2

I'm trying to figure out how to stop users from editing or deleting other users' information. I've used Devise to set up the users so don't have a users controller. The Users Policy is below.

class PostPolicy < ApplicationPolicy
  def index?
    true
  end

  def create?
    user.present?
  end

  def update?
    user.present? && user == post.user
  end

  def destroy?
    user.present? && user == post.user
  end

  private

  def post
    record
  end
end

I managed to stop allowing other users to delete or edit posts that weren't theres, but not sure how to do this without a users controller - I can't find the code in the Devise Gem to see what the controller is doing behind the scenes so not sure how to change its methods without breaking something else Devise does!

Any help is greatly appreciated

0 Answers0