Exempt the app's configured CSRF param, not just authenticity_token

[VSN2015]

The bug

FORM_KEYS (lib/permittable.rb, around line 232) hardcodes the literal "authenticity_token" as the CSRF parameter name to exempt from the top-level unknown: :error check:

FORM_KEYS = %w[authenticity_token _method utf8 commit].freeze

That's Rails' default CSRF parameter name, but config.action_controller.request_forgery_protection_token lets an app rename it. An app that does trips unknown: :error on every ordinary browser form submission — reproducing exactly the bug FORM_KEYS was added to fix in the first place (per the comment right above it), just under the app's own key instead of the default one:

# config/application.rb
config.action_controller.request_forgery_protection_token = :csrf_token

permit_params :create, unknown: :error do
  required :name, :string
end

A normal form POST then carries csrf_token instead of authenticity_token, FORM_KEYS doesn't recognize it, and the request fails with { param: "csrf_token", code: "unknown" } even though nothing is wrong with it.

Since the configured name can differ per controller and isn't knowable at class-load time (Rails may not have finished initializing when this file first loads), a frozen constant computed once can't hold it — it has to be read live, per request.

The fix

permittable_check_unknown now also subtracts the live controller's own request_forgery_protection_token (from ActionController::RequestForgeryProtection, included by ActionController::Base) from the top-level exemption, alongside the existing FORM_KEYS/ROUTING_KEYS constant and permittable_request_supplied_keys:

if top_level
  extra -= UNCHECKED_TOP_LEVEL_KEYS + permittable_request_supplied_keys
  extra -= [permittable_configured_csrf_key].compact
end

def permittable_configured_csrf_key
  return nil unless respond_to?(:request_forgery_protection_token)

  token = request_forgery_protection_token
  token && token.to_s
end

A plain params duck or a standalone Contract has no request_forgery_protection_token method, so permittable_configured_csrf_key returns nil there and behavior is unchanged — they still only get the FORM_KEYS default's "authenticity_token". FORM_KEYS, ROUTING_KEYS, and MONITOR_DROPPED_KEYS are untouched: monitor mode's raw pass-through still only drops routing keys, exactly as before.

Verification

• New test written first (spec/permittable_spec.rb), confirmed to fail (422 instead of 200) before the implementation change and pass after
• bundle exec rspec — 852 examples, 0 failures
• bundle exec rubocop lib/permittable.rb spec/permittable_spec.rb — no offenses

🤖 Generated with Claude Code