Throughout my Message controller, I do this a lot:
@message = Message.find(params[:id],:conditions => ["user_id = ?", @session['user'].id])
Since you need to authenticate to use this app, is there a way i can tie the Accounts model in with the Message model so I dont have to pass in the user_id everytime?
Do you have a helper method that provides the current user? Something like:
def current_user @cur_user ||= User.find(session[:user_id]) end
Then set up a relationship in your user model: class User < AR::Base has_many :messages end
then you can do current_user.messages.find(params[:id])
If you go through the messages relation, it constricts it only to those messages that have the user_id belonging to that user.
Alternatively you could do Message.find_by_id_and_user_id(params[:id], session[:user_id])
or set up a method in your Message class.
I think setting up the has_many :messages association and going through that would be the most idiomatic way.
Also use the accessor method session instead of the instance variable @session, which is deprecated.
Pat