From b7d7d0122bd133930503a78a4e5d985629291a21 Mon Sep 17 00:00:00 2001
From: Sarah Harvey <shh@squareup.com>
Date: Tue, 16 Apr 2019 10:55:52 -0700
Subject: [PATCH] Move inline JS to rendered files to support CSP

---
 app/controllers/teaspoon/suite_controller.rb  |  6 ++++++
 app/views/teaspoon/suite/_boot.html.erb       |  4 +---
 .../teaspoon/suite/_boot_require_js.html.erb  | 20 +------------------
 app/views/teaspoon/suite/config.js.erb        |  2 ++
 app/views/teaspoon/suite/require.js.erb       | 17 ++++++++++++++++
 app/views/teaspoon/suite/show.html.erb        |  5 +----
 app/views/teaspoon/suite/vanilla.js.erb       |  1 +
 lib/teaspoon/engine.rb                        |  1 +
 8 files changed, 30 insertions(+), 26 deletions(-)
 create mode 100644 app/views/teaspoon/suite/config.js.erb
 create mode 100644 app/views/teaspoon/suite/require.js.erb
 create mode 100644 app/views/teaspoon/suite/vanilla.js.erb

diff --git a/app/controllers/teaspoon/suite_controller.rb b/app/controllers/teaspoon/suite_controller.rb
index 3537ae6c..302a5d59 100644
--- a/app/controllers/teaspoon/suite_controller.rb
+++ b/app/controllers/teaspoon/suite_controller.rb
@@ -16,6 +16,12 @@ def show
     @suite = Teaspoon::Suite.new(params)
   end
 
+  def js
+    jstype = params.extract!(:jstype).fetch(:jstype, 'vanilla')
+    @suite = Teaspoon::Suite.new(params)
+    render "teaspoon/suite/#{jstype}", :content_type => 'application/javascript'
+  end
+
   def hook
     hooks = Teaspoon::Suite.new(params).hooks[params[:hook].to_s]
 
diff --git a/app/views/teaspoon/suite/_boot.html.erb b/app/views/teaspoon/suite/_boot.html.erb
index 2cd60f4d..71897cc4 100644
--- a/app/views/teaspoon/suite/_boot.html.erb
+++ b/app/views/teaspoon/suite/_boot.html.erb
@@ -1,4 +1,2 @@
 <%= javascript_include_tag *@suite.spec_assets, debug: @suite.config.expand_assets, allow_non_precompiled: true %>
-<script type="text/javascript">
-  Teaspoon.onWindowLoad(Teaspoon.execute);
-</script>
+<script src="<%= "#{Teaspoon.configuration.mount_at}/js/#{@suite.name}.vanilla.js" %>"></script>
diff --git a/app/views/teaspoon/suite/_boot_require_js.html.erb b/app/views/teaspoon/suite/_boot_require_js.html.erb
index 02b0f435..3dc9ee52 100644
--- a/app/views/teaspoon/suite/_boot_require_js.html.erb
+++ b/app/views/teaspoon/suite/_boot_require_js.html.erb
@@ -1,20 +1,2 @@
-<%
-rails_config = Rails.application.config
-require_options = {baseUrl: rails_config.assets.prefix}
-require_options.merge!(urlArgs: "instrument=1", waitSeconds: 0) if Teaspoon.configuration.use_coverage
-require_options.merge!(rails_config.requirejs.user_config) if rails_config.respond_to?(:requirejs)
-specs = @suite.spec_assets(false).map{ |s| "#{s.gsub(/\.js.*$/, "")}" }
-%>
-
 <%= javascript_include_tag @suite.helper %>
-<script type="text/javascript">
-  Teaspoon.onWindowLoad(function () {
-    // setup the Teaspoon path prefix to load /assets
-    require.config(<%= require_options.to_json.html_safe %>);
-
-    // require specs by striping off the .js file extension
-    require(<%= specs.to_json.html_safe %>, function() {
-      Teaspoon.execute();
-    });
-  });
-</script>
+<script src="<%= "#{Teaspoon.configuration.mount_at}/js/#{@suite.name}.require.js" %>"></script>
diff --git a/app/views/teaspoon/suite/config.js.erb b/app/views/teaspoon/suite/config.js.erb
new file mode 100644
index 00000000..012cc576
--- /dev/null
+++ b/app/views/teaspoon/suite/config.js.erb
@@ -0,0 +1,2 @@
+Teaspoon.version = <%= Teaspoon::VERSION.to_json.html_safe %>;
+Teaspoon.suites  = <%= {all: Teaspoon.configuration.suite_configs.keys, active: @suite.name}.to_json.html_safe %>;
diff --git a/app/views/teaspoon/suite/require.js.erb b/app/views/teaspoon/suite/require.js.erb
new file mode 100644
index 00000000..5c11081a
--- /dev/null
+++ b/app/views/teaspoon/suite/require.js.erb
@@ -0,0 +1,17 @@
+<%
+rails_config = Rails.application.config
+require_options = {baseUrl: rails_config.assets.prefix}
+require_options.merge!(urlArgs: "instrument=1", waitSeconds: 0) if Teaspoon.configuration.use_coverage
+require_options.merge!(rails_config.requirejs.user_config) if rails_config.respond_to?(:requirejs)
+specs = @suite.spec_assets(false).map{ |s| "#{s.gsub(/\.js.*$/, "")}" }
+%>
+
+Teaspoon.onWindowLoad(function () {
+  // setup the Teaspoon path prefix to load /assets
+  require.config(<%= require_options.to_json.html_safe %>);
+
+  // require specs by striping off the .js file extension
+  require(<%= specs.to_json.html_safe %>, function() {
+    Teaspoon.execute();
+  });
+});
diff --git a/app/views/teaspoon/suite/show.html.erb b/app/views/teaspoon/suite/show.html.erb
index 35425326..7ea9578f 100644
--- a/app/views/teaspoon/suite/show.html.erb
+++ b/app/views/teaspoon/suite/show.html.erb
@@ -7,10 +7,7 @@
 
     <%= stylesheet_link_tag *@suite.stylesheets %>
     <%= javascript_include_tag *@suite.javascripts %>
-    <script type="text/javascript">
-      Teaspoon.version = <%= Teaspoon::VERSION.to_json.html_safe %>;
-      Teaspoon.suites  = <%= {all: Teaspoon.configuration.suite_configs.keys, active: @suite.name}.to_json.html_safe %>;
-    </script>
+    <script src="<%= "#{Teaspoon.configuration.mount_at}/js/#{@suite.name}.config.js" %>"></script>
     <%= render @suite.boot_partial %>
   </head>
   <body data-no-turbolink>
diff --git a/app/views/teaspoon/suite/vanilla.js.erb b/app/views/teaspoon/suite/vanilla.js.erb
new file mode 100644
index 00000000..c5d4ee43
--- /dev/null
+++ b/app/views/teaspoon/suite/vanilla.js.erb
@@ -0,0 +1 @@
+Teaspoon.onWindowLoad(Teaspoon.execute);
diff --git a/lib/teaspoon/engine.rb b/lib/teaspoon/engine.rb
index e2ca28c2..e7304674 100644
--- a/lib/teaspoon/engine.rb
+++ b/lib/teaspoon/engine.rb
@@ -9,6 +9,7 @@ class Engine < ::Rails::Engine
     routes do
       root to: "suite#index"
       match "/fixtures/*filename", to: "suite#fixtures", via: :get, as: "fixture"
+      match "/js/:suite.:jstype.js", to: "suite#js", via: :get, defaults: { suite: "default", jstype: "vanilla" }
       match "/:suite", to: "suite#show", via: :get, as: "suite", defaults: { suite: "default" }
       match "/:suite/:hook", to: "suite#hook", via: :post, defaults: { suite: "default", hook: "default" }
     end