Mass assignment warning when using nested attributes with Devise

Question

I'm having trouble with nested attributes and Devise. A similar issue to How do I use nested attributes with the devise model. As far as I can tell I've got everything set up as recommended here: Override devise registrations controller

I've set up the associations for Users and Subscriptions, I have "accepts_nested_attributes_for", and included the :subscriptions_attributes in attr_accessible, but I get a warning from the Devise controller.

class User < ActiveRecord::Base
    devise :database_authenticatable, :registerable,:recoverable, :rememberable, :trackable, :validatable
    validates_presence_of :first_name, :last_name
    has_many :subscriptions
    accepts_nested_attributes_for :subscriptions
    attr_accessible :first_name, :last_name, :email, :password, :password_confirmation, :remember_me, :subscriptions_attributes    
    ... 
end

--

class Subscription < ActiveRecord::Base
  belongs_to :user
  validates_presence_of :user_id, :chargify_subscription_id, :chargify_product_handle
  attr_accessible :user_id, :chargify_subscription_id, :chargify_product_handle
  ... 
end

devise/registrations/new.html.erb :

<%= form_for(resource, :as => resource_name, :url => registration_path(resource_name)) do |f| %>
    <%= devise_error_messages! %>
    <p><%= f.label :first_name %><br />
      <%= f.text_field :first_name %></p>
    ...

    <%= f.fields_for :subscription do |s| %>
        <p><%= s.label :chargify_subscription_id %><br />
          <%= s.text_field :chargify_subscription_id %></p>
            ...

I'm getting the following warning:

Started POST "/users" for 127.0.0.1 at Sat May 14 12:38:49 -0700 2011
  Processing by Devise::RegistrationsController#create as HTML
  Parameters: {"commit"=>"Sign up", "authenticity_token"=>"wNZhZgIhYm9CpZfhvDiRBqaJseoO8QvR0Mk9VIybhcI=", "utf8"=>"✓", "user"=>{"password_confirmation"=>"[FILTERED]",        "last_name"=>"9", "subscription"=>{"chargify_product_handle"=>"medium", "chargify_subscription_id"=>"123"}, "password"=>"[FILTERED]", "first_name"=>"9", "email"=>"99@99.     com"}}
WARNING: Can't mass-assign protected attributes: subscription

I've tried using subscription_attributes (singular) in attr_accessible but that doesn't work.

Any suggestions for what I might be doing wrong? Thanks.

@ecoologic - that gives an `unknown attribute: subscription` error in `Devise::RegistrationsController#create`. Also tried `attr_accessible :subscriptions` but get my original error. — stupakov, May 14 '11 at 23:06

mbreining · Accepted Answer · 2011-05-15T01:24:59.200

5

Since you have a has_many association between your User and Subscription model, I believe you need to specify fields_for :subscriptions rather than fields_for :subscription.

<%= f.fields_for :subscriptions do |s| %>
    <p><%= s.label :chargify_subscription_id %><br />
      <%= s.text_field :chargify_subscription_id %></p>
        ...

The attributes within the fields_for scope will then be passed using the subscriptions_attributes parameter, which should work since you have attr_accessible :subscriptions_attributes.

For more examples of nested has_many association forms, check out the 'Nested Attributes Examples' section (one-to-many) of the Rails documentation.

edited May 15 '11 at 01:24

answered May 15 '11 at 01:19

mbreining

7,739
2
33
35

Yes this is it, then using `accept_nested_attributes_for :subscriptions` you don't even need to do check for `@user.save` to save `@subscriptions` in your controller! – ecoologic May 15 '11 at 12:01
Thanks - that did it. I originally thought `fields_for :subscriptions` was wrong because the subscriptions form fields were not getting rendered. However that was because `subscriptions` was not initialized by Devise::RegistrationsController. As suggested in http://stackoverflow.com/questions/3546289/override-devise-registrations-controller/4527049#4527049, we can build resource.subscriptions in the view. However I think that belongs in the controller, and now I'm having a problem with that: http://stackoverflow.com/questions/6005932/nested-model-not-available-in-devise-views. – stupakov May 15 '11 at 18:02

Mass assignment warning when using nested attributes with Devise

1 Answers1