Many-to-Many Nested Attributes in Rails 4 (with strong parameters)

Question

I have been trying to figure this one out for a few days now. I am using Rails 4 (with the updated mass assignment technique) and trying to use nested attributes with a many-to-many relationship. My record is saving to the DB but everything is nil and I'm getting an "Unpermitted parameters: school, alumnis, prospects" error in my logs.

Here's what I have:

referral.rb

class Referral < ActiveRecord::Base
 belongs_to :school
 belongs_to :alumni
 belongs_to :prospect
end

alumni.rb

class Alumni < ActiveRecord::Base
  has_many :referrals
  has_many :prospects, through: :referrals

  accepts_nested_attributes_for :referrals
end

school.rb

class School < ActiveRecord::Base
  has_many :referrals
  has_many :prospects, through: :referrals
  has_many :alumnis, through: :referrals

  accepts_nested_attributes_for :referrals
end

prospect.rb

class Prospect < ActiveRecord::Base
  has_many :referrals
  has_many :alumnis, through: :referrals

  accepts_nested_attributes_for :referrals
end

referrals_controller.rb

def create
  @referral = Referral.create(referral_params)

  respond_to do |format|
    if @referral.save
      # ReferralMailer.referrer_email(@referral).deliver
      # ReferralMailer.referral_email(@referral).deliver
      format.html { redirect_to @referral, notice: 'Referral was successfully created.' }
      format.json { render action: 'show', status: :created, location: @referral }
    else
      format.html { render action: 'new' }
      format.json { render json: @referral.errors, status: :unprocessable_entity }
    end
  end
end

private
  # Use callbacks to share common setup or constraints between actions.
  def set_referral
    @referral = Referral.find(params[:id])
  end

  # Never trust parameters from the scary internet, only allow the white list through.
  def referral_params
    params.require(:referral).permit(prospects_attributes: [:first_name, :last_name, :email], alumnis_attributes: [:first_name, :last_name, :email], schools_attributes: [:name])

  end

_form.html.erb

<%= form_for(@referral) do |f| %>
  <% if @referral.errors.any? %>
    <div id="error_explanation">
      <h2><%= pluralize(@referral.errors.count, "error") %> prohibited this referral from being saved:</h2>

      <ul>
      <% @referral.errors.full_messages.each do |msg| %>
        <li><%= msg %></li>
      <% end %>
      </ul>
    </div>
  <% end %>

  <%= f.fields_for :school do |builder| %>
    <%= builder.label :name, "School Name" %>
    <%= builder.text_field :name %>
  <% end %>

  <%= f.fields_for :alumnis do |builder| %>
    <%= builder.label :first_name, "First Name" %>
    <%= builder.text_field :first_name %>

    <%= builder.label :last_name, "Last Name" %>
    <%= builder.text_field :last_name %>

    <%= builder.label :email, "Email" %>
    <%= builder.text_field :email %>
  <% end %>

  <%= f.fields_for :prospects do |builder| %>
    <%= builder.label :first_name, "First Name" %>
    <%= builder.text_field :first_name %>

    <%= builder.label :last_name, "Last Name" %>
    <%= builder.text_field :last_name %>

    <%= builder.label :email, "Email" %>
    <%= builder.text_field :email %>
  <% end %>
  <div class="actions">
    <%= f.submit %>
  </div>
<% end %>

server log output

Processing by ReferralsController#create as HTML
  Parameters: {"utf8"=>"✓", "authenticity_token"=>"Ee+rREUU/0wGzNFTEaMxr8oRStaA53X9fmDrlVRyrD8=", "referral"=>{"school"=>{"name"=>"asdf"}, "alumnis"=>{"first_name"=>"asdf", "last_name"=>"asfd", "email"=>"asdf"}, "prospects"=>{"first_name"=>"asdf", "last_name"=>"asdf", "email"=>"asdf"}}, "commit"=>"Create Referral"}
Unpermitted parameters: school, alumnis, prospects
   (0.1ms)  begin transaction
  SQL (0.5ms)  INSERT INTO "referrals" ("created_at", "updated_at") VALUES (?, ?)  [["created_at", Fri, 12 Jul 2013 03:49:06 UTC +00:00], ["updated_at", Fri, 12 Jul 2013 03:49:06 UTC +00:00]]
   (0.6ms)  commit transaction
   (0.1ms)  begin transaction
   (0.1ms)  commit transaction
Redirected to http://localhost:3000/referrals/68

Referral Record

=> #<Referral id: 68, created_at: "2013-07-12 03:49:06", updated_at: "2013-07-12 03:49:06", school_id: nil, alumni_id: nil, prospect_id: nil>

Answer 1

You should pass also 'id' in each of your nested model params try :

def referral_params
    params.require(:referral).permit(prospects_attributes: [:id,:first_name, :last_name, :email], alumnis_attributes: [:id,:first_name, :last_name, :email], schools_attributes: [:id,:name])    
end

Have swing

Cheers

Answer 2

You parameters are not being past to the controller as strong parameters is expecting.

From you server log:

"referral" => {
  "school"  => { 
     "name" => "asdf" }, 
  "alumnis" => { 
    "first_name" => "asdf", 
    "last_name"  => "asfd", 
    "email"      => "asdf" 
  }, 
  "prospects" => {
    "first_name" => "asdf", 
    "last_name"  => "asdf", 
    "email"      => "asdf" 
  }
 }

Strong parameters is expecting prospects_attributes, alumnis_attributes and schools_attributes so prospects, alumnis and school are getting blocked and the objects are getting created without any attributes.