class PostsController < ApplicationController
  def vote
    binding.pry
  end
 end

#posts/index.html.erb
 <div class='row'>
    <div class='span0 well text-center'>
      <%= link_to vote_post_path(post, vote: true), method: 'post' do %>

class PostsController < ApplicationController
  before_action :set_post, only: [:show, edit, :update, :vote]

def vote
  #post = Post.find(params[:id]) or use @post(created in the before_action)
  @vote = Vote.create(voteable: @post, creator: current_user, vote: params[:vote])

  if @vote.valid?
    flash[:notice] = "Your vote was recorded"
  else
    flash[:error] = "Your vote was not recorded"
  end
    redirect_to :back (to go back to the original page viewed)
  end
end

<div class='row'>
  <div class='span0 well text-center'>
    <%= link_to vote_post_path(post, vote: false), method: 'post' do %>

<%post.votes.size%>

class Post < ActiveRecord::Base
   def total_votes
    up_votes - down_votes
   end

   def up_votes
    self.votes.where(vote: true).size
   end

   def down_votes
    self.votes.where(vote: false).size
   end
 end

<% post.total_votes %>

class PostsController < ApplicationController

  def index
    @posts = Post.all(|x| x.total_votes).reverse
  end
end

class  Vote < ActiveRecord::Base
  validates_uniqueness_of :creator, scope: :voteable
end

def vote
  #post = Post.find(params[:id]) or use @post(created in the before_action)
  @vote = Vote.create(voteable: @post, creator: current_user, vote: params[:vote])
    ** We do not need to use strong_params because we are not using the key value
    pairs for mass assignment, instead we are hard coding in the keys.
  if @vote.valid?
    flash[:notice] = "Your vote was recorded"
  else
    flash[:error] = "Your vote was <strong>not</strong> recorded".html_safe
  end
    redirect_to :back #(to go back to the original page viewed)
end

"id, body, user_id, post_id, photo_id, video_id" to

 "id, body, user_id, commentable type, commentable_id"

commentable_type: must be the model name, capitialize first initial, string
 commentable_id: is the primary_key on the 1 side.

 commentable_type to commentable_id: is a composite foreign_key

Create votes table
  =>rails g migration create_votes

create_table :votes do |t|
  t.boolean :vote
  t.integer :user_id
  t.string :voteable_type
  t.integer :voteable_id
  t.timestamps
  end
end

t.references :voteable, polymorphic: true

class Vote < ActiveRecord::Base
  belongs_to :creator, class_name: 'User', foreign_key: 'user_id'
  belongs_to :voteable, polymorphic: true
end

class User < ActiveRecord::Base
  has_many :votes
end

class Post < ActiveRecord::Base
  has_many :votes, as: voteable
end

So in the console:
    v = Votes.first
    v.voteable => nil
    post = Post.first
    post.votes << v
    or another way to assign is
    v.votable = Comments.first
    v.save

#posts/index.html.erb
<div class='row'
  <div class='span0 well text-center'>
  <%= link_to '' do %>
    <i class='icon-arrow-up'></i>
    <% end %>
    <br/>
  <%= link_to '' do %>
    <i class='icon-arrow-down'></i>
    <% end %>
</div>

#routes.rb
Two ways....
a) POST/votes => 'VotesController#create'
  - needs to pass in two pieces of information (1 - whether its the post/comment
  being voted on, 2. The post/comment id
  - also this would create another top level resource)
  - best for if you're voting on alot of objects

        How to implement this in your routes:
        resources :votes, only: [:create]

b) POST/posts/3/vote => 'PostsController#vote'
POST/posts/3/comments/4/vote => 'CommentsController#vote'
    How to implement this in your routes, you must use something called a member, where
    each action will be exposed to the member of that url

    resources :posts, except: [:destroy] do

      member do
        post :vote
      end

      (where post is the member and vote is the action)


      **rake routes | grep vote
      vote_post POST /posts/:id/vote(.:format)   post#vote

# GET /posts/archives

  collection do
    get :archives
  end
  **rake routes | grep archives
  archives_posts GET /posts/archives(.:format)  posts#archives

#posts/index.html.erb
<div class='row'
  <div class='span0 well text-center'>
  <%= link_to vote_post_path(post) method: 'post' do %>
    <i class='icon-arrow-up'></i>
    <% end %>
    <br/>
  <%= link_to '' do %>
    <i class='icon-arrow-down'></i>
  <% end %>
</div>

def users_params
  params.require(:user).permit(:username, :password)
end

validates :password, presence: true, on: :create, length: {minimun: 3}

get '/register', to: 'users#new', as: 'register'

<li>
          <%= link_to 'Register', register_path %>

get '/login', to: 'sessions#new'
      post '/login', to: 'sessions#create'
      get '/logout', to: 'sessions#destroy'

class SessionsController < Application.rb
  def new
  end

  def create
    Let's write pseudo code:
    What are we trying to do... we want to run user.authenticate('password')
    How do we accomplish this?
    1. Get user object
    2. See if the password matches
    3. If so, log in
    4. If not, error message

    user = User.find_by(username: params[:username])
    # we can use a local variable bc we aren't using model backed forms so persistency isn't required.

    if user && user.authenticate(params[:password])
      session[:user_id] = user_id
      flash[:notice] = "You're logged in!"
      redirect_to root_path

      #never pass an object into sessions ( like @user for example)
      bc sessions only have 4KBs in bandwidth and will generate a "cookie overload error" after the user carries out
      so many actions.

    else
      flash[:error] = "There was something wrong with your username and password"
      #Avoid being too specific here, (i.e. found username but wrong password)... to prevent hacking
      redirect_to register_path
    end
  end


  #Login pages should be https://, if not, passwords submitted over an http:// server are not encrypted. The https://
  is not a very high added expense. You just have to purchase SSL certificate.


  def delete
    session[:user_id] = nil
    flash[:notice] = "You've logged out"
    redirect_to root_path
    end
  end

#_navigation.html.erb

    if logged_in?
      <li>Hi<%= current_user.username %></li>
  <li>
      <%= link_to "Log Out", logout_path %>
  </li>
    <% else %>
    <li>
      <%= link_to "Register", register_path %>
    </li>
    <li>
      <%= link_to "Log in", login_path %>
    <% end %>
    </li>

application_controller.rb

helper_method :current_user, :logged_in?

def current_user
  #Wpseudo-code
  #If current user, return the user obj
  #else return nil
    @current_user ||= User.find(session[user_id]) if session[:user_id]
  end
end

  def logged_in?
    !!current_user
  end
end

#posts/index.html.erb
<h3> Welcome </h3>
 <ul>
  <% @posts.each do |post| %>
  <li>
  <%= link_to post.title, post_path(post)
  <% if logged_in? %>
  [<%= link_to 'Edit', edit_post_path(post) %>]

#posts_controller.rb
  before_action :require_user,except: [:index, :show]

#application_controller.rb

  def require_user
    if !logged_in?
      flash[:notice] = "Must be logged in to do that"
      redirect_to root_path
  end

#comments_controller.rb
class CommentsController < ApplicationController.rb
before_action :require_user

  def create
    @comment.creator = current_user #change from @comment_creator = User.first
  end
end

#posts_controller.rb
  def create
    @post.creator = current_user
  end

** has_secured_password
** password_digest
** bcrypt
** validations
** helper methods
** before_action

post_path(post)

- Model backed helpers are tied to an object
  - There is slight syntactical difference:
        - non-model: text_field_tag :title
        - model: f.text_field :title

rake assets:precompile

- In terminal - rails g migration add_password_to_users
  _ Open migration file:
      - def change
        add_column :users, :password_digest, :string
  - rake db:migrate
2. Go to User model and add has_secure_password
3. Add 'bcrypt-ruby' to your gemfile - contains the complex algorithms to create our one-way hash
    Use 'bcrypt-ruby', =3.0.1 if you have installation problems during bundle intall

has_secure_password
4. has_secure_password has validations functionality where password cannot be blank, so add validations: false
        has_secure_password validations: false

Tip: Use gems that do one thing really well not multiple things.

5. has_secure_password gives us multiple methods we can now use:
      1. password setter: u.password = "apple", when run u.save, you will see that password is just a
      virtual attribute, and "apple" was saved to the password_digest column and encrypted using bcrypt.
      2. There is NO getter, so you can't run u.password and expect to get the value.
      3. But there is method called u.authenticate('password'), where you pass in a password that you are trying to check against
      in the database.
       - If the password is not correct, false will be returned.
       - If correct, the user will be returned.
       Authenticate is an instance method being called on the User class

def create
    @post = Post.find(params[:post_id])
    @comment = Comment.new(params.require(:comment).permit(:body))
    @comment.post = @post
  end

def create
    @post = Post.find(params[:post_id])
    @comment = @post.comments.build(params.require(:comment).permit(:body))
  end