policy strong_params

app/policies/user_policy.rb

@@ -17,6 +17,11 @@ class UserPolicy < ApplicationPolicy
     user.admin? || user == record
   end
 
+  def permitted_attributes
+    return [:name, :email, :role, :password, quiz_ids: []] if user.admin?
+    [:name, :email, :password, :password_confirmation]
+  end
+
   class Scope < Scope
     def resolve
       return scope if user.admin?