Default registerable not working in 3.0.0.rc with Rails 3.2.13 and strong_parameters 0.2.1

[filipegiusti]

These 3 doesn't seems to be working fine together.

Devise::RegistrationsController#create isn't working for the default case and I get in the logs Unpermitted parameters: email, password, password_confirmation.

I didn't have time to pull devise and run the tests, but what I could find was that

$ bundle exec rails c
Loading development environment (Rails 3.2.13)
irb(main):001:0> class User < ActiveRecord::Base; devise :database_authenticatable; end
=> {}
irb(main):002:0> params = ActionController::Parameters.new(user: { "email" => "jose", "password" => "passpass",  "role" => "invalid" })
=> {"user"=>{"email"=>"jose", "password"=>"passpass", "role"=>"invalid"}}
irb(main):003:0> sanitizer = Devise::ParameterSanitizer.new(User, :user, params)
=> #<Devise::ParameterSanitizer:0x007f5487b3f730 @resource_class=User(Table doesn't exist), @resource_name=:user, @params={"user"=>{"email"=>"jose", "password"=>"passpass", "role"=>"invalid"}}, @blocks={}>
irb(main):004:0> sanitizer.for(:sign_up)
=> {}

This is almost the same code run in a test case in devise's test suite, but with a different end result.

This may be the same problem of #2452.

I found that #permit was receiving an Array instead of multiple parameters here https://github.com/plataformatec/devise/blob/master/lib/devise/parameter_sanitizer.rb#L48 and this may be the root cause. See the implementation of permit here https://github.com/rails/strong_parameters/blob/master/lib/action_controller/parameters.rb#L64

Anyway, this is an incomplete report, I'll try to look into it and improve this report in the following days.

[josevalim]

Thanks @filipegiusti ! I have changed master to properly splat the array. I want to clean those issues up so we can release a new Devise version!

[filipegiusti]

Thanks.