activestorage 8.1.1 → 8.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bb21689b523e24daf0e515ac7911747dee19392944ff656959d89aab65600a7e
-  data.tar.gz: cf47c4e0cfd77341b0671e7613487dcc2786a3c7b8671f4a1f4560b70d1f4c0a
+  metadata.gz: b700aaa6ff149a5ce6ff88794c94141d8d7e0895c6561578756727ecf5a3128b
+  data.tar.gz: 2eecb99972e95b8495aafbf2458d775bae6a7bcabf4abbc1fc0dd2286b1b140e
 SHA512:
-  metadata.gz: fafe3e80aea4b2df4b614cbb6ee03bb0ba14533fa046e35e0f58220ee11e5a21fd0af895f6eadb9530d2db9e46dce63a476e51e6b5af96ac58fb9f0dd21ff1b0
-  data.tar.gz: 2089114992e5520ad69637d12bd7f7d2ad0478f98b660a79c4c158e903cb210b23f04bbb59a66f380fb62003e5d5084a18b0be6eb649d2df6b2e24710f5e37bc
+  metadata.gz: ddb19a88f6c95a4be6d198a7342e830a53d03a24c2f62e63ae2b41d1a94cb863dde34079d168a90e7c661736974691395605f991987ade4ff5164e187ad860e4
+  data.tar.gz: 3499297b88322fa207ace2e9f140a53f678f88c7fbe06646d2924c2b29c17e1d8fd8723058382310d307960ba3813733fb5848f232f17c868f09c2d75be6b373

data/CHANGELOG.md

@@ -1,3 +1,23 @@
+## Rails 8.1.2 (January 08, 2026) ##
+
+*   Restore ADC when signing URLs with IAM for GCS
+
+    ADC was previously used for automatic authorization when signing URLs with IAM.
+    Now it is again, but the auth client is memoized so that new credentials are only
+    requested when the current ones expire. Other auth methods can now be used
+    instead by setting the authorization on `ActiveStorage::Service::GCSService#iam_client`.
+
+    ```ruby
+    ActiveStorage::Blob.service.iam_client.authorization = Google::Auth::ImpersonatedServiceAccountCredentials.new(options)
+    ```
+
+    This is safer than setting `Google::Apis::RequestOptions.default.authorization`
+    because it only applies to Active Storage and does not affect other Google API
+    clients.
+
+    *Justin Malčić*
+
+
 ## Rails 8.1.1 (October 28, 2025) ##
 
 *   No changes.

data/lib/active_storage/gem_version.rb

@@ -9,7 +9,7 @@ module ActiveStorage
   module VERSION
     MAJOR = 8
     MINOR = 1
-    TINY  = 1
+    TINY  = 2
     PRE   = nil
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")

data/lib/active_storage/service/gcs_service.rb

@@ -144,6 +144,21 @@ module ActiveStorage
       end
     end
 
+    # Returns the IAM client used for direct uploads and signed URLs.
+    # By default, the authorization for the IAM client is set to
+    # {Application Default Credentials}[https://docs.cloud.google.com/docs/authentication/application-default-credentials],
+    # fetched once at instantiation time, then refreshed automatically when expired.
+    # This can be set to a different value to use other authorization methods.
+    #
+    #   ActiveStorage::Blob.service.iam_client.authorization = Google::Auth::ImpersonatedServiceAccountCredentials.new(options)
+    def iam_client
+      @iam_client ||= Google::Apis::IamcredentialsV1::IAMCredentialsService.new.tap do |client|
+        client.authorization ||= Google::Auth.get_application_default(["https://www.googleapis.com/auth/iam"])
+      rescue
+        nil
+      end
+    end
+
     private
       def private_url(key, expires_in:, filename:, content_type:, disposition:, **)
         args = {
@@ -211,19 +226,6 @@ module ActiveStorage
       def signer
         # https://googleapis.dev/ruby/google-cloud-storage/latest/Google/Cloud/Storage/Project.html#signed_url-instance_method
         lambda do |string_to_sign|
-          iam_client = Google::Apis::IamcredentialsV1::IAMCredentialsService.new
-
-          # We explicitly do not set iam_client.authorization so that it uses the
-          # credentials set by the application at Google::Apis::RequestOptions.default.authorization.
-          # If the application does not set it, the GCP libraries will automatically
-          # determine it on each call. This code previously explicitly set the
-          # authorization to Google::Auth.get_application_default which triggers
-          # an explicit call to the metadata server - given this lambda is called
-          # for a significant number of file operations, it can lead to considerable
-          # tail latencies and even metadata server overloads. Additionally, that
-          # prevented applications from being able to configure the credentials
-          # used to perform the signature operation.
-
           request = Google::Apis::IamcredentialsV1::SignBlobRequest.new(
             payload: string_to_sign
           )

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: activestorage
 version: !ruby/object:Gem::Version
-  version: 8.1.1
+  version: 8.1.2
 platform: ruby
 authors:
 - David Heinemeier Hansson
@@ -15,56 +15,56 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.1.1
+        version: 8.1.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.1.1
+        version: 8.1.2
 - !ruby/object:Gem::Dependency
   name: actionpack
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.1.1
+        version: 8.1.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.1.1
+        version: 8.1.2
 - !ruby/object:Gem::Dependency
   name: activejob
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.1.1
+        version: 8.1.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.1.1
+        version: 8.1.2
 - !ruby/object:Gem::Dependency
   name: activerecord
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.1.1
+        version: 8.1.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.1.1
+        version: 8.1.2
 - !ruby/object:Gem::Dependency
   name: marcel
   requirement: !ruby/object:Gem::Requirement
@@ -192,10 +192,10 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rails/rails/issues
-  changelog_uri: https://github.com/rails/rails/blob/v8.1.1/activestorage/CHANGELOG.md
-  documentation_uri: https://api.rubyonrails.org/v8.1.1/
+  changelog_uri: https://github.com/rails/rails/blob/v8.1.2/activestorage/CHANGELOG.md
+  documentation_uri: https://api.rubyonrails.org/v8.1.2/
   mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
-  source_code_uri: https://github.com/rails/rails/tree/v8.1.1/activestorage
+  source_code_uri: https://github.com/rails/rails/tree/v8.1.2/activestorage
   rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths:
@@ -211,7 +211,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 4.0.3
 specification_version: 4
 summary: Local and cloud file storage framework.
 test_files: []