Creating a user via API results in a 500 because identity params are passed to the user model

Summary

The "identity attributes" (see code here) are not deleted from the params hash before being passed for User creation.

Steps to reproduce

Create a user via API passing the provider and extern_uid params

Expected behavior

Passing the provider and extern_uid params should not result in a 500 error

Actual behavior

The server returns a 500 error with this message:

ActiveRecord::UnknownAttributeError (unknown attribute 'extern_uid' for User.)

Possible fixes

Use the same solution from user update, where you create a local variable for the user params, then delete the identify-specific params.

Something like this:

user_params = declared_params(include_missing: false)
identity_attrs = user_params.slice(:provider, :extern_uid)
confirm = user_params.delete(:confirm)

# remove params that are invalid on the user model
user_params.delete(:provider)
user_params.delete(:extern_uid)

user = User.new(user_params)

Maybe this calls for a new hash key in the user API params, e.g. "identities".