Ruby on rails: can't save profile model associated with Devise user - ruby-on-rails

Question

I have Devise user model and associated profile model. Here it is:
class User < ActiveRecord::Base
devise :database_authenticatable, :registerable,
:recoverable, :rememberable, :trackable, :validatable
has_one :profile, autosave: true
accepts_nested_attributes_for :profile
before_create :build_profile
end
Profile model:
class Profile < ActiveRecord::Base
belongs_to :user
end
Next, I include profile fields in default Devise view:
<h2>Edit <%= resource_name.to_s.humanize %></h2>
<%= form_for(resource, as: resource_name, url: registration_path(resource_name), html: { method: :put }) do |f| %>
<%= devise_error_messages! %>
<div class="field">
<%= f.label :email %><br />
<%= f.email_field :email, autofocus: true %>
</div>
<% if devise_mapping.confirmable? && resource.pending_reconfirmation? %>
<div>Currently waiting confirmation for: <%= resource.unconfirmed_email %></div>
<% end %>
<%= f.fields_for :profile do |profile_form| %>
<div class="field">
<%= profile_form.label :username %><br />
<%= profile_form.text_field :username %>
</div>
<div class="field">
<%= profile_form.label :address %><br />
<%= profile_form.text_field :address %>
</div>
<div class="field">
<%= profile_form.label :pin %><br />
<%= profile_form.text_field :pin %>
</div>
<% end %>
<div class="field">
<%= f.label :password %> <i>(leave blank if you don't want to change it)</i><br />
<%= f.password_field :password, autocomplete: "off" %>
</div>
<div class="field">
<%= f.label :password_confirmation %><br />
<%= f.password_field :password_confirmation, autocomplete: "off" %>
</div>
<div class="field">
<%= f.label :current_password %> <i>(we need your current password to confirm your changes)</i><br />
<%= f.password_field :current_password, autocomplete: "off" %>
</div>
<div class="actions">
<%= f.submit "Update" %>
</div>
<% end %>
<h3>Cancel my account</h3>
<p>Unhappy? <%= button_to "Cancel my account", registration_path(resource_name), data: { confirm: "Are you sure?" }, method: :delete %></p>
<%= link_to "Back", :back %>
Now, when I update form, Devise field is updated, but profile fields - not. If I trying to update profile thru rails console, everything works just great.
u = User.find_by(id: 2)
u.profile.pin = 123
u.save

Answer 1

Solved! Just override Devise permitted_parameters in ApplicationController like this:
before_action :configure_devise_permitted_parameters, if: :devise_controller?
protected
def configure_devise_permitted_parameters
registration_params = [:email, :password, :password_confirmation, profile_attributes: [:username, :address, :pin]]
if params[:action] == 'update'
devise_parameter_sanitizer.for(:account_update) {
|u| u.permit(registration_params << :current_password)
}
elsif params[:action] == 'create'
devise_parameter_sanitizer.for(:sign_up) {
|u| u.permit(registration_params)
}
end
end
Thanks #max for answer.