Delete from table if checkbox not checked - ruby-on-rails

Question

In my Rails app I have Users, Roles, and Permissions.
When creating/editing a Role, you can choose which permissions are enabled by checking their checkbox which will save the Permission in a table called 'roles_permissions' (basically on permissions that are allowed are stored in the join table).
So my edit role method is as follows:
def edit
#role = Role.find(params[:id])
#permissions_by_controller = Permission.order('controller asc').group_by(&:controller)
end
and the update method (the patch):
def update
#role = Role.find(params[:id])
if #role.update_attributes(role_params)
redirect_to roles_path, :notice => 'Article updated!'
else
render 'edit'
end
end
and the params:
def role_params
params.require(:role).permit(:name, permission_ids: [])
end
In the edit view I have a checkbox like so:
<%= check_box_tag "role[permission_ids][]", permission.id, #role.permissions.include?(permission), :id => permission.id, :class => 'switch__checkbox' %>
This works fine for when I check the checkbox and it saves.
However when I uncheck the checkbox and save, it doesn't remove the permission... presumably becuase no param is passed back. How do I solve this?
The associations are set as:
class Role < ActiveRecord::Base
has_and_belongs_to_many :users, :join_table => 'users_roles'
has_and_belongs_to_many :permissions, :join_table => 'roles_permissions'
end
class Permission < ActiveRecord::Base
has_and_belongs_to_many :roles, :join_table => 'roles_permissions'
end
Note: I've also noticed that Roles cannot be removed from a User in the same way as it uses checkboxes.

Answer 1

A classic problem. f.check_box solves this for you, by returning false when unchecked, but check_box_tag does not.
You can solve it with a hidden field with an empty value just before the tag.
<%= hidden_field_tag "role[permission_ids][]", '' %>
<%= check_box_tag "role[permission_ids][]", permission.id...
The form knows to populate the empty value field when nothing is selected. (If it's clearer for you, you can also put 'false' instead of an empty string.)

Answer 2

Complementing steel's answer (and since I can't comment on his answer bc of my rep)
I'll say to anyone looking for a different way to solve this.
I prefer attaching the hidden_field to the form .
<%= form.hidden_field :permission_ids, { multiple: true, value: '' } %>
Since we are calling form.hidden_field, the name and id will already contain role and it will add permissions_ids as a key inside role.
Multiple will add the needed square brackets.
The resulting html tag will be:
<input multiple="multiple" value="" type="hidden" name="role[permission_ids][]" id="role_permission_ids">