module Api
  module V1
    class ToppingsController < ApplicationController

      before_action :user_admin?, only: [:create]

      def index
        @toppings = Topping.all
        render json: @toppings
      end

      def create
        topp = Topping.new topping_params
        if topp.save
          render json: {success: 'yeah success'}
        else
          render json: {error: 'Validation Error'}, status: 400
        end
      end

      private

      def user_admin?
        user = User.find_by_id user_id[:id]
        if !user || !user.is?(:admin)
          render json: {error: 'ya bozo'}, status: 403
          return
        end
      end

      def topping_params
        params.permit(:name, :extra_cost)
      end

      def user_id
        params.permit(:id)
      end

    end
  end
end

module Api
  module V1
    class ToppingsController < ApplicationController

      def index
        @toppings = Topping.all
        render json: @toppings
      end

      def create
        topp = Topping.new topping_params
        if topp.save
          render json: {success: 'yeah success'}
        else
          render json: {error: 'ya bozo'}
        end
      end

      def topping_params
        params.permit(:name, :extra_cost )
      end

    end
  end
end

--- 
+++ 
@@ -1,6 +1,8 @@
 module Api
   module V1
     class ToppingsController < ApplicationController
+
+      before_action :user_admin?, only: [:create]
 
       def index
         @toppings = Topping.all
@@ -12,12 +14,26 @@
         if topp.save
           render json: {success: 'yeah success'}
         else
-          render json: {error: 'ya bozo'}
+          render json: {error: 'Validation Error'}, status: 400
+        end
+      end
+
+      private
+
+      def user_admin?
+        user = User.find_by_id user_id[:id]
+        if !user || !user.is?(:admin)
+          render json: {error: 'ya bozo'}, status: 403
+          return
         end
       end
 
       def topping_params
-        params.permit(:name, :extra_cost )
+        params.permit(:name, :extra_cost)
+      end
+
+      def user_id
+        params.permit(:id)
       end
 
     end
Add role check for toppings create route
