orders_controller.rb

module Spree
  class OrdersController < Spree::StoreController
    
    # this gets included by the Spree::BaseController which the Spree::StoreController inherits from
    include Spree::Core::ControllerHelpers::StrongParameters
    
    # ... a bunch of controller methods ...
    
    private

      def order_params
        if params[:order]
          params[:order].permit(*permitted_order_attributes)  # <<<=== dynamically reference defined strong parameters 
        else
          {}
        end
      end
      
end

permitted_attributes.rb

# https://github.com/spree/spree/blob/master/core/lib/spree/permitted_attributes.rb

module Spree
  module PermittedAttributes
    ATTRIBUTES = [:line_item_attributes]

    mattr_reader *ATTRIBUTES

    @@line_item_attributes = [:id, :variant_id, :quantity]
  end
end

strong_parameters.rb

# https://github.com/spree/spree/blob/master/core/lib/spree/core/controller_helpers/strong_parameters.rb

module Spree
  module Core
    module ControllerHelpers
      module StrongParameters
        def permitted_attributes
          Spree::PermittedAttributes
        end

        delegate *Spree::PermittedAttributes::ATTRIBUTES,
                 :to => :permitted_attributes,
                 :prefix => :permitted

        def permitted_order_attributes
          permitted_checkout_attributes + [
            :line_items_attributes => permitted_line_item_attributes
          ]
        end
      end
    end
  end
end