Mass assignment warning when using nested attributes with Devise

I'm having trouble with nested attributes and Devise. A similar issue to How do I use nested attributes with the devise model. As far as I can tell I've got everything set up as recommended here: Override devise registrations controller

I've set up the associations for Users and Subscriptions, I have "accepts_nested_attributes_for", and included the :subscriptions_attributes in attr_accessible, but I get a warning from the Devise controller.

class User < ActiveRecord::Base
    devise :database_authenticatable, :registerable,:recoverable, :rememberable, :trackable, :validatable
    validates_presence_of :first_name, :last_name
    has_many :subscriptions
    accepts_nested_attributes_for :subscriptions
    attr_accessible :first_name, :last_name, :email, :password, :password_confirmation, :remember_me, :subscriptions_attributes    
    ... 
end开发者_开发问答

--

class Subscription < ActiveRecord::Base
  belongs_to :user
  validates_presence_of :user_id, :chargify_subscription_id, :chargify_product_handle
  attr_accessible :user_id, :chargify_subscription_id, :chargify_product_handle
  ... 
end

devise/registrations/new.html.erb :

<%= form_for(resource, :as => resource_name, :url => registration_path(resource_name)) do |f| %>
    <%= devise_error_messages! %>
    <p><%= f.label :first_name %><br />
      <%= f.text_field :first_name %></p>
    ...

    <%= f.fields_for :subscription do |s| %>
        <p><%= s.label :chargify_subscription_id %><br />
          <%= s.text_field :chargify_subscription_id %></p>
            ...

I'm getting the following warning:

Started POST "/users" for 127.0.0.1 at Sat May 14 12:38:49 -0700 2011
  Processing by Devise::RegistrationsController#create as HTML
  Parameters: {"commit"=>"Sign up", "authenticity_token"=>"wNZhZgIhYm9CpZfhvDiRBqaJseoO8QvR0Mk9VIybhcI=", "utf8"=>"✓", "user"=>{"password_confirmation"=>"[FILTERED]",        "last_name"=>"9", "subscription"=>{"chargify_product_handle"=>"medium", "chargify_subscription_id"=>"123"}, "password"=>"[FILTERED]", "first_name"=>"9", "email"=>"99@99.     com"}}
WARNING: Can't mass-assign protected attributes: subscription

I've tried using subscription_attributes (singular) in attr_accessible but that doesn't work.

Any suggestions for what I might be doing wrong? Thanks.

Since you have a has_many association between your User and Subscription model, I believe you need to specify fields_for :subscriptions rather than fields_for :subscription.

<%= f.fields_for :subscriptions do |s| %>
    <p><%= s.label :chargify_subscription_id %><br />
      <%= s.text_field :chargify_subscription_id %></p>
        ...

The attributes within the fields_for scope will then be passed using the subscriptions_attributes parameter, which should work since you have attr_accessible :subscriptions_attributes.

For more examples of nested has_many association forms, check out the 'Nested Attributes Examples' section (one-to-many) of the Rails documentation.