Fix cors bug on WidgetController

app/controllers/widget_controller.rb

@@ -1,4 +1,11 @@
+# frozen_string_literal: true
+
+# License: AGPL-3.0-or-later WITH WTO-AP-3.0-or-later
+# Full license explanation at https://github.com/houdiniproject/houdini/blob/master/LICENSE
 class WidgetController < ApplicationController
+    # we don't want anything to intefer with loading these docs
+    skip_forgery_protection
+
     def v2
         expires_in 10.minutes
         head :found, location: helpers.asset_pack_url("donate-button-v2.js"), content_type: "application/javascript"

spec/controllers/widget_controller_spec.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+# License: AGPL-3.0-or-later WITH WTO-AP-3.0-or-later
+# Full license explanation at https://github.com/houdiniproject/houdini/blob/master/LICENSE
+require 'rails_helper'
+
+RSpec.describe WidgetController, type: :controller do
+  describe 'v2' do
+    it 'accepts requests without a CORS error' do
+      expect {get :v2, format: :js }.to_not raise_error
+    end
+
+    it 'has a cache-control header of 10 minutes' do
+      get :v2, format: :js
+      expect(response.headers["Cache-Control"]).to include "max-age=600"
+    end
+
+    it 'does redirect' do
+      get :v2, format: :js
+      expect(response.headers.has_key?("Location")).to eq true
+    end
+  end
+end