Custom Devise Parameters Not Persisting During Rails User Registration

Below is an explanation of what might be going wrong and how to resolve it.

What's Happening

Even though you added a before action that calls

RUBYCopied
devise_parameter_sanitizer.permit(:sign_up, keys: [:name, :phone, :photo])

the log shows your raw parameters still “unpermitted” (e.g. permitted: false). This happens because:

1. Logging the Raw Params:
   The output in your log comes from params[:user] directly. Before Devise’s sanitizer is applied, these parameters are still “unpermitted” (that is, the permissions have not been merged into the parameter hash yet).

2. Devise’s Internal Use of Sanitized Params:
   Devise uses its own method (usually sign_up_params) to build a new user. If the custom keys are not merged into the permitted parameters at that time, they won’t be used when creating the user.

How to Fix It

1. Ensure Proper Controller Inheritance and Callback Order:
   Double-check that your registrations controller inherits from Devise::RegistrationsController, for example:

   RUBYCopied
   class Users::RegistrationsController < Devise::RegistrationsController
     # Ensure the configuration method is called before creating the user.
     before_action :configure_sign_up_params, only: [:create]
   
     def create
       # If you log here, you'll see the raw parameters.
       logger.debug "#{params[:user].inspect}"
       super
     end
   
     protected
   
     def configure_sign_up_params
       devise_parameter_sanitizer.permit(:sign_up, keys: [:name, :phone, :photo])
     end
   end

2. Log the Sanitized Parameters (Optional):
   If you want to verify that the parameters are properly sanitized, log the result of:

   RUBYCopied
   logger.debug "#{devise_parameter_sanitizer.sanitize(:sign_up).inspect}"

   This call will show you the permitted parameters that Devise uses when creating the user.

3. Double-check Your Form Fields:
   Just as important, make sure that the sign-up form sends the custom fields (name, phone and photo). For instance, your view should have inputs like:

   ERBCopied
   <%= f.text_field :name %>
   <%= f.text_field :phone %>
   <%= f.file_field :photo %>

4. Customize sign_up_params (if needed):
   In some cases, you might prefer to override the sign_up_params method instead of (or in addition to) using devise_parameter_sanitizer. For example:

   RUBYCopied
   def sign_up_params
     params.require(:user).permit(:name, :phone, :photo, :email, :password, :password_confirmation)
   end

   This ensures that when Devise calls sign_up_params, your custom keys are also included.

Summary

The custom parameters are not being saved because they’re not showing up in the parameters that Devise ultimately uses for creating the user. Adjust your controller to make sure that:

• The correct before_action runs and the sanitizer is applied.
• You are checking the sanitized parameters (not the raw params) if you need to debug.
• The sign-up form is providing all the custom fields.

Following these suggestions should result in the added parameters appearing in your database upon user creation.