controller.rb

class TutorialsController < ApplicationController
  before_action :set_tutorial, only: [ :show ]
  before_action :correct_user, only: [ :show, :edit, :update, :destroy ]
  before_action :authenticate_user!
  
  ...
  ...
  ...
  
  private
    # Use callbacks to share common setup or constraints between actions.
    def set_tutorial
      @tutorial = Tutorial.find(params[:id])
    end

    def correct_user
      @tutorial = current_user.tutorials.find_by(id: params[:id])
    end

    # Never trust parameters from the scary internet, only allow the white list through.
    def tutorial_params
      params.require(:tutorial).permit(:title, :author, :description, :user_id)
    end
end