{"action":"opened","issue":{"url":"https://api.github.com/repos/projectjellyfish/api/issues/968","labels_url":"https://api.github.com/repos/projectjellyfish/api/issues/968/labels{/name}","comments_url":"https://api.github.com/repos/projectjellyfish/api/issues/968/comments","events_url":"https://api.github.com/repos/projectjellyfish/api/issues/968/events","html_url":"https://github.com/projectjellyfish/api/issues/968","id":112217358,"number":968,"title":"API should be more strict about what params it accepts","user":{"login":"chriskacerguis","id":2414647,"avatar_url":"https://avatars.githubusercontent.com/u/2414647?v=3","gravatar_id":"","url":"https://api.github.com/users/chriskacerguis","html_url":"https://github.com/chriskacerguis","followers_url":"https://api.github.com/users/chriskacerguis/followers","following_url":"https://api.github.com/users/chriskacerguis/following{/other_user}","gists_url":"https://api.github.com/users/chriskacerguis/gists{/gist_id}","starred_url":"https://api.github.com/users/chriskacerguis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chriskacerguis/subscriptions","organizations_url":"https://api.github.com/users/chriskacerguis/orgs","repos_url":"https://api.github.com/users/chriskacerguis/repos","events_url":"https://api.github.com/users/chriskacerguis/events{/privacy}","received_events_url":"https://api.github.com/users/chriskacerguis/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/projectjellyfish/api/labels/api","name":"api","color":"006b75"},{"url":"https://api.github.com/repos/projectjellyfish/api/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"open","locked":false,"assignee":{"login":"stackus","id":158579,"avatar_url":"https://avatars.githubusercontent.com/u/158579?v=3","gravatar_id":"","url":"https://api.github.com/users/stackus","html_url":"https://github.com/stackus","followers_url":"https://api.github.com/users/stackus/followers","following_url":"https://api.github.com/users/stackus/following{/other_user}","gists_url":"https://api.github.com/users/stackus/gists{/gist_id}","starred_url":"https://api.github.com/users/stackus/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stackus/subscriptions","organizations_url":"https://api.github.com/users/stackus/orgs","repos_url":"https://api.github.com/users/stackus/repos","events_url":"https://api.github.com/users/stackus/events{/privacy}","received_events_url":"https://api.github.com/users/stackus/received_events","type":"User","site_admin":false},"milestone":null,"comments":0,"created_at":"2015-10-19T19:41:56Z","updated_at":"2015-10-19T19:41:56Z","closed_at":null,"body":"Talking with Allen about archiving projects made me realize that having a single *_params method to access permitted params is not going to cut it. Two common cases for different allowed params exist, create and update. We should also consider the action and the user making the call.\r\n\r\n*  Break \r\n````\r\n*_params\r\n````\r\ninto\r\n````\r\ncreate_*_params  and update_*_params\r\n````\r\n\r\n\r\nThis should be done for the majority of cases.\r\n\r\n*  Consider object state when allowing parameters when updating.  An example would be not allowing project attributes to be updated after it has been archived\r\n* [box checked] Use Pundits strong parameters helper permitted_parameters to further filter allowed values based on user access levels or relation to the object\r\n\r\nThis contest repo takes an interesting approach to the first two bullet points: https://github.com/sb8244/railschallenge-city-watch"}}