如何使嵌套资源受限制

Question

所以我有我的网络应用程序设置允许用户创建一个只能由他们的团队看到的项目。在项目中，可以创建任务。我希望这些任务仅限于其创建的项目。但是，当我创建两个单独的项目并导航到视图屏幕时，我在每个项目下看到相同的任务。

TasksController

def index 
    project = Project.find(params[:project_id]) 

    @task = project.tasks 

    respond_to do |format| 
    format.html # index.html.erb 
    format.xml { render :xml => @tasks } 
    end 
    @task = Task.order('title').page(params[:page]).per(4) 
end 

def show 
    project = Project.find(params[:project_id]) 

    @task = project.tasks.find(params[:id]) 

    respond_to do |format| 
    format.html # show.html.erb 
    format.xml { render :xml => @task } 
    end 
end 

ProjectsController

def index 
    @project = current_account.projects 
end 

def show 
    @project = current_user.projects.find(params[:project_id]) 
end 

路线

resources :projects do 
     resources :tasks 
end 

Answer 1

我觉得你的问题是早晚的事使用@task和@tasks

def index 
    project = Project.find(params[:project_id]) 

    # if I follow your program 
    # this should be @tasks 
    @tasks = project.tasks 

    respond_to do |format| 
    format.html # index.html.erb 
    # here you render @tasks 
    format.xml { render :xml => @tasks } 
    end 
    @task = Task.order('title').page(params[:page]).per(4) 
end 

def show 
    project = Project.find(params[:project_id]) 

    @task = project.tasks.find(params[:id]) 

    # simple check makesure @task is child of project 
    if @task.project_id == project.id 
     respond_to do |format| 
     format.html # show.html.erb 
     format.xml { render :xml => @task } 
     end 
    end 
end