Rails 4: internal messaging system

Question

I'm trying to write a simple messaging system for signed up users. I realize there are gems for this but I'm trying to roll my own simpler one.

I've set up my models as follows:

class Conversation < ActiveRecord::Base
  has_many :messages, dependent: :destroy
  belongs_to :sender, class_name: "User"
  belongs_to :receiver, class_name: "User"
  validates_presence_of :sender_id, :receiver_id
end

class Message < ActiveRecord::Base
  belongs_to :conversation
end

class User < ActiveRecord::Base
  has_many :conversations, foreign_key: "sender_id"
  has_many :recipients, through: :conversations, source: :receiver
end

I've set my routes and controller up so that I can make new conversations, and add messages to those conversations. However, I'm trying to figure out how I can make it so that only a logged in user can start a conversation with ONE other user. No other users should be able to access that conversation.

Is this a permissions (cancan) thing or should this be defined by some controller logic?

Thanks!

Answer 1

This should be defined in controller logic such that only users who are conversing get access to the conversation between them. The two users info (mainly their user ids) should be stored along with conversation, so that the restriction can be applied.