How to allow users delete their own comments and not others

Question

In my Rails App, I have a comment model ,a devise user model and a tales model. For each tales post , I have comments posted by signed-in users.The problem here is every other logged in user is able to delete the comments of other user.I want a functionality such that only the user who created the comments can delete it.

My user.rb is here

class User < ActiveRecord::Base
has_one :profile, dependent: :destroy
has_many :tales, dependent: :destroy
end

My comment.rb is here

class Comment < ActiveRecord::Base
belongs_to :tale
end

My tale.rb is here

class Tale < ActiveRecord::Base
belongs_to :user
has_many :comments, dependent: :destroy
belongs_to :category
end

My routes.rb is as follows

Rails.application.routes.draw do
get 'tales/index'


devise_for :users, controllers: { registrations: "registrations" }
resources :profiles
resources :tales do
  resources :comments
end
resources :categories
authenticated :user do
  root "tales#index"
end

unauthenticated :user do
  get "/" => "tales#index"
end
end

My comment controller is here:

class CommentsController < ApplicationController
before_action :authenticate_user!

def create
    @tale = Tale.find(params[:tale_id])
    @comment = @tale.comments.create(comment_params)

    redirect_to tale_path(@tale)
end

def destroy
    @tale = Tale.find(params[:tale_id])
    @comment = @tale.comments.find(params[:id])
    @comment.destroy   
end

private

def comment_params
    params.require(:comment).permit(:name, :body, :tale_id)
end

end

The excerpt from my tales/show page to add comments is here:

<div id="comments">
    <h2><%= @tale.comments.count %> Comments</h2>
    <%= render @tale.comments %>

    <h3>Add a comment:</h3>
    <%= render "comments/form" %>

</div>
</div>

My _comment.html.erb is here

<div class="comment clearfix">
<div class="comment_content">
    <p class="comment_name"><strong><%= comment.name %></strong></p>
    <p class="comment_body"><%= comment.body %></p>
    <p class="comment_time"><%= time_ago_in_words(comment.created_at) %> 
Ago</p>
</div>

  <% if user_signed_in? %>
 <p><%= link_to 'Delete', [comment.tale, comment], method: :delete, data: 
 { confirm: 'Are you sure?' } %></p>
  <% end %> 

 </div>

I see no connection between user and comments and I dont the right way to do it here.Can someone guide me through this such that I can do so without using any gems .

Answer 1

You don't appear to have a relationship between Comment and User . You would need something like this in your Comment class assuming you are storing the user_id for each comment:

  belongs_to :user

Then in your CommentsController your destroy method should be something like this:

  def destroy
    # Only the comments posted by that user will be returned
    @comment = @user.comments.find(params[:id])
    @comment.destroy   
  end

Answer 2

Add use_id in comments table if don't have

add_column :comments, :user_id, :integer

in your view file put following condition. Delete link will only visible to user who added comment.

<% if user_signed_in? && current_user.id == comment.user_id %>
 <p><%= link_to 'Delete', [comment.tale, comment], method: :delete, data: 
 { confirm: 'Are you sure?' } %></p>
 <% end %>