title: Railstutorial | Chapter 10 | Exercise 10.4.1.2 | Why does abritrary password setting work?
body: <p><strong>Description of the Exercise:</strong> <a href="https://www.railstutorial.org/book/updating_and_deleting_users#sec-exercises_administrative_users" rel="nofollow">Railstutorial Exercise 10.4.1.2</a></p>
  
  <p><strong>The exercise:</strong> <strong>'FILL_IN'</strong> has to be replaced with the proper code, so that the test is working</p>
  
  <pre><code>test "should not allow the admin attribute to be edited via the web" do
    log_in_as(@other_user)
    assert_not @other_user.admin?
    patch user_path(@other_user), params: {
                                    user: { password:              FILL_IN,
                                            password_confirmation: FILL_IN,
                                            admin: FILL_IN} }
    assert_not @other_user.FILL_IN.admin?
  end
  </code></pre>
  
  <p><strong>My solution:</strong></p>
  
  <pre><code>test "should not allow the admin attribute to be edited via the web" do
    log_in_as(@other_user)
    assert_not @other_user.admin?
    patch user_path(@other_user), params: {
                                    user: { password:              'password',
                                            password_confirmation: 'password',
                                            admin: true } }
    assert_not @other_user.reload.admin?
  end
  </code></pre>
  
  <p><strong>My Question(s):</strong></p>
  
  <p>If you have set the ':admin' attribute to the list of permitted parameters in user_params (in the UsersController class) the test turns 'Red' as it is supposed to. What I don't understand though, is that you can set random passwords and the test is still working properly, like so:</p>
  
  <pre><code>test "should not allow the admin attribute to be edited via the web" do
    log_in_as(@other_user)
    assert_not @other_user.admin?
    patch user_path(@other_user), params: {
                                    user: { password:              'foobar',
                                            password_confirmation: 'foobar',
                                            admin: true } }
    assert_not @other_user.reload.admin?
  end
  </code></pre>
  
  <p>Shouldn't the only valid option be 'password' (and not 'foobar' or even '' (i.e. blank)), since the instance variable @other_user contains the values of the User 'archer' from the fixtures file 'users.yml', who has 'password' as a password_digest? Wouldn't it result in a mismatch between the two attributes password_digest(='password') and password(='foobar')? Or is the 'password_digest' attribute from 'archer' somehow updated as well? If so, how does it work?</p>
  
  <p>And why does the test turn 'Green', if you type in an invalid password, like:</p>
  
  <pre><code>test "should not allow the admin attribute to be edited via the web" do
    log_in_as(@other_user)
    assert_not @other_user.admin?
    patch user_path(@other_user), params: {
                                    user: { password:              'foo',
                                            password_confirmation: 'bar',
                                            admin: true } }
    assert_not @other_user.reload.admin?
  end
  </code></pre>
  
  <p>Could it be that the 'patch' request aborts due to the incorrect password input and thus also fails to update the admin status? Is that the reason why the test is 'Green' (since admin is still 'nil')?</p>
  
  <p>I already looked up the reference implementation of the sample application by Michael Hartl (<a href="https://bitbucket.org/railstutorial/sample_app_4th_ed" rel="nofollow">https://bitbucket.org/railstutorial/sample_app_4th_ed</a>), but unfortunately he does not provide any code relating to the exercises.</p>
  
  <p>Thanks for help!</p>