Devise user creation with accepts_nested_attributes_for : belongs_to relation requires "optional: true" for validations to pass

[john-999]

Scenario:

• User can have many Roles
• 3 Models: User -< Userrole >- Role
• User+Userrole are created using the "nested models" approach (accepts_nested_attributes_for)
• Validation fails with: "Userroles user must exist"

Models:

class User < ApplicationRecord
  has_many :userroles
  accepts_nested_attributes_for :userroles
end

class Userrole < ApplicationRecord
  belongs_to :user, optional: true  # <--- This seems to be required and disables the foreign_key check
  belongs_to :role
end

class Role < ApplicationRecord
  has_many :userroles
end

The failed validation seems to be the result of how Devise interacts with Rails 5's enforced foreign_key presence validation. (I wrote a test script that represents this situation, but as a "pure" version, not based on/including the Devise account creation mechanism - the script passed without errors (change the file extension from .txt to .rb): record_creation_test_script.txt)

The mode Userrole thus currently requires "optional: true" and therefor disables the foreign_key check.

[ethirajsrinivasan]

optional: true is a feature of rails 5 to check associated objects are present. May i know what is the problem that you are facing with devise on this.

[john-999]

The problem is that if I use Devise's user creation mechanism to create a User in the scenario explained above (meaning: with the nested attributes of Userroles), then the User is not created - its validation fails with "Userroles user must exist". The validation does however pass if I add the "optional: true" as explained above (but having to add that is not the idea; and is also not necessary if I create a User in the above scenario but outside of the Devise mechanism).

[johnnypaper]

John is right...the optional: true on a has_one model had the same problem. It's super irritating and I wasted half a day trying to figure it out.

Let me be clear about this:

class Login < ApplicationRecord
  # Include default devise modules. Others available are:
  # :confirmable, :lockable, :timeoutable and :omniauthable, :rememberable
  devise :database_authenticatable, :registerable, :recoverable, :trackable, :validatable, :confirmable, :lockable, :timeoutable

  has_one :user
  accepts_nested_attributes_for :user
end

class User < ApplicationRecord

  belongs_to :login, optional: true #<- Again as mentioned before, this is mandatory for the model to be created without throwing an error.

end

[tegon]

Hi @john-999, thank you for the report.

I've changed your script to include Devise and still seems to work. Please let me know if I missing something. This is the code I've used:

begin
  require "bundler/inline"
rescue LoadError => e
  $stderr.puts "Bundler version 1.10 or later is required. Please update your Bundler"
  raise e
end

gemfile(true) do
  source "https://rubygems.org"
  gem "rails", "~> 5.0"
  gem "sqlite3"
  gem "devise"
end

require "active_record"
require "minitest/autorun"
require "logger"
require 'rack/test'
require 'action_controller/railtie'
require 'devise/rails/routes'
require 'devise/rails/warden_compat'

# This connection will do for database-independent bug reports.
ActiveRecord::Base.establish_connection(adapter: "sqlite3", database: ":memory:")
ActiveRecord::Base.logger = Logger.new(STDOUT)


Devise.setup do |config|
  require 'devise/orm/active_record'
  config.secret_key = 'secret_key_base'
end

class TestApp < Rails::Application
  config.root = File.dirname(__FILE__)
  config.session_store :cookie_store, key: 'cookie_store_key'
  secrets.secret_token    = 'secret_token'
  secrets.secret_key_base = 'secret_key_base'
  config.eager_load = false

  config.middleware.use Warden::Manager do |config|
    Devise.warden_config = config
  end

  config.logger = Logger.new($stdout)
  Rails.logger  = config.logger

end

class User < ActiveRecord::Base
  devise :database_authenticatable
  has_many :userroles
  accepts_nested_attributes_for :userroles
end

class Userrole < ActiveRecord::Base
  belongs_to :user #, optional: true  # <--- This seems to be required with Devise, and it disables the foreign_key check
  belongs_to :role
end

class Role < ActiveRecord::Base
  has_many :userroles
end

Rails.application.initialize!

ActiveRecord::Schema.define do
  create_table :users, force: true do |t|
    t.string :name
    t.string :email,              null: false
    t.string :encrypted_password, null: true
  end

  create_table :userroles, force: true do |t|
    t.integer :user_id
    t.integer :role_id
  end

  create_table :roles, force: true do |t|
    t.string :name
  end
end

Rails.application.routes.draw do
  devise_for :users

  get '/' => 'test#index'
end

class ApplicationController < ActionController::Base
end

class TestController < ApplicationController
  include Rails.application.routes.url_helpers

  before_action :authenticate_user!

  def index
    render plain: 'Home'
  end
end

class BugTest < Minitest::Test
  def test_parent_child_record_creation_with_nested_attributes
    role = Role.create!(name: 'Administrator')
    user = User.create!(name: 'Dan', email: 'dan@mail.com', password: '123', password_confirmation: '123', userroles_attributes: [role_id: role.id])

    assert_equal 1, Role.count
    assert_equal 1, User.count
    assert_equal role.id, user.userroles.first.role_id
  end
end

[tegon]

I'm closing this issue because it has not had recent activity.
If you're still facing this on the latest version, please open a new one with all the information requested in the template.

Thank you!