Class: I18nProofreading::WidgetsController

Inherits:
ApplicationController show all
Defined in:
app/controllers/i18n_proofreading/widgets_controller.rb

Overview

Serves the widget JavaScript as a plain same-origin script. Same-origin matters: under a script-src 'self' (or nonce-based) CSP, an external script from the app's own host is always allowed — including when Turbo Drive swaps the and re-runs body scripts under the original page's CSP header, where a freshly minted inline nonce would be refused.

Instance Method Summary collapse

Instance Method Details

#show ⇒ Object

The script URL carries a content fingerprint (?v=), so stale code is structurally impossible: new code means a new URL. The canonical fingerprinted URL is immutable and gets long-lived caching; anything else only ETag-revalidates.



19
20
21
22
23
24
 
# File 'app/controllers/i18n_proofreading/widgets_controller.rb', line 19

def show
  expires_in 1.year, public: true if params[:v] == Widget.fingerprint
  return unless stale?(etag: [I18nProofreading::VERSION, Widget.fingerprint])

  render plain: Widget.javascript, content_type: 'text/javascript'
end