- Title: - <%= @article.title %> -
+Articles
-- Text: - <%= @article.text %> -
+-
+ <% @articles.each do |article| %>
+
- + <%= article.title %> + + <% end %> +
Listing Articles
+<%= @article.title %>
-| Title | -Text | -- |
|---|---|---|
| <%= article.title %> | -<%= article.text %> | -<%= link_to 'Show', article_path(article) %> | -
Hello, Rails!
-<%= link_to 'My Blog', controller: 'articles' %> -``` - -The `link_to` method is one of Rails' built-in view helpers. It creates a -hyperlink based on text to display and where to go - in this case, to the path -for articles. - -Let's add links to the other views as well, starting with adding this -"New Article" link to `app/views/articles/index.html.erb`, placing it above the -`| Title | -Text | -- | |
|---|---|---|---|
| <%= article.title %> | -<%= article.text %> | -<%= link_to 'Show', article_path(article) %> | -<%= link_to 'Edit', edit_article_path(article) %> | -
Articles
-<%= link_to 'Edit', edit_article_path(@article) %> | -<%= link_to 'Back', articles_path %> -``` - -And here's how our app looks so far: - - - -### Using partials to clean up duplication in views - -Our `edit` page looks very similar to the `new` page; in fact, they -both share the same code for displaying the form. Let's remove this -duplication by using a view partial. By convention, partial files are -prefixed with an underscore. - -TIP: You can read more about partials in the -[Layouts and Rendering in Rails](layouts_and_rendering.html) guide. - -Create a new file `app/views/articles/_form.html.erb` with the following -content: - -```html+erb -<%= form_with model: @article, local: true do |form| %> - - <% if @article.errors.any? %> -
-
+- <%= pluralize(@article.errors.count, "error") %> prohibited - this article from being saved: -
--
- <% @article.errors.full_messages.each do |msg| %>
-
- <%= msg %> - <% end %> -
-
+ <% @articles.each do |article| %>
+
- + <%= link_to article.title, article %> + <% end %> - -
- <%= form.label :title %>
- <%= form.text_field :title %>
-
- <%= form.label :text %>
- <%= form.text_area :text %>
-
- <%= form.submit %> -
- -<% end %> +New Article
+### Creating a New Article -<%= render 'form' %> +Now we move on to the "C" (Create) of CRUD. Typically, in web applications, +creating a new resource is a multi-step process. First, the user requests a form +to fill out. Then, the user submits the form. If there are no errors, then the +resource is created and some kind of confirmation is displayed. Else, the form +is redisplayed with error messages, and the process is repeated. -<%= link_to 'Back', articles_path %> -``` - -Then do the same for the `app/views/articles/edit.html.erb` view: - -```html+erb -Edit Article
- -<%= render 'form' %> - -<%= link_to 'Back', articles_path %> -``` - -### Deleting Articles - -We're now ready to cover the "D" part of CRUD, deleting articles from the -database. Following the REST convention, the route for -deleting articles as per output of `bin/rails routes` is: - -```ruby -DELETE /articles/:id(.:format) articles#destroy -``` - -The `delete` routing method should be used for routes that destroy -resources. If this was left as a typical `get` route, it could be possible for -people to craft malicious URLs like this: - -```html -look at this cat! -``` - -We use the `delete` method for destroying resources, and this route is mapped -to the `destroy` action inside `app/controllers/articles_controller.rb`, which -doesn't exist yet. The `destroy` method is generally the last CRUD action in -the controller, and like the other public CRUD actions, it must be placed -before any `private` or `protected` methods. Let's add it: - -```ruby -def destroy - @article = Article.find(params[:id]) - @article.destroy - - redirect_to articles_path -end -``` - -The complete `ArticlesController` in the -`app/controllers/articles_controller.rb` file should now look like this: +In a Rails application, these steps are conventionally handled by a controller's +`new` and `create` actions. Let's add a typical implementation of these actions +to `app/controllers/articles_controller.rb`, below the `show` action: ```ruby class ArticlesController < ApplicationController @@ -1503,27 +795,470 @@ class ArticlesController < ApplicationController @article = Article.new end - def edit + def create + @article = Article.new(title: "...", body: "...") + + if @article.save + redirect_to @article + else + render :new + end + end +end +``` + +The `new` action instantiates a new article, but does not save it. This article +will be used in the view when building the form. By default, the `new` action +will render `app/views/articles/new.html.erb`, which we will create next. + +The `create` action instantiates a new article with values for the title and +body, and attempts to save it. If the article is saved successfully, the action +redirects the browser to the article's page at `"http://localhost:3000/articles/#{@article.id}"`. +Else, the action redisplays the form by rendering `app/views/articles/new.html.erb`. +The title and body here are dummy values. After we create the form, we will come +back and change these. + +NOTE: [`redirect_to`](https://api.rubyonrails.org/classes/ActionController/Redirecting.html#method-i-redirect_to) +will cause the browser to make a new request, +whereas [`render`](https://api.rubyonrails.org/classes/AbstractController/Rendering.html#method-i-render) +renders the specified view for the current request. +It is important to use `redirect_to` after mutating the database or application state. +Otherwise, if the user refreshes the page, the browser will make the same request, and the mutation will be repeated. + +#### Using a Form Builder + +We will use a feature of Rails called a *form builder* to create our form. Using +a form builder, we can write a minimal amount of code to output a form that is +fully configured and follows Rails conventions. + +Let's create `app/views/articles/new.html.erb` with the following contents: + +```html+erb +New Article
+ +<%= form_with model: @article, local: true do |form| %> +
+ <%= form.label :title %>
+ <%= form.text_field :title %> +
+
+ + <%= form.text_field :title %> +
+ <%= form.label :body %>
+ <%= form.text_area :body %> +
+
+ + <%= form.text_area :body %> +
+ <%= form.submit %>
+
+<% end %>
+```
+
+The [`form_with`](https://api.rubyonrails.org/classes/ActionView/Helpers/FormHelper.html#method-i-form_with)
+helper method instantiates a form builder. In the `form_with` block we call
+methods like [`label`](https://api.rubyonrails.org/classes/ActionView/Helpers/FormBuilder.html#method-i-label)
+and [`text_field`](https://api.rubyonrails.org/classes/ActionView/Helpers/FormBuilder.html#method-i-text_field)
+on the form builder to output the appropriate form elements.
+
+NOTE: By default, `form_with` creates a form that submits via Ajax to avoid full
+page reloads. To make this guide easier to follow, we have disabled that feature
+by using `local: true` in the above code.
+
+The resulting output from our `form_with` call will look like:
+
+```html
+
+```
+
+TIP: To learn more about form builders, see [Action View Form Helpers](
+form_helpers.html).
+
+#### Using Strong Parameters
+
+Submitted form data is put into the `params` Hash, alongside captured route
+parameters. Thus, the `create` action can access the submitted title via
+`params[:article][:title]` and the submitted body via `params[:article][:body]`.
+We could pass these values individually to `Article.new`, but that would be
+verbose and possibly error-prone. And it would become worse as we add more
+fields.
+
+Instead, we will pass a single Hash that contains the values. However, we must
+still specify what values are allowed in that Hash. Otherwise, a malicious user
+could potentially submit extra form fields and overwrite private data. In fact,
+if we pass the unfiltered `params[:article]` Hash directly to `Article.new`,
+Rails will raise a `ForbiddenAttributesError` to alert us about the problem.
+So we will use a feature of Rails called *Strong Parameters* to filter `params`.
+Think of it as [strong typing](https://en.wikipedia.org/wiki/Strong_and_weak_typing)
+for `params`.
+
+Let's add a private method to the bottom of `app/controllers/articles_controller.rb`
+named `article_params` that filters `params`. And let's change `create` to use
+it:
+
+```ruby
+class ArticlesController < ApplicationController
+ def index
+ @articles = Article.all
+ end
+
+ def show
@article = Article.find(params[:id])
end
+ def new
+ @article = Article.new
+ end
+
def create
@article = Article.new(article_params)
if @article.save
redirect_to @article
else
- render 'new'
+ render :new
end
end
+ private
+ def article_params
+ params.require(:article).permit(:title, :body)
+ end
+end
+```
+
+TIP: To learn more about Strong Parameters, see [Action Controller Overview §
+Strong Parameters](action_controller_overview.html#strong-parameters).
+
+#### Validations and Displaying Error Messages
+
+As we have seen, creating a resource is a multi-step process. Handling invalid
+user input is another step of that process. Rails provides a feature called
+*validations* to help us deal with invalid user input. Validations are rules
+that are checked before a model object is saved. If any of the checks fail, the
+save will be aborted, and appropriate error messages will be added to the
+`errors` attribute of the model object.
+
+Let's add some validations to our model in `app/models/article.rb`:
+
+```ruby
+class Article < ApplicationRecord
+ validates :title, presence: true
+ validates :body, presence: true, length: { minimum: 10 }
+end
+```
+
+The first validation declares that a `title` value must be present. Because
+`title` is a string, this means that the `title` value must contain at least one
+non-whitespace character.
+
+The second validation declares that a `body` value must also be present.
+Additionally, it declares that the `body` value must be at least 10 characters
+long.
+
+NOTE: You may be wondering where the `title` and `body` attributes are defined.
+Active Record automatically defines model attributes for every table column, so
+you don't have to declare those attributes in your model file.
+
+With our validations in place, let's modify `app/views/articles/new.html.erb` to
+display any error messages for `title` and `body`:
+
+```html+erb
+New Article
+ +<%= form_with model: @article, local: true do |form| %> +
+ <%= form.label :title %>
+ <%= form.text_field :title %> + <%= @article.errors.full_messages_for(:title).each do |message| %> +
+
+ + <%= form.text_field :title %> + <%= @article.errors.full_messages_for(:title).each do |message| %> +
<%= message %>
+ <% end %>
+
+ <%= form.label :body %>
+ <%= form.text_area :body %>
+ <%= @article.errors.full_messages_for(:body).each do |message| %> +
+
+ + <%= form.text_area :body %>
+ <%= @article.errors.full_messages_for(:body).each do |message| %> +
<%= message %>
+ <% end %>
+
+ <%= form.submit %>
+
+<% end %>
+```
+
+The [`full_messages_for`](https://api.rubyonrails.org/classes/ActiveModel/Errors.html#method-i-full_messages_for)
+method returns an array of user-friendly error messages for a specified
+attribute. If there are no errors for that attribute, the array will be empty.
+
+To understand how all of this works together, let's take another look at the
+`new` and `create` controller actions:
+
+```ruby
+ def new
+ @article = Article.new
+ end
+
+ def create
+ @article = Article.new(article_params)
+
+ if @article.save
+ redirect_to @article
+ else
+ render :new
+ end
+ end
+```
+
+When we visit Articles
+ +-
+ <% @articles.each do |article| %>
+
- + <%= link_to article.title, article %> + + <% end %> +
+ <%= form.label :title %>
+ <%= form.text_field :title %> + <%= article.errors.full_messages_for(:title).each do |message| %> +
+
+ + <%= form.text_field :title %> + <%= article.errors.full_messages_for(:title).each do |message| %> +
<%= message %>
+ <% end %>
+
+ <%= form.label :body %>
+ <%= form.text_area :body %>
+ <%= article.errors.full_messages_for(:body).each do |message| %> +
+
+ + <%= form.text_area :body %>
+ <%= article.errors.full_messages_for(:body).each do |message| %> +
<%= message %>
+ <% end %>
+
+ <%= form.submit %>
+
+<% end %>
+```
+
+The above code is the same as our form in `app/views/articles/new.html.erb`,
+except that all occurrences of `@article` have been replaced with `article`.
+Because partials are shared code, it is best practice that they do not depend on
+specific instance variables set by a controller action. Instead, we will pass
+the article to the partial as a local variable.
+
+Let's update `app/views/articles/new.html.erb` to use the partial via [`render`](
+https://api.rubyonrails.org/classes/ActionView/Helpers/RenderingHelper.html#method-i-render):
+
+```html+erb
+New Article
+ +<%= render "form", article: @article %> +``` + +NOTE: A partial's filename must be prefixed **with** an underscore, e.g. +`_form.html.erb`. But when rendering, it is referenced **without** the +underscore, e.g. `render "form"`. + +And now, let's create a very similar `app/views/articles/edit.html.erb`: + +```html+erb +Edit Article
+ +<%= render "form", article: @article %> +``` + +TIP: To learn more about partials, see [Layouts and Rendering in Rails § Using +Partials](layouts_and_rendering.html#using-partials). + +#### Finishing Up + +We can now update an article by visiting its edit page, e.g. +<%= @article.title %>
+ +<%= @article.body %>
+ +-
+
- <%= link_to "Edit", edit_article_path(@article) %> +
Listing Articles
-<%= link_to 'New article', new_article_path %> -| Title | -Text | -- | ||
|---|---|---|---|---|
| <%= article.title %> | -<%= article.text %> | -<%= link_to 'Show', article_path(article) %> | -<%= link_to 'Edit', edit_article_path(article) %> | -<%= link_to 'Destroy', article_path(article), - method: :delete, - data: { confirm: 'Are you sure?' } %> | -
<%= @article.body %>
+ +-
+
- <%= link_to "Edit", edit_article_path(@article) %> +
- <%= link_to "Destroy", article_path(@article), + method: :delete, + data: { confirm: "Are you sure?" } %> +
- Title: - <%= @article.title %> -
+<%= @article.title %>
-- Text: - <%= @article.text %> -
+<%= @article.body %>
+ +-
+
- <%= link_to "Edit", edit_article_path(@article) %> +
- <%= link_to "Destroy", article_path(@article), + method: :delete, + data: { confirm: "Are you sure?" } %> +
Add a comment:
<%= form_with model: [ @article, @article.comments.build ], local: true do |form| %> @@ -1781,9 +1507,6 @@ So first, we'll wire up the Article show template <%= form.submit %> <% end %> - -<%= link_to 'Edit', edit_article_path(@article) %> | -<%= link_to 'Back', articles_path %> ``` This adds a form on the `Article` show page that creates a new comment by @@ -1825,15 +1548,16 @@ the `show` action of the `ArticlesController` which in turn renders the add that to the `app/views/articles/show.html.erb`. ```html+erb -- Title: - <%= @article.title %> -
+<%= @article.title %>
-- Text: - <%= @article.text %> -
+<%= @article.body %>
+ +-
+
- <%= link_to "Edit", edit_article_path(@article) %> +
- <%= link_to "Destroy", article_path(@article), + method: :delete, + data: { confirm: "Are you sure?" } %> +
Comments
<% @article.comments.each do |comment| %> @@ -1862,9 +1586,6 @@ add that to the `app/views/articles/show.html.erb`. <%= form.submit %> <% end %> - -<%= link_to 'Edit', edit_article_path(@article) %> | -<%= link_to 'Back', articles_path %> ``` Now you can add articles and comments to your blog and have them show up in the @@ -1901,15 +1622,16 @@ Then you can change `app/views/articles/show.html.erb` to look like the following: ```html+erb -- Title: - <%= @article.title %> -
+<%= @article.title %>
-- Text: - <%= @article.text %> -
+<%= @article.body %>
+ +-
+
- <%= link_to "Edit", edit_article_path(@article) %> +
- <%= link_to "Destroy", article_path(@article), + method: :delete, + data: { confirm: "Are you sure?" } %> +
Comments
<%= render @article.comments %> @@ -1928,9 +1650,6 @@ following: <%= form.submit %> <% end %> - -<%= link_to 'Edit', edit_article_path(@article) %> | -<%= link_to 'Back', articles_path %> ``` This will now render the partial in `app/views/comments/_comment.html.erb` once @@ -1963,24 +1682,22 @@ create a file `app/views/comments/_form.html.erb` containing: Then you make the `app/views/articles/show.html.erb` look like the following: ```html+erb -- Title: - <%= @article.title %> -
+<%= @article.title %>
-- Text: - <%= @article.text %> -
+<%= @article.body %>
+ +-
+
- <%= link_to "Edit", edit_article_path(@article) %> +
- <%= link_to "Destroy", article_path(@article), + method: :delete, + data: { confirm: "Are you sure?" } %> +
Comments
<%= render @article.comments %>Add a comment:
<%= render 'comments/form' %> - -<%= link_to 'Edit', edit_article_path(@article) %> | -<%= link_to 'Back', articles_path %> ``` The second render just defines the partial template we want to render, @@ -2010,8 +1727,9 @@ Within the `article` model, after running a migration to add a `status` column, ```ruby class Article < ApplicationRecord has_many :comments - validates :title, presence: true, - length: { minimum: 5 } + + validates :title, presence: true + validates :body, presence: true, length: { minimum: 10 } VALID_STATUSES = ['public', 'private', 'archived'] @@ -2042,29 +1760,19 @@ end Then, in our `index` action template (`app/views/articles/index.html.erb`) we would use the `archived?` method to avoid displaying any article that is archived: ```html+erb -Listing Articles
-<%= link_to 'New article', new_article_path %> -| Title | -Text | -- | ||
|---|---|---|---|---|
| <%= article.title %> | -<%= article.text %> | -<%= link_to 'Show', article_path(article) %> | -<%= link_to 'Edit', edit_article_path(article) %> | -<%= link_to 'Destroy', article_path(article), - method: :delete, - data: { confirm: 'Are you sure?' } %> | -
Listing Articles
-Our blog has <%= Article.public_count %> articles and counting! Add yours now. -<%= link_to 'New article', new_article_path %> -| Title | -Text | -- | ||
|---|---|---|---|---|
| <%= article.title %> | -<%= article.text %> | -<%= link_to 'Show', article_path(article) %> | -<%= link_to 'Edit', edit_article_path(article) %> | -<%= link_to 'Destroy', article_path(article), - method: :delete, - data: { confirm: 'Are you sure?' } %> | -
<%= link_to 'Destroy Comment', [comment.article, comment], method: :delete, - data: { confirm: 'Are you sure?' } %> + data: { confirm: "Are you sure?" } %>
``` @@ -2249,8 +1945,9 @@ class Article < ApplicationRecord include Visible has_many :comments, dependent: :destroy - validates :title, presence: true, - length: { minimum: 5 } + + validates :title, presence: true + validates :body, presence: true, length: { minimum: 10 } end ```