Why Mass Assignment is the job of the controller in Rails 4.
Before I can talk about why mass assignment is now apart of the controller instead of the model (as it is in Rails 3) I first want to talk about the MVC user interface paradigm and what Mass Assignment is.
What is the MVC User interface paradigm?
Quite simply, the Model View Controller User Paradigm is a software architecture pattern first introduced by Trygve Reenskaug. It partitions the representations of data from the way the user interfaces with it.
What is Mass Assignment?
Mass Assignment allows us to use Active Record to set a bunch of attributes at once using a params hash. Where the attributes are the keys and and the value are the values you would like to assign.
A quick and dirty of what models, views, and controllers are and their roles in the MVC user interface paradigm. I like to think of the MVC paradigm like such;
The models are the Chefs. They know how to make the food from ingredients, you can think of the ingredients as data from a database.
The controllers are the waiters. They know where to bring the food, at what time, and how it should be modified to the guests liking, and tell the chefs what must be made.
The views are the guest. They tell the waiters what it is they want to eat, the order they want to eat it in, and of course, they eat the food.
Models
Models are where information from your database goes from being unrelated data, to knowledge. Models contain logic that represent single or multiple objects. Models also notify its associated views and controllers when there has been a change in state. This notification allows views to product updated out put and updated input. Business logic goes here.
Views
Views are the visual representation of the model. It's purpose to focus on a aspects of the model defined by the controller and suppresses others.
Controllers
Controllers are the link between the user and the system. the controller receives information from the view and send it to the model and vice versa. The controller has context over the information being sent from the model to the view and vice versa. This is where all application logic should live.
So given the definitions above...
Why is Mass Assignment responsibility of the controller in Rails 4 and not the model as it is in every previous versions of rails?
The whole point of the controller as stated above, is to control the flow between the user and the application. Mass assignment is a feature of the active record model which allows you to be selective of what input you will accept when you are mass assigning a hash of attributes.
This security feature, aimed at user (form) input, if placed in the model ends up making the implicit assumption that all normal interaction happen via an HTTP request. This assumption is wrong and inherently causes problems.
It's the controllers job to deal with HTTP input because its has explicit context of what is being inputed and requested by the user.
