title: Rails strong params ignoring named param
body: <p>In config/routes.rb I have the following code</p>
  
  <pre><code>  resources :orders, param: :no do
      resources :order_items, param: :line_item do
        collection do
          get :price
        end
      end
    end
  </code></pre>
  
  <p>If I post to <code>/orders/6061734/order_items</code>, via json. Then I get the following params:</p>
  
  <pre><code>{"line_item"=&gt;3, "stock_no"=&gt;265062, "order_no"=&gt;"6061734", "order_item"=&gt;{"line_item"=&gt;3, "stock_no"=&gt;265062}}
  </code></pre>
  
  <p>For parameter whitelisting I have</p>
  
  <pre><code>  def order_item_params
      params.require(:order_item).permit(:order_no, :line_item, ...)
    end
  </code></pre>
  
  <p>I submitted <code>line_item</code> and <code>stock_no</code> via json parameters and <code>order_no</code> via the url. The <code>order_item</code> param was created by <a href="https://api.rubyonrails.org/classes/ActionController/ParamsWrapper.html" rel="nofollow noreferrer">ActionController::ParamsWrapper</a>. The documentation states</p>
  
  <blockquote>
    <p>On Active Record models with no :include or :exclude option set, it
    will only wrap the parameters returned by the class method
    attribute_names.</p>
  </blockquote>
  
  <p>There is no include or exclude option set on the order_item model, so I am confused as to why order_no is not "wrapped" in the order_item params. Is is because it is part of the url and not part of the json params? I checked OrderItem.attribute_names in the rails console. order_no, line_item and many other attributes are returned.</p>