How to associate user to orders - ruby-on-rails

Question

Only the admin can create orders. The orders are assigned to a user by user_id. On a users profile page, is the only place where a user can see only their records. I have a feeling the problem is with my controller.
class OrdersController < ApplicationController
before_action :set_order, only: [:show, :edit, :update, :destroy]
# GET /orders
# GET /orders.json
def index
#orders = Order.all
end
# GET /orders/1
# GET /orders/1.json
def show
end
# GET /orders/new
def new
#order = User.find_by(params[:id]).orders.build
end
# GET /orders/1/edit
def edit
end
# POST /orders
# POST /orders.json
def create
#order = current_user.orders.build(order_params)
respond_to do |format|
if #order.save
format.html { redirect_to #order, notice: 'Order was successfully created.' }
format.json { render :show, status: :created, location: #order }
else
format.html { render :new }
format.json { render json: #order.errors, status: :unprocessable_entity }
end
end
end
# PATCH/PUT /orders/1
# PATCH/PUT /orders/1.json
def update
respond_to do |format|
if #order.update(order_params)
format.html { redirect_to #order, notice: 'Order was successfully updated.' }
format.json { render :show, status: :ok, location: #order }
else
format.html { render :edit }
format.json { render json: #order.errors, status: :unprocessable_entity }
end
end
end
# DELETE /orders/1
# DELETE /orders/1.json
def destroy
#order.destroy
respond_to do |format|
format.html { redirect_to orders_url, notice: 'Order was successfully destroyed.' }
format.json { head :no_content }
end
end
private
# Use callbacks to share common setup or constraints between actions.
def set_order
#order = Order.find(params[:id])
end
# Never trust parameters from the scary internet, only allow the white list through.
def order_params
params.require(:order).permit(:service, :charge, :user_id)
end
end
This is my users's controller
class UsersController < ApplicationController
def index
#users = User.all
end
def new
#user = User.new
end
def create
customer = Stripe::Customer.create(
:email => 'example#stripe.com',
:card => params[:stripeToken]
)
rescue Stripe::CardError => e
flash[:error] = e.message
redirect_to charges_path
end
def admin_dashboard
#users = User.all
end
def show
end
def edit
end
def update
if params[:user][:password].blank?
params[:user].delete(:password)
params[:user].delete(:password_confirmation)
end
token = params[:stripeToken]
customer = Stripe::Customer.create(
card: token,
email: current_user.email
)
current_user.stripeid = customer.id
current_user.save
redirect_to dashboard_path
end
def payment
end
def destroy
end
private
def user_params
params.require(:user).permit( :stripe_card_token, :avatar, :first_name, :last_name, :country_code, :phone_number,:home_adress,:work_address, :email, :password, :current_password)
end
end
Model User
class User < ActiveRecord::Base
# Include default devise modules. Others available are:
# :confirmable, :lockable, :timeoutable and :omniauthable
devise :database_authenticatable, :registerable,
:recoverable, :rememberable, :trackable, :validatable
has_many :orders
end
Order Model
class Order < ActiveRecord::Base
belongs_to :user
end
Profile Page
<div class = 'container'>
<table class="table table-hover" style = 'width: 70%'>
<thead>
<tr>
<th> ID </th>
<th> Date </th>
<th>Service</th>
<th>Charge</th>
<th>Feedback</th>
</tr>
</thead>
<tbody>
<% Order.all.each do |orders| %>
<tr>
<td><%= orders.user.id %></td>
<td><%= orders.created_at %></td>
<td><%= orders.service %></td>
<td><%= orders.charge %></td>
</tr>
<%end%>
If I'm missing anything please let me know. I'm not sure how I would associate the admin class to all of this.