All the little details

app/controllers/suppliers/employee_shifts_controller.rb

@@ -2,6 +2,11 @@ module Suppliers
   class EmployeeShiftsController < Suppliers::ApplicationController
     def index
       @employee_shifts = EmployeeShift.for_supplier(current_supplier, relevant_from: 1.week.ago)
+      @employee_shifts.include_relation(:employee)
+      # Only select shifts from currently linked and employees
+      @employee_shifts.select! do |shift|
+        current_supplier.employee_ids.include?(shift.employee.try(:id))
+      end
       render json: @employee_shifts, each_serializer: Suppliers::EmployeeShiftSerializer
     end
     def create

app/controllers/suppliers/employees_controller.rb

@@ -18,10 +18,11 @@ module Suppliers
     # POST /employees
     # POST /employees.json
     def create
-      @employee = Employee.new(employee_params)
+      @employee = Employee.find_by_email(employee_params[:email]) if employee_params[:email].present?
+      @employee ||= Employee.new(employee_params)
 
       if @employee.save
-        current_supplier.add_employee @employee
+        current_supplier.add_employee @employee unless current_supplier.employee_ids.include? @employee.id # already linked
         render json: @employee, serializer: Suppliers::EmployeeSerializer, status: :created
       else
         render json: {errors: @employee.errors}, status: :unprocessable_entity
@@ -47,8 +48,9 @@ module Suppliers
     # DELETE /employees/1.json
     def destroy
       @employee = Employee.find(params[:id])
-      render json: {}, status: :forbidden unless @employee.supplier_id == current_supplier.id
-      @employee.destroy
+      render json: {}, status: :forbidden unless current_supplier.employee_ids.include?(@employee.id)
+      head :forbidden and return if @employee == current_employee # do not remove self at the moment
+      current_supplier.remove_employee @employee
 
       respond_to do |format|
         format.json { head :no_content }