ruby on rails - How to Hide "Private" Show Pages from Other Users? -

in other words if user types in example:

http://0.0.0.0:3000/goals/3 

they able see user's goal if user submitted "private". had overlooked because stands submitting via "private" hides goal user's profile , feed, not if user directly searches via url.

how can fix this?

goals_controller

class goalscontroller < applicationcontroller   before_action :set_goal, only: [:show, :edit, :update, :destroy, :like, :user_goals]   before_action :logged_in_user, only: [:create, :destroy]   before_action :correct_user, only: [:edit, :update, :destroy]    def index     if params[:tag]       @goals = goal.tagged_with(params[:tag])     elsif params[:user_id]       @accomplished_goals = user.find(params[:user_id]).goals.accomplished.order("deadline")       @unaccomplished_goals = user.find(params[:user_id]).goals.unaccomplished.order("deadline")     else       @accomplished_goals = current_user.goals.accomplished.order("deadline")       @unaccomplished_goals = current_user.goals.unaccomplished.order("deadline")     end   end    def user_goals       @goals = goal.find_by({user_id: params[:user_id]})       render :index # or other view   end    def show     @goal = goal.find(params[:id])     @commentable = @goal     @comments = @commentable.comments     @comment = comment.new     @notable = @goal     @notes = @notable.notes     @note = note.new     @correct_user = current_user.goals.find_by(id: params[:id])   end    def new     @goal = current_user.goals.build   end    def edit   end    def create     @goal = current_user.goals.build(goal_params)     if (params[:commit] == 'conceal')       @goal.conceal = true       @goal.save       redirect_to @goal, notice: 'goal created'     elsif       @goal.save       track_activity @goal       redirect_to @goal, notice: 'goal created'     else       flash.now[:danger] = 'required field: "enter goal"'       render 'new'     end   end    def update     if @goal.update(goal_params)       redirect_to goals_url, notice: 'goal updated'     else       render action: 'edit'   end end    def destroy     @goal.destroy     redirect_to goals_url   end    def     @goal = goal.find(params[:id])     @goal_like = current_user.goal_likes.build(goal: @goal)     if @goal_like.save       @goal.increment!(:likes)       flash[:success] = 'thanks liking!'     else       flash[:error] = 'two many likes'     end         redirect_to(:back)   end    private     def set_goal       @goal = goal.find(params[:id])     end      def correct_user       @goal = current_user.goals.find_by(id: params[:id])       redirect_to root_url, notice: "not authorized edit goal" if @goal.nil?     end      def goal_params       params.require(:goal).permit(:name, :like, :deadline, :accomplished, :tag_list, :comment, :private_submit)     end end 

goal.rb

class goal < activerecord::base     scope :publish, ->{ where(:conceal => false) }     belongs_to :user     scope :accomplished, -> { where(accomplished: true) }     scope :unaccomplished, -> { where(accomplished: false) } end 

is private_submit boolean field?

if so, here's quick way make show page private if private_submit field has value of "true".

class goalscontroller < applicationcontroller   # remove :edit, :update, destroy, , :user_gmails below action duplicated  before_action :set_goal, only: [:show, :like]    def show     ## remove:  @goal = goal.find(params[:id])   end    def     # remove it's being called ready in set_goal:      # @goal = goal.find(params[:id])     ...   end    ...    def set_goal     @goal = goal.find(params[:id])     redirect_to(:back) unless @goal.user_id == current_user.id or @goal.private_submit == false   end  end