rails

Rails

Expert Ruby on Rails development with Rails 7/8 conventions, security hardening, and performance patterns.

Rails Version Awareness

These instructions target Rails 7+ / Rails 8. Key modern defaults:

• Propshaft (Rails 8) or Sprockets (7) for assets
• bin/importmap for JS by default — avoid Webpacker
• Solid Queue replaces Sidekiq in default Rails 8 stack
• authenticate DSL built into Rails 8 (no Devise needed for simple cases)
• SQLite in production is now a first-class option with Litestream

Models

class User < ApplicationRecord
  has_many :posts, dependent: :destroy
  has_secure_password  # BCrypt hashing; adds authenticate()

  validates :email, presence: true,
                    uniqueness: { case_sensitive: false },
                    format: { with: URI::MailTo::EMAIL_REGEXP }
  normalizes :email, with: ->(e) { e.strip.downcase }
end

• Use normalizes (Rails 7.1+) instead of before_validation for simple transformations
• Avoid fat callbacks — use service objects or form objects for complex workflows
• Scope query logic to the model: scope :published, -> { where(published: true) }
• Use includes to prevent N+1: Post.includes(:author).limit(20)

Controllers

class PostsController < ApplicationController
  before_action :authenticate_user!
  before_action :set_post, only: %i[show edit update destroy]

  def create
    @post = current_user.posts.build(post_params)
    if @post.save
      redirect_to @post, notice: t('.created')
    else
      render :new, status: :unprocessable_entity
    end
  end

  private

  def set_post
    @post = current_user.posts.find(params[:id])
  end

  def post_params
    params.require(:post).permit(:title, :body, :published)
  end
end

• Always scope finds through the current user's association — never Post.find(params[:id]) bare
• Return status: :unprocessable_entity on failed render so Turbo handles it correctly
• Use respond_to blocks only when you need both HTML and JSON; otherwise keep it simple