effective_storage 0.4.4 → 0.4.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3fd5855eb03beb973377deab121f3a632fe8afc28999b802717ab8300c1bfb60
-  data.tar.gz: b519d27a7ad134900899897874b40bf6a10cf36b34c64a3836507731880a8ba0
+  metadata.gz: ce0b1d8d9b061e3e2a3b81d4662a6ff7f4bea772bb3b639068e4148867b79e7c
+  data.tar.gz: 88115f4894e78a14807ef47eaf8af3f4f20e300ca42ac5f8e6148ff4b56aa84f
 SHA512:
-  metadata.gz: '0093a45fdfe5cabef645f11913770d36070ccc395dc6aa85b71a9aa0fb750e8319be4f752dc628f8e9379ebf229503c0b5cdcf2d5179fec304d86a0f3504041e'
-  data.tar.gz: 255295667680f5a9dd9b5c9a097ea06d4b7d93ea1e849ecd5fb84cf5966634b9ec844acc92ce0148683f3e1a04c29fa2d034e78f044ff1f1b3c8126492725290
+  metadata.gz: c261ab3931f45c6892f7c1df8780e27f0f17fdf4af5b2eb1046682c8580496f23e9275f0a649f795c91421c33a012eacce8d352d335cf7150412640f97afe16a
+  data.tar.gz: e8bd885fe445aeb7b9b071cb101225199ff411ceb8da2194ed727ee18cb2e66d433640ef4e455190c6184ff40f1e6f350a43e67a0fc24e602ccf06a52c825917

data/app/models/concerns/active_storage_authorization.rb

@@ -14,6 +14,13 @@
 module ActiveStorageAuthorization
   extend ActiveSupport::Concern
 
+  AUTHORIZED_EFFECTIVE_DOWNLOADS = [
+    'Effective::CarouselItem', 
+    'Effective::PageBanner', 
+    'Effective::PageSection', 
+    'Effective::Permalink'
+  ]
+
   included do
     rescue_from(Effective::UnauthorizedStorageException, with: :unauthorized_active_storage_request)
   end
@@ -54,18 +61,24 @@ module ActiveStorageAuthorization
   def authorize_active_storage!
     return unless @blob.present?
 
-    # If the blob has been given permission
-    return true if authorized?(@blob)
+    # Disable strict loading and let the @blob just pull :attachments
+    @blob.strict_loading!(false) if @blob.try(:strict_loading?)
 
     # If the blob is not attached to anything, permit the blob
-    return true if @blob.attachments.blank? && authorize_content_download?(@blob)
+    return true if @blob.attachments.blank?
 
     # If the blob is an ActiveStorage::Variant it's been previously authorized
     return true if @blob.attachments.any? { |attachment| authorized_variant_download?(attachment) }
 
+    # If the blob is a known good effective class fast path it
+    return true if @blob.attachments.any? { |attachment| authorized_effective_download?(attachment) }
+
     # If we are authorized on any attached record, permit the download
     return true if @blob.attachments.any? { |attachment| authorized_attachment_download?(attachment) }
 
+    # If the blob has been given permission using Mark Public
+    return true if authorized?(@blob)
+
     # Otherwise raise a 404 Not Found and block the download
     head(:not_found)
 
@@ -100,32 +113,29 @@ module ActiveStorageAuthorization
     false
   end
 
-  # This is a file that was drag & drop or inserted into the article editor
-  # I think this might only happen with article editor edit screens
-  def authorize_content_download?(blob)
-    # Allow signed out users to view images
-    return true if blob.image?
-
-    # Require sign in to view any attached files
-    # current_user.present?
-
-    # Let anyone view these files
-    true
-  end
-
   # This was included and resized in an ActionText::RichText object
   # But these ones don't belong_to any record
   def authorized_variant_download?(attachment)
     attachment.record_type == 'ActiveStorage::VariantRecord'
   end
 
+  # These are always public images
+  # Fast path them so we don't have to load any user for a permission check
+  def authorized_effective_download?(attachment)
+    AUTHORIZED_EFFECTIVE_DOWNLOADS.include?(attachment.record_type)
+  end
+
   # This is a has_one_attached or has_many_attached record
   # Or an ActionText::RichText object, that belongs_to a record
   def authorized_attachment_download?(attachment)
+    return false if attachment.record_type.blank?
+
+    # Attachment itself
+    return true if EffectiveResources.authorized?(self, :show, attachment)
+
     # DO NOT USE .blank? or .present? here. They return incorrect values.
     return false if attachment.record.nil?
 
-    # Associated Record
     record = attachment.record
     return true if authorized?(record)
 
@@ -133,9 +143,6 @@ module ActiveStorageAuthorization
     resource = record.record if record.respond_to?(:record)
     return true if authorized?(resource)
 
-    # Attachment itself
-    return true if authorized?(attachment)
-
     false
   end
 

data/lib/effective_storage/version.rb

@@ -1,3 +1,3 @@
 module EffectiveStorage
-  VERSION = '0.4.4'.freeze
+  VERSION = '0.4.6'.freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: effective_storage
 version: !ruby/object:Gem::Version
-  version: 0.4.4
+  version: 0.4.6
 platform: ruby
 authors:
 - Code and Effect
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-08-11 00:00:00.000000000 Z
+date: 2023-12-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails