strong_params_nested_attributes

🛠️ Leverage Strong Parameters for Complex Nested Attributes

When accepting nested attributes for deep associations, explicitly permit nested hashes to avoid mass-assignment vulnerabilities. Use permit with a nested hash of allowed fields and arrays of permitted IDs.

class ProjectsController < ApplicationController
  def project_params
    params.require(:project).permit(
      :name, :deadline,
      tasks_attributes: [:id, :title, :_destroy,
        subtasks_attributes: [:id, :description, :_destroy]
      ]
    )
  end
end

Ensure the model uses accepts_nested_attributes_for for tasks and subtasks, and set allow_destroy: true to handle removals safely.