fix collection params

app/controllers/v1/collections_controller.rb

@@ -7,7 +7,7 @@ class V1::CollectionsController < ApplicationController
   include ::Paginator
 
 
-  before_action :set_collection, only: [:show, :update, :destroy, :add_object, :set_collection_items]
+  before_action :set_collection, only: [:show, :update, :destroy, :add_object]
   before_action :authenticate_user!, only: [:create, :update, :destroy]
 
   # GET /v1/collections
@@ -27,9 +27,10 @@ class V1::CollectionsController < ApplicationController
   # POST /v1/collection.json
   def create
     collection = Collection.new(collection_params)
-    set_collection_items
+    
 
     if collection.save
+      collection.add_items(items_params[:items])
       render json: collection, status: :created
     else
       render json: collection.errors, status: :unprocessable_entity
@@ -40,9 +41,8 @@ class V1::CollectionsController < ApplicationController
   # PUT/PATCH /v1/users/1.json
   def update
 
-    set_collection_items
-
     if @collection.update(collection_params)
+      @collection.add_items(items_params[:items])
       render json: @collection, status: :ok
     else
       render json: @collection.errors, status: :unprocessable_entity
@@ -59,7 +59,7 @@ class V1::CollectionsController < ApplicationController
   # POST /v1/collections/!/items
   def add_object
     render nothing: true, status: :unprocessable_entity if params.nil?
-    set_collection_items
+    @collection.add_items(items_params[:items])
     render json: @collection, status: :ok
   end
 
@@ -77,17 +77,13 @@ class V1::CollectionsController < ApplicationController
     @collection ||= Collection.find(params[:id])
   end
 
-  def set_collection_items
-    items = collection_params[:items]
-    collection_items = items.map{ |item| CollectionItem.new(collection: @collection,
-                                                            collectionable: item[:type].constantize.find(item[:id]),
-                                                            order: item[:order])}
-    CollectionItem.import collection_items, on_duplicate_key_update: {conflict_target: [:collection_id, :collectionable_id, :collectionable_type]}
-  end
-
   # Never trust parameters from the scary internet, only allow the white list through.
   def collection_params
-    params.require(:collection).permit(:name, :description, :owner_id, :owner_type, :privacy, tags: [], items: [:type, :id])
+    params.require(:collection).permit(:name, :description, :owner_id, :owner_type, :privacy, tags: [])
+  end
+
+  def items_params
+    params.require(:collection).permit(items: [:type, :id, :order])
   end
 
 end

app/models/collection.rb

@@ -74,6 +74,13 @@ class Collection < ApplicationRecord
     privacy == 'private'
   end
 
+  def add_items(items)
+    collection_items = items.map{ |item| CollectionItem.new(collection: self,
+                                                            collectionable: item[:type].constantize.find(item[:id]),
+                                                            order: item[:order])}
+    CollectionItem.import collection_items, on_duplicate_key_update: {conflict_target: [:collection_id, :collectionable_id, :collectionable_type], columns: [:order]}
+  end
+  
   ## score methods
   def user_category
     owner.try('user_category')