Question

When the user is logged in, only the user who create the record can destroy his own record.
What should I add to the code below??

  def destroy

    @topic = Topic.find(params[:id])
    @topic.destroy
    flash[:notice] = "topic deleted!"

  end

Answer 1

What you are looking for is not really devise but a authorization solution like CanCan.

Devise can only authenticate users and verify that they are logged in and active. What you need is a way to determine if the user has the right to delete this topic or not.

You can of course roll your own like this:

  def destroy
    @topic = Topic.find(params[:id])
    if @topic.user_id == current_user.id
      @topic.destroy
      flash[:notice] = "topic deleted!"
    else
      flash[:error] = "not allowed"
    end
  end

(The code assumes you have a belongs_to :creator, :class_name => :user association set up in your Topic.. But you get the idea).

But using something like CanCan will make your life a whole lot easier and would reduce the code to something like this:

  def destroy
    @topic = Topic.find(params[:id])
    authorize! :destroy, @topic
    @topic.destroy
    flash[:notice] = "topic deleted!"
  end

With your ability file (See defining abilities) set up like this:

can :manage, Topic, :owner_id => user.id