Ruby Rails Path Show All Item by User - ruby-on-rails

Question

A RoR beginner here. I am trying to implement a page 'My Products' to show all products added by current user. Currently I have set my 'All Products' page as my index root "products#index". My Product has Controller but my User does not not Controller because I am using Devise. I have a few questions which I still couldnt get it right.
Because currently
Product
belongs_to :user
User
has_many :products
routes
devise_for :users
resources :products
rake routes I have
new_user_session GET /users/sign_in(.:format) devise/sessions#new
user_session POST /users/sign_in(.:format) devise/sessions#create
destroy_user_session DELETE /users/sign_out(.:format) devise/sessions#destroy
user_password POST /users/password(.:format) devise/passwords#create
new_user_password GET /users/password/new(.:format) devise/passwords#new
edit_user_password GET /users/password/edit(.:format) devise/passwords#edit
PATCH /users/password(.:format) devise/passwords#update
PUT /users/password(.:format) devise/passwords#update
cancel_user_registration GET /users/cancel(.:format) devise/registrations#cancel
user_registration POST /users(.:format) devise/registrations#create
new_user_registration GET /users/sign_up(.:format) devise/registrations#new edit_user_registration GET /users/edit(.:format) devise/registrations#edit
PATCH /users(.:format) devise/registrations#update
PUT /users(.:format) devise/registrations#update
DELETE /users(.:format) devise/registrations#destroy
products GET /products(.:format) products#index
POST /products(.:format) products#create
new_product GET /products/new(.:format) products#new
edit_product GET /products/:id/edit(.:format) products#edit
product GET /products/:id(.:format) products#show
PATCH /products/:id(.:format) products#update
PUT /products/:id(.:format) products#update
DELETE /products/:id(.:format) products#destroy
Currently what I have in mind to achieve this:
Create a UserController to have #user = User.all then because with association I can use #user.product. (I saw some people said that I shouldn't create new controller because of Devise?) However, I tried to test with rails console before doing the implementation.
product = Product.first
product.user #here I get all details about user
user = User.first
user.product #here I get error. Why it works for product to find user but not both ways?
Next, this then makes me wonder how do I create configure the route to get path /users/:id/products . Should I use a nested resource?
Next question, I tried to have
resources :users do
resources :products
end
resources :products
I typed in rake routes again. I am confused
user_products GET /users/:user_id/products(.:format) products#index
products GET /products(.:format) products#index
Question:
Can 2 path has the same Controller#Action?
user_products_path and products_path are 2 different path where user_products_path represents user's product. and products_path represents all products
Sorry for the long post.I really wish to clarify those things. Thanks a lot if you could help!! :)

Answer 1

user.product #here I get error. Why it works for product to find user but not both ways?
As User has_many :products, you need to use correct association name as:
user.products # it will give you all products of an user
Can 2 path has the same Controller#Action?
In short, YES. You can specify controller and action name explicitly in your route.rb like:
get 'users/:id/products' => 'products#index', :as => :user_products_path
Note that in your case, it will be going into products#index by default also.
user_products_path and products_path are 2 different path where user_products_path represents user's product. and products_path represents all products
Correct, it's absolutely fine. As you are using devise, you don't need to use id parameter coming from the URL i.e. users/:id/products. You can get the user directly from current_user, which is better in terms of security also. Keep in mind that if you have admin role who can see details of every user then you will need to manage id in that case.

Answer 2

Because you're just starting out, I'll keep this example simple with having easy to read logic. However, there are better ways to configure and optimize this so that you're not relying on if statements in your controller.
class ProductsController < ApplicationController
def index
if params[:user_id]
#user = User.find(params[:user_id])
#products = #user.products.all
else
#products = Product.all
end
end
end
One reason why this is bad practice is that you're relying on the user_id param to be valid. If the user_id param is not valid, then the second line #products = #user.products.all will return undefined method for Nil class.
Also, in your views, if you reference #user then you will get an error if you're just listing out all products.
Also, there isn't any security being done where anyone can see anyone's products if they know or try to guess the user's id.
However, this should work in your instance. You may also want to consider that if the user_id is present to then call current_user.products.all so that it will only return the current user's products instead of the particular user_id's. However, it is really up to how you're designing the application that will determine the best route to take.
What I'll typically do is if the /products route should be for the administrative level, I'll namespace it and put the appropriate security around the namespacing so that it does not allow general users to access it, but rather only administrators of the site.