Question

I have a project where an User can own a Project and make part of a Project as a Team.

My models are like that:

class User
 has_many :projects, :foreign_key => "owner_id"
 has_many :project_memberships, :foreign_key => "member_id"
 has_many :shared_projects, :class_name => "Project", :through => :project_memberships, :foreign_key => "member_id"
end

class Project
 belongs_to :owner, :class_name => "User"
 has_many :project_memberships
 has_many :members, :class_name => "User", :through => "project_memberships", :foreign_key => "member_id"
end

My question is: How can I create/delete etc a new Project so an User can own it since I’m not using nested resources?

Here is my Project Controller:

def new
@project = Project.new
end

def create
@owner = User.find(params[:user_id])
@project= @owner.projects.build(params[:project])   
    ...
end

Thanks in advance.

Answer 1

If I understand your question correctly, you need to store current signed in user ID in session or use some authentication gem (like devise) which will do it for you.

Devise provides helper method current_user which returns an instance of User model. So you could do like so:

def create
@project= current_user.projects.build(params[:project])   
    ...
end

Update
If you pass user_id through form, you allow anyone to create project with another user’s id. Actions that create something, that belong to current user should be constrained to current user on the serverside