stffn/declarative_authorization — Issue #127: filter_resource_access does not work with scoped attr_accessible in rails 3.2
Author: rawongithub
Created: 2012-01-27 22:21:58+00:00
State: open

Here is what to do to recreate the problem:
```ruby
class User < ActiveRecord::Base
has_and_belongs_to_many :roles
attr_accessible :email
attr_accessible :email, :role_ids, as: :admin
```
```ruby
class UsersController < ApplicationController
before_filter :authenticate_user!
filter_resource_access
# POST /users
def create
@user = User.new
@user.assign_attributes(params[:user], as: :admin)
[...]
end
```
End here is the error:
```
Started POST "/admin/users" for 127.0.0.1 at 2012-01-27 22:48:06 +0100
Processing by UsersController#create as HTML
Parameters: {"utf8"=>"✓", "authenticity_token"=>"BAoXoik98sq2sBztYf+4Bx25A8B5eC0cL+3+Kzpizfc=", "user"=>{"email"=>"test@test.pl", "role_ids"=>["", "2"], "active"=>"1"}, "commit"=>"Create User"}
User Load (0.6ms) SELECT "users".* FROM "users" WHERE "users"."id" = 1 LIMIT 1
Completed 500 Internal Server Error in 3ms

ActiveModel::MassAssignmentSecurity::Error (Can't mass-assign protected attributes: role_ids):
activemodel (3.2.1) lib/active_model/mass_assignment_security/sanitizer.rb:48:in `process_removed_attributes'
activemodel (3.2.1) lib/active_model/mass_assignment_security/sanitizer.rb:20:in `debug_protected_attribute_removal'
activemodel (3.2.1) lib/active_model/mass_assignment_security/sanitizer.rb:12:in `sanitize'
activemodel (3.2.1) lib/active_model/mass_assignment_security.rb:228:in `sanitize_for_mass_assignment'
activerecord (3.2.1) lib/active_record/attribute_assignment.rb:75:in `assign_attributes'
activerecord (3.2.1) lib/active_record/base.rb:495:in `initialize'
declarative_authorization (0.5.5) lib/declarative_authorization/in_controller.rb:158:in `new'
declarative_authorization (0.5.5) lib/declarative_authorization/in_controller.rb:158:in `new_controller_object_from_params'
declarative_authorization (0.5.5) lib/declarative_authorization/in_controller.rb:517:in `block in filter_resource_access'
activesupport (3.2.1) lib/active_support/callbacks.rb:440:in `_run__384995521__process_action__22731472__callbacks'
activesupport (3.2.1) lib/active_support/callbacks.rb:405:in `__run_callback'
activesupport (3.2.1) lib/active_support/callbacks.rb:385:in `_run_process_action_callbacks'
activesupport (3.2.1) lib/active_support/callbacks.rb:81:in `run_callbacks'
actionpack (3.2.1) lib/abstract_controller/callbacks.rb:17:in `process_action'
actionpack (3.2.1) lib/action_controller/metal/rescue.rb:29:in `process_action'
actionpack (3.2.1) lib/action_controller/metal/instrumentation.rb:30:in `block in process_action'
activesupport (3.2.1) lib/active_support/notifications.rb:123:in `block in instrument'
activesupport (3.2.1) lib/active_support/notifications/instrumenter.rb:20:in `instrument'
activesupport (3.2.1) lib/active_support/notifications.rb:123:in `instrument'
actionpack (3.2.1) lib/action_controller/metal/instrumentation.rb:29:in `process_action'
actionpack (3.2.1) lib/action_controller/metal/params_wrapper.rb:205:in `process_action'
activerecord (3.2.1) lib/active_record/railties/controller_runtime.rb:18:in `process_action'
actionpack (3.2.1) lib/abstract_controller/base.rb:121:in `process'
actionpack (3.2.1) lib/abstract_controller/rendering.rb:45:in `process'
actionpack (3.2.1) lib/action_controller/metal.rb:203:in `dispatch'
actionpack (3.2.1) lib/action_controller/metal/rack_delegation.rb:14:in `dispatch'
actionpack (3.2.1) lib/action_controller/metal.rb:246:in `block in action'
actionpack (3.2.1) lib/action_dispatch/routing/route_set.rb:66:in `call'
actionpack (3.2.1) lib/action_dispatch/routing/route_set.rb:66:in `dispatch'
actionpack (3.2.1) lib/action_dispatch/routing/route_set.rb:30:in `call'
journey (1.0.1) lib/journey/router.rb:68:in `block in call'
journey (1.0.1) lib/journey/router.rb:56:in `each'
journey (1.0.1) lib/journey/router.rb:56:in `call'
actionpack (3.2.1) lib/action_dispatch/routing/route_set.rb:589:in `call'
warden (1.1.0) lib/warden/manager.rb:35:in `block in call'
warden (1.1.0) lib/warden/manager.rb:34:in `catch'
warden (1.1.0) lib/warden/manager.rb:34:in `call'
actionpack (3.2.1) lib/action_dispatch/middleware/best_standards_support.rb:17:in `call'
rack (1.4.1) lib/rack/etag.rb:23:in `call'
rack (1.4.1) lib/rack/conditionalget.rb:35:in `call'
actionpack (3.2.1) lib/action_dispatch/middleware/head.rb:14:in `call'
actionpack (3.2.1) lib/action_dispatch/middleware/params_parser.rb:21:in `call'
actionpack (3.2.1) lib/action_dispatch/middleware/flash.rb:242:in `call'
rack (1.4.1) lib/rack/session/abstract/id.rb:205:in `context'
rack (1.4.1) lib/rack/session/abstract/id.rb:200:in `call'
actionpack (3.2.1) lib/action_dispatch/middleware/cookies.rb:338:in `call'
activerecord (3.2.1) lib/active_record/query_cache.rb:64:in `call'
activerecord (3.2.1) lib/active_record/connection_adapters/abstract/connection_pool.rb:443:in `call'
actionpack (3.2.1) lib/action_dispatch/middleware/callbacks.rb:28:in `block in call'
activesupport (3.2.1) lib/active_support/callbacks.rb:405:in `_run__907276882__call__950603030__callbacks'
activesupport (3.2.1) lib/active_support/callbacks.rb:405:in `__run_callback'
activesupport (3.2.1) lib/active_support/callbacks.rb:385:in `_run_call_callbacks'
activesupport (3.2.1) lib/active_support/callbacks.rb:81:in `run_callbacks'
actionpack (3.2.1) lib/action_dispatch/middleware/callbacks.rb:27:in `call'
actionpack (3.2.1) lib/action_dispatch/middleware/reloader.rb:65:in `call'
actionpack (3.2.1) lib/action_dispatch/middleware/remote_ip.rb:31:in `call'
actionpack (3.2.1) lib/action_dispatch/middleware/debug_exceptions.rb:16:in `call'
actionpack (3.2.1) lib/action_dispatch/middleware/show_exceptions.rb:56:in `call'
railties (3.2.1) lib/rails/rack/logger.rb:26:in `call_app'
railties (3.2.1) lib/rails/rack/logger.rb:16:in `call'
actionpack (3.2.1) lib/action_dispatch/middleware/request_id.rb:22:in `call'
rack (1.4.1) lib/rack/methodoverride.rb:21:in `call'
rack (1.4.1) lib/rack/runtime.rb:17:in `call'
activesupport (3.2.1) lib/active_support/cache/strategy/local_cache.rb:72:in `call'
rack (1.4.1) lib/rack/lock.rb:15:in `call'
actionpack (3.2.1) lib/action_dispatch/middleware/static.rb:53:in `call'
railties (3.2.1) lib/rails/engine.rb:479:in `call'
railties (3.2.1) lib/rails/application.rb:220:in `call'
rack (1.4.1) lib/rack/content_length.rb:14:in `call'
railties (3.2.1) lib/rails/rack/log_tailer.rb:14:in `call'
rack (1.4.1) lib/rack/handler/webrick.rb:59:in `service'
/home/rafal/.rvm/rubies/ruby-1.9.3-p0/lib/ruby/1.9.1/webrick/httpserver.rb:138:in `service'
/home/rafal/.rvm/rubies/ruby-1.9.3-p0/lib/ruby/1.9.1/webrick/httpserver.rb:94:in `run'
/home/rafal/.rvm/rubies/ruby-1.9.3-p0/lib/ruby/1.9.1/webrick/server.rb:191:in `block in start_thread'
```