アイヌ語追加 (#428) (#433)

Reviewed-on: #433
Co-authored-by: miteruzo <miteruzo@naver.com>

backend/app/controllers/application_controller.rb

@@ -1,22 +1,52 @@
 class ApplicationController < ActionController::API
+  include ActionController::Cookies
+  include ActionController::RequestForgeryProtection
+
+  class UnsupportedLocale < StandardError
+    ;
+  end
+
   rescue_from ActiveRecord::RecordInvalid, with: :render_record_invalid
   rescue_from ActiveRecord::RecordNotUnique, with: :render_record_not_unique
+  rescue_from(UnsupportedLocale) { head :not_found }
 
   before_action :reject_banned_ip_address!
   before_action :authenticate_user
   before_action :reject_banned_user!
+  before_action :validate_explicit_locale!
+  protect_from_forgery with: :exception
+  self.forgery_protection_origin_check = true
+  rescue_from ActionController::InvalidAuthenticityToken, with: :reject_invalid_csrf
+  after_action :prevent_authenticated_caching
 
   def current_user = @current_user
 
   private
 
+  def reject_invalid_csrf
+    response.headers['X-CSRF-Invalid'] = '1'
+    response.headers['Cache-Control'] = 'private, no-store'
+    head :forbidden
+  end
+
   def authenticate_user
-    code = request.headers['X-Transfer-Code'] || request.headers['HTTP_X_TRANSFER_CODE']
+    code = session[:inheritance_code]
     return if code.blank?
 
     @current_user = User.find_by(inheritance_code: code)
   end
 
+  def prevent_authenticated_caching
+    response.headers['Cache-Control'] = 'private, no-store' if current_user
+  end
+
+  def establish_user_session user
+    reset_session
+    session[:inheritance_code] = user.inheritance_code
+    @current_user = user
+    response.headers['Cache-Control'] = 'private, no-store'
+  end
+
   def bool? key, default: false
     return default if params[key].nil?
 
@@ -93,5 +123,21 @@ class ApplicationController < ActionController::API
     value
   end
 
-  def resolve_locale! = Locale.find_by(code: params[:locale]) || Locale.nipponese
+  def resolve_locale!
+    return @resolved_locale if defined?(@resolved_locale)
+
+    code = params.fetch(:locale, 'ja')
+    unless code.is_a?(String) && Locale.codes.value?(code)
+      raise UnsupportedLocale
+    end
+
+    locale = Locale.find_by(code:)
+    raise UnsupportedLocale unless locale && locale.deprecated_at.nil?
+
+    @resolved_locale = locale
+  end
+
+  def validate_explicit_locale!
+    resolve_locale! if params.key?(:locale)
+  end
 end