Passing an id to create review - ruby-on-rails

Question

Im attempting to pass user_id and a game_id to create a review. I can get it to work if I just select the game_id in a dropdown, but unable to pass the game_id correctly...
here is my code for the form
<div class="field form-group">
<%= form.number_field :user_id, id: :review_user_id, class:"form-control", value: current_user.id, type: :hidden %>
</div>
<div class="field form-group">
<%= form.number_field :game_id, id: :review_game_id, class:"form-control", value: #game_id, type: :hidden %>
</div>
My Reviews Controller
ReviewsController
....
def new
#review = current_user.reviews.build
end
def create
#review = current_user.reviews.build(review_params)
respond_to do |format|
if #review.save
format.html { redirect_to #review, notice: 'Review was successfully created.' }
format.json { render :show, status: :created, location: #review }
else
format.html { render :new }
format.json { render json: #review.errors, status: :unprocessable_entity }
end
end
end
def review_params
params.require(:review).permit(:reviewed_game, :rating, :game_id, :user_id)
Pretty sure it has to do with something in my Controller, im not passing something correctly. I attempted to do something like this with my GameController:
def create
#game = Game.new(params[:review])
...
end
no luck, Im pretty green to RoR...any help would be great!
Thanks

Answer 1

Welcome to Rails!
Looks to me like you're not setting #game_id anywhere, so that value will be nil, and thus an empty value tag in your HTML. So when the form is submitted, no :game_id will be in your params.
What you're trying to build sounds like a great case for nested resources.
In your config/routes.rb you would have something like
resources :games do
resources :reviews
end
So when you visit a URL like "/games/123/reviews/new", you'll hit the ReviewsController but there'll be a params[:game_id] equal to 123.
Your ReviewsController would look something like this
class ReviewsController < ApplicationController
def new
#game = Game.find(params[:game_id])
#review = current_user.reviews.new
end
def create
#review = current_user.reviews.new(review_params)
#game = Game.find(params[:game_id])
#review.game = #game
if #review.save
# etc.
end
end
Your reviews/new view template would have a form that points to this nested URL.
I believe you can do that with form_with
So, something like:
form_with model: [#game, #review] do |f|
# form code
When you run current_user.reviews.new, the Review instance will automatically have the :user_id attribute assigned. So you don't need to have the user_id floating around in your params, which as max points out, is a security flaw.
Similarly, #review.game = #game should assign the correct game_id.
By taking this approach, the only real information you need from the user is the rating, your routes will handle the Game in question, and Devise's current_user will handle the User.
I hope this helps in some way. Persistence is fruitful. 🍇