Question

When I pass the JSON Parameters: {"friend"=>{"username"=>"example"}, "auth_token"=>"n2A1Sk85MZSupXEiE1nG"}, I get the following error:

ActiveModel::MassAssignmentSecurity::Error (Can't mass-assign protected attributes: username)

---

FriendsController
def create
    @user = User.find(current_user)
    @friend = Friend.new(params[:friend])
    @friend.user_id = current_user.id
    @friend.friend_id = User.find(user.username)
    respond_to do |format|
        if @friend.save
            #flash[:notice] = 'Game was successfully created.'
            #format.html { redirect_to(@game) }
            format.json  { render :json => @friend }
        else
            #format.html { render :action => "new" }
            format.json  { render :json => @friend.errors, :status => :unprocessable_entity }
        end
    end
end

---

Friend Model
class Friend < ActiveRecord::Base
   attr_accessible :friend_id, :user_id
     belongs_to :user
     validates_presence_of :friend_id
     validates_presence_of :user_id
end

---

User Model
  class User < ActiveRecord::Base
 # Include default devise modules. Others available are:
 # :token_authenticatable, :confirmable,
 # :lockable, :timeoutable and :omniauthable
 devise :database_authenticatable, :registerable,
        :recoverable, :rememberable, :trackable, :validatable, :token_authenticatable

 before_save :ensure_authentication_token

 # Setup accessible (or protected) attributes for your model
 attr_accessible :email, :password, :password_confirmation, :remember_me, :username, :friends_attributes, :friends
 # attr_accessible :title, :body

 has_many :games#, :dependent => :destroy
 has_many :friends, :dependent => :destroy

 validates_presence_of :username
 validates_uniqueness_of :username
end

---

How can I accept a username from JSON and then in turn find the corresponding user_id? I am trying to allow a user to friend another by searching for the username.

Answer 1

You need to add username to the list of attributes that are accessible on the Friend model. So change:

attr_accessible :friend_id, :user_id

to

attr_accessible :friend_id, :user_id, :username

I believe that should do it.