I'm struggling with a issue related to my joined table called user_notes, which connects an adventure_id with a user_id (belongs_to) and includes a longtext field called :note. The problem I'm facing is that all users can see each other's notes on the page when they should be private. Despite trying different queries in the controller and conditionals in the JS, the issue persists. Although the ajax calls and modal/form updates are functioning correctly, any attempt to display only the current_user's notes breaks the ajax functionality.
In the user_notes_controller.rb:
def index
@adventure = Adventure.find(params[:adventure_id])
@user = current_user
@user_notes = current_user.user_notes.where(adventure: @adventure).order(created_at: :desc)
end
Within index.html.erb:
<div class="container">
<div class="row mt-4 card">
<div class="col-12">
<h3 class="text-center">Add a New Note</h3>
<h6 class="text-center">(SHIFT + RETURN/ENTER for a new line)</h6>
<%= form_with(model: [@adventure, UserNote.new], url: adventure_user_notes_path(@adventure), local: false, method: :post, id: 'note_form') do |form| %>
<%= form.text_area :note, oninput: 'this.style.height = "";this.style.height = this.scrollHeight + "px"', class: "form-control", placeholder: 'Add a new note...' %>
<%= form.hidden_field :adventure_id, value: @adventure.id %>
<%= form.hidden_field :user_id, value: @user.id %>
</div>
<div class="d-inline-flex justify-content-center">
<%= form.submit 'Save Note', class: "btn btn-outline-success text-end" %>
</div>
</div>
<% end %>
<!-- Display Saved Notes -->
<div class="container-fluid overflow-auto">
<div id="user-notes-list">
<%= render partial: 'user_notes/note', collection: @adventure.user_notes.order(created_at: :desc), as: :note, locals: { adventure_id: @adventure.id, user_id: @user.id } %>
</div>
</div>
</div><!-- End Container -->
<!-- JavaScript logic goes here -->
<script> ... </script>
To manage the issue of displaying incorrect notes, I added
data-current-user-id="<%= current_user.id %>"<% if note.user_id == @user.id %>