#472: Update the Projects::BuildListsController and Api::V1::BuildListsController

app/models/build_list/item.rb

@@ -2,7 +2,7 @@ class BuildList::Item < ActiveRecord::Base
 
   belongs_to :build_list, touch: true
 
-  attr_protected :build_list_id
+  # attr_protected :build_list_id
 
   GIT_ERROR = 5
 

app/models/collaborator.rb

@@ -3,7 +3,6 @@ class Collaborator
   include ActiveModel::Validations
   include ActiveModel::Serializers::JSON
   # include ActiveModel::MassAssignmentSecurity
-  include ActiveModel::ForbiddenAttributesProtection
   extend  ActiveModel::Naming
 
   attr_accessor :role, :actor, :project, :relation

app/policies/build_list_policy.rb

@@ -61,7 +61,7 @@ class BuildListPolicy < ApplicationPolicy
   #
   # Returns Array
   def permitted_attributes
-    %i(
+    pa = %i(
       arch_id
       auto_create_container
       auto_publish
@@ -69,20 +69,23 @@ class BuildListPolicy < ApplicationPolicy
       build_for_platform_id
       commit_hash
       external_nodes
-      extra_build_lists
-      extra_params
-      extra_repositories
-      include_repos
       include_testing_subrepository
       project_id
       project_version
       save_buildroot
       save_to_platform_id
       save_to_repository_id
-      update_type,
+      update_type
       use_cached_chroot
       use_extra_tests
     )
+    pa << {
+      include_repos:      [],
+      extra_build_lists:  [],
+      extra_repositories: [],
+      extra_params:       BuildList::EXTRA_PARAMS,
+    }
+    pa
   end
 
   class Scope < Scope

spec/controllers/api/v1/build_lists_controller_spec.rb

@@ -533,7 +533,8 @@ describe Api::V1::BuildListsController, type: :controller do
             @another_user = FactoryGirl.create(:user)
             @build_list.update_column(:status, BuildList::SUCCESS)
             @build_list.save_to_repository.update_column(:publish_without_qa, true)
-            @build_list.project.collaborators.create(actor_type: 'User', actor_id: @another_user.id, role: 'reader')
+            Collaborator.create(actor_type: 'User', actor_id: @another_user.id, role: 'reader', project: @build_list.project)
+
             http_login(@another_user)
             do_reject_publish
           end

spec/controllers/projects/build_lists_controller_spec.rb

@@ -165,7 +165,7 @@ describe Projects::BuildListsController, type: :controller do
 
         it 'returns an error if user is project reader' do
           @another_user = FactoryGirl.create(:user)
-          @build_list.project.collaborators.create(actor_type: 'User', actor_id: @another_user.id, role: 'reader')
+          Collaborator.create(actor_type: 'User', actor_id: @another_user.id, role: 'reader', project: @build_list.project)
           set_session_for(@another_user)
 
           expect_any_instance_of(BuildList).to_not receive(:rerun_tests)
@@ -245,7 +245,7 @@ describe Projects::BuildListsController, type: :controller do
             @another_user = FactoryGirl.create(:user)
             @build_list.update_column(:status, BuildList::SUCCESS)
             @build_list.save_to_repository.update_column(:publish_without_qa, true)
-            @build_list.project.collaborators.create(actor_type: 'User', actor_id: @another_user.id, role: 'reader')
+            Collaborator.create(actor_type: 'User', actor_id: @another_user.id, role: 'reader', project: @build_list.project)
             set_session_for(@another_user)
             do_reject_publish
           end