Fix CSRF conflicts with Phoenix using automatic pipeline separation

[camilohollanda]

Summary

Adds FunWithFlags.UI.Plug, a host-side helper that lets users embed FunWithFlags.UI.Router under Phoenix's standard :browser pipeline (or any host pipeline that uses Plug.CSRFProtection) without hitting Plug.CSRFProtection.InvalidCrossOriginRequestError on the dashboard's static assets.

Fixes #52

Problem

When the UI is forwarded under a :browser-style pipeline:

scope "/" do
  pipe_through [:browser, :require_authenticated_user]
  forward "/feature-flags", FunWithFlags.UI.Router
end

Phoenix's :protect_from_forgery runs before control reaches FunWithFlags.UI.Router. The browser's <script> and <link> requests for /feature-flags/assets/* are flagged as cross-origin, and Plug.CSRFProtection raises:

** (Plug.CSRFProtection.InvalidCrossOriginRequestError) security warning: an embedded
<script> tag on another site requested protected JavaScript ...

The current README workaround (:mounted_apps pipeline) is fine but requires users to define a separate pipeline that omits :protect_from_forgery, which is non-obvious.

Solution

FunWithFlags.UI.Plug is a host-side plug. Users insert it in their :browser pipeline before :protect_from_forgery, scoped to the path the router is forwarded under:

pipeline :browser do
  plug :accepts, ["html"]
  plug :fetch_session
  plug :fetch_live_flash
  plug :put_root_layout, html: {MyAppWeb.Layouts, :root}
  plug :put_secure_browser_headers
  plug FunWithFlags.UI.Plug, mount: "/feature-flags"
  plug :protect_from_forgery
end

scope "/" do
  pipe_through :browser
  forward "/feature-flags", FunWithFlags.UI.Router
end

For GET/HEAD requests whose path is <mount>/assets/<file>, the helper sets conn.private[:plug_skip_csrf_protection] = true — the documented escape hatch from Plug.CSRFProtection. Everything else (form submits, deletes, non-asset paths, paths outside the configured mount) flows through :protect_from_forgery unchanged.

The :mount option is required and matched against conn.path_info segments, so mount-prefix substrings (/feature-flags-extra/assets/...) and assets-prefix segments (/feature-flags/assets-extra/...) do not match. The bare <mount>/assets path with no file is also not skipped.

What's added

• lib/fun_with_flags/ui/plug.ex — FunWithFlags.UI.Plug, the host-side helper.
• test/fun_with_flags/ui/plug_test.exs — unit tests covering init/1 validation, segment-based path matching, mount/asset/method edge cases, plus an end-to-end integration test that runs Plug.Session → FunWithFlags.UI.Plug → Plug.CSRFProtection on a JS response and asserts the error fires without the helper and is suppressed with it.
• README.md — documents the new helper as an option for mounting under the standard :browser pipeline. The existing :mounted_apps recipe is unchanged.

Backward compatibility

Fully backward-compatible. FunWithFlags.UI.Router is unchanged. Users following either the existing :mounted_apps recipe or the standalone Plug.Router recipe in the README don't need to change anything. The new helper is purely opt-in for users who want to mount under a :browser-style pipeline that already protects against CSRF.

Test plan

• mix test — 81 tests, 0 failures
• Integration test exercises the full host pipeline (Plug.Session → helper → Plug.CSRFProtection → JS response) and verifies the InvalidCrossOriginRequestError is raised without the helper and not raised with it

[camilohollanda]

@tompave any chance to get this merged?