permissions_problem.rb

class Bid < AR::Base
  belongs_to :project
  belongs_to :bidder, :creator => true, :class_name => "User"

  def create_permitted?
    return false if acting_user == project_owner
    return false if project.already_bidded?(acting_user)
    bidder_is? acting_user
  end
  def view_permitted?(attribute)
    new_record? or bidder_is? acting_user or project_owner == acting_user
  end
  def project_owner
    project.user
  end
end
class Project < AR::Base
  belongs_to :user, :creator => true
  has_many :bids
  has_many :bidders, :through => :bids, :class_name => "User"
  
  def already_bidded?(bidder)
    bidders.include? bidder
  end
end