scoped mass assignment overview

user_attr_accessible.rb

class User < ActiveRecord::Base
  belongs_to :group

  attr_accessible :name
end

user = User.new(:name => "John", :group_id => 5)
user.attributes # {:name => "John", :group_id => nil} group_id is nil because it is not accessible

user_classic.rb

class User < ActiveRecord::Base
  belongs_to :group
  
  attr_protected :group_id
end

user = User.new(:group_id => 5)
user.group_id # nil due to attribute protection

user_with_scope.rb

class User < ActiveRecord::Base
  attr_accessible :name
  attr_accessible :role, :as => :admin
end

#don't use a scope, so role is protected 
#IE you'd use a normal scope for mass assignment in a users/update action
user = User.new(:name => "John", :role => "admin")
user.attributes # {:name => "John", :role => nil}

#now with the admin scope I can set the role
#IE you'd use an admin scope when in your administrative backend (/admin/users/update)
user = User.new({:name => "John", :role => "admin"}, :as => :admin)
user.attributes # {:name => "John", :role => "admin"}

user_without_protection.rb

secure_or_controlled_attributes = {:name => "John", :role => "admin"}
user = User.new(secure_or_controlled_attributes, :without_protection => true)
user.attributes # {:name => "John", :role => "admin") #role is not protected because of the without_protection argument