I’m wanting to create an Asset from an Organisation Show page. I need the Organisation ID to be passed to the Asset for creation.
# ../models/organisation.rb
has_many :assets
# ../models/asset.rb
belongs_to :organisation
I have a button to create an asset, which is passing the organisation.id in the URL params.
# ../views/organisations/show.html.erb
<%= link_to 'New Asset', new_asset_path(:organisation_id => @organisation.id) %>
I'm able to access the organisation_id
value in the ../views/assets/new
view, however, when I submit the form I'm receiving a “Method not allowed”
error.
# ../controllers/assets_controller.rb
def create
@asset = Asset.new(params[:organisation_id])
...
end
Q1: Why am I getting this error:
Q2: Is there another way to pass the organisation_id through to the Asset new page? I.e. not in the URL.
Q3: If I can only pass the ID through the URL, Is there a way to stop a user tampering with it? I.e. changing the Org ID to something else and saving the asset to another organisation.
Q4: Would nested resources help in this instance?
Rails 5.0.0.1, Ruby 2.3.1