From bdc4ec46447a5e338519374ac292794e066a5c62 Mon Sep 17 00:00:00 2001
From: cryptogopher <cryptogopher@noreply.me>
Date: Fri, 22 Nov 2024 15:48:09 +0100
Subject: [PATCH] Specify user modifiable ATTRIBUTES

---
 app/controllers/default/units_controller.rb | 3 ++-
 app/controllers/units_controller.rb         | 2 +-
 app/models/unit.rb                          | 2 ++
 3 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/app/controllers/default/units_controller.rb b/app/controllers/default/units_controller.rb
index d117005..9ca24a7 100644
--- a/app/controllers/default/units_controller.rb
+++ b/app/controllers/default/units_controller.rb
@@ -18,9 +18,10 @@ class Default::UnitsController < ApplicationController
   end
 
   def import
+    params = @unit.slice(Unit::ATTRIBUTES - [:symbol, :base_id])
     current_user.units
       .find_or_initialize_by(symbol: @unit.symbol)
-      .update!(base: @base, **@unit.slice(:name, :multiplier))
+      .update!(base: @base, **params)
     run_and_render :index
   end
 
diff --git a/app/controllers/units_controller.rb b/app/controllers/units_controller.rb
index f48cfef..81fdc92 100644
--- a/app/controllers/units_controller.rb
+++ b/app/controllers/units_controller.rb
@@ -58,7 +58,7 @@ class UnitsController < ApplicationController
   private
 
   def unit_params
-    params.require(:unit).permit(:symbol, :name, :base_id, :multiplier)
+    params.require(:unit).permit(Unit::ATTRIBUTES)
   end
 
   def find_unit
diff --git a/app/models/unit.rb b/app/models/unit.rb
index 29c05fb..b4f3c86 100644
--- a/app/models/unit.rb
+++ b/app/models/unit.rb
@@ -1,4 +1,6 @@
 class Unit < ApplicationRecord
+  ATTRIBUTES = [:symbol, :name, :multiplier, :base_id]
+
   belongs_to :user, optional: true
   belongs_to :base, optional: true, class_name: "Unit"
   has_many :subunits, class_name: "Unit", dependent: :restrict_with_error, inverse_of: :base