title: Use Pundit with strong parameters in Rails API
body: <p>How is it possible to use Pundit <a href="https://github.com/varvet/pundit#strong-parameters" rel="nofollow noreferrer">strong parameters</a> when working with JSON API if a model contains some relations?
  I have already <a href="https://stackoverflow.com/questions/58559549/rails-api-pundit-strong-parameters-with-activemodelserializers">posted</a> a question that explained how to work around with it in case of a single model.
  Son here is what works:</p>
  
  <pre class="lang-rb prettyprint-override"><code># posts_controller.rb
  
  def update
      if @post.update(permitted_attributes(@post))
        render jsonapi: @post
      else
        render jsonapi: @post.errors, status: :unprocessable_entity
      end
    end
  
  private
  
    def set_post
      @post = Post.find(params[:id])
    end
  
    def post_params
      ActiveModelSerializers::Deserialization.jsonapi_parse(
        params,
        only: [:title, :body, :user]
      )
    end
  
    def pundit_params_for(_record)
      params.fetch(:data, {}).fetch(:attributes, {})
    end
  </code></pre>
  
  <p>Unfortunately it will fail to extact models defined in <code>relationships</code> block of the request JSON, foe example:</p>
  
  <pre><code>"relationships"=&gt;{"country"=&gt;{"data"=&gt;{"type"=&gt;"countries", "id"=&gt;"1"}}, "language"=&gt;{"data"=&gt;{"type"=&gt;"languages", "id"=&gt;"245"}}}
  </code></pre>
  
  <p>Any ideas ?</p>