Unpermitted Parameters: profile (NestedAttribu

Question

This question has many times asking by others user but still not solved my problem here. Im having a problem with my rails apps where error "Unpermitted Parameters: profile" appear.

user_controller.rb

class Admin::UsersController < ApplicationController
  before_filter :set_user, only: [:edit, :update]
  before_filter :store_location, only: [:index]
  before_filter :require_admin

  def edit
    if @user
      render
    else
      redirect_to admin_users_path, notice: "User profile not found."
    end
  end

  def update
    # Rails.logger.debug "===> (1)"
    if @user.update(user_params)
      redirect_to edit_admin_user_path, notice: "#{@user.profile.full_name} account has been updated."
    else
      render 'edit'
    end
  end

  private

  def set_user
    @user = User.find(params[:id])
  end

  def user_params
    params.require(:user).permit(:id, :username, :email, profile_attributes: [:user_id, :full_name])
  end
end

edit.html.erb

<%= form_for :user, url: admin_user_path(@user), method: :patch do |f| %>

  <div class="form-group">
    <%= f.label :username %><br>
    <%= f.text_field :username, :class => "form-control" %>
  </div>

  <%= f.fields_for :profile, @user.profile do |profile| %>

  <div class="form-group">
    <%= profile.label :full_name %><br>
    <%= profile.text_field : full_name, :class => "form-control" %>
  </div>

  <% end %>

  <div class="form-group">
    <%= f.submit "Save", :class => "btn btn-primary" %>
  </div>

<% end %>

User.rb

class User < ActiveRecord::Base

  has_one :profile
  accepts_nested_attributes_for :profile #, update_only: true, allow_destroy: true

  validates :username, :uniqueness => { :case_sensitive => false }

end

Profile.rb

class Profile < ActiveRecord::Base

  belongs_to :user

  validates_presence_of :user_id
  validates_presence_of :full_name

end

development.log

Started PATCH "/master/users/7" for 127.0.0.1 at 2014-09-10 23:18:26 +0800
  Parameters: {"utf8"=>"✓", "authenticity_token"=>"23oUfOBaYAmcrfhW3R11F1x53lJAT760Shv0HqkmEzw=", "user"=>{"username"=>"lisa", "profile"=>{"full_name"=>"Evalisa Andriaasdasda"}}, "commit"=>"Save", "id"=>"7"}
[1m[35mUser Load (0.3ms)[0m  SELECT  `users`.* FROM `users`  WHERE `users`.`id` = 7 LIMIT 1
[1m[36mUser Load (0.3ms)[0m  [1mSELECT  `users`.* FROM `users`  WHERE `users`.`id` = 6  ORDER BY `users`.`id` ASC LIMIT 1[0m
Unpermitted parameters: profile
[1m[35m (0.2ms)[0m  BEGIN
[1m[36mUser Exists (0.4ms)[0m  [1mSELECT  1 AS one FROM `users`  WHERE (`users`.`username` = 'lisa' AND `users`.`id` != 7) LIMIT 1[0m
[1m[35m (0.2ms)[0m  COMMIT
[1m[36mProfile Load (0.4ms)[0m  [1mSELECT  `profiles`.* FROM `profiles`  WHERE `profiles`.`user_id` = 7 LIMIT 1[0m

I really don't know where is the mistake. Please help.

Thanks in advance!

Answer 1

Ah, I solved my own question. For those out there, here is the solution:-

From development.log, i notice something that is "profile" => {}. It SHOULD BE "profile_attributes" => {} so I modified my edit.html.erb form to:-

<%= form_for :user, url: admin_user_path(@user), method: :patch do |f| %>

  <div class="form-group">
    <%= f.label :username %><br>
    <%= f.text_field :username, :class => "form-control" %>
  </div>

  <%= f.fields_for :profile_attributes, @user.profile do |profile| %>

  <div class="form-group">
    <%= profile.label :full_name %><br>
    <%= profile.text_field :full_name, :class => "form-control" %>
  </div>

  <% end %>

  <div class="form-group">
    <%= f.submit "Save", :class => "btn btn-primary" %>
  </div>

<% end %>

Then, I got another error said in development.log:-

ActiveRecord::RecordNotSaved (Failed to remove the existing associated profile. The record failed to save after its foreign key was set to nil.):

So again, I update my user.rb to have:-

class User < ActiveRecord::Base

  has_one :profile
  accepts_nested_attributes_for :profile, update_only: true, allow_destroy: true

  validates :username, :uniqueness => { :case_sensitive => false }
end

Answer 2

Update your user_params method to include all of the attributes from the profile object. You are missing the id so rails is trying to create the profile object and this causes undesired behavior (Your development log shows you are making a PATCH request, so you are trying to update something, not create something):

def user_params
  params.require(:user).permit(:id, :username, :email, profile_attributes: [:id, :user_id, :full_name])
end

You may also have to update your form to actually pass the id of the profile object.

See this answer for another look: https://stackoverflow.com/a/17561608/1026898