Edit: The Dispossessed City 4

The form is fully derived through simple_form. slug is read-only (editable: false); active is an input only for managers (editable: :manage — toggle admin); purchase_price is hidden from non-managers entirely (if: :manage). One permit list drives both the form and strong-params, so they can't drift. The chapters are rows of a has_many edited in place: “Add Chapter” is a plain link that loads one more row into a turbo-frame below the fields, and each saved row has a remove box.

accepts_nested_attributes_for :chapters, allow_destroy: true, reject_if: :all_blank

crud_structure do
  attribute :slug,   editable: false      # read-only in the form
  attribute :active, editable: :manage    # an input only for managers
  attribute :purchase_price, if: :manage  # hidden from non-managers everywhere
  attribute :chapters, nested: %i[title pages]   # rows in this form, not a picker
  fieldset :form, %i[title subtitle slug blurb price purchase_price pages
                     published_on genre active publisher authors chapters cover manual]
end

def update
  @book.update(book_params) ? redirect_to(@book) : render(:edit, status: :unprocessable_entity)
end

def book_params
  params.require(:book).permit(*CrudComponents.permitted_attributes(Book, action: :update, ability: current_ability))
end

<%= crud_form @book %>

Read more: Forms  ·  Permissions