Rails 3 Mass-Assignment Errors with fields_for

Question

I have the following model relationships:
OrderModel:

has_one :credit_card
    accepts_nested_attributes_for :credit_card
    attr_accessible :user_id, :date_updated, :date_finished, :amount, :payment_method, :status, :billing_cycle, :auth_net_subscription_id, :billing_start_date, :credit_card_attributes, :billing_address_id, :cc_id

CreditCardModel:

belongs_to :order

Here is my Order Controller (orders#checkout)

def checkout
  @order = current_order
  @cc = CreditCard.new
  @order.build_credit_card
  respond_with @order
end

Here is the form for entering in a CC on the order:

<%= form_for(@order, :url => finish_checkout_path, :html => { :class => 'validate' }) do |f| %>
    <%= f.fields_for @cc do |cc| %>
        <%= cc.text_field :cc_number, :placeholder => "Credit Card Number", :class => "full-width validate[required, creditCard] cc" %>
        <%= cc.text_field :name, :placeholder => "Name as it appears on card", :class => "full-width validate[required]" %>
        <%= select_month(Date.today, {:field_name => 'exp_month', :prefix => "order[credit_card]", :prompt => "EXP. MONTH"}, { :class => "dk half-width validate[required,past] marginRight10" }) %>
        <%= select_year(Date.today, {:field_name => 'exp_year', :prefix => "order[credit_card]", :prompt => "EXP. YEAR", :start_year => Date.today.year, :end_year => Date.today.year + 10}, { :class => "dk half-width validate[required]" }) %>
        <%= link_to "What's this?", "#", :class => 'cvv-help' %>
        <%= cc.text_field :cvv, :class => 'half-width validate[required] marginRight10', :placeholder => "CVV" %>
        <%= cc.text_field :zip_code, :class => 'half-width validate[required]', :placeholder => "Zip Code" %>
    <% end %>
    <%= f.hidden_field :amount, :value => @order.products.collect(&:price).reduce(&:+) %>
    <p class="tos">By clicking the button below you agree to our <a href="#" class="pink">terms of service</a>.</p>
    <p class="align-center"><%= f.submit "Submit", :class => 'btn submit' %></p>
<% end %>

And here is where I update the order (orders#finish):

current_order.update_attributes(params[:order])

When I do this, I get the following error: Can't mass-assign protected attributes: credit_card

I clearly have the credit_card_attributes in my attr_accessibleso I am not sure why this is erroring out.

Answer 1

Not sure, but it might be because of your controller code:

def checkout
   @order = current_order
   @cc = CreditCard.new
   @order.build_credit_card
   respond_with @order
end

With this, the credit card that you use in your fields_for is not linked to your order. That might be the problem.

Try doing that:

def checkout
   @order = current_order
   @order.build_credit_card
   respond_with @order
end

and

<%= f.fields_for :credit_card do |cc| %>