Always link callout resources to their own page (never inline)#1976
Merged
Conversation
Resources attached to built-in callouts (payment/scholarship/certificate/ videoconference) and to custom callouts previously rendered a full inline PDF/preview at the bottom of the callout page, while handouts/forms/W-9 already rendered clickable link cards. That inconsistency is what a registrant sees. Render every callout's resources as link cards to the resource's own page (PDF preview + download), so the document is only ever shown on its own page — matching the handouts/forms/invoice/receipt cards. The registrant resource page's eyebrow now returns to whichever callout the registrant came from (the four built-ins and custom callouts), so the back link is always accurate. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
maebeale
force-pushed
the
maebeale/resources-clickable-own-page
branch
from
c75c2a1 to
f61352f
Compare
maebeale
force-pushed
the
maebeale/resources-clickable-own-page
branch
from
63203f1 to
aaab37c
Compare
maebeale
force-pushed
the
maebeale/resources-clickable-own-page
branch
from
282f022 to
2a79649
Compare
maebeale
force-pushed
the
maebeale/resources-clickable-own-page
branch
from
2a79649 to
f61352f
Compare
The resource show page and the registrant single-resource page preview a PDF in an <object>, which the global object_src :none (kept strict to block legacy <object>/<embed> injection app-wide) flags on every view. Rather than loosen the policy globally, relax object-src to :self only on those two actions via a per-controller override — the idiomatic Rails mechanism for scoping a CSP relaxation to where a legitimate embed lives. Serve the blob through ActiveStorage proxy mode (rails_storage_proxy_path) so the bytes stream same-origin instead of 302-redirecting to the storage host; that keeps :self sufficient in production (DigitalOcean Spaces), not just dev/Disk. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The browser's built-in PDF viewer only renders its page-thumbnail sidebar (the single-vs-multipage indicator) when the embed is wide enough; at max-w-3xl (768px) it collapses. Make the callout_page card width a local (defaulting to max-w-3xl so every other callout page is unchanged) and have the single-resource page opt into max-w-5xl, and widen the shared PDF <object> wrapper to match. The regular callout cards stay narrow; only the resource preview gets the extra room. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🤖 suggested review level: 3 Read 📖 contained rendering swap on callout pages + eyebrow return_to plumbing + a scoped CSP override
Why
Some associated resources on a registrant's callout pages showed a full inline PDF/preview, while others (handouts, forms, W-9, invoice, receipt) were clickable link cards to the resource's own page. That inconsistency is what a registrant sees. This makes them all consistent: resources always render as link cards; the document itself is only ever shown on its own page.
What
@builtin_resourcesinline preview → link cards to the registrant resource page.RegistrationTicketCalloutsController#show): inline resource preview → link cards (in-ticket registrant page when aregslug is present, else the resource's own page).PDF preview & CSP
This PR makes the resource page the canonical way to open any callout resource, so its PDF
<object>preview (from #1893) is now front-and-center — and it tripped the globalobject_src 'none'(report-only). Rather than loosen CSP globally or switch to an iframe:object-srcto:selfonly on the two PDF-preview actions (ResourcesController#show,Events::CalloutsController#resource) via per-controllercontent_security_policy— the strict globalobject_src :none(blocks legacy<object>/<embed>injection) stays everywhere else.rails_storage_proxy_pathso the bytes stream same-origin instead of 302-redirecting to the storage host — keeping:selfsufficient in production (DigitalOcean Spaces), not just dev.(The unrelated footer/SVG inline-script CSP cleanup was split out into #1986.)