Users can create posts, view posts, mark posts as spam, view categories

I also think this will not let spam through since you are not permitting the attribute. I would split to multiple lines for ease of reading:

``` ruby
params
  .require(:post)
  .premit(:title, :body, :spam)
  .merge(user_id: current_user.id)
```