how to go about making sure nested resource user id is associated to order

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty{ height:90px;width:728px;box-sizing:border-box;
}

Issue: I can change the user_id of the nested resource url to anything id and it still works. I'm not sure way this is happening and how to avoid this.

thanks to cancancan gem, no1 can see an order that isn't connected to their account for both a buyer and seller.

The issue is, a url, such as,

http://localhost:3000/users/1/orders/1/

can be changed to:

http://localhost:3000/users/121432121423/orders/1/

and the same order still appears.

Nested Route:

  resources :users do

    resources :orders

  end

Models:

order.rb

  belongs_to :buyer, class_name: "User"

  belongs_to :seller, foreign_key: :seller_id, class_name: "User"

user.rb

  has_many :sales, class_name: "Order", foreign_key: "seller_id"

  has_many :purchases, class_name: "Order", foreign_key: "buyer_id"

CanCanCan model ability:
def initialize(user)

  user ||= User.new # guest user (not logged in)

  #Admin

  if user.admin?

    can :manage, :all

  #Seller && Buyer

elsif user.seller? && user.buyer?

      can :manage, Listing, user_id: user.id

      can :read, Listing

      can :manage, Order, buyer_id: user.id

      can :manage, StripeAccount, user_id: user.id

      can :manage, BankAccount, user_id: user.id

      can :manage, User, user_id: user.id



      # can [:read, :update] Order

  #Buyer

      elsif user.buyer?

        can :read, Listing

        can [:create, :read, :edit, :purchases], Order, buyer_id: user.id



  #Guest

      else

        can :read, Listing

        can :create, Order

        can :create, User

      end

    end

Note: a seller is automatically a buyer as buyer boolean is set to true on signup. (seller isn't true and must be verified by admin)

How can I make it so in the rare occurrence when a user does happen to change the user_id number, it will block it and show an error?

Is this a model issue or maybe something that can be defined with cancancan? Or something else perhaps?

asked Nov 25 '18 at 7:00

uno

34819

1

How do you load the order in the controller? Can a user see other users order or should the user_id always match the current_user's id?

– spickermann
Nov 25 '18 at 7:12

Whether it's a seller or a buyer signed in, the user_id should always match the current_user - and no, if i attempt to see another users order it gets blocked by cancancan.

– uno
Nov 25 '18 at 7:48

When you load the order in the controller like this User.find(params[…user_id]).orders.find(params[:id]) or current_user.orders.find(params[:id]) then you can be sure that the order belongs to the user. But I suggest reading about Shallow Nesting in the Rails Guides, because there is actually no need to have both ids in the URL.

– spickermann
Nov 25 '18 at 7:54

I tried previously: @user = current_user.orders.find(params[:id]) - but i get the error "ndefined method `orders' for #<User:01243..." --- before i nested the routes, i had it set up where it was just /orders/id --- do you think its best to not nest them? I was really only doing it to keep the urls in order for organizational sake

– uno
Nov 25 '18 at 7:59

Feels to me like you didn't model the associations between the models correctly or used just some other names. Is there a user_id on an order? Does an order belongs_to :user? Does a user has_many :orders?

– spickermann
Nov 25 '18 at 8:15

|
show 1 more comment

Issue: I can change the user_id of the nested resource url to anything id and it still works. I'm not sure way this is happening and how to avoid this.

thanks to cancancan gem, no1 can see an order that isn't connected to their account for both a buyer and seller.

The issue is, a url, such as,

http://localhost:3000/users/1/orders/1/

can be changed to:

http://localhost:3000/users/121432121423/orders/1/

and the same order still appears.

Nested Route:

  resources :users do

    resources :orders

  end

Models:

order.rb

  belongs_to :buyer, class_name: "User"

  belongs_to :seller, foreign_key: :seller_id, class_name: "User"

user.rb

  has_many :sales, class_name: "Order", foreign_key: "seller_id"

  has_many :purchases, class_name: "Order", foreign_key: "buyer_id"

CanCanCan model ability:
def initialize(user)

  user ||= User.new # guest user (not logged in)

  #Admin

  if user.admin?

    can :manage, :all

  #Seller && Buyer

elsif user.seller? && user.buyer?

      can :manage, Listing, user_id: user.id

      can :read, Listing

      can :manage, Order, buyer_id: user.id

      can :manage, StripeAccount, user_id: user.id

      can :manage, BankAccount, user_id: user.id

      can :manage, User, user_id: user.id



      # can [:read, :update] Order

  #Buyer

      elsif user.buyer?

        can :read, Listing

        can [:create, :read, :edit, :purchases], Order, buyer_id: user.id



  #Guest

      else

        can :read, Listing

        can :create, Order

        can :create, User

      end

    end

Note: a seller is automatically a buyer as buyer boolean is set to true on signup. (seller isn't true and must be verified by admin)

How can I make it so in the rare occurrence when a user does happen to change the user_id number, it will block it and show an error?

Is this a model issue or maybe something that can be defined with cancancan? Or something else perhaps?

asked Nov 25 '18 at 7:00

uno

34819

1

How do you load the order in the controller? Can a user see other users order or should the user_id always match the current_user's id?

– spickermann
Nov 25 '18 at 7:12

Whether it's a seller or a buyer signed in, the user_id should always match the current_user - and no, if i attempt to see another users order it gets blocked by cancancan.

– uno
Nov 25 '18 at 7:48

When you load the order in the controller like this User.find(params[…user_id]).orders.find(params[:id]) or current_user.orders.find(params[:id]) then you can be sure that the order belongs to the user. But I suggest reading about Shallow Nesting in the Rails Guides, because there is actually no need to have both ids in the URL.

– spickermann
Nov 25 '18 at 7:54

I tried previously: @user = current_user.orders.find(params[:id]) - but i get the error "ndefined method `orders' for #<User:01243..." --- before i nested the routes, i had it set up where it was just /orders/id --- do you think its best to not nest them? I was really only doing it to keep the urls in order for organizational sake

– uno
Nov 25 '18 at 7:59

Feels to me like you didn't model the associations between the models correctly or used just some other names. Is there a user_id on an order? Does an order belongs_to :user? Does a user has_many :orders?

– spickermann
Nov 25 '18 at 8:15

|
show 1 more comment

Issue: I can change the user_id of the nested resource url to anything id and it still works. I'm not sure way this is happening and how to avoid this.

thanks to cancancan gem, no1 can see an order that isn't connected to their account for both a buyer and seller.

The issue is, a url, such as,

http://localhost:3000/users/1/orders/1/

can be changed to:

http://localhost:3000/users/121432121423/orders/1/

and the same order still appears.

Nested Route:

  resources :users do

    resources :orders

  end

Models:

order.rb

  belongs_to :buyer, class_name: "User"

  belongs_to :seller, foreign_key: :seller_id, class_name: "User"

user.rb

  has_many :sales, class_name: "Order", foreign_key: "seller_id"

  has_many :purchases, class_name: "Order", foreign_key: "buyer_id"

CanCanCan model ability:
def initialize(user)

  user ||= User.new # guest user (not logged in)

  #Admin

  if user.admin?

    can :manage, :all

  #Seller && Buyer

elsif user.seller? && user.buyer?

      can :manage, Listing, user_id: user.id

      can :read, Listing

      can :manage, Order, buyer_id: user.id

      can :manage, StripeAccount, user_id: user.id

      can :manage, BankAccount, user_id: user.id

      can :manage, User, user_id: user.id



      # can [:read, :update] Order

  #Buyer

      elsif user.buyer?

        can :read, Listing

        can [:create, :read, :edit, :purchases], Order, buyer_id: user.id



  #Guest

      else

        can :read, Listing

        can :create, Order

        can :create, User

      end

    end

Note: a seller is automatically a buyer as buyer boolean is set to true on signup. (seller isn't true and must be verified by admin)

How can I make it so in the rare occurrence when a user does happen to change the user_id number, it will block it and show an error?

Is this a model issue or maybe something that can be defined with cancancan? Or something else perhaps?

asked Nov 25 '18 at 7:00

uno

34819

Issue: I can change the user_id of the nested resource url to anything id and it still works. I'm not sure way this is happening and how to avoid this.

thanks to cancancan gem, no1 can see an order that isn't connected to their account for both a buyer and seller.

The issue is, a url, such as,

http://localhost:3000/users/1/orders/1/

can be changed to:

http://localhost:3000/users/121432121423/orders/1/

and the same order still appears.

Nested Route:

  resources :users do

    resources :orders

  end

Models:

order.rb

  belongs_to :buyer, class_name: "User"

  belongs_to :seller, foreign_key: :seller_id, class_name: "User"

user.rb

  has_many :sales, class_name: "Order", foreign_key: "seller_id"

  has_many :purchases, class_name: "Order", foreign_key: "buyer_id"

CanCanCan model ability:
def initialize(user)

  user ||= User.new # guest user (not logged in)

  #Admin

  if user.admin?

    can :manage, :all

  #Seller && Buyer

elsif user.seller? && user.buyer?

      can :manage, Listing, user_id: user.id

      can :read, Listing

      can :manage, Order, buyer_id: user.id

      can :manage, StripeAccount, user_id: user.id

      can :manage, BankAccount, user_id: user.id

      can :manage, User, user_id: user.id



      # can [:read, :update] Order

  #Buyer

      elsif user.buyer?

        can :read, Listing

        can [:create, :read, :edit, :purchases], Order, buyer_id: user.id



  #Guest

      else

        can :read, Listing

        can :create, Order

        can :create, User

      end

    end

Note: a seller is automatically a buyer as buyer boolean is set to true on signup. (seller isn't true and must be verified by admin)

How can I make it so in the rare occurrence when a user does happen to change the user_id number, it will block it and show an error?

Is this a model issue or maybe something that can be defined with cancancan? Or something else perhaps?

ruby-on-rails ruby

asked Nov 25 '18 at 7:00

uno

34819

asked Nov 25 '18 at 7:00

uno

34819

asked Nov 25 '18 at 7:00

uno

34819

asked Nov 25 '18 at 7:00

uno

34819

asked Nov 25 '18 at 7:00

uno

34819

1

How do you load the order in the controller? Can a user see other users order or should the user_id always match the current_user's id?

– spickermann
Nov 25 '18 at 7:12

Whether it's a seller or a buyer signed in, the user_id should always match the current_user - and no, if i attempt to see another users order it gets blocked by cancancan.

– uno
Nov 25 '18 at 7:48

When you load the order in the controller like this User.find(params[…user_id]).orders.find(params[:id]) or current_user.orders.find(params[:id]) then you can be sure that the order belongs to the user. But I suggest reading about Shallow Nesting in the Rails Guides, because there is actually no need to have both ids in the URL.

– spickermann
Nov 25 '18 at 7:54

I tried previously: @user = current_user.orders.find(params[:id]) - but i get the error "ndefined method `orders' for #<User:01243..." --- before i nested the routes, i had it set up where it was just /orders/id --- do you think its best to not nest them? I was really only doing it to keep the urls in order for organizational sake

– uno
Nov 25 '18 at 7:59

Feels to me like you didn't model the associations between the models correctly or used just some other names. Is there a user_id on an order? Does an order belongs_to :user? Does a user has_many :orders?

– spickermann
Nov 25 '18 at 8:15

|
show 1 more comment

1

How do you load the order in the controller? Can a user see other users order or should the user_id always match the current_user's id?

– spickermann
Nov 25 '18 at 7:12

Whether it's a seller or a buyer signed in, the user_id should always match the current_user - and no, if i attempt to see another users order it gets blocked by cancancan.

– uno
Nov 25 '18 at 7:48

When you load the order in the controller like this User.find(params[…user_id]).orders.find(params[:id]) or current_user.orders.find(params[:id]) then you can be sure that the order belongs to the user. But I suggest reading about Shallow Nesting in the Rails Guides, because there is actually no need to have both ids in the URL.

– spickermann
Nov 25 '18 at 7:54

I tried previously: @user = current_user.orders.find(params[:id]) - but i get the error "ndefined method `orders' for #<User:01243..." --- before i nested the routes, i had it set up where it was just /orders/id --- do you think its best to not nest them? I was really only doing it to keep the urls in order for organizational sake

– uno
Nov 25 '18 at 7:59

Feels to me like you didn't model the associations between the models correctly or used just some other names. Is there a user_id on an order? Does an order belongs_to :user? Does a user has_many :orders?

– spickermann
Nov 25 '18 at 8:15

How do you load the order in the controller? Can a user see other users order or should the user_id always match the current_user's id?

– spickermann
Nov 25 '18 at 7:12

Whether it's a seller or a buyer signed in, the user_id should always match the current_user - and no, if i attempt to see another users order it gets blocked by cancancan.

– uno
Nov 25 '18 at 7:48

When you load the order in the controller like this User.find(params[…user_id]).orders.find(params[:id]) or current_user.orders.find(params[:id]) then you can be sure that the order belongs to the user. But I suggest reading about Shallow Nesting in the Rails Guides, because there is actually no need to have both ids in the URL.

– spickermann
Nov 25 '18 at 7:54

I tried previously: @user = current_user.orders.find(params[:id]) - but i get the error "ndefined method `orders' for #<User:01243..." --- before i nested the routes, i had it set up where it was just /orders/id --- do you think its best to not nest them? I was really only doing it to keep the urls in order for organizational sake

– uno
Nov 25 '18 at 7:59

Feels to me like you didn't model the associations between the models correctly or used just some other names. Is there a user_id on an order? Does an order belongs_to :user? Does a user has_many :orders?

– spickermann
Nov 25 '18 at 8:15

|
show 1 more comment

0

active

oldest

votes

Your Answer

StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});

}
});

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53465368%2fhow-to-go-about-making-sure-nested-resource-user-id-is-associated-to-order%23new-answer', 'question_page');
}
);

Post as a guest

Name

Required, but never shown

0

active

oldest

votes

0

active

oldest

votes

draft saved

draft discarded

Thanks for contributing an answer to Stack Overflow!

Please be sure to answer the question. Provide details and share your research!

But avoid …

Asking for help, clarification, or responding to other answers.

Making statements based on opinion; back them up with references or personal experience.

To learn more, see our tips on writing great answers.

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Name

Required, but never shown

Name

Required, but never shown

This page is only for reference, If you need detailed information, please check here

搜尋此網誌

Wsrtjtyk