diff --git a/README.md b/README.md index 1dd6023..c94456f 100644 --- a/README.md +++ b/README.md @@ -63,13 +63,37 @@ This will mark the `:log_entry` parameters hash and any subhash of it permitted. You can also use permit on nested parameters, like: ``` ruby -params.permit(:name, {:emails => []}, :friends => [ :name, { :family => [ :name ], :hobbies => [] }]) +params.permit( + :name, + {:emails => []}, + :friends => [ :name, { :family => [ :name ], :hobbies => [] }] +) ``` This declaration whitelists the `name`, `emails` and `friends` attributes. It is expected that `emails` will be an array of permitted scalar values and that `friends` will be an array of resources with specific attributes : they should have a `name` attribute (any permitted scalar values allowed), a `hobbies` attribute as an array of permitted scalar values, and a `family` attribute which is restricted to having a `name` (any permitted scalar values allowed, too). Thanks to Nick Kallen for the permit idea! +## Nested models + +Permitting nested model attributes works like nested parameters, but you permit the key names, not the nested model names. + +``` ruby +class Company + validates :name, presence: true + accepts_nested_attributes_for :people +end +``` + +In the controller: + +``` ruby +params.require(:company).permit( + :name, + {:people_attributes => []} +) +``` + ## Require Multiple Parameters If you want to make sure that multiple keys are present in a params hash, you can call the method twice: