title: how to let users only delete their own reviews Ruby on Rails?
body: <p>Im new to rails and working on my project.When a user logs into his account i want to give him the ability to delete only his reviews and not the reviews of others.Currently one is able to log in an delete any reviews.I know this needs some authorization thing but im not sure.Here is my code...
  here is the model relationship and controllers</p>
  <pre><code>class Airline &lt; ApplicationRecord
      has_many :reviews
      has_many :users,through: :reviews
  
      
  end
  
  class Review &lt; ApplicationRecord
    belongs_to :user
    belongs_to :airline
  
   
  
  end
  
  class User &lt; ApplicationRecord
      has_secure_password
      has_many :reviews
      has_many :airlines,through: :reviews 
     
  
    
      
  end
  
  
  </code></pre>
  <p>Application controller</p>
  <pre><code># app/controllers/application_controller.rb
  class ApplicationController &lt; ActionController::API
    include ActionController::Cookies
    
    rescue_from ActiveRecord::RecordInvalid, with: :render_unprocessable_entity_response
  
    before_action :authorize
     
      
  
      private
      def authorize
        puts &quot;hello&quot;,session[:user_id]
        @current_user = User.find_by(id: session[:user_id])
    
        render json: { errors: [&quot;Not authorized&quot;] }, status: :unauthorized unless @current_user
      end
    
      def render_unprocessable_entity_response(exception)
        render json: { errors: exception.record.errors.full_messages }, status: :unprocessable_entity
      end
    end
  </code></pre>
  <p>Session controller</p>
  <pre><code>class SessionsController &lt; ApplicationController
  
      skip_before_action :authorize, only: :create
      def create
          user = User.find_by(email: params[:email])
          if user&amp;.authenticate(params[:password])
            session[:user_id] = user.id
            render json: user
          else
            render json: { errors: [&quot;Invalid username or password&quot;] }, status: :unauthorized
          end
        end
  
      def destroy
          session.delete :user_id
          head :no_content
        end
      
      
  end
      
  </code></pre>
  <p>User controller</p>
  <pre><code>class UsersController &lt; ApplicationController
      
      skip_before_action :authorize, only: :create
     
      def create
          user = User.create!(user_params)
          session[:user_id] = user.id
          render json: user, status: :created
        end
  
     
        def show
          render json: @current_user
        end
  
       
        def index
          user=User.all 
          render json: user
  
        end
  
      private 
      
      def user_params
          params.permit(:name,:email,:password)
  
      end
  end
  
  </code></pre>
  <p>Reviews controller</p>
  <pre><code>class ReviewsController &lt; ApplicationController
      before_action :authorize
  
  
      def index
          review=Review.all
          render json: review
  
      end
      def show
          review=Review.find(params[:id])
          render json: review
  
      end
      def create
          review=Review.create!(review_params)
          render json: review,status: :created
  
  
      end
  
      def update
          review=Review.find(params[:id])
          review.update!(review_params)
          render json: review,status: :ok
  
      end
  
      def destroy
          review=Review.find(params[:id])
          review.destroy
          head :no_content
      rescue ActiveRecord::RecordInvalid =&gt; invalid
          render json: { errors: invalid.record.errors }, status: :not_found
      end
  
      private
      
      def review_params
          params.permit(:image,:date,:description,:destination,:seat,:user_id,:airline_id)
  
      end
  
     
  end
  
  </code></pre>
  <p>Airline controller</p>
  <pre><code>class AirlinesController &lt; ApplicationController
      def index
          airline=Airline.all 
          render json: airline,status: :ok
  
      end
  end
  </code></pre>
  <p>on the front end</p>
  <pre><code>mport {useParams} from &quot;react-router-dom&quot;;
  import Button from 'react-bootstrap/Button';
  import Card from 'react-bootstrap/Card';
  import &quot;./Styling.css&quot;
  function ReviewCard({review,handleDelete}){
      const {id}=useParams();
      const{image,date,destination,seat,description,likes,dislikes,airline_id,user_id}=review;
     
      function handleDeleteClick() {
   
        fetch(`/reviews/${review.id}`, {
          method: &quot;DELETE&quot;,
    
        })
        handleDelete(review.id)
        
    
      } 
  
  
      return(
          &lt;div className=&quot;reviewcard&quot;&gt;
  
  
          
          &lt;img  className=&quot;cardimg&quot; src={image} /&gt;
          &lt;p&gt;&lt;/p&gt;
          &lt;h6&gt;{date}&lt;/h6&gt;
          &lt;h5&gt;{destination}&lt;/h5&gt;
          &lt;h5&gt;{seat}&lt;/h5&gt;
          &lt;Card.Text&gt;{description}&lt;/Card.Text&gt;
          &lt;Card.Title&gt;By {review.user.name}&lt;/Card.Title&gt;
          &lt;p&gt;&lt;/p&gt;
          &lt;h6&gt;Likes: {likes}&lt;/h6&gt;
           &lt;h6&gt;Dislikes: {dislikes}&lt;/h6&gt;
  
          &lt;br/&gt;
  
          &lt;Button  className =&quot;btn btn-success&quot;  &gt; &lt;/Button&gt;
  
          &lt;Button  className =&quot;btn btn-danger&quot;  &gt;  &lt;/Button&gt;
          &lt;hr /&gt;
          
          &lt;Button  className =&quot;btn btn-primary&quot; onClick={handleDeleteClick}  &gt;Delete&lt;/Button&gt;
          
            
      
          
          &lt;/div&gt;
      )
  }
  </code></pre>