Rails 4 - pundit - how to write if statement to check user permissions -

i'm trying learn how use pundit rails 4 app.

i have potential use policy. potential use table has attribute called :user_id.

i want users permitted update instances if created them. i'm trying figure out how update action work.

my current attempts shown below.

class potentialusepolicy < applicationpolicy      attr_reader :user, :record    def initialize(user, record)     @user = user     @record = record   end       def index?         true if user.is_admin?     end      def show?         true      end      def new?       true   end      def create?         new?     end      def update?         if @user.id == @potential_use.user_id          # if user.id == potential_use.user_id             true         else             false         end     end      def destroy?         update?     end      def edit?                 true     end      def potential_use         record     end   end 

when try these, keep getting errors saying:

undefined method `user_id' nil:nilclass 

i don't understand why message. when in console, can see entry has user id.

p = potentialuse.where(project_id: 26)   potentialuse load (0.5ms)  select "potential_uses".* "potential_uses" "potential_uses"."project_id" = $1  [["project_id", 26]]  => #<activerecord::relation [#<potentialuse id: 9, comment: "adsfsfdadfasdddxxddbbdd", project_id: 26, created_at: "2016-08-18 23:16:06", updated_at: "2016-08-24 01:06:00", user_id: 1, private_comment: false>]>  2.3.0p0 :016 >  

when in view (without trying use pundit policy, page renders right content, including user name (which accessed user_id).

the update action in potential use controller has:

def update     authorize @potential_use     respond_to |format|       if @potential_use.update(potential_use_params)         format.html { redirect_to @project, notice: 'potential use updated.' }         format.json { render :show, status: :ok, location: @potential_use }       else         format.html { render @project }         format.json { render json: @potential_use.errors, status: :unprocessable_entity }       end     end   end 

can see i've done wrong?

you access authorized objects accessors. in example probaly called

authorize @potential_use 

in controller update action. update? method on controller this:

def update?     user.id == record.user_id end