title: Prevent Users from Navigating Hidden Authors
body: <p>I have an index page that hides/shows different Authors by using a boolean. The problem that I am having is that signed in users can still access hidden authors and their books through the URL.  </p>
  
  <p><strong>How can I prevent current users from navigating to hidden Authors and their corresponding Books through the URL? Is there a way to redirect them back to Authors Page if author is hidden?</strong></p>
  
  <p>Currently, I have used the Controllers &amp; a boolean value to help hide/show Authors or Books from signed in users. Can someone please point me in the right direction. Here is my Code. </p>
  
  <p><strong>MODELS</strong></p>
  
  <pre><code>class Author &lt; ActiveRecord::Base
    attr_accessible :name, :photo
  
    has_many :books
  
  end
  
  class Book &lt; ActiveRecord::Base
    attr_accessible :author_id, :title, :photo
  
    belongs_to :author
  
  end
  </code></pre>
  
  <p><strong>CONTROLLERS</strong></p>
  
  <pre><code>class AuthorsController &lt; ApplicationController
    before_filter :signed_in_user, only: [:index]
    before_filter :admin_user, only: [:edit, :update, :destroy, :new, :show]
  
    respond_to :html, :js
  
    ###Only displays unhidden authors to non admin users.  
  
    def index
      if current_user.admin?
        @authors = Author.all(:order =&gt; "created_at")
      else
        @authors = Author.where(:display =&gt; true).all(:order =&gt; "created_at")
      end
    end
  
    private
  
      def signed_in_user
        unless signed_in?
          store_location
          redirect_to (root_path), notice: "Please sign in."
        end
      end
  
      def admin_user
        redirect_to(root_path) unless current_user.admin?
      end
  end
  
  class BooksController &lt; ApplicationController
    before_filter :signed_in_user, only: [:index]
    before_filter :admin_user, only: [:edit, :update, :destroy, :new, :show]
    before_filter :get_author
  
    respond_to :html, :js
  
    def get_author
      @author = Author.find(params[:author_id])
    end
  
    def index
      @books = @author.books
    end
  
    private
  
      def signed_in_user
        unless signed_in?
          store_location
          redirect_to (root_path), notice: "Please sign in."
        end
      end
  
      def admin_user
        redirect_to(root_path) unless current_user.admin?
      end
  end
  </code></pre>
  
  <p><strong>VIEWS</strong></p>
  
  <pre><code>Authors index.html.erb
  
  &lt;% @authors.each do |author| %&gt;
  
    &lt;%= link_to (image_tag author.photo(:medium)), 
      url_for(author_books_path(author)),
      class: "img-rounded" %&gt;
  
  &lt;% end %&gt;
  
  ### How Can I prevent Users from accessing Hidden Author's Books (Index Page)
  Books index.html.erb
  
    &lt;% @books.each do |book| %&gt;
      &lt;%= image_tag book.photo(:medium) %&gt;
      &lt;%= book.name %&gt;
    &lt;% end %&gt;
  </code></pre>
  
  <p><strong>ROUTES</strong></p>
  
  <pre><code>resources :authors do
    resources :books
  end
  </code></pre>
  
  <p><strong>SCHEMA</strong></p>
  
  <pre><code>create_table "authors", :force =&gt; true do |t|
    t.string   "name"
    t.boolean  "display",             :default =&gt; false
    t.datetime "created_at",                             :null =&gt; false
    t.datetime "updated_at",                             :null =&gt; false
    t.string   "photo_file_name"
    t.string   "photo_content_type"
    t.integer  "photo_file_size"
    t.datetime "photo_updated_at"
  end
  
  create_table "books", :force =&gt; true do |t|
    t.integer  "author_id"
    t.string   "title"
    t.datetime "created_at",          :null =&gt; false
    t.datetime "updated_at",          :null =&gt; false
    t.string   "photo_file_name"
    t.string   "photo_content_type"
    t.integer  "photo_file_size"
    t.datetime "photo_updated_at"
  end
  </code></pre>