Confused about nested resources and authentication in Rails - ruby-on-rails

Question

Let's see if I can explain myself well enough about the doubts I have.
I have a User model that is managed by Devise. So in my routes I have:
devise_for :users
In the User model, I have an association with the model Plan. The assocation is:
User has_many Plans
Plan belongs_to User
At this point I also have a resource for the Plan model, so I can fetch all the Plans, show a particular plan and so on. But I want to go further.
I want to be able to see plans of a particular User and let a particular User to see his own plans and edit them.
So, for example, whenever I go to:
/users/:id/plans
I want to be able to see the plans for that particular :id user. And if the user who is visiting that url is the one that is logged in, I want him to be able to edit those plans.
How can I manage all this behavior? Is there any gem out there that helps with it? Or I need to do conditionals in the views saying if current_user...

Answer 1

Let's start with routes, you can make your routes like this:
resources :users do
resources :plans, only: [:index]
end
resources :plans, except: [:index]
I used resources :plans inside resources :users to have route like this /users/:user_id/plans, while the resources :plans outside is for the rest of the actions (edit, destroy, ...) that don't require a user_id, i.e., a plan is identified by a unique id so you don't need a user_id to fetch it from the db for editing or destroying.
Now for the controller, we can make it like this:
class PlansController < ApplicationController
before_filter :is_plan_owner?, only: [:edit, :update]
def index
#plans = Plan.where(:user_id => params[:user_id])
end
def edit
#plan = Plan.find(params[:id])
end
private
def is_plan_owner?
if current_user != Plan.find(params[:id]).user
# Scream, shout, call 911 and/or redirect else where
end
end
end

Answer 2

This is no different than using any other nested resource. The call to devise_for in the routes.rb file does not provide RESTful routing to the user model. Think about it without the nested resource for a minute, with just a standard Devise install. If you were to rake routes you would get something similar to the following:
new_user_session GET /users/sign_in(.:format) devise/sessions#new
user_session POST /users/sign_in(.:format) devise/sessions#create
user_password POST /users/password(.:format) devise/passwords#create
new_user_password GET /users/password/new(.:format) devise/passwords#new
edit_user_password GET /users/password/edit(.:format) devise/passwords#edit
sign_in GET /sign_in(.:format) devise/sessions#new
This provides nothing for indexing or showing users, so you would still need to add routes for that:
resources :users, only: [:index, :show]
Now you get:
users GET /users(.:format) users#index
user GET /users/:id(.:format) users#show
Ok, now we're getting somewhere, then it's simply adding the nested resource, all the while Devise pays it no mind.
resources :users, only: [:index, :show] do
resources :plans
end
Which gives you the resourceful routing you desire
user_plans GET /users/:user_id/plans(.:format) plans#index
POST /users/:user_id/plans(.:format) plans#create
new_user_plan GET /users/:user_id/plans/new(.:format) plans#new
edit_user_plan GET /users/:user_id/plans/:id/edit(.:format) plans#edit
user_plan GET /users/:user_id/plans/:id(.:format) plans#show
PUT /users/:user_id/plans/:id(.:format) plans#update
DELETE /users/:user_id/plans/:id(.:format) plans#destroy
And that's really all there is to it. Devise stays out of your way on this one.