playlist.rb

class Playlist < ApplicationRecord
  belongs_to :site
  belongs_to :customer
  belongs_to :user

  acts_as_tenant :site

  validates_presence_of :title, :content

  attr_accessor :spam_answer

  has_many :playlist_items, dependent: :destroy

  accepts_nested_attributes_for :playlist_items, allow_destroy: true, reject_if: :all_blank
  validates_associated :playlist_items

  enum status: { draft:0, published:1}

  include ImageUploader[:image]

  def to_param
    [id, title.parameterize].join('-')
  end

end

playlist_item.rb

class PlaylistItem < ApplicationRecord
  belongs_to :site
  belongs_to :playlist
  belongs_to :listable, polymorphic: true

  acts_as_tenant :site

  validates_presence_of :listable_id, :listable_type

  validates_uniqueness_to_tenant :playlist_id, scope: [:listable_id, :listable_type]

  attr_accessor :content_url

end

playlists_controller.rb

class PlaylistsController < ApplicationController

  LISTABLES = {
    'Course'      => Course,
    'Lesson'      => Lesson,
    'Post'        => Post,
    'LiveStream'  => LiveStream,
    'Download'    => Download,
    'Project'     => Project,
    'Exercise'    => Exercise,
    'Quiz'        => Quiz
  }

  before_action :set_playlist, except: [:index, :new, :create]
  before_action :set_authorized_editor, only: [:edit, :save_order, :update, :destroy]
  before_action :redirect_if_plugin_not_activated, :authenticate_customer!, except: [:index, :show]
  before_action :status_protect, only: :show

  def index
    @playlists = Playlist.published.order(created_at: :desc).paginate(page:params[:page])
  end

  def show
  end

  def new
    @playlist = Playlist.new
    @playlists = user_signed_in? ? current_user.playlists : (customer_signed_in? ? current_customer.playlists : nil)

    if params[:listable_type].present?
      klass = LISTABLES.fetch(params[:listable_type])
      @listable = klass.find(params[:listable_id])
    end
  end

  def edit
  end

  def create
    @playlist = Playlist.new(playlist_params)
    @playlist.user = current_user if user_signed_in?
    @playlist.customer = current_customer if customer_signed_in?

    respond_to do |format|
      if (params.dig('playlist', 'spam_answer') != current_tenant.site_plugins.find_by_slug('playlists').data['spam_answer'])
        redirect_to new_playlist_path, danger: 'Playlist not created.'
      elsif @playlist.save
        format.html{ redirect_to edit_playlist_path(@playlist), success:'Playlist created!' }
        format.js{}
      else
        format.html{ render :new }
        format.js{}
      end
    end
  end

  def update
    if @playlist.update(playlist_params)
      redirect_to edit_playlist_path(@playlist), success: 'Playlist was successfully updated.'
    else
      render :edit
    end
  end

  # DELETE /projects/1
  def destroy
    @playlist.destroy
    redirect_to playlists_url, success: 'Playlist was successfully destroyed.'
  end

  def save_order
    ids = params[:item_ids] ? params[:item_ids].reject(&:blank?) : nil
    if ids
      @playlist.playlist_items.where(id:ids).update_all(["ordinal = (STRPOS(?, ','||lpad(cast(id as text), 20, '0')||',') - 1)/21 + 1", ",#{ids.map{|x| "%020d" % x }.join(',')},"])
    end
  end

  private

    def set_playlist
      @playlist = Playlist.find(params[:id])
    end

    def set_authorized_editor
      redirect_to playlists_path unless (
        ( current_customer && (current_customer == @playlist.customer) ) ||
        ( current_user && (current_user == @playlist.user) ) ||
        ( current_user && current_user.can_access_site?(current_tenant) )
      )
    end

    def redirect_if_plugin_not_activated
      redirect_to site_root_path unless current_tenant.plugin_activated?('playlists')
    end

    def playlist_params
      params.require(:playlist).permit(:title, :content, :status, :image, :remove_image, :playlist_items_attributes => [:id, :listable_id, :listable_type, :content_url, :_destroy])
    end

    def status_protect
      redirect_to root_url if (!@playlist || @playlist.status == 'draft') && (!user_signed_in? || (!current_user.can_access_site?(current_tenant) && !current_user.role?(:admin)) )
    end
end