The translation screen

Routes

A document reference is 1 to 255 letters, digits, _, ., : or -; a language, 2 to 35 letters, digits or -. The same file imports the glossary pages.

The application's services

use Phil\TranslationBundle\Application\SourceDocument;
use Phil\TranslationBundle\Application\SourceDocuments;
use Phil\TranslationMemory\LanguageTag;

final readonly class ArticleSources implements SourceDocuments
{
    public function __construct(private ArticleRepository $articles) {}

    public function find(string $document): ?SourceDocument
    {
        $article = str_starts_with($document, 'article:') ? $this->articles->find(substr($document, 8)) : null;

        return null === $article ? null : new SourceDocument($article->content(), LanguageTag::of($article->language()), $article->title());
    }
}

TranslationPolicy answers three questions for the current user: canTranslate() — see the page, write and propose targets, confirm and clear them, dismiss checks, comment, ask for machine translations, export and import —, canReview() — mark targets as reviewed and remove comments — and canEditGlossary() — edit the glossary of a pair of languages.

The page

The page previews the document's preparation, storing nothing, then shows its progress, the button of machine translation when a translator is configured, the export link and the import form, and one row per segment: its state and key, the mark machine translation on a target the machine proposed, its source as written — tags shown as text —, what changed in a stale source, the glossary's terms and notes, the target a regional variant inherits, a form with the target, the glossary's issues, the quality checks with a button that dismisses each, the segment's flags, the memory's matches for any segment not yet usable, each with a button that proposes it, and the comments with a form to add one.

Forms post plain HTML and work without JavaScript. A form from another site is refused by SameOriginGuard, which asks for two things:

• the standard request headers name this site: Sec-Fetch-Site: same-origin, or else an Origin that is the screen's own;
• the form passes Symfony's stateless CSRF check of the token phil_translation. Each form carries the field _csrf_token, rendered with the name of the token's cookie (csrf-token by default, FrameworkBundle's csrf_protection.cookie_name). When the layout loads Stimulus, the screen's csrf controller (phil--translation-bundle--csrf, mapped for AssetMapper) replaces it, as a form is sent, by a new random token and sets it in a cookie of that name (__Host- first and secure over HTTPS, same-site only), so that the field and the cookie carry the same token; without JavaScript the field keeps the name and the origin alone decides. SameOriginCsrfTokenManager refuses a token that is neither, and a cookie of another token when the browser's headers do not name this site; FrameworkBundle clears the cookie on the answer.

The bundle adds the token to FrameworkBundle's csrf_protection.stateless_token_ids, which turns framework.csrf_protection on: leave it on. With csrf_protection: false, the container stops with a LogicException that says so.

The layout

The screen extends the template named by layout, which defines the blocks title and content. The bundle's own, @PhilTranslation/layout.html.twig, is a bare page with a few styles and no script; point layout at the application's base template, with its Stimulus application, to show the screen in its back office with the csrf controller. The page's markup sits in <main class="phil-translation">, with the classes progress, variant, done, error, report, state state-<state>, machine, change, inherited, terms, issues, checks, flags, suggestions, comments and comment.