Use constants for controller allowed params (#14815)

* Constants for controller allowed params

* Apply suggestions from code review

Co-authored-by: Michael Kohl <me@citizen428.net>

Co-authored-by: Michael Kohl <me@citizen428.net>

app/controllers/admin/pages_controller.rb

@@ -2,6 +2,11 @@ module Admin
   class PagesController < Admin::ApplicationController
     layout "admin"
 
+    PAGE_ALLOWED_PARAMS = %i[
+      title slug body_markdown body_html body_json description template
+      is_top_level_path social_image landing_page
+    ].freeze
+
     def index
       @pages = Page.all.order(created_at: :desc)
       @code_of_conduct = Page.find_by(slug: "code-of-conduct")
@@ -59,11 +64,7 @@ module Admin
     private
 
     def page_params
-      allowed_params = %i[
-        title slug body_markdown body_html body_json description template
-        is_top_level_path social_image landing_page
-      ]
-      params.require(:page).permit(allowed_params)
+      params.require(:page).permit(PAGE_ALLOWED_PARAMS)
     end
 
     def prepopulate_new_form(slug)

app/controllers/admin/podcasts_controller.rb

@@ -3,6 +3,23 @@ module Admin
     layout "admin"
 
     before_action :find_podcast, only: %i[edit update fetch add_owner]
+    PODCAST_ALLOWED_PARAMS = %i[
+      title
+      feed_url
+      description
+      itunes_url
+      overcast_url
+      android_url
+      soundcloud_url
+      website_url
+      twitter_username
+      pattern_image
+      main_color_hex
+      slug
+      image
+      reachable
+      published
+    ].freeze
 
     def index
       @podcasts = Podcast.left_outer_joins(:podcast_episodes)
@@ -56,24 +73,7 @@ module Admin
     end
 
     def podcast_params
-      allowed_params = %i[
-        title
-        feed_url
-        description
-        itunes_url
-        overcast_url
-        android_url
-        soundcloud_url
-        website_url
-        twitter_username
-        pattern_image
-        main_color_hex
-        slug
-        image
-        reachable
-        published
-      ]
-      params.require(:podcast).permit(allowed_params)
+      params.require(:podcast).permit(PODCAST_ALLOWED_PARAMS)
     end
   end
 end

app/controllers/admin/users_controller.rb

@@ -3,6 +3,18 @@ module Admin
     layout "admin"
     using StringToBoolean
 
+    USER_ALLOWED_PARAMS = %i[
+      new_note note_for_current_role user_status
+      merge_user_id add_credits remove_credits
+      add_org_credits remove_org_credits
+      organization_id identity_id
+    ].freeze
+
+    EMAIL_ALLOWED_PARAMS = %i[
+      email_subject
+      email_body
+    ].freeze
+
     after_action only: %i[update user_status banish full_delete merge] do
       Audit::Logger.log(:moderator, current_user, params.dup)
     end
@@ -260,18 +272,12 @@ module Admin
     end
 
     def user_params
-      allowed_params = %i[
-        new_note note_for_current_role user_status
-        merge_user_id add_credits remove_credits
-        add_org_credits remove_org_credits
-        organization_id identity_id
-      ]
-      params.require(:user).permit(allowed_params)
+      params.require(:user).permit(USER_ALLOWED_PARAMS)
     end
 
     def send_email_params
-      params.require(%i[email_subject email_body])
-      params.permit(%i[email_subject email_body])
+      params.require(EMAIL_ALLOWED_PARAMS)
+      params.permit(EMAIL_ALLOWED_PARAMS)
     end
   end
 end

app/controllers/users/notification_settings_controller.rb

@@ -19,6 +19,7 @@ module Users
                         mod_roundrobin_notifications
                         reaction_notifications
                         welcome_notifications].freeze
+    ONBOARDING_ALLOWED_PARAMS = %i[email_newsletter email_digest_periodic].freeze
 
     def update
       authorize current_user, policy_class: UserPolicy
@@ -37,8 +38,7 @@ module Users
       authorize User
 
       if params[:notifications]
-        permitted_params = %i[email_newsletter email_digest_periodic]
-        current_user.notification_setting.assign_attributes(params[:notifications].permit(permitted_params))
+        current_user.notification_setting.assign_attributes(params[:notifications].permit(ONBOARDING_ALLOWED_PARAMS))
       end
 
       current_user.saw_onboarding = true

app/models/settings/mandatory.rb

@@ -10,13 +10,14 @@ module Settings
       suggested_tags: Settings::General,
       suggested_users: Settings::General
     }.freeze
+    MAPPING_KEYS = MAPPINGS.keys
 
     MAPPINGS.each do |setting, settings_model|
       delegate setting, "#{setting}=", to: settings_model
     end
 
     def self.keys
-      MAPPINGS.keys
+      MAPPING_KEYS
     end
 
     def self.missing