user can only delete/edit what he/she posted? not all posts - ruby-on-rails

Question

How do I make it so the user can only delete/edit what he/she posted? and not all posts? My current songs_controller only has authorization which allows users to edit, destroy, update once they're signed in. The problem is, all users can edit all posts. That said, how can I allow just the user to edit his/her own posts? and not have access to that functionality with others posts?
songs_controller.rb
class SongsController < ApplicationController
before_action :set_song, only: [:show, :edit, :update, :destroy]
before_filter :authorize, only: [:create ,:edit, :update, :destroy]
# GET /Songs
# GET /Songs.json
def index
#songs = Song.all
end
# GET /Songs/1
# GET /Songs/1.json
def show
end
# GET /Songs/new
def new
#song = Song.new
end
# GET /Songs/1/edit
def edit
end
# POST /Songs
# POST /Songs.json
def create
#song = Song.new(song_params)
respond_to do |format|
if #song.save
format.html { redirect_to #song, notice: 'Song was successfully created.' }
format.json { render action: 'show', status: :created, location: #song }
else
format.html { render action: 'new' }
format.json { render json: #song.errors, status: :unprocessable_entity }
end
end
end
# PATCH/PUT /Songs/1
# PATCH/PUT /Songs/1.json
def update
respond_to do |format|
if #song.update(Song_params)
format.html { redirect_to #song, notice: 'Song was successfully updated.' }
format.json { head :no_content }
else
format.html { render action: 'edit' }
format.json { render json: #song.errors, status: :unprocessable_entity }
end
end
end
# Song /Songs/1
# Song /Songs/1.json
def destroy
#song.destroy
respond_to do |format|
format.html { redirect_to songs_url }
format.json { head :no_content }
end
end
private
def set_song
#song = Song.find(params[:id])
end
def song_params
params.require(:song).permit(:title, :artist, :bio, :track)
end
end

Answer 1

You most likely have some sort of User model that users are able to authenticate to. Try adding a has_many :songs association on your User model. Add a foreign key called user_id on the Song model along with a belongs_to :user. Migrate. Pull the user's id from the current_user helper and do the following:
#user = User.find(current_user.id)
#songs = #user.songs #will give you only the songs the user added
Here is a good guide to reference:
http://guides.rubyonrails.org/association_basics.html

Answer 2

if you only want the user to see the posts they have made then what jbearden suggests would work well although it doesn't prevent someone from accessing the delete or update etc from the address line manually which is bad.
if you want the user to see all songs but only have the option to delete etc on their own songs then you probably want to have the view only show the edit and delete links for songs owned by the user (which would use jbearden's idea of makign an association for the songs to users) - that helps with the UI but still doesn't solve your authentication problem.
the authentication can be handled by using the cancan gem (see railscasts on this - Ryan is the author of the gem). cancan takes some getting used to for configuring it but works quite well for controlling whether a given user can view, edit, delete etc objects (like your songs).
good luck!