Stub project access control for users

app/controllers/concerns/project_scoped.rb

@@ -0,0 +1,12 @@
+module ProjectScoped
+  extend ActiveSupport::Concern
+
+  included do
+    before_action :set_project
+  end
+
+  private
+    def set_project
+      @project = Current.user.projects.find(params[:project_id])
+    end
+end

app/controllers/projects/users_controller.rb

@@ -0,0 +1,24 @@
+class Projects::UsersController < ApplicationController
+  include ProjectScoped
+
+  before_action :set_user, except: %i[ index ]
+
+  def index
+    @users = @project.users
+  end
+
+  def create
+    @project.accesses.create_or_find_by!(user: @user)
+    redirect_to project_users_url(@project)
+  end
+
+  def destroy
+    @project.accesses.destroy_by(user: @user)
+    redirect_to project_users_url(@project)
+  end
+
+  private
+    def set_user
+      @user = Current.account.users.find(params[:id])
+    end
+end

app/models/user.rb

@@ -9,6 +9,7 @@ class User < ApplicationRecord
 
   has_many :accesses, dependent: :destroy
   has_many :projects, through: :accesses
+  has_many :bubbles, through: :projects
 
   normalizes :email_address, with: ->(value) { value.strip.downcase }
 

app/views/projects/users/index.html.erb

@@ -0,0 +1,7 @@
+<h1>Users on <%= @project.name %></h1>
+
+<ul>
+  <% @users.each do |user| %>
+    <li><%= user.name %> <%= link_to "X", project_user_path(@project, user), data: { turbo_method: :delete } %></li>
+  <% end %>
+</ul>

config/routes.rb

@@ -3,7 +3,9 @@ Rails.application.routes.draw do
 
   resource :session
 
-  resources :projects
+  resources :projects do
+    resources :users, controller: "projects/users"
+  end
 
   resources :bubbles do
     resource :image, controller: "bubbles/images"