不顯示要登錄用戶的公共帖子-Rails

Question

我正在使用此應用程序 ，唯一的問題是，當用戶登錄時，即使他們沒有創建它，他們也可以看到公開的帖子。

有沒有辦法讓它不會與其他用戶的帖子一起顯示？

該應用程序的重點是用戶可以登錄並創建帖子，默認情況下這些帖子是私人的，這意味着只有他們可以看到它，如果用戶將該帖子設為公開，我希望它是未登錄或已登錄用戶可以查看，但是，這正是我所擁有的，但是所有公開帖子都與其他用戶的帖子一起顯示。

這是應用程序控制器：

class ApplicationController < ActionController::Base
  protect_from_forgery
  rescue_from ActiveRecord::RecordNotFound, :with => :handle_not_found

    def handle_not_found
      respond_to do |type|
        type.html { redirect_to root_path, :notice => 'Record not found'}
        type.all  { render :nothing => true, :status => 404 }
      end
      true
    end
end

這是后控制器：

class PostsController < ApplicationController

  before_filter :authenticate_user!, :except => [:index, :show]

  # GET /posts
  # GET /posts.json
  def index
    @posts = current_user ? Post.public_or_owned_by(current_user) : nil
    render :template => current_user ? 'posts/index_logged_in' : 'posts/index_not_logged_in'
  end

  # GET /posts/1
  # GET /posts/1.json
  def show
    @post = current_user ? Post.public_or_owned_by(current_user).find_by_url_id!(params[:id]) : Post.public.find_by_url_id!(params[:id])

    respond_to do |format|
      format.html # show.html.erb
      format.json { render json: @post }
    end
  end

  # GET /posts/new
  # GET /posts/new.json
  def new
    @post = Post.new

    respond_to do |format|
      format.html # new.html.erb
      format.json { render json: @post }
    end
  end

  # GET /posts/1/edit
  def edit
    @post = current_user.posts.find_by_url_id(params[:id])
  end

  # POST /posts
  # POST /posts.json
  def create
    @post = current_user.posts.build(params[:post])

    respond_to do |format|
      if @post.save
        format.html { redirect_to @post, notice: 'Post was successfully created.' }
        format.json { render json: @post, status: :created, location: @post }
      else
        format.html { render action: "new" }
        format.json { render json: @post.errors, status: :unprocessable_entity }
      end
    end
  end

  # PUT /posts/1
  # PUT /posts/1.json
  def update
    @post = current_user.posts.find_by_url_id(params[:id])

    respond_to do |format|
      if @post.update_attributes(params[:post])
        format.html { redirect_to @post, notice: 'Post was successfully updated.' }
        format.json { head :no_content }
      else
        format.html { render action: "edit" }
        format.json { render json: @post.errors, status: :unprocessable_entity }
      end
    end
  end

  # DELETE /posts/1
  # DELETE /posts/1.json
  def destroy
    @post = current_user.posts.find_by_url_id(params[:id])
    @post.destroy

    respond_to do |format|
      format.html { redirect_to posts_url }
      format.json { head :no_content }
    end
  end
end

這是帖子模型：

class Post < ActiveRecord::Base
  belongs_to :user
  before_create :generate_url_id

  attr_accessible :title, :body, :is_public

  scope :public, where(:is_public => true)

  def self.public_or_owned_by(user)
    t = Post.arel_table
    Post.where(t[:user_id].eq(user.id).or(t[:is_public].matches(true)))
  end

  def generate_url_id
    self.url_id = SecureRandom.urlsafe_base64
  end

  def to_param
    self.url_id
  end

end

這是用戶模型：

class User < ActiveRecord::Base
  # Include default devise modules. Others available are:
  # :token_authenticatable, :confirmable,
  # :lockable, :timeoutable and :omniauthable
  devise :database_authenticatable, :registerable,
         :recoverable, :rememberable, :trackable, :validatable

  # Setup accessible (or protected) attributes for your model
  attr_accessible :email, :password, :password_confirmation, :remember_me
  # attr_accessible :title, :body
  has_many :posts
end

Answer 1

仍然不確定我是否了解您想要什么，但是我會使用兩種不同的路線：

 resources :posts     # see all public posts from everyone
 resources :users do
   resources :posts   # nested route for a user to only see his own posts
 end

因此，在您的控制器中，您將擁有：

 def index
   if params[:user_id]
     if current_user && current_user.id == params[:user_id].to_i
       # see all posts for a user, even non-public ones
       @posts = Post.where( user_id: params[:user_id] ) 
     else
       # see public posts from a user
       @posts = Post.public.where( user_id: params[:user_id] )
     end
   else
     # see all public posts
     @posts = Post.public 
   end
 end

這不是您可以做的最好的事情，但是它是功能性的。 更好的方法是使用諸如CanCan之類的授權機制。