Rails: ForbiddenAttributesError for dynamic simple form - ruby-on-rails

Question

I followed the answer given here to create a simple dynamic form (not nested). The idea is to invite several people with their email. Then I have an "Add Team Member" button to add the fields to enter the coworker email.
I get the following error but I don't know why:
ActiveModel::ForbiddenAttributesError in InvitationsController#create
The parameters:
{"utf8"=>"✓",
"authenticity_token"=>"zLs8DWkzO+bPc2jGhFptgc+BAGAwzr1kcn/hkX/6vQbQ/cDCzuqoGCMGUTcYHs+up7nBzHFiEXVcKustyL1KIA==",
"invitation"=>[{"email"=>"test#test.fr", "_destroy"=>"false", "user_id"=>"1"}, {"email"=>"test2#test2.fr", "_destroy"=>"false", "user_id"=>"1"}],
"commit"=>"Save Team Members"}
My create action and invitation_params in the controller:
def create
puts params[:invitation].to_yaml
params[:invitation].each do |invitation_params|
Invitation.create(invitation_params)
end
redirect_to invitation_path
end
def invitation_params
params.require(:invitation).permit(:id, :email, :user_id, :_destroy, :token)
end
My form:
<%= form_for(invitation) do |f| %>
<% if invitation.errors.any? %>
<div id="error_explanation">
<h2><%= pluralize(invitation.errors.count, "error") %> prohibited this invitation from being saved:</h2>
<ul>
<% invitation.errors.full_messages.each do |message| %>
<li><%= message %></li>
<% end %>
</ul>
</div>
<% end %>
<div id="container_invitations"></div>
<%= link_to "Add a New Team Member", add_invitation_path, :method => :post, :remote => true %>
<div class="actions">
<%= f.submit "Save Team Members", class: "cta2" %>
</div>
<% end %>
add_invitation controller action (to add the fields dynamically):
def add_invitation
respond_to do |format|
format.js
end
end
add_invitation.js.erb:
$('#container_invitations').append("<%= escape_javascript(render :partial => 'invitation_fields_render') %>");
$('.remove_fields').on('click', function(e) {
$(this).parent().remove();
});
_invitation_fields_render.html.erb (the partial with the fields)
<div class="new_invitation_row">
<%= email_field_tag "invitation[][email]", nil, placeholder: "Team Member Email", :required => 'required' %>
<%= hidden_field_tag "invitation[][_destroy]", nil, value: false %>
<a class="remove-link remove_fields dynamic" href="#"><i class="fa fa-trash fa-lg" title="Remove"></i></a>
<%= hidden_field_tag "invitation[][user_id]", nil, value: current_user.id %>
</div>
My invitation model:
class Invitation < ActiveRecord::Base
has_secure_token
belongs_to :user
end
Thank you.
UPDATE
I added the new params.permit line proposed by IngoAlbers. I still get the error. Here is the full stacktrace of the error:
Started POST "/invitations" for 127.0.0.1 at 2017-12-01 07:49:02 +0000
Processing by InvitationsController#create as HTML Parameters:
{"utf8"=>"✓",
"authenticity_token"=>"pV5wQj3QHXksNEtJ8nZSjWDc8VyHiewVCt4A1+ijH8G5GIyNmgmOh8BBcrhuMvCiCOQw8MYlQAQkiwprX+To5w==",
"invitation"=>[{"email"=>"test#test.fr", "_destroy"=>"false",
"user_id"=>"1"}], "commit"=>"Save Team Members"} User Load (0.4ms)
SELECT "users".* FROM "users" WHERE "users"."id" = ? ORDER BY
"users"."id" ASC LIMIT ? [["id", 1], ["LIMIT", 1]] CoreBot Load
(0.2ms) SELECT "core_bots".* FROM "core_bots" WHERE "core_bots"."id"
= ? LIMIT ? [["id", 1], ["LIMIT", 1]] Completed 500 Internal Server Error in 4ms (ActiveRecord: 0.6ms)
ActiveModel::ForbiddenAttributesError
(ActiveModel::ForbiddenAttributesError):
app/controllers/invitations_controller.rb:35:in block in create'
app/controllers/invitations_controller.rb:34:ineach'
app/controllers/invitations_controller.rb:34:in `create' Rendering
/Users/nicolasleroux/.rbenv/versions/2.3.0/lib/ruby/gems/2.3.0/gems/actionpack-5.0.6/lib/action_dispatch/middleware/templates/rescues/diagnostics.html.erb
within rescues/layout Rendering
/Users/nicolasleroux/.rbenv/versions/2.3.0/lib/ruby/gems/2.3.0/gems/actionpack-5.0.6/lib/action_dispatch/middleware/templates/rescues/_source.html.erb
Rendered
/Users/nicolasleroux/.rbenv/versions/2.3.0/lib/ruby/gems/2.3.0/gems/actionpack-5.0.6/lib/action_dispatch/middleware/templates/rescues/_source.html.erb
(5.3ms) Rendering
/Users/nicolasleroux/.rbenv/versions/2.3.0/lib/ruby/gems/2.3.0/gems/actionpack-5.0.6/lib/action_dispatch/middleware/templates/rescues/_trace.html.erb Rendered
/Users/nicolasleroux/.rbenv/versions/2.3.0/lib/ruby/gems/2.3.0/gems/actionpack-5.0.6/lib/action_dispatch/middleware/templates/rescues/_trace.html.erb (2.5ms) Rendering
/Users/nicolasleroux/.rbenv/versions/2.3.0/lib/ruby/gems/2.3.0/gems/actionpack-5.0.6/lib/action_dispatch/middleware/templates/rescues/_request_and_response.html.erb
Rendered
/Users/nicolasleroux/.rbenv/versions/2.3.0/lib/ruby/gems/2.3.0/gems/actionpack-5.0.6/lib/action_dispatch/middleware/templates/rescues/_request_and_response.html.erb
(1.5ms) Rendered
/Users/nicolasleroux/.rbenv/versions/2.3.0/lib/ruby/gems/2.3.0/gems/actionpack-5.0.6/lib/action_dispatch/middleware/templates/rescues/diagnostics.html.erb
within rescues/layout (93.1ms)

Answer 1

The problem is that invitation is an array. So you actually need to permit the array in the invitation_params.
def invitation_params
params.permit(invitation: [:id, :email, :user_id, :_destroy, :token])
end
In addition you have a problem in the create action itself.
You don't actually use the permitted parameters, that was defined.
It should probably look like this:
def create
invitation_params[:invitation].each do |invitation|
Invitation.create(invitation)
end
redirect_to invitation_path
end