Can't mass-assign protected attributes in multistep form

Question

I'm doing something I thought would be quite simple that's ended up being very complicated. I've followed this Railscasts to create a multistep form. Now I'm trying to nest a form in Order views to create a parent Customer if one doesn't already exist inside of it (see this question).

Basically, I want a customer to be created to own an order if they don't already exist. Am I going about this the wrong way?

At present, I get

Can't mass-assign protected attributes: customer_attributes

when I have Orders belongs_to :customers. But that seems most logical to me? I've put the code below.

Customer Model:

class Customer < ActiveRecord::Base
  attr_accessible :address_1, :address_2, :email, :name, :phone, :user_id

  belongs_to :user
end

Order Model:

class Order < ActiveRecord::Base
  attr_accessible :customer_id, :format, :message, :phone, :quantity

  belongs_to :customer
  accepts_nested_attributes_for :customer
  attr_writer :current_step

...

Relevant Order controller methods:

  # GET /orders/new
  # GET /orders/new.json
  def new
    session[:order_params] ||= {}
    @order = Order.new(session[:order_params])
    @order.build_customer(session[:order_params])
    @order.current_step = session[:order_step]
  end

  # POST /orders
  # POST /orders.json
  def create
    session[:order_params].deep_merge!(params[:order]) if params[:order]
    @order = Order.new(session[:order_params])
    @order.current_step = session[:order_step]
    if params[:back_button]
      @order.previous_step
    elsif @order.last_step?
      @order.save
    else
      @order.next_step
    end
    session[:order_step] = @order.current_step

    if @order.new_record?
      render 'new'
    else
      session[:order_step] = session[:order_params] = nil
      flash[:notice] = "Order saved."
      redirect_to @order
    end
  end

views/orders/new

%h1 New order

= form_for(@order) do |f|
  - if @order.errors.any?
    #error_explanation
      %h2
        = pluralize(@order.errors.count, "error")
        prohibited this order from being saved:
      %ul
        - @order.errors.full_messages.each do |msg|
          %li= msg
  = render "#{@order.current_step}_step", :f => f 
  = f.submit "Continue"
  = f.submit "Back", :name => "back_button" unless @order.first_step?

The partial view in which I'm trying to nest the form:

.field
  = f.label :quantity    
  = f.text_field :quantity

%h3
  Customer details

=f.fields_for :customer do |builder|
  =builder.label :name
  =builder.text_field :name

  =builder.label :email
  =builder.text_field :email

Hopefully that's everything. I've done nested forms before, but never in combination with a multistep form. Any help would be really appreciated.

Yes, sorry - I thought it was something to do with the multistep form. It's not, so I've accepted the answer below. — Nick

apneadiving apneadiving · Accepted Answer · 2013-04-29T12:24:29

Yes, you need both:

attr_accessible :customer_attributes, :customer_id, :format, :message, :phone, :quantity
accepts_nested_attributes_for :customer

attr_accessible tells Rails those attributes area allowed.

accepts_nested_attributes_for tells rails to delegate attributes to an other class.

Can't mass-assign protected attributes in multistep form

1 Answers