Protected Show

pacientes_controller.rb

class PacientesController < ApplicationController
  before_action :protected_show, only: [:show]

  def show
    @paciente = Paciente.find(params[:id])
  end
  
  private
    def protected_show
      unless clinica_logada.pacientes.where(id: params[:id]).any?
        render file:  "public/404.html", status:  404, layout:  false
      end
    end
end