# login_controller.rb

def login
    session[:user_id]=nil
     user=User.login(params[:email],params[:password])
      if user
        session[:user_id]=user.id
        session[:user_email]=user.email
        redirect_to(:controller=>:list)
      else
        flash[:notice]="Invalid user/password combination"
      end
  end

#user.rb (model)

require 'digest/sha1'

class User < ActiveRecord::Base
  has_many :stores
  validates_presence_of :firstname,:lastname, :password, :email
  validates_uniqueness_of :email
  validates_length_of :password, :minimum=>5, :message=>"should be at least 5 characters long"

  attr_accessor :password_confirmation
  validates_confirmation_of :password

  def self.login(email, password)
    user = self.find_by_email(email)
    if user
      expected_password = encrypted_password(password, user.salt)
      if user.hashed_password != expected_password
        user=nil
      end
    end
    user
  end

   def password
    @password
  end

  def password=(pwd)
    @password=pwd
    create_new_salt
    self.hashed_password = User.encrypted_password(self.password, self.salt)
  end

  private

  def create_new_salt
    self.salt = self.object_id.to_s   rand.to_s
  end

  def self.encrypted_password(password, salt)
    string_to_hash = password   "arg0rulz"   salt
    Digest::SHA1.hexdigest(string_to_hash)
  end
end