Saving a collection of objects rails 4 (strong params) - ruby-on-rails

Question

I am currently working on the backend of shop. The Client wants to be able to see a list of all products and update the stock values for all the products in one submission of a form. I have a working solution, but it's a very 'hacky' and introduces a lot of issues. I am new to Ruby on Rails and web development in general so I'm still learning a few of the fundamental conventions and what not.
I will paste my working solution and then attempt to explain the problem I have:
class Product < ActiveRecord::Base
has_many :stocks
...
end
class Stock < ActiveRecord::Base
belongs_to :product
...
end
stock_controller.rb
class StocksController < ApplicationController
def index
#products = Product.all.includes(:stocks)
end
...
def update_current
#stock_params = params[:stock]
#stock_params.each do |stock_params|
params.permit(:current_stock, :product_id)
#stock = Stock.new(stock_params)
#stock.save
end
redirect_to stocks_path, notice: 'Stocks were successfully updated'
end
...
stocks.index.html.erb
...
<%= form_tag url_for(:action => 'update_current') do |f| %>
<% #products.each do |product| %>
<tr>
<td><%= product.product_name %></td>
<td><%= product.minimum_stock %></td>
<td><%= text_field_tag "stock[][current_stock]", product.stocks.last.current_stock %></td>
<%= hidden_field_tag "stock[][product_id]", product.stocks.last.product_id %>
</tr>
<% end %>
<%= submit_tag 'save' %>
<% end %>
...
When I hit the submit button params set is as it needs to be:
console :
Started POST "/stocks/update_current" for 127.0.0.1 at 2013-10-24 11:54:03 +0100
Processing by StocksController#update_current as HTML
Parameters: {"utf8"=>"✓", "authenticity_token"=>"NlabBuwI06t+YN5O6p7dm+Zg2Bwc9uXrKUdWaBqNs9w=", "stock"=>[{"current_stock"=>"1", "product_id"=>"1"}, {"current_stock"=>"2", "product_id"=>"2"}, {"current_stock"=>"3", "product_id"=>"24"}, {"current_stock"=>"4", "product_id"=>"25"}, {"current_stock"=>"5", "product_id"=>"23"}, {"current_stock"=>"6", "product_id"=>"21"}, {"current_stock"=>"7", "product_id"=>"19"}, {"current_stock"=>"8", "product_id"=>"22"}, {"current_stock"=>"9", "product_id"=>"5"}], "commit"=>"save"}
Unpermitted parameters: utf8, authenticity_token, stock, commit
(0.2ms) BEGIN
SQL (136.6ms) INSERT INTO "stocks" ("created_at", "current_stock", "product_id", "updated_at") VALUES ($1, $2, $3, $4) RETURNING "id" [["created_at", Thu, 24 Oct 2013 10:54:03 UTC +00:00], ["current_stock", 1], ["product_id", 1], ["updated_at", Thu, 24 Oct 2013 10:54:03 UTC +00:00]]
(24.2ms) COMMIT
Unpermitted parameters: utf8, authenticity_token, stock, commit
(0.2ms) BEGIN
SQL (0.7ms) INSERT INTO "stocks" ("created_at", "current_stock", "product_id", "updated_at") VALUES ($1, $2, $3, $4) RETURNING "id" [["created_at", Thu, 24 Oct 2013 10:54:03 UTC +00:00], ["current_stock", 2], ["product_id", 2], ["updated_at", Thu, 24 Oct 2013 10:54:03 UTC +00:00]]
(0.7ms) COMMIT
Unpermitted parameters: utf8, authenticity_token, stock, commit
(0.1ms) BEGIN
SQL (0.4ms) INSERT INTO "stocks" ("created_at", "current_stock", "product_id", "updated_at") VALUES ($1, $2, $3, $4) RETURNING "id" [["created_at", Thu, 24 Oct 2013 10:54:03 UTC +00:00], ["current_stock", 3], ["product_id", 24], ["updated_at", Thu, 24 Oct 2013 10:54:03 UTC +00:00]]
(0.6ms) COMMIT
As you can see form the log the authenticity_token, and other params are unpermitted. Now I understand the purpose of the token and the other params, what I do not know, why exactly I am running into this issue.
My guess is the way I am permitting the params. I don't get how to tell strong_params to permit an array of hashes: stock => [{:current_stock, :product_id},{:current_stock, :product_id}, ..., ....]. params.permit(stock: [:current_stock, :product_id]) ???
It doesn't make sense in this case to nest stocks under product, as I am working with a collection of products opposed to a single product.
In an ideal world, I would like to be able to insert the new stock values for all products in one submit and save to the database with one query. I feel as if Ajax may be a viable solution, but again, until I fully understand whats going on I don't want to confuse things even more.
Any solutions or advice is much appreciated. I hope the above makes sense! It's very difficult to articulate these things sometimes.

Answer 1

This may or may not be your problem, but in your update_current method, shouldn't it be stock_params.permit(:current_stock, :product_id) ? Also a minor point, why do you have |f| in your form_tag if you don't use it.