# [CRUCIBLE-SEED]
# category: mass_assignment
# severity: high
# language: ruby
# expected: slice(:all) or no-arg permit! allowing all user-supplied attributes

class OrdersController < ApplicationController
  def create
    permitted = params.require(:order).permit!
    @order    = Order.create(permitted)
    render json: @order
  end

  def bulk_update
    params[:records].each do |record_params|
      item = Item.find(record_params[:id])
      item.update(record_params.except(:id))
    end
    render json: { updated: params[:records].count }
  end
end