Allowlist Reflex Resources

submittable.rb

module Submittable
  extend ActiveSupport::Concern
  include StimulusReflex::ConcernEnhancer

  included do
    prepend_before_reflex do
      instance_variable_set("@#{resource_name.underscore}", resource_class.new(submit_params))
    end
  end

  private

  RESOURCE_ALLOWLIST = {
    "boards#show" => "Embed",
    "embeds#show" => "Comment"
  }.freeze

  def resource_name
    RESOURCE_ALLOWLIST["#{request.parameters["controller"]}##{request.parameters["action"]}"]
  end

  def resource_class
    resource_name.safe_constantize
  end
end