Class: TurboDesktop::InspectorAssetsController

Inherits:
ActionController::Base
  • Object
show all
Defined in:
app/controllers/turbo_desktop/inspector_assets_controller.rb

Overview

Serves the Dev Inspector's JavaScript from the Rails origin so the desktop shell's turbo-desktop.js can import() it same-origin.

The shell points its WebView at your Rails app (server_url), so a relative import("./inspector.js") resolves against the Rails origin — which is why these assets must be served here, not from the bundled Tauri frontend.

Only the fixed set of inspector modules is served (strict allow-list, so no path traversal). Enabled implicitly by mounting the engine; the meta-tag helper points the shell at these URLs.

Constant Summary collapse

ASSET_ROOT = 
TurboDesktop::Engine.root.join("lib/turbo_desktop/inspector_assets").freeze
ALLOWED =

Relative paths (as requested by the browser) → allowed. Anything else 404s.

%w[
  inspector.js
  inspector/state.js
  inspector/panel.js
  inspector/bridge-tap.js
  inspector/catalog.js
].freeze

Instance Method Summary collapse

Instance Method Details

#show ⇒ Object

GET /turbo-desktop/inspector.js GET /turbo-desktop/inspector/.js



26
27
28
29
30
31
32
33
34
35
 
# File 'app/controllers/turbo_desktop/inspector_assets_controller.rb', line 26

def show
  rel = requested_asset
  return head(:not_found) unless ALLOWED.include?(rel)

  path = ASSET_ROOT.join(rel)
  return head(:not_found) unless File.file?(path)

  response.set_header("Cache-Control", "public, max-age=3600")
  render body: File.read(path), content_type: "text/javascript"
end