project.rb

class Project < ApplicationRecord
  include AttachmentUploader[:file]
  has_one :proj_status, :foreign_key => "status_id", :primary_key => 'status_id'
  belongs_to :user
  has_many :comments, dependent: :destroy
  has_many :uploads, dependent: :destroy

  scope :newproj, lambda { where(:status_id < 1)}

  validates_presence_of :projname, {:message => "Project Name cannot be blank."}


end

projects show.html.erb

  <div class="text-center m-t-md">
                    <%= render 'uploads/form' %>
                 


                    </div>

projects_controller.rb

class ProjectsController < ApplicationController
  before_action :set_project, only: [:show, :edit, :update, :destroy]

  # GET /projects
  # GET /projects.json
  def index
    @projects = Project.joins(:proj_status)

  end

  # GET /projects/1
  # GET /projects/1.json
  def show
      @projects = Project.joins(:proj_status)
      @comments = Comment.where(project_id: @project).order("created_at DESC")
      @uploads = Upload.where(project_id: @project).order("created_at DESC")
  end

  # GET /projects/new
  def new
    @project = current_user.projects.build
    @projstatus = ProjStatus.all
    @pagetitle = "Create New Project"
  end

  # GET /projects/1/edit
  def edit
    @pagetitle = "Edit Project"
  end

  # POST /projects
  # POST /projects.json
  def create
    @project = current_user.projects.build(project_params)

    respond_to do |format|
      if @project.save
        format.html { redirect_to @project, notice: 'Project was successfully created.' }
        format.json { render :show, status: :created, location: @project }
      else
        format.html { render :new }
        format.json { render json: @project.errors, status: :unprocessable_entity }
      end
    end
  end

  # PATCH/PUT /projects/1
  # PATCH/PUT /projects/1.json
  def update
    respond_to do |format|
      if @project.update(project_params)
        format.html { redirect_to @project, notice: 'Project was successfully updated.' }
        format.json { render :show, status: :ok, location: @project }
      else
        format.html { render :edit }
        format.json { render json: @project.errors, status: :unprocessable_entity }
      end
    end
  end

  # DELETE /projects/1
  # DELETE /projects/1.json
  def destroy
    @project.destroy
    respond_to do |format|
      format.html { redirect_to projects_url, notice: 'Project was successfully destroyed.' }
      format.json { head :no_content }
    end
  end

  private
    # Use callbacks to share common setup or constraints between actions.
    def set_project
      @project = Project.find(params[:id])

    end

    # Never trust parameters from the scary internet, only allow the white list through.
    def project_params
      params.require(:project).permit(:projname, :startdate, :enddate, :installer, :createdby, :cpdcprojnum, :projmanager, :customername, :customerphone, :customeremail, :projtype, :building, :rooms, :description, :status_id, :file)
    end
end

upload.rb

class Upload < ApplicationRecord
  belongs_to :project
  belongs_to :user
  validates_presence_of :file, { message: "You must select a file to upload."}
end

uploads _form.html.erb

<%= form_for([@project, @upload || @project.uploads.build]) do |f| %>
<div>
  <%= error_messages_for(f.object) %>
</div>
    <div>
      <%= f.hidden_field :file, value: @project.cached_file_data %>
      <%= f.file_field :file %>
    </div>

    <div style="padding-top:20px;">
      <%= f.submit 'Upload File', :class => 'btn btn-primary' %>
    </div>
<% end %>

uploads_controller.rb

class UploadsController < ApplicationController

  before_action :find_project
  before_action :find_upload, only: [:destroy, :edit, :update, :upload_owner]
  before_action :upload_owner, only: [:destroy, :edit, :update]


  def new
    @upload = @project.uploads.build
  end

  def create
    @uploads = Upload.where(project_id: @project).order("created_at DESC")
    @upload = @project.uploads.new(params[:upload].permit(:file))
    @upload.user_id = current_user.id

    if @upload.save
      redirect_to project_path(@project), notice: 'upload was successfully created.'
    else
      render "projects/show"
    end
  end

  def edit
  end

  def update
    if @upload.update(params[:upload].permit(:file))
      redirect_to project_path(@project)
    else
      render 'edit'
    end
  end

  def destroy
    @upload.destroy
      redirect_to project_path(@project)
  end

  private
  def find_project
    @project = Project.find(params[:project_id])
  end

  def find_upload
    @upload = @project.uploads.find(params[:id])
  end

  def upload_owner
    unless current_user.id == @upload.user_id
      flash[:notice] = "You cannot modify a different users udpates."
      redirect_to @project
    end

  end

end