The problem is this line:
@widgets.include?(request.widget_slug)
You're calling widget_slug
on the request object, which knows nothing about widgets. Here are the docs for Request: http://api.rubyonrails.org/classes/ActionDispatch/Request.html
I'd suggest moving this functionality to the widget controller. It's simple enough to do the validation in your show action rather than create a Constraint, especially one that fetches all widgets on every request.