Rails Nested Form - Unpermitted Parameters

Question

I have an Orders model that has many Items and Customers. For some reason, and I have looked high and low for a solution, I am unable to save the attributes for Items and Customers in their respected tables when using a nested form.

I'm relatively new to Rails, so my apologies if I've missed something obvious.

Started POST "/orders" for ::1 at 2017-05-16 16:12:17 -0600 Processing by OrdersController#create as HTML Parameters: {"utf8"=>"✓", "authenticity_token"=>"k1QPQ560j44Mx0SNeCMBQAUGLQfEi4g0QpDfHuYeP4Zd7nVgcHJf3qXNsVQv29dV+5G0oJ7wiaoQ3Idw+DP+iw==", "order"=>{"customer"=>{"name"=>"Test", "email"=>"Test", "phone"=>"Test"}, "item"=>{"name"=>"Test", "ref_num"=>"Test", "retail"=>"122"}, "status"=>"Test", "arrival"=>"06/06/19", "tracking"=>"Test439"}, "commit"=>"Save Order"} Unpermitted parameters: customer, item

Orders Controller

    def create
        @order = Order.new(order_params)
        @order.items.build
        @order.customers.build
        @order.save
        redirect_to @order 
    end
private
    def order_params
    params.require(:order).permit(:status, :arrival, :tracking, 
        customers_attributes: [:name, :phone, :email], 
        items_attributes: [:name, :ref_num, :retail])
    end

Orders Model

class Order < ApplicationRecord
    has_many :items
    has_many :customers
    accepts_nested_attributes_for :items, :customers
end

Orders Form (New)

<%= form_for :order, url: orders_path do |f| %>

<%# customer parameters%>
<%= f.fields_for :customers do |cu| %>
   <p>
    <%= cu.label :customer_name %><br>
    <%= cu.text_field :name %>
  </p>

  <p>
    <%= cu.label :email %><br>
    <%= cu.text_field :email %>
  </p>

  <p>
    <%= cu.label :phone %><br>
    <%= cu.text_field :phone %>
  </p>
<% end %>

 <%# Item parameters %>

 <%= f.fields_for :items do |it| %>

  <p>
    <%= it.label :item_name %><br>
    <%= it.text_field :name %>
  </p>

  <p>
    <%= it.label :reference_number %><br>
    <%= it.text_field :ref_num %>
  </p>

  <p>
    <%= it.label :retail %><br>
    <%= it.text_field :retail%>
  </p>
<% end %>

<%# order parameters%>
  <p>
    <%= f.label :status %><br>
    <%= f.text_field :status %>
  </p>

  <p>
    <%= f.label :est_arrival %><br>
    <%= f.text_field :arrival %>
  </p>

 <p>
    <%= f.label :tracking %><br>
    <%= f.text_field :tracking %>
</p>


  <p>
    <%= f.submit %>
  </p>

 <% end %>
<%= link_to 'Back', orders_path %>

Is this really coming from this form? I don't see anything wrong with the form at first glance at least. — Eyeslandic
Try using form_for @order on your form instead, and instantiating @order = Order.new on your new action — ErvalhouS

ErvalhouS ErvalhouS · Accepted Answer · 2017-05-17T14:43:42

This is happening because form_for :order doesn't make reference to your model object, it makes a simple :order param, which doesn't takes into consideration your model's accepts_nested_attributes_for, thus not building f.fields_for :customers with _attributes suffix. You should instantiate a Order object for the expected behavior to happen in your form_for @object instead of just referencing a :object which renders only the name of the param.

Rails Nested Form - Unpermitted Parameters

1 Answers