documentcloud/backbone — Issue #1066: model.destroy foreign key
Author: meskyanichi
Created: 2012-03-04 02:48:31+00:00
State: open

Hi,

How does one go about deleting nested resources that need to be authorized server-side? I'm using Backbone in a Rails app and I have multiple nested layers and I am obviously not going to just let anyone delete any resource without proper authorization.

So I have the standard `current_user` as my "session" method, which I scope everything through, but now I need to go two levels (or more) deep, this is when the issues arise.

Here's a basic example: User > Post > Comment

Server-side controller

```ruby
class CommentsController < ApplicationController
respond_to :json

def destroy
respond_with current_user.posts.find(params[:post_id]).comments.find(params[:id]).destroy
end
end
```

In CoffeeScript:

```coffee
comment.destroy()
```

In the shell:

```shell
Started DELETE "/comments/4f52d3518aa92a91e4000003"
```

It hits the proper URL, but it would be nice to somehow be able to pass in the foreign key for the post model so I don't have to first load every Post by the current user in memory on the server just to map through them to find the comment.

So I tried something like this:

```coffee
comment.destroy({data: { post_id: comment.get("post_id") }})
```

Then, printing out the params on the DELETE request: `Parameters: {"object Object"=>nil, "id"=>"4f52d5878aa92a9203000004"}`

I also tried it without nesting the params in `data:` but that didn't help: ` Parameters: {"id"=>"4f52d5878aa92a9203000004"}`

So if I didn't just overlook it, and this is not supported, can anyone tell me how one handles the deletion of nested resources?

Thanks!