You already know how to build a basic web application with the Ruby on Rails framework. Perhaps, you have even taken Course 1, "Ruby on Rails: An Introduction" (we highly recommend it) where you relied on external web services to be your “data layer”. But in the back of your mind, you always knew that there would come a time when you would need to roll up your sleeves and learn SQL to be able to interact with your own relational database (RDBMS). But there is an easier way to get started with SQL using the Active Record Object/Relational (ORM) framework. In this course, we will be able to use the Ruby language and the Active Record ORM framework to automate interactions with the database to quickly build the application we want. In Rails with Active Record and Action Pack, we will explore how to interact with relational databases by using Active Record, a Ruby gem, which Rails uses by default for database access. We will then take a look at what role Active Record plays in the overall request-response cycle, when a client (the browser) requests data from the server, as well as how to submit the data to the server. Of course, when accessing data, security is of paramount importance! We will talk about vulnerabilities such as SQL injection, as well as how to secure access to data by authenticating and authorizing users accessing the data. Take this course to build a Ruby on Rails application with Active Record to automate the detailed SQL interactions with our database.
Nested Resources: Part 1
Loading...
来自 Johns Hopkins University 的课程
Rails 的 Active Record 与 Action Pack
701 个评分
从本节课中
Security and Nested Resources in Action Pack
In this module, we will talk about how to deal with nested resources in Rails. We will then talk about securing your app with a username and password combination for authentication purposes and making sure that users are only authorized to make changes to and view their own resources. We will finish off the module by discussing pagination and deploying to Heroku Paas (Platform as a Service).
与讲师见面
Kalman HazinsAdjunct Professor, Graduate Computer Science
Whiting School of Engineering
[MUSIC]
Hi and welcome to Lecture 2.
In this lecture, we talk about nested resources and
what should go into a nested resources controller.
So, we're done generating the books resource and the scaffold for that.
And for the notes resources we also can scaffold the regular RESTful controller.
But if you think about it, note resource depends on the book resource.
Which means that anytime you are talking about a specific note,
it has to be viewed in the context of a book, right?
You're making a comment,
you're making a note about a book, you're reviewing a specific book.
And the Rails calls such secondary resources Nested Resources.
So for now, we're just gonna go ahead and generate an empty controller.
We're not gonna specify any actions for the notes.
So we're gonna say rails g controller notes, no actions here.
And for our routes what we're gonna do is,
we're gonna say that yes, notes is a resource, but
it's a nested resource, as you can see here, we're gonna say resources :books,
that's what was generated when we did the scaffold into our books.
And we're going to nest the resources of the notes inside our books resources.
And what this means is that now the resources that passed
to the notes resources are always gonna have a book ID in them.
So the routes we have so far for books, we're gonna have the seven actions,
index, show, new, create, and edit, update, and destroy.
You have seen this from previous module.
So, which means that we have now the books_path variable, and so on.
But now, this is interesting.
Now we also have because of nesting the resources inside the books,
the resource is books in the routes are the b file, we also have these paths.
We have a path to the index, show, and then new, create, and edit, update,
I always like having these together, and the destroy action.
And each one of them is going to have a book ID in its path.
And the variables to those are gonna be book_notes_path and
book_note_path and so on.
So a lot of these are gonna be very much the same as your typical non-nested
resources, but they're gonna have the book inside of them for variable name.
And if you do a rake routes, you'll see what all the routes so far are.
We have all the routes of our books.
And then we have the routes for the notes.
So the routes for the notes are gonna be also books/:book_id embedded.
And then notes.
And then when you need to be talking about a specific note,
you can have a book_id and you're going to have a regular id.
So the regular id is always the one that's pointing to the actual resource,
which is the note.
And the book_id is going to be a reference to the book for
which this nested resource is a resource for.
So what actions are we gonna need for the notes?
So in our routes .erb so far we have a mapping to all the seven actions,
but in the control that we generated, we didn't generate any actions.
And if you think about it, on the book show page, we're gonna have,
that is where we're gonna show the actual form for creating a note, right?
So if you imagine in your mind, you're gonna have the book scaffold.
So you have show all the books, then when you go to a particular book,
that shows information about that book, the name of the book, the author of
the book you're also gonna have a form, where you will be able to put in a note.
So the point is, you wouldn't need a new action,
which is usually the place we show the form, because the form for
a new note is going to be embedded Into the show action of the book.
So for now what we're going to do is we're going to only have create and
destroy actions, because if you want to edit an action,
you would just be able to destroy it and then create another one instead.
So the way you specify that is you don't want all seven actions,
you only want a subset, you would say only: [:create,
:destroy], only give me these two, the create and destroy actions.
The resources gives you all seven obviously, but we only want a subset,
we only want create and destroy.
And now when you do rake routes you're gonna see that you only have
the create and destroy actions for the notes.
And again notice that you have a book_id variable for the book id and
the actual id for the id that, in this case, you're trying to destroy.
So this is what our notes controller would look like.
We always have to be talking about a specific book.
So we're gonna have a before_action for the set_book, and
that's going to be for the create and destroy actions only.
And actually this controller, for right now, is only going to have the create and
destroy actions in it.
So the set_book looks as follows.
You have a Book.find(params of the book_id,
and remember that when you're looking for a book, it's a book_id,
not an ID like you would usually have by a regular scaffolded controller.
And then for
a create action what we're gonna do is we're gonna have a book.notes.new.
So we are creating a note in the context of a book, for particular book.
And we´re gonna have a note_params,
which are gonna be parameters for the note that we are creating.
And these note_params, I´m sure as you remember, I use strong parameters, right?
Note_params are not your regular params, but
they´re params that require you to have a note parameter in there.
And the note is only allowed to save values for a title and
a note and no other titles.
So in case we add more columns to the notes table later on,
we're gonna need to update our strong parameters to include those added columns.
So we're gonna create a new note.
We're gonna save a note.
That's what note.save is and this returns true if it's successful.
And look at this.
We're gonna redirect, but not to notes page because there is no notes page.
We're gonna redirect back to the book page, to the book show page with
a notice that says the note was successfully created or added.
And if it's false, then we're also gonna redirect to a book page with an alert,
and as you remember, the notice and alert are the two things we embedded into
the layout file of the application.html.erb file.
And the destroy action we're gonna do is,
we're gonna again find the particular note.
The way we do that is we say give me the book, based on a set book.
And then find the notes and then find the particular
book, I'm sorry particular notes.
That's what params[:id] is.
The id here is a reference to the actual ID of a note,
whereas the book_id is a reference to a book.
And then we're going to destroy the note and then again we're going to redirect
back to the book show page and we're going to say that the note was deleted.
In this case it's
not an alert notice because we actually want the note to be deleted.
So in summary you will usually just need a subset of the seven actions for
the nested controller.
And remember to use the strong parameters even
in the nested resource control that you're using.
What's next?
Next we'll see how we complete the nested resources
with the notes we been talking about and how we do reviews for them.
