Let’s say I have a route /authors/:id, and its partial is lazily loading the author books in a table with a lazy loading turbo_frame_tag, via the route author/:id/books, this table also have show, delete, update, routes for each table row to allow updating, deleting a book.

now everything works fine, but now users can access /authors/:id/books if they have typed the url and the other show, destroy, update routes, how can I restrict access to these pages if not in the context of author’s show page?