ForbiddenAttributesError in Rails 4 with a has_many polymorphic accepts_nested_attributes_for form

Question

Trying to create a address for my member model with a nested form.

model

class Member < ActiveRecord::Base
  has_many :addresses, :as => :addressable, dependent: :destroy

  accepts_nested_attributes_for :addresses
end

class Address < ActiveRecord::Base
  belongs_to :addressable, :polymorphic => true
end

controller

**new**
  @member = Member.new
  @member.addresses.build

**create**
  @member = Member.new(member_params)

**update**
  @member.update(member_params)
    # Am I doing this right? Haven't gotten this far in the process without error.

**private**
  # Never trust parameters from the scary internet, only allow the white list through.
  def member_params
    params.require(:member).permit(
      :first_name,
      :last_name,
      :birthdate,
      addresses_attributes: [:street1, :street2, :city, :state, :zip, :country, :id]
      )
  end

view

= simple_form_for @member do |f|
  = f.simple_fields_for :addresses do |address|
    = address.input :street1
    = address.input :street2
    = address.input :city
    = address.input :state
    = address.input :zip
    = address.input :country, :priority => [ "United States" ] 
  = f.submit "Save", class: "btn btn-success"

Error

ActiveModel::ForbiddenAttributesError

Using Pry

 pry(#<MembersController>)> member_params
    Unpermitted parameters: address
    => {}

 pry(#<MembersController>)> params
    => {"utf8"=>"✓",
    "_method"=>"patch",
    "authenticity_token"=>"44f8YqwLCuVKnKDC2uZUDodOjPtgi+EcJKPQh4IqwPA=",
    "member"=>{"address"=>{"street1"=>"1234 Fake St.", "street2"=>"", "city"=>"Tacoma", "state"=>"WA", "zip"=>"999999", "country"=>"US"}},
    "commit"=>"Save",
    "action"=>"update",
    "controller"=>"members",
    "id"=>"1"}

Hope someone can help! Thx! I don't see what the issue is... I'm pretty sure i'm accepting the nested attributes correctly, very curious to where I'm going wrong! I'm new to strong_parameters, so hopefully it's something simple...

UPDATE Followed suggestions and changed

= simple_fields_for :address do |address|

to

= simple_fields_for :addresses do |address|

and I also changed member_params to include :id for addresses_attributes

...
addresses_attributes: [:street1, :street2, :city, :state, :zip, :country, :id]
...

I also tried adding :member_id to addresses_attributes but I still get ForbiddenAttributesError

Anything else come to mind? :) thanks guys.

score 0 · Accepted Answer · answered Nov 17 '14 at 21:56

0

You don't have "addresses_attributes" in your params, you simply have "address". If you want the ability to input multiple addresses (which your data model suggests) then you need to change to something like this:

= simple_form_for @member do |f|
  = f.simple_fields_for :addresses do |address|
    = address.input :street1
...

As Andrey mentions in another answer you also need to add :id to your list of params in the address_attributes array, and :_destroy if you want to be able to remove addresses from the form as well.

answered Nov 17 '14 at 21:56

Michael Chaney

2,911
19
26

changed to =f.simple_fields_for :addresses and also added the :id attribute to member_params as Andre suggested, I still get the same ForbiddenAttributesError. – Morphiuz Nov 17 '14 at 22:12
You need to update your question and show what your params are now. – Michael Chaney Nov 18 '14 at 00:00
updated my question. Also, does my update action on my MemberController look like it would be correct? – Morphiuz Nov 18 '14 at 01:07
You didn't show the params. Your update is wrong - you just need to `@member.update(member_params)`. – Michael Chaney Nov 18 '14 at 01:17
Aha! I was having an issue with the simple_fields_for :addresses -- somehow I was viewing a old version of the browser cache and I was testing the html for the :address fields. Though, do I need a @member.addresses.build anywhere in the controller to make this work? otherwise the form doesn't render. I currently call the form in a modal on Member#show. Thanks for your help Michael! – Morphiuz Nov 18 '14 at 01:39
Yes, you need to build an address in order for one to show up, and generally you do that in the "new" action. If you're allowing multiple addresses, you can put together an "add" button and perhaps a "remove" button to allow standard maintenance of the data. – Michael Chaney Nov 18 '14 at 14:22

ForbiddenAttributesError in Rails 4 with a has_many polymorphic accepts_nested_attributes_for form

1 Answers1