user_controller.rb

class UserController < ApplicationController
  def create
    @user = User.create(UserInput.create(params))
  end
  
  def update
    @user = User.find(params[:id].to_i)
    @user.update_attributes(UserInput.update(params))
  end
  
  def update_password
    @user = User.find(params[:id].to_i)
    @user.update_attributes(UserInput.update_password(params))
  end
end

user_input.rb

class UserInput
  def initialize(p)
    @params = p
  end

  class << self
    def create(p)
      p.require(:user).permit([ :name, :email, :password, :password_confirmation ])
    end
  
    def update(p)
      p.require(:user).permit([ :name, :email ])
    end
  
    def update_password(p)
      p.require(:user).permit([ :password, :password_confirmation ])
    end
  end
end

Just a quick update to the source pattern, completely untested but wanted to put it down while I was thinking about it.