How to update data in join table in Rails 4 - ruby-on-rails

Question

I am building an app with Rails 4 using Devise and CanCan. When a new user registers they are not given a default role. The admin has to manually assign it through the admin panel. And that's where I am running into difficulty. I can't figure out how to update the data in the join field. Here's what I have so far.
My UsersController:
class UsersController < ApplicationController
before_filter :authenticate_user!
before_action :set_user, only: [:show, :update, :destroy]
def index
authorize! :index, #user, message: 'Not authorized as an administrator.'
#users = User.all
end
def show
end
def update
authorize! :update, #user, message: 'Not authorized as an administrator.'
if #user.update_attributes(user_params)
redirect_to users_path, notice: "User updated."
else
redirect_to users_path, alert: "Unable to update user."
end
end
def destroy
authorize! :destroy, #user, message: 'Not authorized as an administrator.'
unless #user == current_user
#user.destroy
redirect_to users_path, notice: "User deleted."
else
redirect_to users_path, notice: "Can't delete yourself."
end
end
private
def set_user
#user = User.find(params[:id])
end
def user_params
params.require(:user).permit(:name, :email, :role_id, :user_id)
end
end
And my role model:
class Role < ActiveRecord::Base
has_and_belongs_to_many :users, :join_table => :users_roles
belongs_to :resource, :polymorphic => true
scopify
end
And my user model:
class User < ActiveRecord::Base
rolify
# Include default devise modules. Others available are:
# :token_authenticatable, :confirmable,
# :lockable, :timeoutable and :omniauthable
devise :database_authenticatable, :registerable,
:recoverable, :rememberable, :trackable, :validatable
end
As you can see it's pretty much the standard model as generated by Devise.
And here's the form I'm using to update the role:
<div id="role-options-<%= user.id %>" class="reveal-modal medium" style="display: none;">
<%= simple_form_for user, url: user_path(user), html: {method: :put, class: 'custom' } do |f| %>
<h3>Change Role</h3>
<%= f.input :role_ids, collection: Role.all, as: :radio_buttons, label_method: lambda {|t| t.name.titleize}, label: false, item_wrapper_class: 'inline', checked: user.role_ids.first %>
<%= f.submit "Change Role", class: "small button" %>
<a class="close-reveal-modal" href="#">Close</a>
<% end %>
</div>
When I check the new role on the form and submit it, I am redirected to the users page with the message "User updated." However, the user role has not been updated.
I'm still fairly new to Rails and just can't figure out exactly what I am doing wrong. If I understand correctly, I need to update the data in the user_roles table. I just can't figure out what I'm doing wrong.

Answer 1

You are using string params, but forgot to add role_ids into allowed fields.
So, your controller should contain something like this (in case role_ids is an array):
def user_params
params.require(:user).permit(:name, :email, :role_ids => [])
end
Or if role_ids is scalar, just drop => [] part.
More info could be found here

Answer 2

I am not sure what rolify does. But I would do this:
class User
has_one :users_roles
has_one :role, through: :users_roles
I am not sure about this though. But you could give it a try. I know has_one :users_roles is weird.