Unpermitted Parameters with Strong Params with many-to-many relationship

Question

I have a has and belongs to many relationship setup like so:

has_and_belongs_to_many :players, :class_name => "User" # In app/models/team.rb
has_and_belongs_to_many :teams                          # In app/models/user.rb

I'm using a form to create a team, after already having created users. Here is my teams controller:

def create
  @team = Team.create(team_params)
end

private
def team_params
  params.require(:team).permit(:name,:captain,:season,:year,:active,:player_ids)
end

And everything saves except for the players (users). Here is what is output on the console:

Started POST "/teams" for 127.0.0.1 at 2013-10-20 01:46:04 -0400
Processing by TeamsController#create as HTML
  Parameters: {"utf8"=>"✓", "authenticity_token"=>"jhNUgdfSVNxBgpZkmvjSQg/7DGsV1ts+Y1a1xWQ6A1Y=", "team"=>{"name"=>"uuuuu", "captain"=>"18", "season"=>"Summer", "year"=>"2013", "player_ids"=>["", "18"]}, "button"=>""}
  User Load (1.4ms)  SELECT "users".* FROM "users" WHERE "users"."id" = 18 ORDER BY "users"."id" ASC LIMIT 1
Unpermitted parameters: player_ids
   (0.2ms)  BEGIN
  SQL (3.4ms)  INSERT INTO "teams" ("captain", "created_at", "name", "season", "updated_at", "year") VALUES ($1, $2, $3, $4, $5, $6) RETURNING "id"  [["captain", 18], ["created_at", Sun, 20 Oct 2013 05:46:04 UTC +00:00], ["name", "uuuuu"], ["season", "Summer"], ["updated_at", Sun, 20 Oct 2013 05:46:04 UTC +00:00], ["year", 2013]]
   (4.2ms)  COMMIT
Redirected to http://lvh.me:3000/admin
Completed 302 Found in 23ms (ActiveRecord: 9.3ms)

Any idea why players wouldn't save? Originally I didn't have player_ids in the params.require, but I added it to no avail

Saltpeter

Do you have accepts_nested_attributes_for :players in your team model? – Metralgia

Yeah sorry I didn't show that part – Saltpeter

Answer 1

Try with:

params.require(:team).permit(:name,:captain,:season,:year,:active,player_ids: [])

Metralgia

Why does this work? I don't remember seeing it in the docs or anything – Saltpeter

This is life saver for me – Edelsten

params.require(...).permet(..., players: []) worked for me. Thanks for the pointer in the right direction. – Kennel