Devise custom sign up parameters not permitted - ruby-on-rails

Question

Preamble
As a little bit of a setup to the problem, we have an authenticatable user model that is separate from the user model that contains non-authentication related data.
Problem
As the title suggests, adding custom fields to the built in configure_sign_up_params method does not actually permit the fields in the create action. I've generated the relevant controller and views with rails generate devise:controllers user and rails generate devise:views user, and made modifications to both. In the view:
<h2>Custom User Sign up</h2>
<%= form_for(resource, as: resource_name, url: registration_path(resource_name)) do |f| %>
<%= devise_error_messages! %>
<%= fields_for(:extra_user_attributes) do |pa| %>
<div class="field">
<%= pa.label :first_name %><br />
<%= pa.text_field :first_name %>
</div>
<div class="field">
<%= pa.label :last_name %><br />
<%= pa.text_field :last_name %>
</div>
<% end %>
<div class="field">
<%= f.label :email %><br />
<%= f.email_field :email %>
</div>
<div class="field">
<%= f.label :password %>
<% if #minimum_password_length %>
<em>(<%= #minimum_password_length %> characters minimum)</em>
<% end %><br />
<%= f.password_field :password, autocomplete: "off" %>
</div>
<div class="field">
<%= f.label :password_confirmation %><br />
<%= f.password_field :password_confirmation, autocomplete: "off" %>
</div>
<div class="actions">
<%= f.submit "Sign up" %>
</div>
<% end %>
<%= render "user/shared/links" %>
We have a nested :extra_user_attributes field that we need permitted, so in the devise generated controller, I uncommented a couple of lines and added the relevant logic:
class CustomUser::RegistrationsController < Devise::RegistrationsController
before_action :configure_sign_up_params, only: [:create]
# POST /resource
def create
ap sign_up_params
end
protected
# If you have extra params to permit, append them to the sanitizer.
def configure_sign_up_params
devise_parameter_sanitizer.permit(:sign_up, keys: [:extra_user_attributes => [:first_name, :last_name]])
end
end
This is where I got stuck. I've tried several permutations in the keys array, but everything I've tried thus far yields the same result. For my own sanity, I verified the before_action actually does trigger.
As for the endpoint, I'm simply printing the output to the console just to see what the permitted signup parameters are.
Parameters: {"utf8"=>"✓", "authenticity_token"=>"5MqzDUsbrdMdE0Z7/Vw70zJddaKR+0eLYdnum3wEyTShNjB9o3Nb4ZsnE0dZEPlgs4SheZtQad0VpuIGtCeSmw==", "extra_user_attributes"=>{"first_name"=>"", "last_name"=>""}, "user"=>{"email"=>"", "password"=>"[FILTERED]", "password_confirmation"=>"[FILTERED]"}, "commit"=>"Sign up"}
{
"email" => "",
"password" => "",
"password_confirmation" => ""
}
Am I missing something here?
Workaround
A workaround would be to:
def other_signup_params
params.require(:extra_user_attributes).permit(:first_name, :last_name)
end
Which works just fine, but it just doesn't feel right. I feel like I should be able to use the built in configure_sign_up_parameters method that Devise provides but I'm somehow doing something wrong. Appreciate the help in advance.

Answer 1

The problem was not with devise, but a problem with the nested parameters I set up.
<%= fields_for(:extra_user_attributes) do |pa| %>
<div class="field">
<%= pa.label :first_name %><br />
<%= pa.text_field :first_name %>
</div>
<div class="field">
<%= pa.label :last_name %><br />
<%= pa.text_field :last_name %>
</div>
<% end %>
The fields_for did not get associated with the parent form, and got orphaned. It should have read:
<%= f.fields_for(:extra_user_attributes) do |pa| %>
Then, the sanitizer properly permits the fields:
{
"email" => "foo#example.com",
"password" => "hello!",
"password_confirmation" => "world!",
"extra_user_attributes" => {
"first_name" => "Foo",
"last_name" => "Bar"
}
}