Strong parameters for mass assignment protection

                  module Api
  module V1
    class PostsController < BaseController
      before_action :authenticate_user!

      def create
        post = current_user.posts.build(post_params)

        if post.save
          render json: post, status: :created
        else
          render json: { errors: post.errors }, status: :unprocessable_entity
        end
      end

      def update
        post = current_user.posts.find(params[:id])

        if post.update(post_params)
          render json: post, status: :ok
        else
          render json: { errors: post.errors }, status: :unprocessable_entity
        end
      end

      private

      def post_params
        params.require(:post).permit(:title, :body, :published_at, tags: [])
      end
    end
  end
end