Repository navigation
add endsideout iframe - #149
Merged
Merged
Conversation
The external_game route now reads its host from one config value. Production uses endsideoutgames.netlify.app. Every other environment uses staging--endsideout-games.netlify.app. The route also accepts an optional token and adds it to the URL as a GET parameter. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Games run on another origin and have no Rails session, so the start and finish endpoints now skip CSRF protection. The signed token is the credential. The endpoints send CORS headers only for the games host and answer OPTIONS preflight requests. A missing or changed token now returns a 422 JSON error with the message "Invalid token" instead of a 500. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The play page now embeds the game from the games host and passes the signed game attempt token as the token GET parameter. The fake quiz is no longer needed, so this removes the quiz controller, the embed page and layout, and the embed route. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Add docs/game-api.md. It explains the token GET parameter on the game URL, the start and finish endpoints, the error responses, and the hosts. It includes fetch and curl examples. The README links to it. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Replace the after_action headers, the preflight action, and the OPTIONS routes with the rack-cors middleware. The allowed origin is still the games host, and the rules for the game attempts API now live in config/initializers/cors.rb. The middleware answers preflight requests with status 200 instead of 204, so the preflight test now expects 200. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
sean-dickinson
force-pushed
the
add-endsideout-iframe
branch
from
October 31, 2026 17:44
10c0a09 to
c19e5d5
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves #81
Description