policy strong_params

app/controllers/admin/profile_controller.rb

@@ -26,7 +26,7 @@ module Admin
     private
 
       def user_params
-        params.require(:user).permit(:name, :email, :password, :password_confirmation)
+        params.require(:user).permit(policy(User).permitted_attributes)
       end
   end
 end

app/controllers/admin/user_controller.rb

@@ -50,7 +50,7 @@ module Admin
     private
 
       def user_params
-        params.require(:user).permit(:name, :email, :role, :password, quiz_ids: [])
+        params.require(:user).permit(policy(User).permitted_attributes)
       end
   end
 end

app/policies/user_policy.rb

@@ -17,6 +17,11 @@ class UserPolicy < ApplicationPolicy
     user.admin? || user == record
   end
 
+  def permitted_attributes
+    return [:name, :email, :role, :password, quiz_ids: []] if user.admin?
+    [:name, :email, :password, :password_confirmation]
+  end
+
   class Scope < Scope
     def resolve
       return scope if user.admin?