### params being posted


{"county"=>"county down", "firstname"=>"chris", "existing_qualification_attributes"=>{}, "secondname"=>"mccabe"}


###

require 'digest/sha1'

class User < ActiveRecord::Base
  has_many :history
  has_many :education
  has_many :qualifications, :dependent => :destroy


  validates_presence_of :firstname, :secondname, :email
  validates_uniqueness_of :email

  attr_accessor :password_confirmation
  validates_confirmation_of :password

  validate :password_non_blank

  def password
    @password
  end

  def password=(pwd)
    @password = pwd
	return if pwd.blank?
	create_new_salt
	self.hashed_password = User.encrypted_password(self.password, self.salt)
  end

  def self.autheticate(email, password)
    user = self.find_by_email(email)
	if user
	  expected_password = encrypted_password(password, user.salt)
	  if user.hashed_password != expected_password
	    user = nil
	  end
	end
	user
  end

  def new_qualification_attributes=(qualification_attributes)
    qualification_attributes.each do |attributes|
	  qualifications.build(attributes)
	end
  end

  after_update :save_qualifications

  def existing_qualification_attributes=(qualification_attributes)
	  qualifications.reject(&:new_record?).each do |qualification|
	    attributes = qualification_attributes[qualification.id.to_s]
		if attributes
		  qualification.attributes = attributes
		else
		  qualifications.delete(qualification)
		end
	end
  end

  def save_qualifications
    qualifications.each do |qualification|
	  qualification.save(false)
    end
  end



private

  def password_non_blank
    errors.add(:password, "Missing password") if hashed_password.blank?
  end

  def self.encrypted_password(password, salt)
    string_to_hash = password + "wibble" + salt
	Digest::SHA1.hexdigest(string_to_hash)
  end

  def create_new_salt
    self.salt = self.object_id.to_s + rand.to_s
  end


end



####controller
####


class UsersController < ApplicationController
  # GET /users
  # GET /users.xml
  def index
    @users = User.find(:all, :order => :secondname)

    respond_to do |format|
      format.html # index.html.erb
      format.xml  { render :xml => @users }
    end
  end

  # GET /users/1
  # GET /users/1.xml
  def show
    @user = User.find(params[:id])

    respond_to do |format|
      format.html # show.html.erb
      format.xml  { render :xml => @user }
    end
  end

  # GET /users/new
  # GET /users/new.xml
  def new
    @user = User.new
	@user.qualification.build

    respond_to do |format|
      format.html # new.html.erb
      format.xml  { render :xml => @user }
    end
  end

  # GET /users/1/edit
  def edit
    @user = User.find(params[:id])

  end

  # POST /users
  # POST /users.xml
  def create
    @user = User.new(params[:user])

    respond_to do |format|
      if @user.save
        flash[:notice] = 'User #{@user.email} was successfully created.'
        format.html { redirect_to(@user) }
        format.xml  { render :xml => @user, :status => :created, :location => @user }
      else
        format.html { render :action => "new" }
        format.xml  { render :xml => @user.errors, :status => :unprocessable_entity }
      end
    end
  end

  # PUT /users/1
  # PUT /users/1.xml
  def update
    params[:user][:existing_qualification_attributes] || = {}
    @user = User.find(params[:id])

    respond_to do |format|
      if @user.update_attributes(params[:user])
        flash[:notice] = params[:user].inspect
        format.html { redirect_to(@user) }
        format.xml  { head :ok }
      else
        format.html { render :action => "edit" }
        format.xml  { render :xml => @user.errors, :status => :unprocessable_entity }
      end
    end
  end

  # DELETE /users/1
  # DELETE /users/1.xml
  def destroy
    @user = User.find(params[:id])
    @user.destroy

    respond_to do |format|
      format.html { redirect_to(users_url) }
      format.xml  { head :ok }
    end
  end
end