Why does devise parameter sanitizer permit sign_up instead of user_registration - ruby-on-rails

Question

class ApplicationController < ActionController::Base
before_action :configure_permitted_parameters, if: :devise_controller?
protected
def configure_permitted_parameters
# Permit the `subscribe_newsletter` parameter along with the other
# sign up parameters.
devise_parameter_sanitizer.permit(:sign_up, keys: [:subscribe_newsletter])
end
end
Why is the first parameter here sign_up?
when typing `rails routes`,
I see
new_user_registration GET /users/sign_up(.:format) devise/registrations#new
edit_user_registration GET /users/edit(.:format) devise/registrations#edit
user_registration PATCH /users(.:format) devise/registrations#update
PUT /users(.:format) devise/registrations#update
DELETE /users(.:format) devise/registrations#destroy
POST /users(.:format) devise/registrations#create
I'd assume user_registration (for the POST)instead:
devise_parameter_sanitizer.permit(:user_registration, keys: [:subscribe_newsletter])
I think there should be some logic in devise mapping sign_up to use_registration.
I can locate the permit function:
def permit(action, keys: nil, except: nil, &block)
if block_given?
#permitted[action] = block
end
if keys.present?
#permitted[action] ||= #auth_keys.dup
#permitted[action].concat(keys)
end
if except.present?
#permitted[action] ||= #auth_keys.dup
#permitted[action] = #permitted[action] - except
end
end
How to continue tracing from here?

Answer 1

It's just what they are called, no mapping here:
DEFAULT_PERMITTED_ATTRIBUTES = {
sign_in: [:password, :remember_me],
sign_up: [:password, :password_confirmation],
account_update: [:password, :password_confirmation, :current_password]
}
https://github.com/heartcombo/devise/blob/v4.8.1/lib/devise/parameter_sanitizer.rb#L38
Notice that permit method doesn't actually permit anything, it's just building a hash, and it's letting you add your own parameters.
Actual parameter permission is happening in sanitize method, where attributes held in sign_up are used to permit params submitted by the form, which are scoped to user. Something like this:
# params = {"user"=>{"email"=>"email", "password"=>"[FILTERED]", "password_confirmation"=>"[FILTERED]"}
# device_mapping = :user
# permitted = DEFAULT_PERMITTED_ATTRIBUTES
params[device_mapping].permit(permitted[:sign_up])