Form with nested models with many to many through relationship "can't assign mass attributes" error

Question

I am stuck on the error "Can't mass-assign protected attributes: user" for my form. I have a user that creates a family and other users through a single form. Currently I am trying to create the functionality to have the user create a new family and one new user in one form. I have the Cocoon gem installed and am using Rails 3.2.16. https://github.com/nathanvda/cocoon

The error is occuring on this line

families_controller.rb

  def create
    binding.pry
    @user = current_user
    @family = Family.new(params[:family]) <<<<<

The params are:

=> {"utf8"=>"✓",
 "authenticity_token"=>"EqWGxK3Fuj2uYk3namWK9SbXLPRKSn6cReT7wQddG0E=",
 "family"=>
  {"name"=>"test Family",
   "users_attributes"=>{"0"=>{"first_name"=>"jane", "last_name"=>"smith"}}},
 "commit"=>"Create Family",
 "action"=>"create",
 "controller"=>"families"}

Models

user.rb

class User < ActiveRecord::Base

  attr_accessible :first_name, :last_name, :age_months, :height_inches, :weight_ounces

  has_many :user_families
  has_many :families, through: :user_families
end

family.rb

class Family < ActiveRecord::Base
   attr_accessible :location, :name, :users_attributes, user_families_attributes

   has_many :user_families
   has_many :users, through: :user_families

   accepts_nested_attributes_for :users, :reject_if => :all_blank, :allow_destroy => true
   accepts_nested_attributes_for :user_families, :reject_if => :all_blank, :allow_destroy => true
end

View

families.new.html.erb

<%= form_for(@family) do |f| %>

<form class = 'form-horizontal' role = 'form'>
  <div class='form-group'>
    <%= f.label :name %>
    <%= f.text_field :name, placeholder: 'Family Name' %>
  </div>
  <div class='form-group'>
  <%= f.fields_for @new_user do |ff| %>
    <%= label_tag :first_name %>
    <%= ff.text_field :first_name, placeholder: 'First Name' %>
    <%= label_tag :last_name %>
    <%= ff.text_field :last_name, placeholder: 'Last Name' %>
    <%= label_tag :age_months %>
    <%= ff.number_field :age_months, placeholder: 'Enter Age' %>
    <%= label_tag :height_inches %>
    <%= ff.number_field :height_inches, placeholder: 'Height in Inches' %>
    <%= label_tag :weight_ounces %>
    <%= ff.number_field :weight_ounces, placeholder: 'Weight in Pounds' %>
  <% end %>
  </div>
  <div class='actions'>
    <%= f.submit %>
  </div>
</form>
<% end %>

Controller

families_controller.rb

class FamiliesController < ApplicationController
  def index
    @families = Family.all
  end

  def show
    @user = current_user
    @family = Family.find(params[:id])
  end

  def new
    @user = current_user
    @family = Family.new(name: "#{@user.last_name} Family")
    @family.users.build
    @new_user = User.new
  end

  def edit
    @family = Family.find(params[:id])
  end

  def create
    @user = current_user
    @family = Family.new(params[:family])
    @family.users << @user
    @family.save
    redirect_to root_path
  end

  def update
    @family = Family.find(params[:id])
    @family.update_attributes(params[:family])
    @family.save
    redirect_to root_path(anchor: 'profile')
  end

  def destroy
    @family = Family.find(params[:id])
    @family.destroy
    redirect_to families_path
  end
end

Answer 1

Family and User are associated with 1-M relationship.

In your view families/new.html.erb

Change

<%= f.fields_for @new_user do |ff| %>

To

<%= f.fields_for :users, @new_user do |ff| %>