Rails Comments User + Id

Question

In my Rails app, I have a comments scaffold which lets users comment on a movie.

I am faced with two problems.

The first problem is that anyone can create a comment, even if they are not signed in, how would I assign a comment to a user, so if there is a current_user , they can create a comment and I would be able to assign the user to the comment so <%= comment.user.first_name %>, and if they are not signed in, they cant create a comment. How would i do this? ( I am using devise )

The second problem is that when I create a comment, it takes me to this path (where 12 is :movie_id)

localhost:3000/movies/12/comments/new

This is fine but when i am creating the comment, I have to specify the movie_id (12), how this be done automatically, so rails sees that the movie_id for the comment is 12.

My Comments Controller, incase needed

class CommentsController < ApplicationController
  # GET /comments
  # GET /comments.json
  before_filter :load_movie


  def index
    @comments = @movie.comments.all
    @search = Movie.search(params[:q])

    respond_to do |format|
      format.html # index.html.erb
      format.json { render json: @comments }
    end
  end

  # GET /comments/1
  # GET /comments/1.json
  def show
    @comment = Comment.find(params[:id])
    @search = Movie.search(params[:q])

    respond_to do |format|
      format.html # show.html.erb
      format.json { render json: @comment }
    end
  end

  # GET /comments/new
  # GET /comments/new.json
  def new
    @comment = Comment.new
    @search = Movie.search(params[:q])

    respond_to do |format|
      format.html # new.html.erb
      format.json { render json: @comment }
    end
  end

  # GET /comments/1/edit
  def edit
    @comment = Comment.find(params[:id])
    @search = Movie.search(params[:q])

  end

  # POST /comments
  # POST /comments.json
  def create
    @comment = Comment.new(params[:comment])
    @search = Movie.search(params[:q])

    respond_to do |format|
      if @comment.save
        format.html { redirect_to :back }
        format.json { render json: @comment, status: :created, location: @comment }
      else
        format.html { render action: "new" }
        format.json { render json: @comment.errors, status: :unprocessable_entity }
      end
    end
  end

  # PUT /comments/1
  # PUT /comments/1.json
  def update
    @comment = Comment.find(params[:id])
    @search = Movie.search(params[:q])

    respond_to do |format|
      if @comment.update_attributes(params[:comment])
        format.html { redirect_to (@movie), notice: 'Comment was successfully updated.' }
        format.json { head :no_content }
      else
        format.html { render action: "edit" }
        format.json { render json: @comment.errors, status: :unprocessable_entity }
      end
    end
  end

  # DELETE /comments/1
  # DELETE /comments/1.json
  def destroy
    @comment = Comment.find(params[:id])
    @comment.destroy

    respond_to do |format|
      format.html { redirect_to comments_url }
      format.json { head :no_content }
    end
  end

private
    def load_movie
      @movie = Movie.find_by_id(:movie_id)
    end


end

Answer 1

First:
using devise, you can request that a user is signed in by saying at the top of your controller:

before_filter :authenticate_user!, only: [:new,:create]

so if someone not signed in tries to access these actions, they are redirected to the sign in page and after sign in forwarded to the original request.

Second:
As you can see from the routes, 12 is assigned to params[:movie_id]. So in your controllers new action write:

@movie = Movie.find(params[:movie_id])
@comment = @movie.comments.new
@comment.user=current_user