ruby - In Rails, How do I Validate that a User Has Access to Modify an Entry? -

in rails app, using devise authenticates users in app. gives me variables current_user.id current logged-in user's userid.

in app, every user member of @ least 1 group. user can create 1 or many trinkets , can assign each trinket 1 of groups.

so, here models:

user has_many :memberships user has_many :groups, :through => :memberships  group has_many :memberships group has_many :users, :through => :memberships group has_many :trinkets  trinket belongs_to :group 

so there models! working great!

when user updates trinket, can assign trinket 1 of groups.

but, there security flaw! if views trinket/edit or trinket/new page, copies html source code, changes values of <select> or <input> tags in form, can submit trinket else's groupid.

i'd add validation model or controller confirms user has access use submitted values before writing them database. in case, want see if groupid trinket groupid within user.find(current_user.id).groups cannot figure out how validation in trinket model.

anyone know how verify user trying assign value have access assign to? devise or gem have way of checking associations user submitted data?

the current trinket model file has:

attr_accessible :trinketname, :group_id validates_presence_of :trinketname 

hope makes sense. appreciated! :-)

versions: rails 3.2.13, ruby 1.9.3p392, devise 2.2.4. have protect_from_forgery in application_controller.rb file.

you can put if statement inside action. not accurate hope gets point across:

 def create    if trinket.group_id == current_user.group_id      trinket.new(params[:trinket])        if trinket.save          redirect_to somewhere        else           render :new        end    else           flash[:warn] "you're not allowed"  end