title: rails password authentication
body: <p>First I am very very new to rails. so bear with any of my noob mistakes. Still trying to find the best sources for reliable information. Many things are a little outdated. </p>
  
  <p>I was following the Rails <a href="http://ruby.railstutorial.org/chapters/beginning#top" rel="nofollow">tutorial</a> and working with password authentication. In my app i have Users, and Departments with a has_many through relationship between them. The relationship is called the manager_relationship. MY authentication and authorization for users works. The manage and unmanage button works to create a manager relationship. I have also set up each department with a secure password. I was hoping to require a user to enter a password for the department before the manager relationship can be created. I added a password field next to the manage button.</p>
  
  <p>Models:</p>
  
  <pre><code>department.rb
  class Department &lt; ActiveRecord::Base
  attr_accessible :department_name, :password, :password_confirmation
  has_many :manager_relationships, dependent: :destroy
  has_many :users, through: :manager_relationships
  has_secure_password
  </code></pre>
  
  <p>manager_relationship.rb</p>
  
  <pre><code>class ManagerRelationship &lt; ActiveRecord::Base
  attr_accessible :department_id
  
  belongs_to :user
  belongs_to :department
  
  validates :user_id, presence: true
  validates :department_id, presence: true
  end
  </code></pre>
  
  <p>user.rb</p>
  
  <pre><code>class User &lt; ActiveRecord::Base
  attr_accessible :name, :email, :password, :password_confirmation
  has_many :manager_relationships, dependent: :destroy
  has_many :departments, through: :manager_relationships
  has_secure_password
  </code></pre>
  
  <p>Views
  department/show.html.erb</p>
  
  <pre><code>...
  &lt;div class="span8"&gt;
      &lt;%= render 'manage_form' if signed_in? %&gt;
  &lt;/div&gt;
  &lt;/div&gt;
  </code></pre>
  
  <p>departmnet/_manage.html.erb</p>
  
  <pre><code>&lt;%= form_for(current_user.manager_relationships.build(department_id: @department.id), remote: true) do |f| %&gt;
  &lt;div&gt;&lt;%= f.hidden_field :bdepartment_id %&gt;&lt;/div&gt;
  &lt;%= f.submit "Manage Department", class: "btn btn-large btn-primary" %&gt;
  &lt;% end %&gt;
  </code></pre>
  
  <p>Controller: ManagerRelationshipsController</p>
  
  <pre><code>class ManagerRelationshipsController &lt; ApplicationController
  before_filter :signed_in_user
  
  def create
      @department = Department.find(params[:manager_relationship][:department_id])
  
      current_user.manage!(@department)
      respond_to do |format|
          format.html { redirect_to @department }
          format.js
      end
  end
  </code></pre>
  
  <p>The above code works. It successfully creates and destroys a manager relationship. But there is no authentication. Any user can manage any department. I would like to require the managing user to enter a department password to create the manager_relationship </p>
  
  <p>Here is what i have tried.</p>
  
  <p>departmnet/_manage.html.erb</p>
  
  <pre><code> &lt;%= form_for(current_user.manager_relationships.build(department_id: @department.id), 
  remote: true) do |f| %&gt;
  ##################This Was Added ##############
  &lt;div&gt;
  &lt;%= f.label :password %&gt;
  &lt;%= f.password_field :password %&gt;
  &lt;/div&gt;
  ################################################
  
  &lt;div&gt;&lt;%= f.hidden_field :department_id %&gt;&lt;/div&gt;
  &lt;%= f.submit "Manage Department", class: "btn btn-large btn-primary" %&gt;
  &lt;% end %&gt;
  </code></pre>
  
  <p>ManagerRelationshipsController</p>
  
  <pre><code>class ManagerRelationshipsController &lt; ApplicationController
  before_filter :signed_in_user
  def create
      @department = Department.find(params[:manager_relationship][:department_id])
              ########################The line below was Added ##########################
      if @department.authenticate(params[:manager_relationship][:password])
              ###########################################################################
          current_user.manage!(@department)
      respond_to do |format|
          format.html { redirect_to @department }
          format.js
      end
         ####################I added this##################
      else
          flash.now[:error] = 'Invalid password'
          render 'new'
      end
         ############################################################
  </code></pre>