## app/model/var.rb
class Var < ActiveRecord::Base

  named_scope :year_start_after, lambda {|day| {:conditions => ['previous_year_end <= ?',day]}}
  named_scope :year_end_before, lambda {|day| {:conditions => ['start_date >= ?',day]}}
  named_scope :current, :order => "year DESC"

end

## app/model/user.rb
require 'digest/sha1'
class User < ActiveRecord::Base
  has_many :addresses, :dependent => :destroy
  has_many :phones, :dependent => :destroy
  has_many :order_transactions
  has_many :orders
  has_many :line_items, :through => :orders
  has_many :spaces
  has_many :previous_spaces, :class_name => "Space", :foreign_key => "previous_user_id"

  # Virtual attribute for the unencrypted password
  attr_accessor :password, :fullname

  validates_presence_of     :login, :email
  validates_presence_of     :password,                   :if => :password_required?
  validates_presence_of     :password_confirmation,      :if => :password_required?
  validates_length_of       :password, :within => 4..40, :if => :password_required?
  validates_confirmation_of :password,                   :if => :password_required?
  validates_length_of       :login,    :within => 3..40
  validates_length_of       :email,    :within => 3..100
  validates_uniqueness_of   :login, :case_sensitive => false
  validates_associated      :addresses
  validates_associated      :phones
  before_save :encrypt_password
  after_update :save_addresses, :save_phones

  named_scope :by_id, :order => "users.id"
  named_scope :by_surname, :order => "surname"
  named_scope :by_given_name, :order => "given_name"
  named_scope :by_name, :order => "surname, given_name"
  named_scope :include_addresses, :include => :addresses
  named_scope :with_spaces, :include => :spaces
  named_scope :without_spaces, :include => :spaces,
              :conditions => ["spaces.user_id is null"]
  named_scope :with_previous_spaces, :joins => :previous_spaces
  ### logic is flawed, will find spaces reserved in previous years
  ### use :with_spaces instead
  named_scope :with_reservations, :include => :line_items,
              :conditions => ["line_items.billable_type = 'Space'"]
  named_scope :with_current_orders, :include => :orders,
              :conditions => ["orders.order_status = 'paid' or orders.order_status = 'confirmed'"]
  named_scope :awaiting_payment, :include => :orders,
              :conditions => ["orders.order_status = 'awaiting_payment'"]
  named_scope :with_archived_orders, :include => :orders,
              :conditions => ["orders.order_status = 'archived'"]
  named_scope :not_confirmed, :include => :orders,
              :conditions => ["orders.order_status <> 'confirmed'"]
  named_scope :orders_last_year, :include => :orders,
              :conditions => ["orders.checkout_at between ? and ?",Var.current.first.previous_year_start, Var.current.first.previous_year_end]
  named_scope :orders_this_year, :include => :orders,
              :conditions => ["orders.checkout_at >= ?", Var.current.first.previous_year_end]
  named_scope :no_orders_this_year, :joins => :orders,
              :conditions => ["orders.order_status <> 'archived'"]
              #:conditions => ["orders.checkout_at not between ? and ?", Var.current.first.previous_year_end, Var.current.first.end_date]
  named_scope :with_active_orders, :joins => :orders,
              :conditions => ["orders.order_status <> 'archived'"]
  named_scope :order_year, lambda { |*args| {:include => :orders, :conditions => ["orders.checkout_at between ? and ?", args.first, args.last]}}
  named_scope :sorting_order, lambda { |*args| {:order => args}}

  # prevents a user from submitting a crafted form that bypasses activation
  # anything else you want your user to change should be added here.
  attr_accessible :login,
                  :email,
                  :password,
                  :password_confirmation,
                  :nickname,
                  :url,
                  :given_name,
                  :middle_initial,
                  :surname,
                  :amcaid,
                  :admin,
                  :existing_address_attributes,
                  :new_address_attributes,
                  :address_attributes,
                  :existing_phone_attributes,
                  :new_phone_attributes,
                  :phone_attributes,
                  :company_name

  def active_orders
    Order.user(self.id).neg_status("archived").size
  end

  def new_address_attributes=(address_attributes)
    address_attributes.each do |attributes|
      addresses.build(attributes)
    end
  end

  def existing_address_attributes=(address_attributes)
    addresses.reject(&:new_record?).each do |address|
      attributes = address_attributes[address.id.to_s]
      if attributes
        address.attributes = attributes
      else
        addresses.delete(address)
      end
    end
  end

  def save_addresses
    addresses.each do |address|
      address.save(false)
    end
  end

  def new_phone_attributes=(phone_attributes)
    phone_attributes.each do |attributes|
      phones.build(attributes)
    end
  end

  def existing_phone_attributes=(phone_attributes)
    phones.reject(&:new_record?).each do |phone|
      attributes = phone_attributes[phone.id.to_s]
      if attributes
        phone.attributes = attributes
      else
        phone.delete(phone)
      end
    end
  end

  def save_phones
    phones.each do |phone|
      phone.save(false)
    end
  end

  # Authenticates a user by their login name and unencrypted password.  Returns the user or nil.
  def self.authenticate(login, password)
    u = find_by_login(login) # need to get the salt
    u && u.authenticated?(password) ? u : nil
  end

  # Encrypts some data with the salt.
  def self.encrypt(password, salt)
    Digest::SHA1.hexdigest("--#{salt}--#{password}--")
  end

  # Encrypts the password with the user salt
  def encrypt(password)
    self.class.encrypt(password, salt)
  end

  def authenticated?(password)
    crypted_password == encrypt(password)
  end

  def remember_token?
    remember_token_expires_at && Time.now.utc < remember_token_expires_at
  end

  # These create and unset the fields required for remembering users between browser closes
  def remember_me
    remember_me_for 2.weeks
  end

  def remember_me_for(time)
    remember_me_until time.from_now.utc
  end

  def remember_me_until(time)
    self.remember_token_expires_at = time
    self.remember_token            = encrypt("#{email}--#{remember_token_expires_at}")
    save(false)
  end

  def forget_me
    self.remember_token_expires_at = nil
    self.remember_token            = nil
    save(false)
  end

  def full_name
    self.fullname = self.middle_initial ? "#{self.given_name} #{self.middle_initial} #{self.surname}" : "#{self.given_name} #{self.surname}"
    self.fullname
  end

  def name_with_amcaid
    "#{self.full_name} - #{self.amcaid}"
  end

  # Returns true if the user has just been activated.
  def recently_activated?
    @activated
  end

  protected
    # before filter
    def encrypt_password
      return if password.blank?
      self.salt = Digest::SHA1.hexdigest("--#{Time.now.to_s}--#{login}--") if new_record?
      self.crypted_password = encrypt(password)
    end

    def password_required?
      crypted_password.blank? || !password.blank?
    end

end