activestorage 7.0.0 → 7.0.2.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 85a5cf62726ae4b98295bb1b62926f4f2fa15257babdb8d6251cff37c682c354
-  data.tar.gz: 65f662b546c7f3e5eaf0775f065174f6d7162721578d763213eefd2875565a7b
+  metadata.gz: 797efdf2ca8b6bb58815e2352e430b2cca2b6defaf37fc4e524c2a2150695f4a
+  data.tar.gz: 11490b758f9b6e9c2a9eda88757e5a454ca92e587624ce85cb6235dfa9f10fbd
 SHA512:
-  metadata.gz: 3ff136a959f672bb822be34f573209a3017744a8ba476e8f6e2ec3de11130b9fb1bf4e876ee2b0233b1a2bfa9acd66d211b2b9b329f533b9449fd8d084482ec6
-  data.tar.gz: 1d38c4402a276a86847c492c1d373fab6ace21b6149e03426744561a1528307947f4353645b53db5bdf32cfa4776aa0c15cfd0591631bdc554be66b481f5d77e
+  metadata.gz: 02a012dd3e41df712e0b4f64576db45634659b369d5e09245c6cc87e1bbb38d31bebd2e110d5782f97477ba2798717f9770167325c68b3b3b8c12d3409c492c5
+  data.tar.gz: b89aa21d7d77e5c4ed766c507b06c7c81b34cf79db5fd01f8f1aaa171476e88cf90cabb0e576ebfba698065ab1daee2021cb34b6a9ba2da7054a21907fcd0218

data/CHANGELOG.md

@@ -1,3 +1,33 @@
+## Rails 7.0.2.2 (February 11, 2022) ##
+
+*   No changes.
+
+
+## Rails 7.0.2.1 (February 11, 2022) ##
+
+*   No changes.
+
+
+## Rails 7.0.2 (February 08, 2022) ##
+
+*   Revert the ability to pass `service_name` param to `DirectUploadsController` which was introduced
+    in 7.0.0.
+
+    That change caused a lot of problems to upgrade Rails applications so we decided to remove it
+    while in work in a more backwards compatible implementation.
+
+    *Gannon McGibbon*
+
+*   Allow applications to opt out of precompiling Active Storage JavaScript assets.
+
+    *jlestavel*
+
+
+## Rails 7.0.1 (January 06, 2022) ##
+
+*   No changes.
+
+
 ## Rails 7.0.0 (December 15, 2021) ##
 
 *   Support transforming empty-ish `has_many_attached` value into `[]` (e.g. `[""]`).

data/MIT-LICENSE

@@ -1,4 +1,4 @@
-Copyright (c) 2017-2021 David Heinemeier Hansson, Basecamp
+Copyright (c) 2017-2022 David Heinemeier Hansson, Basecamp
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the

data/app/assets/javascripts/activestorage.esm.js

@@ -508,7 +508,7 @@ function toArray(value) {
 }
 
 class BlobRecord {
-  constructor(file, checksum, url, directUploadToken, attachmentName) {
+  constructor(file, checksum, url) {
     this.file = file;
     this.attributes = {
       filename: file.name,
@@ -516,8 +516,6 @@ class BlobRecord {
       byte_size: file.size,
       checksum: checksum
     };
-    this.directUploadToken = directUploadToken;
-    this.attachmentName = attachmentName;
     this.xhr = new XMLHttpRequest;
     this.xhr.open("POST", url, true);
     this.xhr.responseType = "json";
@@ -545,9 +543,7 @@ class BlobRecord {
   create(callback) {
     this.callback = callback;
     this.xhr.send(JSON.stringify({
-      blob: this.attributes,
-      direct_upload_token: this.directUploadToken,
-      attachment_name: this.attachmentName
+      blob: this.attributes
     }));
   }
   requestDidLoad(event) {
@@ -608,12 +604,10 @@ class BlobUpload {
 let id = 0;
 
 class DirectUpload {
-  constructor(file, url, serviceName, attachmentName, delegate) {
+  constructor(file, url, delegate) {
     this.id = ++id;
     this.file = file;
     this.url = url;
-    this.serviceName = serviceName;
-    this.attachmentName = attachmentName;
     this.delegate = delegate;
   }
   create(callback) {
@@ -622,7 +616,7 @@ class DirectUpload {
         callback(error);
         return;
       }
-      const blob = new BlobRecord(this.file, checksum, this.url, this.serviceName, this.attachmentName);
+      const blob = new BlobRecord(this.file, checksum, this.url);
       notify(this.delegate, "directUploadWillCreateBlobWithXHR", blob.xhr);
       blob.create((error => {
         if (error) {
@@ -653,7 +647,7 @@ class DirectUploadController {
   constructor(input, file) {
     this.input = input;
     this.file = file;
-    this.directUpload = new DirectUpload(this.file, this.url, this.directUploadToken, this.attachmentName, this);
+    this.directUpload = new DirectUpload(this.file, this.url, this);
     this.dispatch("initialize");
   }
   start(callback) {
@@ -684,12 +678,6 @@ class DirectUploadController {
   get url() {
     return this.input.getAttribute("data-direct-upload-url");
   }
-  get directUploadToken() {
-    return this.input.getAttribute("data-direct-upload-token");
-  }
-  get attachmentName() {
-    return this.input.getAttribute("data-direct-upload-attachment-name");
-  }
   dispatch(name, detail = {}) {
     detail.file = this.file;
     detail.id = this.directUpload.id;

data/app/assets/javascripts/activestorage.js

@@ -503,7 +503,7 @@
     }
   }
   class BlobRecord {
-    constructor(file, checksum, url, directUploadToken, attachmentName) {
+    constructor(file, checksum, url) {
       this.file = file;
       this.attributes = {
         filename: file.name,
@@ -511,8 +511,6 @@
         byte_size: file.size,
         checksum: checksum
       };
-      this.directUploadToken = directUploadToken;
-      this.attachmentName = attachmentName;
       this.xhr = new XMLHttpRequest;
       this.xhr.open("POST", url, true);
       this.xhr.responseType = "json";
@@ -540,9 +538,7 @@
     create(callback) {
       this.callback = callback;
       this.xhr.send(JSON.stringify({
-        blob: this.attributes,
-        direct_upload_token: this.directUploadToken,
-        attachment_name: this.attachmentName
+        blob: this.attributes
       }));
     }
     requestDidLoad(event) {
@@ -600,12 +596,10 @@
   }
   let id = 0;
   class DirectUpload {
-    constructor(file, url, serviceName, attachmentName, delegate) {
+    constructor(file, url, delegate) {
       this.id = ++id;
       this.file = file;
       this.url = url;
-      this.serviceName = serviceName;
-      this.attachmentName = attachmentName;
       this.delegate = delegate;
     }
     create(callback) {
@@ -614,7 +608,7 @@
           callback(error);
           return;
         }
-        const blob = new BlobRecord(this.file, checksum, this.url, this.serviceName, this.attachmentName);
+        const blob = new BlobRecord(this.file, checksum, this.url);
         notify(this.delegate, "directUploadWillCreateBlobWithXHR", blob.xhr);
         blob.create((error => {
           if (error) {
@@ -643,7 +637,7 @@
     constructor(input, file) {
       this.input = input;
       this.file = file;
-      this.directUpload = new DirectUpload(this.file, this.url, this.directUploadToken, this.attachmentName, this);
+      this.directUpload = new DirectUpload(this.file, this.url, this);
       this.dispatch("initialize");
     }
     start(callback) {
@@ -674,12 +668,6 @@
     get url() {
       return this.input.getAttribute("data-direct-upload-url");
     }
-    get directUploadToken() {
-      return this.input.getAttribute("data-direct-upload-token");
-    }
-    get attachmentName() {
-      return this.input.getAttribute("data-direct-upload-attachment-name");
-    }
     dispatch(name, detail = {}) {
       detail.file = this.file;
       detail.id = this.directUpload.id;

data/app/controllers/active_storage/direct_uploads_controller.rb

@@ -4,10 +4,8 @@
 # When the client-side upload is completed, the signed_blob_id can be submitted as part of the form to reference
 # the blob that was created up front.
 class ActiveStorage::DirectUploadsController < ActiveStorage::BaseController
-  include ActiveStorage::DirectUploadToken
-
   def create
-    blob = ActiveStorage::Blob.create_before_direct_upload!(**blob_args.merge(service_name: verified_service_name))
+    blob = ActiveStorage::Blob.create_before_direct_upload!(**blob_args)
     render json: direct_upload_json(blob)
   end
 
@@ -16,10 +14,6 @@ class ActiveStorage::DirectUploadsController < ActiveStorage::BaseController
       params.require(:blob).permit(:filename, :byte_size, :checksum, :content_type, metadata: {}).to_h.symbolize_keys
     end
 
-    def verified_service_name
-      ActiveStorage::DirectUploadToken.verify_direct_upload_token(params[:direct_upload_token], params[:attachment_name], session)
-    end
-
     def direct_upload_json(blob)
       blob.as_json(root: false, methods: :signed_id).merge(direct_upload: {
         url: blob.service_url_for_direct_upload,

data/app/javascript/activestorage/blob_record.js

@@ -1,19 +1,16 @@
 import { getMetaValue } from "./helpers"
 
 export class BlobRecord {
-  constructor(file, checksum, url, directUploadToken, attachmentName) {
+  constructor(file, checksum, url) {
     this.file = file
 
     this.attributes = {
       filename: file.name,
       content_type: file.type || "application/octet-stream",
       byte_size: file.size,
-      checksum: checksum,
+      checksum: checksum
     }
 
-    this.directUploadToken = directUploadToken
-    this.attachmentName = attachmentName
-
     this.xhr = new XMLHttpRequest
     this.xhr.open("POST", url, true)
     this.xhr.responseType = "json"
@@ -46,11 +43,7 @@ export class BlobRecord {
 
   create(callback) {
     this.callback = callback
-    this.xhr.send(JSON.stringify({
-      blob: this.attributes,
-      direct_upload_token: this.directUploadToken,
-      attachment_name: this.attachmentName
-    }))
+    this.xhr.send(JSON.stringify({ blob: this.attributes }))
   }
 
   requestDidLoad(event) {

data/app/javascript/activestorage/direct_upload.js

@@ -5,12 +5,10 @@ import { BlobUpload } from "./blob_upload"
 let id = 0
 
 export class DirectUpload {
-  constructor(file, url, serviceName, attachmentName, delegate) {
+  constructor(file, url, delegate) {
     this.id = ++id
     this.file = file
     this.url = url
-    this.serviceName = serviceName
-    this.attachmentName = attachmentName
     this.delegate = delegate
   }
 
@@ -21,7 +19,7 @@ export class DirectUpload {
         return
       }
 
-      const blob = new BlobRecord(this.file, checksum, this.url, this.serviceName, this.attachmentName)
+      const blob = new BlobRecord(this.file, checksum, this.url)
       notify(this.delegate, "directUploadWillCreateBlobWithXHR", blob.xhr)
 
       blob.create(error => {

data/app/javascript/activestorage/direct_upload_controller.js

@@ -5,7 +5,7 @@ export class DirectUploadController {
   constructor(input, file) {
     this.input = input
     this.file = file
-    this.directUpload = new DirectUpload(this.file, this.url, this.directUploadToken, this.attachmentName, this)
+    this.directUpload = new DirectUpload(this.file, this.url, this)
     this.dispatch("initialize")
   }
 
@@ -41,14 +41,6 @@ export class DirectUploadController {
     return this.input.getAttribute("data-direct-upload-url")
   }
 
-  get directUploadToken() {
-    return this.input.getAttribute("data-direct-upload-token")
-  }
-
-  get attachmentName() {
-    return this.input.getAttribute("data-direct-upload-attachment-name")
-  }
-
   dispatch(name, detail = {}) {
     detail.file = this.file
     detail.id = this.directUpload.id

data/app/models/active_storage/variant.rb

@@ -4,7 +4,7 @@
 # These variants are used to create thumbnails, fixed-size avatars, or any other derivative image from the
 # original.
 #
-# Variants rely on {ImageProcessing}[https://github.com/janko-m/image_processing] gem for the actual transformations
+# Variants rely on {ImageProcessing}[https://github.com/janko/image_processing] gem for the actual transformations
 # of the file, so you must add <tt>gem "image_processing"</tt> to your Gemfile if you wish to use variants. By
 # default, images will be processed with {ImageMagick}[http://imagemagick.org] using the
 # {MiniMagick}[https://github.com/minimagick/minimagick] gem, but you can also switch to the
@@ -46,9 +46,9 @@
 #
 # Visit the following links for a list of available ImageProcessing commands and ImageMagick/libvips operations:
 #
-# * {ImageProcessing::MiniMagick}[https://github.com/janko-m/image_processing/blob/master/doc/minimagick.md#methods]
+# * {ImageProcessing::MiniMagick}[https://github.com/janko/image_processing/blob/master/doc/minimagick.md#methods]
 # * {ImageMagick reference}[https://www.imagemagick.org/script/mogrify.php]
-# * {ImageProcessing::Vips}[https://github.com/janko-m/image_processing/blob/master/doc/vips.md#methods]
+# * {ImageProcessing::Vips}[https://github.com/janko/image_processing/blob/master/doc/vips.md#methods]
 # * {ruby-vips reference}[http://www.rubydoc.info/gems/ruby-vips/Vips/Image]
 class ActiveStorage::Variant
   attr_reader :blob, :variation

data/app/models/active_storage/variation.rb

@@ -10,7 +10,7 @@ require "mini_mime"
 #
 #   ActiveStorage::Variation.new(resize_to_limit: [100, 100], colourspace: "b-w", rotate: "-90", saver: { trim: true })
 #
-# The options map directly to {ImageProcessing}[https://github.com/janko-m/image_processing] commands.
+# The options map directly to {ImageProcessing}[https://github.com/janko/image_processing] commands.
 class ActiveStorage::Variation
   attr_reader :transformations
 

data/lib/active_storage/analyzer/audio_analyzer.rb

@@ -54,7 +54,7 @@ module ActiveStorage
           end
         end
       rescue Errno::ENOENT
-        logger.info "Skipping audio analysis because FFmpeg isn't installed"
+        logger.info "Skipping audio analysis because ffprobe isn't installed"
         {}
       end
 

data/lib/active_storage/analyzer/video_analyzer.rb

@@ -133,7 +133,7 @@ module ActiveStorage
           end
         end
       rescue Errno::ENOENT
-        logger.info "Skipping video analysis because FFmpeg isn't installed"
+        logger.info "Skipping video analysis because ffprobe isn't installed"
         {}
       end
 

data/lib/active_storage/engine.rb

@@ -30,6 +30,7 @@ module ActiveStorage
     config.active_storage.analyzers = [ ActiveStorage::Analyzer::ImageAnalyzer::Vips, ActiveStorage::Analyzer::ImageAnalyzer::ImageMagick, ActiveStorage::Analyzer::VideoAnalyzer, ActiveStorage::Analyzer::AudioAnalyzer ]
     config.active_storage.paths = ActiveSupport::OrderedOptions.new
     config.active_storage.queues = ActiveSupport::InheritableOptions.new
+    config.active_storage.precompile_assets = true
 
     config.active_storage.variable_content_types = %w(
       image/png
@@ -167,8 +168,10 @@ module ActiveStorage
     end
 
     initializer "active_storage.asset" do
-      if Rails.application.config.respond_to?(:assets)
-        Rails.application.config.assets.precompile += %w( activestorage activestorage.esm )
+      config.after_initialize do |app|
+        if app.config.respond_to?(:assets) && app.config.active_storage.precompile_assets
+          app.config.assets.precompile += %w( activestorage activestorage.esm )
+        end
       end
     end
 

data/lib/active_storage/errors.rb

@@ -26,7 +26,4 @@ module ActiveStorage
 
   # Raised when a Previewer is unable to generate a preview image.
   class PreviewError < Error; end
-
-  # Raised when direct upload fails because of the invalid token
-  class InvalidDirectUploadTokenError < Error; end
 end

data/lib/active_storage/gem_version.rb

@@ -9,8 +9,8 @@ module ActiveStorage
   module VERSION
     MAJOR = 7
     MINOR = 0
-    TINY  = 0
-    PRE   = nil
+    TINY  = 2
+    PRE   = "2"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end

data/lib/active_storage/previewer/video_previewer.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "shellwords"
+
 module ActiveStorage
   class Previewer::VideoPreviewer < Previewer
     class << self

data/lib/active_storage.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 #--
-# Copyright (c) 2017-2021 David Heinemeier Hansson, Basecamp
+# Copyright (c) 2017-2022 David Heinemeier Hansson, Basecamp
 #
 # Permission is hereby granted, free of charge, to any person obtaining
 # a copy of this software and associated documentation files (the
@@ -41,7 +41,6 @@ module ActiveStorage
   autoload :Service
   autoload :Previewer
   autoload :Analyzer
-  autoload :DirectUploadToken
 
   mattr_accessor :logger
   mattr_accessor :verifier

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: activestorage
 version: !ruby/object:Gem::Version
-  version: 7.0.0
+  version: 7.0.2.2
 platform: ruby
 authors:
 - David Heinemeier Hansson
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-12-15 00:00:00.000000000 Z
+date: 2022-02-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -16,56 +16,56 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.0.0
+        version: 7.0.2.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.0.0
+        version: 7.0.2.2
 - !ruby/object:Gem::Dependency
   name: actionpack
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.0.0
+        version: 7.0.2.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.0.0
+        version: 7.0.2.2
 - !ruby/object:Gem::Dependency
   name: activejob
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.0.0
+        version: 7.0.2.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.0.0
+        version: 7.0.2.2
 - !ruby/object:Gem::Dependency
   name: activerecord
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.0.0
+        version: 7.0.2.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.0.0
+        version: 7.0.2.2
 - !ruby/object:Gem::Dependency
   name: marcel
   requirement: !ruby/object:Gem::Requirement
@@ -170,7 +170,6 @@ files:
 - lib/active_storage/attached/many.rb
 - lib/active_storage/attached/model.rb
 - lib/active_storage/attached/one.rb
-- lib/active_storage/direct_upload_token.rb
 - lib/active_storage/downloader.rb
 - lib/active_storage/engine.rb
 - lib/active_storage/errors.rb
@@ -199,12 +198,12 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rails/rails/issues
-  changelog_uri: https://github.com/rails/rails/blob/v7.0.0/activestorage/CHANGELOG.md
-  documentation_uri: https://api.rubyonrails.org/v7.0.0/
+  changelog_uri: https://github.com/rails/rails/blob/v7.0.2.2/activestorage/CHANGELOG.md
+  documentation_uri: https://api.rubyonrails.org/v7.0.2.2/
   mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
-  source_code_uri: https://github.com/rails/rails/tree/v7.0.0/activestorage
+  source_code_uri: https://github.com/rails/rails/tree/v7.0.2.2/activestorage
   rubygems_mfa_required: 'true'
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -219,8 +218,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.2.32
-signing_key: 
+rubygems_version: 3.2.22
+signing_key:
 specification_version: 4
 summary: Local and cloud file storage framework.
 test_files: []

data/lib/active_storage/direct_upload_token.rb

@@ -1,59 +0,0 @@
-# frozen_string_literal: true
-
-module ActiveStorage
-  module DirectUploadToken
-    extend self
-
-    SEPARATOR = "."
-    DIRECT_UPLOAD_TOKEN_LENGTH = 32
-
-    def generate_direct_upload_token(attachment_name, service_name, session)
-      token = direct_upload_token(session, attachment_name)
-      encode_direct_upload_token([service_name, token].join(SEPARATOR))
-    end
-
-    def verify_direct_upload_token(token, attachment_name, session)
-      raise ActiveStorage::InvalidDirectUploadTokenError if token.nil?
-
-      service_name, *token_components = decode_token(token).split(SEPARATOR)
-      decoded_token = token_components.join(SEPARATOR)
-
-      return service_name if valid_direct_upload_token?(decoded_token, attachment_name, session)
-
-      raise ActiveStorage::InvalidDirectUploadTokenError
-    end
-
-    private
-      def direct_upload_token(session, attachment_name) # :doc:
-        direct_upload_token_hmac(session, "direct_upload##{attachment_name}")
-      end
-
-      def valid_direct_upload_token?(token, attachment_name, session) # :doc:
-        correct_token = direct_upload_token(session, attachment_name)
-        ActiveSupport::SecurityUtils.fixed_length_secure_compare(token, correct_token)
-      rescue ArgumentError
-        raise ActiveStorage::InvalidDirectUploadTokenError
-      end
-
-      def direct_upload_token_hmac(session, identifier) # :doc:
-        OpenSSL::HMAC.digest(
-          OpenSSL::Digest::SHA256.new,
-          real_direct_upload_token(session),
-          identifier
-        )
-      end
-
-      def real_direct_upload_token(session) # :doc:
-        session[:_direct_upload_token] ||= SecureRandom.urlsafe_base64(DIRECT_UPLOAD_TOKEN_LENGTH, padding: false)
-        encode_direct_upload_token(session[:_direct_upload_token])
-      end
-
-      def decode_token(encoded_token) # :nodoc:
-        Base64.urlsafe_decode64(encoded_token)
-      end
-
-      def encode_direct_upload_token(raw_token) # :nodoc:
-        Base64.urlsafe_encode64(raw_token)
-      end
-  end
-end