Using SQL Foreign Key Constraints to Stop Rails User Manipulation - sql

Question

Hello my SQL and/or Rails friends.
Let's say we have two models:
class Hostel < ActiveRecord::Base
has_many :beds
end
class Bed < ActiveRecord::Base
belongs_to :hostel
end
When my user, a hostel owner, attempts to create a new booking, the params come in like so:
{bed_id: 12, start_date: "2017-10-13", end_date: "2017-10-15",...}
The bed_id comes from a dropdown menu showing all the current_user's bed names. The id is passed with the rest of the form data. Now, in the BookingsController, I have to manually make sure that a hacker doesn't manipulate the bed_id variable to a bed they don't own.
class BookingsController < ApplicationController
def create
#bed = current_user.beds.where(id: params[:bed_id]).first
if #bed
# create hostel booking
else
# this happens when the user willfully changes the bed_id
# number using DevTools
end
end
I don't mind verifying the user inputs this way, but I was wondering if there's a way to utilize SQL and/or foreign key constraints to make sure that a user doesn't create a booking using a bed that doesn't belong to them?
Here's some pidgin SQL that kind of demonstrates what I'm looking for. Basically, making the database validate that the user_id of the bed_id being used is that of the current_user's ID.
INSERT INTO bookings (start_date, end_date, bed_id, user_id)
VALUES ("2017-10-13", "2017-10-15", 12, 1)
UNLESS (SELECT * FROM beds WHERE id = 12).user_id != current_user.id
# what I'm doing above is verifying that bed #12 has a user_id that
# is the same as the current user's ID. That way, if a user
# manipulates the params, SQL catches it.
EDIT:
Here's a better question:
In Rails, I can open the console and create a new reservation manually:
Booking.new(user_id: 1, bed_id: 12, start: "2017-10-13", end: "2017-10-15")
and the database will create the record, even though the bed with ID #12 does not belong to user #1. Is there anyway to make SQL reinforce these constraints?

Answer 1

I know it is not exactly what was asked, but...
my preferred solution would be to do it in rails, which gives you better control and is platform independent.
(sorry I cannot validate this easily, but it should give you the idea)
class BookingsController < ApplicationController
before_action :check_authorisation, only: :create
def check_authorisation
unless current_user.beds.where(id: params[:bed_id]).first
flash[:danger] = "You are not authorised to access this section"
redirect_to home_url # halts request cycle need to adjust home_url to appropriate
end
end