CSP: remove Angular Templates

[Matt-Yorkley]

What we should change and why (this is tech debt)

We need to get to a place where we can remove the unsafe_eval directive from our CSP configuration in config/initializers/content_security_policy.rb. In order to do that we need to remove/replace a few things in the codebase (otherwise the app will be broken). The main one is our use of Angular Templates.

Removing and replacing our Angular Templates will be quite tricky but we can do it one bit at a time. As a bit of background, this functionality is provided by gem 'angular-rails-templates', '>= 0.3.0' in the Gemfile and the templates mostly live (at the time of writing) in /app/assets/javascripts/templates/*. They look like this:

openfoodnetwork/app/assets/javascripts/templates/authentication.html.haml

Lines 1 to 7 in 35c58ca

	%div{"ng-controller" => "AuthenticationCtrl"}
	%tabset
	%ng-include{src: "'login.html'"}
	%ng-include{src: "'signup.html'"}
	%ng-include{src: "'forgot.html'"}
	%a.close-reveal-modal{"ng-click" => "$close()"}
	%i.ofn-i_009-close

Confusingly we also have a bunch of template directives scattered around under the app/views/* as well 🤕 They look like this:

openfoodnetwork/app/views/shopping_shared/tabs/_producers.html.haml

Lines 1 to 7 in 35c58ca

	%script{ type: "text/ng-template", id: "shop/producers.html" }
	.content#producers{"ng-controller" => "ProducersTabCtrl"}
	.row
	.small-12.columns
	%h5
	= t :shopping_producers_of_hub, hub: '{{ shopfront.name }}'
	%ul.small-block-grid-1.medium-block-grid-2.large-block-grid-3

It's not simple to just remove these, we need to replace their functionality with completely different frontend implementations which solve. Hopefully we'll start to have more examples of how to do that nicely in the codebase soon, and it'll become more obvious what ditching these templates looks like in practise.

All of this stuff explodes unless unsafe_eval is used. We need to transition away from these Angular Templates, ultimately remove them completely, and then remove unsafe_eval from our CSP configuration.

Context

This came up as part of #8648

Impact and timeline

The impact is huge but the timeline is unlikely to be short.

When this is finished we should be able to remove the unsafe_eval directive from our CSP config and still have a green build.