rails/strong_parameters — pull request #74 by reggieb (2012-12-31 14:29:58+00:00)
Title: Strengthen with chained require and permit

Modifies the way require and permit relate to one another.

* require is now a special permit that raises an error if the matching parameter is missing.
* a required parameter can be anywhere within the parameters, not just at the root.
* require and permit can be chained and the order is not important
* All parameters not matching a permit or require are removed

The previous usage was

params.require(:person).permit(:name, :age)

The equivalent to this would now be:

params.require(:person).permit(:person => [:name, :age])
params[:person]

And can also be expressed as:

params.permit(:person => [:name, :age]).require(:person)
params[:person]

Note that require now returns its modified self, and not the value of the key being required. This was changed as it prevented calls being chained and prescribed the order in which require and permit calls are added.

If you wanted to require a single parameter within the model's parameters, you can now do this:

params.permit(:person => [:age]).require(:person => [:name])

Or if you prefer

person_params = params[:person].permit(:age).require(:name)

I've added a method 'strengthen' that allows permits and requires to be set in a single call. This allows you to do the above like this:

params.strengthen(:person => {:name => :require, :age => :permit})

As I think Parameters#permitted? was confusing (it flags whether permit has been called not whether a set of parameters are permitted), I have replaced it with Parameters#strengthened?. Parameters#permitted? is an alias of this.