title: Testing controller specs for PUT without permitting ID
body: <p>I have a controller that RESTfully updates a model. The action looks as follows:</p>
  
  <pre><code>def update
    @user = User.find(params[:id])
    params['skill_list'] = params['skill_list'].join(',') if params['skill_list'].present?
    @user.update!(user_params)
    render nothing: true
  end
  
  def user_params
    params.permit(:id, :summary, :skill_list)
  end
  </code></pre>
  
  <p>And my spec looks as follows:</p>
  
  <pre><code>it "should return 200 if param is for user put is summary" do
    ActionController::Parameters.action_on_unpermitted_parameters = :raise
    put :update, id: @bob.id, summary: 'yadayada', skill_list: ['a','b']
    assert_response 200
  end
  </code></pre>
  
  <p>Now the flow is the following</p>
  
  <ol>
  <li>We need to put the <code>id</code> in the <code>put</code> spec in order to tell it which <code>id</code> to use when updating.</li>
  <li>Controller finds it and updates the <code>summary</code> and <code>skill_list</code> fields.</li>
  <li>However, it also OVERRIDES <code>id</code>.</li>
  <li>If I don't permit <code>id</code>, the test fails with <code>ActionController::UnpermittedParams</code></li>
  <li>If I do permit it, the actual <code>id</code> gets replaces (we use <code>friendly_id</code> gem so that's unwanted - the numeric ID will get replaced by the slug, rendering the user unusable.</li>
  </ol>
  
  <p>For now we forbade <code>id</code> and put the spec on pending - but what is the best practice in these cases?</p>
  
  <p>Thanks in advance!</p>