title: Rails 4.0 with Devise. Nested attributes Unpermited parameters
body: <p>I am working on a web-app using Devise and Rails 4. I have a <strong>User</strong> model which I have extended with 2 extra form fields such that when a user signs up he can also submit his first/last names. (based on <a href="http://blog.12spokes.com/web-design-development/adding-custom-fields-to-your-devise-user-model-in-rails-4/">http://blog.12spokes.com/web-design-development/adding-custom-fields-to-your-devise-user-model-in-rails-4/</a>). I now want to add a <strong>Institution</strong> model. This model <strong>has_many</strong> :users, and a user <strong>belongs_to</strong> :institution. I want to be able to register the <strong>institution's name</strong> on the same form I register the user. I know I need a nested_attribute in my <strong>Institution</strong> model, since this is the parent, which I will show in a bit. When I try to sign up the user I get in the console: <strong>Unpermited parameters: Institutions</strong>.</p>
  
  <p>My hint is that I cannot update my parent class(Institution) based upon my child class (User). Might there be a solution to this? Or has anyone experienced something similar?</p>
  
  <pre><code>class Institutions &lt; ActiveRecord::Base
      has_many :users, 
      accepts_nested_attributes_for :users
  end
  
  class User &lt; ActiveRecord::Base
       devise :database_authenticatable, :registerable,
       :recoverable, :rememberable, :trackable, :validatable
       belongs_to :institution
  end
  </code></pre>
  
  <p><strong>registrations/new.html.erb</strong> Here I have the nested form</p>
  
  <pre><code>&lt;%= form_for(resource, :as =&gt; resource_name, :url =&gt; registration_path(resource_name)) do |f|     %&gt;
  &lt;%= devise_error_messages! %&gt;
  .
  . 
      &lt;%= f.fields_for :institutions do |i| %&gt;
          &lt;p&gt;&lt;%= i.label :name %&gt;&lt;br /&gt;
          &lt;%= i.text_field :institutions_attr %&gt;&lt;/p&gt;
      &lt;% end %&gt;
  </code></pre>
  
  <p>Based on the tutorial I have linked earlier, I have created a new <strong>User::ParameterSanitizer</strong> which inherits from the <strong>Devise::ParameterSanitizer</strong> and overridden the <strong><code>sign_up</code></strong> method as follows:</p>
  
  <p><strong>lib/user_sanitizer.rb</strong></p>
  
  <pre><code>private
  def sign_up
      default_params.permit(:first_name, :last_name ,:email, :password,  :password_confirmation, :current_password, institutions_attributes: [:id, :name])
  end
  </code></pre>
  
  <p>Finally, my <strong>application_controller.rb</strong></p>
  
  <pre><code>class ApplicationController &lt; ActionController::Base
    protect_from_forgery with: :exception
  
    protected
    def devise_parameter_sanitizer
      if resource_class == User
      User::ParameterSanitizer.new(User, :user, params)
      else 
      super
      end
    end
  end
  </code></pre>
  
  <p>Thank you for reading!</p>
  
  <p><strong>Console params output:</strong></p>
  
  <pre><code>{"utf8"=&gt;"✓",
   "authenticity_token"=&gt;"JKuN6K5l0iwFsj/25B7GKDj7WEHR4DO3oaVyGxGJKvU=",
   "user"=&gt;{"email"=&gt;"abc@foo.com",
   "first_name"=&gt;"abc",
   "last_name"=&gt;"xyz",
   "institutions"=&gt;{"name"=&gt;"Government"},
   "password"=&gt;"[FILTERED]",
   "password_confirmation"=&gt;"[FILTERED]"},
   "commit"=&gt;"Sign up"}
  </code></pre>
  
  <p><strong>EDIT</strong></p>
  
  <p>As suggested, I have added </p>
  
  <pre><code>params.require(resource_name).permit( :email, :first_name, :last_name, institution:  [:name], :password, :password_confirmation ) and I get an *error syntax error, unexpected ',', expecting =&gt; ...nstitution: [:name], :password, :password_confirmation )*
  </code></pre>
  
  <p>BUT, if I re-edit to </p>
  
  <pre><code>params.require(resource_name).permit( :email, :first_name, :last_name, :password, :password_confirmation, institution:  [:name] ) 
  </code></pre>
  
  <p>I get NO syntax error but I get Unpermited parameters: Institutions in the Request.</p>
  
  <p>My belief is that this happens because User is a child of Institution. I have, however, been unable to find a work-around this. </p>