Updating Nested Form / Model Attributes

I have a nested form on a Devise signup page. The user signs up and then they also fill out their company info (Name , Address etc.). My User and Company model are associated through a Role model which has id_user and id_company. My form has nested form_for tags for the Role and Company models. The sign-up works like magic and the Role is created automatically with the id_user and id _company filled in.

Now the part I can't figure out. When they sign up the Company is new and the User is the first and therefore should be the 'owner' Role. I have some other attributes I want to set ( :role => 'owner', :active => 1, :default_role => 1 etc.). The role attribute will be used later for an authorization system - probably with Pundit.

I want to do this on the backend with the controller. The intermediate Role is created via 'magic' but can you hook into that process and further update the record? I know I could probably add a hidden field in the form but to me that is opening a security hole. Here is my StackExchange post that has the code etc.:

http://stackoverflow.com/questions/28039893/how-do-i-update-a-nested-resource-without-passing-the-data-via-a-form

I just posted an answer that hopefully works for you. The create action is where you want to add the logic to set the role, active, and default_role attributes. Since your form submits a role object already, we can assume this is the last one and update it to have the default attributes of ( :role => 'owner', :active => 1, :default_role => 1 etc.).

Make sense?