title: Unpermitted parameters in Rails strong params from related Model on create
body: <p>I'm using a form in Rails to create an instance of one Model and create a join table to another model on create. In my <code>Accounts</code> controller, after verifying the new instance of <code>Account</code> has been created, I create a new join table based on checkboxes chosen in the form from another model. </p>
  
  <p>Here is my code: </p>
  
  <p>Models: </p>
  
  <pre><code>class Account &lt; ApplicationRecord
      has_many :account_authorizations
      has_many :authorizations, through: :account_authorizations
      accepts_nested_attributes_for :authorizations
  end
  </code></pre>
  
  <pre><code>class Authorization &lt; ApplicationRecord
  
      has_many :account_authorizations
      has_many :accounts, through: :account_authorizations
  end
  </code></pre>
  
  <pre><code>class AccountAuthorization &lt; ApplicationRecord
      belongs_to :account 
      belongs_to :authorization 
  end
  </code></pre>
  
  <p>My <code>Accounts</code> controller: </p>
  
  <pre><code>class AccountsController &lt; ApplicationController
    before_action :find_account, only: [:show, :update, :destroy]
  
    def index
      @accounts = Account.all
  
    end
  
    def show 
    end
  
    def new 
       @authorizations = Authorization.all
    end
  
    def create 
      byebug 
      @account = Account.new(account_params) 
      if @account.save 
        authorization_ids = params.permit![:authorization][:ids]
        authorization_ids.each do |auth_id| 
        AccountAuthorization.create(authorization_id: auth_id, account_id: params[:id]) if !auth_id.empty?
        end
        flash[:notice] = "Account created sucsessfully"
        redirect_to account_path(@account) 
      else    
        flash[:error] = @item.errors.full_messages.to_sentence
        render :new 
      end
    end
  
    def edit   
    end
  
    def update
       @account = Account.update(account_params) 
      if @account.valid?
        flash[:notice] = "Account created sucsessfully"
        redirect_to accounts_path(@account) 
      else    
        flash[:error] = @item.errors.full_messages.to_sentence
        render :edit 
      end
    end
  
    def destroy
      @account.delete
      redirect_to accounts_path
    end
  
  
  
  private 
  
  def find_account 
    @account = Account.find(params[:id])
  end
  
  def account_params
      params.permit(
        :account_name,
        :account_address_line1,
        :account_address_line2,
        :account_city,
        :account_state,
        :account_zipcode,
        :account_ppu,
        :account_notes,
        :contact_first_name,
        :contact_last_name,
        :contact_phone,
        :contact_email
      )
    end
  
  end 
  </code></pre>
  
  <p>I've tried using .permit! on params but this does not allow the the ids from <code>Authorization</code> to pass into a new join instance of <code>AccountAuthorization</code>. </p>
  
  <p>The attributes that don't pass are:</p>
  
  <pre><code>Unpermitted parameters: :authenticity_token, :authorization, :commit
  
  </code></pre>
  
  <p>I've also tried putting those in the permit hash in the strong_params method. </p>
  
  <p>** UPDATE **</p>
  
  <p>My Views page with <code>form</code>: </p>
  
  <pre><code>&lt;% states = [ 'AL', 'AK', 'AS', 'AZ', 'AR', 'CA', 'CO', 'CT', 'DC', 'DE', 'DC', 'FL', 'GA', 'HI', 'ID', 'IL', 'IN', 'IA', 'KS', 'KY', 'LA', 'ME', 'MH', 'MD', 'MA', 'MI', 'MN', 'MS', 'MO', 'MT', 'NE', 'NV', 'NH', 'NJ', 'NM', 'NY', 'NC', 'ND', 'MP', 'OH', 'OK', 'OR', 'PA' 'RI', 'SC', 'SD', 'TN', 'TX', 'UT', 'VT' 'VA', 'WA', 'WV', 'WI', 'WY'] %&gt;
  &lt;% ppu = ['Employment', 'Insurance', 'Law Enforement'] %&gt;
  
  &lt;div class="row justify-content-center"&gt;
      &lt;div class="col-lg-16"&gt;
          &lt;h3&gt;Create New Account&lt;/h3&gt;
      &lt;/div&gt;
  &lt;/div&gt;
  &lt;div class="row justify-content-center"&gt;
      &lt;div class="col-lg-16"&gt;
  
              &lt;%= form_with(url: accounts_path, model: @account, local: true) do |f| %&gt;
  
              &lt;%= f.text_field :account_name, class: "form-control", placeholder: "Account Name" %&gt;
              &lt;%= f.text_field :account_address_line1, class: "form-control", placeholder: "address line 1" %&gt;
              &lt;%= f.text_field :account_address_line2, class: "form-control", placeholder: "address line 2" %&gt;
              &lt;%= f.text_field :account_city, class: "form-control", placeholder: "account city" %&gt;
              &lt;%= f.select :account_state, options_for_select(states), { :prompt =&gt; true }, class: "form-control", include_blank: true, placeholder: "state" %&gt;
              &lt;%= f.text_field :account_zipcode, class: "form-control", placeholder: "account zipcode" %&gt;
              &lt;%= f.text_field :contact_first_name, class: "form-control", placeholder: "contact first name" %&gt;
              &lt;%= f.text_field :contact_last_name, class: "form-control", placeholder: "contact last name" %&gt;
              &lt;%= f.text_field :contact_phone, class: "form-control", placeholder: "conact phone" %&gt;
              &lt;%= f.text_field :contact_email, class: "form-control", placeholder: "contact email" %&gt;
              &lt;%= f.select :account_ppu, options_for_select(ppu), { :prompt =&gt; true }, class: "form-control", include_blank: true, placeholder: "ppu" %&gt;
              &lt;%= f.text_area :account_notes, class: "form-control", placeholder: "Notes..." %&gt;
  
              &lt;div class="d-flex justify-content-between flex-wrap"&gt;
               &lt;%= f.fields_for :authorization do |auth| %&gt;
              &lt;div class="order-3 p-2 bd-highlight"&gt;
                  &lt;%= auth.collection_check_boxes :ids, Authorization.all, :id, :auth_name %&gt;
              &lt;/div&gt;
              &lt;% end %&gt;
               &lt;/div&gt;
              &lt;%= f.submit "Create", class: 'btn btn-success' %&gt;
              &lt;% end %&gt;
  
  
  
      &lt;/div&gt;
  &lt;/div&gt;
  </code></pre>