Rails上的嵌套属性：无法批量分配受保护的属性

Question

I've been stuck on getting nested attributes to work on Rails 3.2.14 for a while and having looked at many examples I still can't seem to get it to work. At the moment when I try to submit the form I get the following error:

ActiveModel::MassAssignmentSecurity::Error in Admin::CategoriesController#create

Can't mass-assign protected attributes: products, category_departments

Here's my code:

 class Category < ActiveRecord::Base
   extend FriendlyId 
   friendly_id :category_name, use: :slugged
   attr_accessible :category_name, :products_attributes, :slug, :department_id,     :category_departments_attributes

   has_many :products
   has_many :category_departments
   has_many :departments, :through => :category_departments

   validates_presence_of :category_name

   accepts_nested_attributes_for :products
   accepts_nested_attributes_for :category_departments

   scope :department_category, lambda {|department| joins(:department,   :products).where("departments.department_name" => department ) }
end

Controller:

 class Admin::CategoriesController < ApplicationController

      def new
        @category = Category.new
     @category.products.build
     @category.category_departments.build
  end

def create
   @category = Category.new(params[:category])
   if @category.save
     redirect_to admin_products_path
   else
     flash.now[:error] = "Could not save the category"
     render "new"
   end
 end

Form-view So I finally solved this by removing the products fields_for and allowing the department to be selected from the products creation page.

 Form:-
  <h1> Create a Category </h1>
   <%= form_for :category, :url => { :action => "create" }, :method => :post do  |f| %>
   <%= render :partial => 'form_category', :locals => {:f => f} %>
  <% end %>

 Partial:-
    <div class="category-form-update">
<form class="form-horizontal">

    <div class="control-group">
        <label class="control-label">
            <%= f.label :category_name %>
        </label>
        <div clas="controls">
            <%= f.text_field :category_name %>
        </div>
    </div>
<div class="control-group">
        <%= f.fields_for :category_departments do |builder| %>
        <label class="control-label">
            <%= builder.label :department, "Department" %>
        </label>
        <div class="controls">
            <% department = Department.all.map { |dep| [dep.department_name.capitalize, dep.id] } %>
        <%= builder.select(:department_id ,options_for_select(department)) %>
        <% end %>
        </div>
    </div>

    <div class="control-group">
        <div class="controls">
            <button class="btn">
                <%= f.submit %>
            </button>
        </div>
    </div>
</div>

What am I not doing correctly here?

Answer 1

I think this is as easy as adding :products and :category_departments to attr_accessible like so:

class Category < ActiveRecord::Base
  extend FriendlyId 
  friendly_id :category_name, use: :slugged
  attr_accessible :category_name, :products_attributes, :slug, :department_id, :category_departments_attributes, :products, :category_departments

...

Without checking the internals, I assume this is necessary because the nested_attributes magic uses the :products_attributes to populate :products .

EDIT:

This only revealed the actual issue which is the nested attribute naming magic didn't kick in and name the fields properly. My guess is the form_for doesn't have the category object as a parameter.