Nested Comment body not being saved Ruby on Rails

Question

I'm banging my head on my desk trying to figure out why the comment is posting comment.body, but when I go into IRB body=nil and it won't display on App show page.

The structure: Apps have many comments on their show page, along with a comment form.

Apps View:

<h3>Comments</h3>
<% @comments.each do |comment| %>
  <div>
    <p><%= comment.user.email %></p>
    <p><%= comment.body %></p>
    <p><%= link_to 'Delete', [@app, comment], method: :delete, data: { confirm: 'Are you sure?' } %></p>
  </div>
<% end %>
<%= render 'comments/form' %>

Comments Controller:

  def create
    @app = App.find(params[:app_id])
    @comment = current_user.comments.build(params[:comment_params])
    @comment.user = current_user
    @comment.app = @app    
    @comment.save

      if @comment.save
        flash[:notice] = "Comment was added to the #{@comment.app.name}."
        redirect_to(@app)
      else
        flash[:error] = "There was a problem adding the comment."
        redirect_to(@app)
      end
  end

def comment_params
  params.require(:comment).permit(:user_id, :app_id, :body, :user_attributes => [:email])
end

In my Apps Controller:

  def show
    @app = App.find(params[:id])
    @comments = @app.comments.all
    @comment = @app.comments.build
  end

def app_params
  params.require(:app).permit(:name, :brief, :description, :element, :user_attributes => [:id], :element_attributes => [:name], :elements => [:name])
end

Comment form:

<%= form_for [@app, @comment] do |f| %>

  <div class="field">
    <%= f.label :body %><br>
    <%= f.text_area :body %>
  </div>
  <div class="actions">
    <%= f.submit %>
  </div>
  <%= f.hidden_field :app_id %>
<% end %>

Why the heck is the server Posting but not saving the body? What am I overlooking here?

Thanks in advance.

Answer 1

You don't really need to use nested attributes in this case at all. There is no reason to pass the user_id and app_id via the form either since they are known in the controller. Doing so just opens up the door for potential mischief. Like sending

user_id: 1, body: 'My boss is such a duchebag'

Whoops.

def create
  @app = App.find(params[:app_id])
  @comment = Comment.new(comment_params.merge(
    app: @app,
    user: current_user
  ))
  # notice that you where calling @comment.save twice..
  if @comment.save
    flash[:notice] = "Comment was added to the #{@comment.app.name}."
    redirect_to(@app)
  else
    flash[:error] = "There was a problem adding the comment."
    redirect_to(@app)
  end
end

def comment_params
  params.require(:comment).permit(:body)
end