Files
Jeremy Daer a52b6f1c87 Add explicit wrap_parameters to all controllers (#2680)
* Add explicit wrap_parameters to controllers for flat JSON API support

Virtual attributes (has_rich_text, has_one_attached, delegated setters,
ActiveModel attrs) are not in Model.attribute_names, so wrap_parameters
auto-detection silently drops them from flat JSON requests. Add explicit
include: lists matching each controller's permitted params.

* Convert short-form wrap_parameters to explicit include: lists

Defense-in-depth: these controllers only have real-column params today,
so auto-detection works, but explicit lists prevent future regressions
if virtual attributes are added.

* Add flat JSON param tests for all wrap_parameters controllers

17 new tests covering every controller with wrap_parameters, verifying
that flat (unwrapped) JSON payloads are correctly wrapped and processed.
Focuses on virtual attributes that would be silently dropped without
explicit include: lists.
2026-03-09 21:47:05 -07:00

28 lines
635 B
Ruby

class Notifications::SettingsController < ApplicationController
wrap_parameters :user_settings, include: %i[ bundle_email_frequency ]
before_action :set_settings
def show
@boards = Current.user.boards.alphabetically
end
def update
@settings.update!(settings_params)
respond_to do |format|
format.html { redirect_to notifications_settings_path, notice: "Settings updated" }
format.json { head :no_content }
end
end
private
def set_settings
@settings = Current.user.settings
end
def settings_params
params.expect(user_settings: :bundle_email_frequency)
end
end