Rails 5.1, search scope within a group - ruby-on-rails

Question

I have a little issue with a search scope.
Users can join groups by providing a token. User can also create spendings and they can share them in a group. We are in the show view of a group. This is where I loop through spendings that each user has in this group. It looks something like that :
<% group_spendings_paginate_search.each do |groupspending| %>
<%= groupspending.member.user.firstname %>
<%= groupspending.spending.title %>
<%= groupspending.spending.description %>
<%= '%.02f' % groupspending.spending.amount %>
<%= groupspending.spending.currency.symb %>
<%= groupspending.created_at.strftime("%d/%m/%Y") %>
<% end %>
The group_spendings_paginate_search comes from a helper which represent this :
def group_spendings_paginate_search
#search.scope.order('created_at DESC').paginate(:page => params[:page], :per_page => 10)
end
The search form looks like this and is just above the loop :
<%= form_tag group_path(#group), method: :get do %>
<%= date_field_tag "search[date_from]", #search.date_from %>
<%= date_field_tag "search[date_to]", #search.date_to %>
<%= select_tag "search[user_id]", options_from_collection_for_select(#group.users.all, :id, :firstname, params[:user_id]), include_blank: "All Users" %>
<%= select_tag "search[currency_id]", options_from_collection_for_select(Currency.all, :id, :name, params[:currency_id]), include_blank: "All Currencies" %>
<%= submit_tag "Search", name: nil %>
<% end %>
Note that here I had to go for Currency.all which is not the currencies the user are using. They may only use euro for example and here the all list is going to pop, which is also not very cool. Would prefer to show only the currencies the users are using according to the group and spending. But hey it's already complicated enough so for now I'll keep it simple and come back on that later. But if anybody has a idea, feel free.
My controller :
def show
#search = GroupspendingSearch.new(params[:search])
end
And finally my GroupspendingSearch.rb
class GroupspendingSearch
attr_reader :date_from, :date_to, :user_id, :currency_id
def initialize(params)
params ||= {}
#date_from = parsed_date(params[:date_from], 1.month.ago.to_date)
#date_to = parsed_date(params[:date_to], Date.tomorrow)
#user_id = params[:user_id]
#currency_id = params[:currency_id]
end
def scope
launch = Groupspending.where('groupspendings.created_at BETWEEN ? AND ?', #date_from, #date_to)
launch = launch.where(member_id: find_member) if find_member.exists?
launch = launch.where(spending_id: find_currency) if find_currency.exists?
launch
end
private
def parsed_date(date_string, default)
Date.parse(date_string)
rescue ArgumentError, TypeError
default
end
def find_member
Member.where(user_id: #user_id)
end
def find_currency
Spending.where(currency_id: #currency_id)
end
end
The scope as is is actually working. Only problem is that it goes for all the Groupspending and not #group.groupspendings. It means that if I go in any group I will see all the spendings and I want to avoid that of course. Also I had to be smart about how I find the user_id and the currency_id. Using the table Groupspending gives me only member_id and spending_id. With the group_id or token in this model everything would be way easier...
Basically I don't know how to specify in the scope to look for the #group if this makes any sense.
I thought about a couple of things. The first is in the controller and specify a other param like so #search = GroupspendingSearch.new(params[:search],#group) and add it in the model def initialize(params, group) but to be honnest I don't really know what I'm doing so yea...
I'm dry here, anybody to help ? Maybe I'm totally wrong here and there is a other approach.
Models relations (don't pay attention to link and notification, it's a other story ^^) :
class Currency < ApplicationRecord
has_many :spendings, dependent: :destroy
has_many :users, through: :spendings
end
class Group < ApplicationRecord
has_secure_token :auth_token
has_many :members, :dependent => :destroy
has_many :users, through: :members, source: :user
belongs_to :owner, class_name: "User"
has_many :links, through: :grouplinks
has_many :grouplinks, through: :members
has_many :spendings, through: :groupspendings
has_many :groupspendings, through: :members
has_many :notifications, dependent: :destroy
def to_param
auth_token
end
end
class Groupspending < ApplicationRecord
belongs_to :spending
belongs_to :member
end
class Member < ApplicationRecord
belongs_to :user
belongs_to :group
has_many :grouplinks, dependent: :destroy
has_many :groupspendings, dependent: :destroy
validates :user_id, :presence => true
validates :group_id, :presence => true
validates :user_id, :uniqueness => {:scope => [:user_id, :group_id]}
end
class Spending < ApplicationRecord
belongs_to :user
belongs_to :currency
has_many :groupspendings, dependent: :destroy
end
class User < ApplicationRecord
has_secure_password
has_many :spendings, dependent: :destroy
has_many :currencies, through: :spendings
has_many :links, dependent: :destroy
has_many :notifications, dependent: :destroy
has_many :members, :dependent => :destroy
has_many :groups, :through => :members
has_one :owned_group, foreign_key: "owner_id", class_name: "Group"
end
EDIT :
Well I just realized that actually the scope isn't correct... I look for member_id: find_member and this goes for all the member with a member_id: X. Which means that if a user is a member of many groups well... it shows multiple entries. I'm getting crazy ^^

Answer 1

Ok I think I got it but I want to be sure that there is no mistake or security issues...
Here is what I changed :
Helper
def group_spendings_paginate_search
m = Member.where(group_id: #group.id)
gs = Groupspending.where(member_id: m)
#search.scope.where(member_id: gs.all.map(&:member_id) ).order('created_at DESC').paginate(:page => params[:page], :per_page => 10)
end
I didn't change the view and didn't change the GroupspendingSearch either. With this new helper I retrieve only the members within the group which "blocks" the search query to that. I guess...
I don't know if it's the best, and I don't know if it's safe. In the URL if I try to change the user_id to someone else, if he/she is not part of the group it doesn't show up. So it looks ok. Of course I have to secure the show view by restricting only to the members of the group. But appart from that, would that be ok ?