bp3-activestorage 0.2.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c92e9ed2f063e2d3d1a777bdd9f3d3ddb23892a9ad70ef54796c4b4abf2e5f43
-  data.tar.gz: f6bcf3de5ed1ee85c69dcebab7281bbde03049f927b455e4535928d592d8ec58
+  metadata.gz: 109755bc5d9c018fc401b343738355f976b96d73e2f34997ac3c19cd3e730afa
+  data.tar.gz: 05cab73a42dcfc96d4d3a2b29f4122eb4315ed4c2f11aff389ed65a908af8fd5
 SHA512:
-  metadata.gz: a2fb3b472e8299d518b954a56b5a973a91601d23ad8dd7c9555b49b441423f4ddd44e0e6f166b2a33d34b2963c6d85c69b2ba33984dadf4cef2e16c07fabd990
-  data.tar.gz: 37c2134952350031e4d4a994468d4e38f8a566a83257e59ffcf0d310a904f639cc660d648818b307f5a2b124f699bc5f119092a40089a81f2caae3f6e217b003
+  metadata.gz: '0927cc2fd1066da4137fb6eb3d5057d168e33efb90c42e3021e49f7e48157772a4caf9c40186e4798aa50d4c6767ff07fb4dbeb6d80668e42c32b87884dbc240'
+  data.tar.gz: 05ee612b2d54d5c3e3d877200565d560862bee6c73b1e6965d7d197657dba593840a3f0dc1b2bbde37d97409871c90a7841bb91c56fb857761ca1ffcabb8c34b

data/CHANGELOG.md

@@ -1,5 +1,15 @@
 ## [Unreleased]
 
+## [0.3.0] - 2026-11-03
+
+### Security
+
+- Require a signed-in user, site admin or root for direct uploads
+
+### Fixed
+
+- Reopen the Active Storage classes in `to_prepare`, so a development reload keeps what this gem adds
+
 ## [0.2.0] - 2026-10-30
 
 ### Security

data/CLAUDE.md

@@ -20,8 +20,10 @@ shell is not already on it; a missing `rspec` means the wrong Ruby, not a missin
 
 ## Architecture
 
-`lib/bp3/activestorage/railtie.rb` reopens five classes in an `after_initialize` block. The Railtie is
-only defined when `Rails.env` is.
+`lib/bp3/activestorage/railtie.rb` reopens six classes in a `to_prepare` block. Active Storage's models and
+controllers are reloaded with the application's code in development, and `to_prepare` runs again after
+each reload, where `after_initialize` would not. Each class is referenced before it is reopened, so that
+it is autoloaded rather than defined anew. The Railtie is only defined when `Rails.env` is.
 
 **Models**: `ActiveStorage::Attachment`, `Blob` and `VariantRecord`
 - include `Bp3::Core::Rqid`, `Sqnr` and `Ransackable` (Blob also `Displayable`), call
@@ -34,8 +36,11 @@ only defined when `Rails.env` is.
 
 **Controllers**: `ActiveStorage::BaseController` and `ActiveStorage::Representations::ProxyController`
 include `Bp3::Core::Actions`, `Settings`, `FeatureFlags` and `Cookies`, so file requests get the same site,
-tenant and request tracking as the rest of the application. They do not authenticate;
-`authenticate_root!` breaks the proxy controller.
+tenant and request tracking as the rest of the application. They do not authenticate: the signed URL is
+the permission, and public pages and emails show files to people with no session.
+`ActiveStorage::DirectUploadsController` does: it answers 401 unless `grsc.current_login` names someone. It
+inherits `set_global_request_state` from `Bp3::Core::Actions` through `BaseController`, and its own check
+runs after it, so it asks the request state rather than Devise.
 
 ## Testing
 

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    bp3-activestorage (0.2.0)
+    bp3-activestorage (0.3.0)
       activestorage (~> 8.1)
       bp3-core (>= 0.4.0)
       paper_trail (>= 15.1)
@@ -60,9 +60,10 @@ GEM
       actionview (~> 8.1)
       activesupport (~> 8.1)
       bp3-request_state (~> 0.1)
-    bp3-request_state (0.1.3)
+    bp3-request_state (0.1.4)
       actionpack (~> 8.1)
       activesupport (~> 8.1)
+      ostruct (>= 0.6)
       request_store (>= 1.5.1)
     builder (3.3.0)
     byebug (13.0.0)
@@ -91,6 +92,7 @@ GEM
       prism (~> 1.5)
     nokogiri (1.19.4-x86_64-darwin)
       racc (~> 1.4)
+    ostruct (0.6.3)
     paper_trail (17.0.0)
       activerecord (>= 7.1)
       request_store (~> 1.4)

data/lib/bp3/activestorage/railtie.rb

@@ -7,101 +7,114 @@ module Bp3
   module Activestorage
     if defined?(Rails.env)
       class Railtie < Rails::Railtie
-        initializer 'bp3.activestorage.railtie.register' do |app|
-          app.config.after_initialize do
-            ::ActiveStorage::Attachment # preload
-            ::ActiveStorage::Blob # preload
-            ::ActiveStorage::VariantRecord # preload
-            ::ActiveStorage::BaseController # preload
-            ::ActiveStorage::Representations::ProxyController # preload
-            module ::ActiveStorage
-              # CAUTION: do not include Tenantable, it breaks things (it may set site/tenant behind the scenes,
-              #   and sets the default scope, and then later the blob can't be found
-              class Attachment
-                include Bp3::Core::Rqid
-                include Bp3::Core::Sqnr
-                include Bp3::Core::Ransackable
-
-                use_sqnr_for_ordering
-                has_paper_trail
-
-                belongs_to :sites_site, class_name: 'Sites::Site', optional: true
-                alias site sites_site
-                alias site= sites_site=
-                belongs_to :tenant, optional: true
-
-                def self.table_name_basis
-                  table_name.gsub(/\Apublic\./, '').singularize
-                end
+        # to_prepare rather than after_initialize: Active Storage's models and controllers are reloaded
+        # with the application's code in development, and what is added to them here goes with them.
+        config.to_prepare do
+          ::ActiveStorage::Attachment # preload
+          ::ActiveStorage::Blob # preload
+          ::ActiveStorage::VariantRecord # preload
+          ::ActiveStorage::BaseController # preload
+          ::ActiveStorage::Representations::ProxyController # preload
+          ::ActiveStorage::DirectUploadsController # preload
+          module ::ActiveStorage
+            # CAUTION: do not include Tenantable, it breaks things (it may set site/tenant behind the scenes,
+            #   and sets the default scope, and then later the blob can't be found
+            class Attachment
+              include Bp3::Core::Rqid
+              include Bp3::Core::Sqnr
+              include Bp3::Core::Ransackable
+
+              use_sqnr_for_ordering
+              has_paper_trail
+
+              belongs_to :sites_site, class_name: 'Sites::Site', optional: true
+              alias site sites_site
+              alias site= sites_site=
+              belongs_to :tenant, optional: true
+
+              def self.table_name_basis
+                table_name.gsub(/\Apublic\./, '').singularize
               end
+            end
+
+            class Blob
+              include Bp3::Core::Rqid
+              include Bp3::Core::Sqnr
+              include Bp3::Core::Displayable
+              include Bp3::Core::Ransackable
 
-              class Blob
-                include Bp3::Core::Rqid
-                include Bp3::Core::Sqnr
-                include Bp3::Core::Displayable
-                include Bp3::Core::Ransackable
+              # The key locates the file in storage, so it is not to be guessed at one character at a time
+              self.unexplorable_columns = %w[key]
 
-                # The key locates the file in storage, so it is not to be guessed at one character at a time
-                self.unexplorable_columns = %w[key]
+              use_sqnr_for_ordering
+              has_paper_trail
 
-                use_sqnr_for_ordering
-                has_paper_trail
+              belongs_to :sites_site, class_name: 'Sites::Site', optional: true
+              alias site sites_site
+              alias site= sites_site=
+              belongs_to :tenant, optional: true
+
+              def self.table_name_basis
+                table_name.gsub(/\Apublic\./, '').singularize
+              end
+
+              private
+
+              def version_filter_mask
+                '[FILTERED][AB]'
+              end
+            end
 
-                belongs_to :sites_site, class_name: 'Sites::Site', optional: true
-                alias site sites_site
-                alias site= sites_site=
-                belongs_to :tenant, optional: true
+            class VariantRecord
+              include Bp3::Core::Rqid
+              include Bp3::Core::Sqnr
+              include Bp3::Core::Ransackable
 
-                def self.table_name_basis
-                  table_name.gsub(/\Apublic\./, '').singularize
-                end
+              use_sqnr_for_ordering
+              has_paper_trail
 
-                private
+              belongs_to :sites_site, class_name: 'Sites::Site', optional: true
+              alias site sites_site
+              alias site= sites_site=
+              belongs_to :tenant, optional: true
 
-                def version_filter_mask
-                  '[FILTERED][AB]'
-                end
+              def self.table_name_basis
+                table_name.gsub(/\Apublic\./, '').singularize
               end
+            end
 
-              class VariantRecord
-                include Bp3::Core::Rqid
-                include Bp3::Core::Sqnr
-                include Bp3::Core::Ransackable
+            class BaseController
+              include Bp3::Core::Actions
+              include Bp3::Core::Settings
+              include Bp3::Core::FeatureFlags
+              include Bp3::Core::Cookies
+
+              # No login is asked of anyone fetching a file. The URL is signed, and holding it is the
+              # permission: a visitor reading a page and an email client showing a logo have no session.
+            end
 
-                use_sqnr_for_ordering
-                has_paper_trail
+            # A direct upload creates a blob and hands back a signed URL to store a file at, and Rails asks
+            # nothing of the caller. It is for signed-in work, such as a rich text editor, so it asks for a
+            # login. BaseController's Bp3::Core::Actions#set_global_request_state runs before this, so the
+            # request state knows who is signed in.
+            class DirectUploadsController
+              before_action :require_login_for_direct_upload
 
-                belongs_to :sites_site, class_name: 'Sites::Site', optional: true
-                alias site sites_site
-                alias site= sites_site=
-                belongs_to :tenant, optional: true
+              private
 
-                def self.table_name_basis
-                  table_name.gsub(/\Apublic\./, '').singularize
-                end
+              def require_login_for_direct_upload
+                head :unauthorized unless grsc.current_login
               end
+            end
 
-              class BaseController
+            module Representations
+              class ProxyController
                 include Bp3::Core::Actions
                 include Bp3::Core::Settings
                 include Bp3::Core::FeatureFlags
                 include Bp3::Core::Cookies
 
-                # TODO: is this needed?
-                # before_action :authenticate_root!
-              end
-
-              module Representations
-                class ProxyController
-                  include Bp3::Core::Actions
-                  include Bp3::Core::Settings
-                  include Bp3::Core::FeatureFlags
-                  include Bp3::Core::Cookies
-
-                  # using authenticate_root! breaks things
-                  # TODO: is this needed?
-                  # before_action :authenticate_root!
-                end
+                # Like ActiveStorage::BaseController, asks no login: the signed URL is the permission.
               end
             end
           end

data/lib/bp3/activestorage/version.rb

@@ -2,6 +2,6 @@
 
 module Bp3
   module Activestorage
-    VERSION = '0.2.0'
+    VERSION = '0.3.0'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: bp3-activestorage
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.0
 platform: ruby
 authors:
 - Wim den Braven
@@ -180,7 +180,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.4
+rubygems_version: 4.0.23
 specification_version: 4
 summary: bp3-activestorage adapts activestorage for BP3 (persuavis/black_phoebe_3).
 test_files: []