required

  def index
  end

  def profile
    @user = current_user
    if request.post?
      if @user.update_attributes(params[:user])
        flash[:notice] = 'Profile was successfully updated.'
        redirect_to :controller => 'dashboard' }
      else
        render :action => 'profile'
      end
    end
  end
end

## dashboard/profile.rhtml

<% title 'My Profile' %>

<pre><%= @user.to_yaml %></pre>

<%= error_messages_for :user %>
<% form_for :user, @user, :url => { :action => 'profile' } do |f| %>

<p><label for="first_name">First Name</label><br/>
<%= f.text_field :first_name %></p>

<p><label for="last_name">Last Name</label><br/>
<%= f.text_field :last_name %></p>

<p><label for="city">City</label><br/>
<%= f.text_field :city %></p>

<p><label for="state">State</label><br/>
<%= f.text_field :state %></p>

<p><label for="zip_code">Zip Code</label><br/>
<%= f.text_field :zip_code %></p>

<p><label for="country">Country</label><br/>
<%= f.text_field :country %></p>

<p><%= submit_tag 'Submit' %></p>
<% end -%>

## user.rb

require 'digest/sha1'
class User < ActiveRecord::Base
  # Virtual attribute for the unencrypted password
  attr_accessor :password

  validates_presence_of     :login, :email
  validates_presence_of     :password,                   :if => :password_required?
  validates_presence_of     :password_confirmation,      :if => :password_required?
  validates_length_of       :password, :within => 4..40, :if => :password_required?
  validates_confirmation_of :password,                   :if => :password_required?
  validates_length_of       :login,    :within => 3..40
  validates_length_of       :email,    :within => 3..100
  validates_uniqueness_of   :login, :email, :case_sensitive => false
  before_save :encrypt_password

  # prevents a user from submitting a crafted form that bypasses activation
  # anything else you want your user to change should be added here.
  attr_accessible :login, :email, :password, :password_confirmation

  # Authenticates a user by their login name and unencrypted password.  Returns the user or nil.
  def self.authenticate(login, password)
    u = find_by_login(login) # need to get the salt
    u && u.authenticated?(password) ? u : nil
  end

  # Encrypts some data with the salt.
  def self.encrypt(password, salt)
    Digest::SHA1.hexdigest("--#{salt}--#{password}--")
  end

  # Encrypts the password with the user salt
  def encrypt(password)
    self.class.encrypt(password, salt)
  end

  def authenticated?(password)
    crypted_password == encrypt(password)
  end

  def remember_token?
    remember_token_expires_at && Time.now.utc < remember_token_expires_at
  end

  # These create and unset the fields required for remembering users between browser closes
  def remember_me
    remember_me_for 2.weeks
  end

  def remember_me_for(time)
    remember_me_until time.from_now.utc
  end

  def remember_me_until(time)
    self.remember_token_expires_at = time
    self.remember_token            = encrypt("#{email}--#{remember_token_expires_at}")
    save(false)
  end

  def forget_me
    self.remember_token_expires_at = nil
    self.remember_token            = nil
    save(false)
  end

  protected
    # before filter
    def encrypt_password
      return if password.blank?
      self.salt = Digest::SHA1.hexdigest("--#{Time.now.to_s}--#{login}--") if new_record?
      self.crypted_password = encrypt(password)
    end

    def password_required?
      crypted_password.blank? || !password.blank?
    end

end