# Newbie question - limiting record view

**URL:** <https://www.ruby-forum.com/t/newbie-question-limiting-record-view/174443>\
**Category:** Rails\
**Created:** [August 26, 2009, 8:34pm UTC](https://www.ruby-forum.com/t/newbie-question-limiting-record-view/174443 "2009-08-26T20:34:22Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![mlittle](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/c4cdca/32.png) [@mlittle](https://www.ruby-forum.com/u/mlittle)\
**Post date:** [August 26, 2009, 8:34pm UTC](https://www.ruby-forum.com/t/newbie-question-limiting-record-view/174443/1 "2009-08-26T20:34:22Z")

</div>

I’m new to rails and I’m having problems figuring out how to limit the  
ability to for 1 user to see the records that another user creates. I  
have Users and Children and I want to make it so a User with user\_id  
of 1 who creates children\_id of 8,9 can only see children 8,9. I also  
want to make it so User\_id 2 cannot see user\_id 1 or children 8 and 9.  
I am using restful\_authentication.

---

<div class="post-metadata">

**Author:** ![mlittle](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/c4cdca/32.png) [@mlittle](https://www.ruby-forum.com/u/mlittle)\
**Post date:** [August 26, 2009, 8:36pm UTC](https://www.ruby-forum.com/t/newbie-question-limiting-record-view/174443/2 "2009-08-26T20:36:08Z")

</div>

The simplest thing to do is create a relationship between the record  
and the user. If you object/record was product then:

class Product  
belongs\_to :user  
end

class User  
has\_many :products  
end

then in your Product controller always access products via the user:

def index  
current\_user.products  
end

def new  
current\_user.products.build  
end

def create  
current\_user.products.build(params[:products])  
end

etc…

HTH,  
Nicholas

---

<div class="post-metadata">

**Author:** ![mlittle](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/c4cdca/32.png) [@mlittle](https://www.ruby-forum.com/u/mlittle)\
**Post date:** [August 26, 2009, 8:37pm UTC](https://www.ruby-forum.com/t/newbie-question-limiting-record-view/174443/3 "2009-08-26T20:37:18Z")

</div>

One thing. I looked at the example you send and was wondering if this  
will prevent other users from viewing the products created by other  
users? That is what I am trying to do. I will test you code ASAP.

---

<div class="post-metadata">

**Author:** ![mlittle](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/c4cdca/32.png) [@mlittle](https://www.ruby-forum.com/u/mlittle)\
**Post date:** [August 26, 2009, 9:05pm UTC](https://www.ruby-forum.com/t/newbie-question-limiting-record-view/174443/4 "2009-08-26T21:05:59Z")

</div>

To clarify…

def create  
current\_user.products.build(params[:products])  
end

should have been

def create  
current\_user.products.build(params[:products])  
… # etc  
end

---

<div class="post-metadata">

**Author:** ![mlittle](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/c4cdca/32.png) [@mlittle](https://www.ruby-forum.com/u/mlittle)\
**Post date:** [August 26, 2009, 10:23pm UTC](https://www.ruby-forum.com/t/newbie-question-limiting-record-view/174443/5 "2009-08-26T22:23:53Z")

</div>

Nick,

WOW! Thanks for the quick reply. I have created the relationship and I  
will change my controllers to reflect your suggestion. Thanks a bunch  
for the help.

---

<div class="post-metadata">

**Author:** ![mlittle](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/c4cdca/32.png) [@mlittle](https://www.ruby-forum.com/u/mlittle)\
**Post date:** [August 26, 2009, 9:44pm UTC](https://www.ruby-forum.com/t/newbie-question-limiting-record-view/174443/6 "2009-08-26T21:44:03Z")

</div>

Yes it will, just use the scope when finding a record. Continuing from  
my previous example:

def show  
@product = current\_user.products.find(params[:id])  
end

Sent from my iPhone

---

<div class="post-metadata">

**Author:** ![mlittle](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/c4cdca/32.png) [@mlittle](https://www.ruby-forum.com/u/mlittle)\
**Post date:** [September 5, 2009, 7:22pm UTC](https://www.ruby-forum.com/t/newbie-question-limiting-record-view/174443/7 "2009-09-05T19:22:01Z")

</div>

Thanks so much for the help. This worked perfectly. Sorry for the late  
response.