effective_storage 0.4.5 → 0.4.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8de0c7807726e325a8a2f34f1e205c14dd27740daed1f7622db12dd39fb865a2
-  data.tar.gz: 126797b758eed3ad5d192cde7ce3f365096dfad96ebdf232f217b8b5428b91b1
+  metadata.gz: de41d5679792d22ce1d00b2d9f4ba396de441a723eaef5359c8475fa00732538
+  data.tar.gz: 9c6e0a0c32fbcaf488ce51b3857aab7322dede9936d842783f04f2ae6eae5c17
 SHA512:
-  metadata.gz: bba482aece015938fa979889a7d7da64ab68681100250409a3a147698c97274fe237c7257b2e2d5c6dec6ed97f8ab234e8b7cab654a36ab2a12ca53577996d07
-  data.tar.gz: 837259796bbbe60101329b80e96bfc0a1743b2b5afbcf42e2a59ef70b6ad97c433a5400bd8aeb91e5f9a5d01a44407599982f37c311fd29353a3b240341bf4e4
+  metadata.gz: e07be03e0526dea2ebbcefb438d3ce9a4fd8d3c76eb273d15ed9bfa775b4b7f161daa37d7f189638d58ef79e571e1084ced3722d73562aa088a5cae76be46718
+  data.tar.gz: 5fa8b3f7a68a1b0c14dde1e29838f25570ca7bc3f48aa4434be0e95857c5a0d088af6fa67ac5d6f5a3852e85679a9b996583f25799d58bfc19426e535898d09d

data/app/models/concerns/active_storage_authorization.rb

@@ -14,6 +14,13 @@
 module ActiveStorageAuthorization
   extend ActiveSupport::Concern
 
+  AUTHORIZED_EFFECTIVE_DOWNLOADS = Set.new([
+    'Effective::CarouselItem',
+    'Effective::PageBanner',
+    'Effective::PageSection',
+    'Effective::Permalink'
+  ]).freeze
+
   included do
     rescue_from(Effective::UnauthorizedStorageException, with: :unauthorized_active_storage_request)
   end
@@ -47,25 +54,31 @@ module ActiveStorageAuthorization
   private
 
   def set_download_blob
-    @blob ||= ActiveStorage::Blob.where(key: decode_verified_key().try(:dig, :key)).first
+    @blob ||= ActiveStorage::Blob.includes(:attachments, :active_storage_extensions).where(key: decode_verified_key().try(:dig, :key)).first
   end
 
   # Authorize the current blob and prevent it from being served if unauthorized
   def authorize_active_storage!
     return unless @blob.present?
 
+    # Disable strict loading and let the @blob just pull :attachments
+    @blob.strict_loading!(false) if @blob.try(:strict_loading?)
+
     # If the blob is not attached to anything, permit the blob
     return true if @blob.attachments.blank?
 
     # If the blob is an ActiveStorage::Variant it's been previously authorized
     return true if @blob.attachments.any? { |attachment| authorized_variant_download?(attachment) }
 
+    # If the blob is a known good effective class fast path it
+    return true if @blob.attachments.any? { |attachment| authorized_effective_download?(attachment) }
+
+    # If the blob has been marked public, permit the download (in-memory check, no queries)
+    return true if @blob.permission_public?
+
     # If we are authorized on any attached record, permit the download
     return true if @blob.attachments.any? { |attachment| authorized_attachment_download?(attachment) }
 
-    # If the blob has been given permission using Mark Public
-    return true if authorized?(@blob)
-
     # Otherwise raise a 404 Not Found and block the download
     head(:not_found)
 
@@ -106,6 +119,12 @@ module ActiveStorageAuthorization
     attachment.record_type == 'ActiveStorage::VariantRecord'
   end
 
+  # These are always public images
+  # Fast path them so we don't have to load any user for a permission check
+  def authorized_effective_download?(attachment)
+    AUTHORIZED_EFFECTIVE_DOWNLOADS.include?(attachment.record_type)
+  end
+
   # This is a has_one_attached or has_many_attached record
   # Or an ActionText::RichText object, that belongs_to a record
   def authorized_attachment_download?(attachment)

data/lib/effective_storage/engine.rb

@@ -30,10 +30,22 @@ module EffectiveStorage
 
           ActiveStorage::Blobs::RedirectController.class_eval do
             before_action :authorize_active_storage_redirect!, only: [:show]
+
+            private
+
+            def blob_scope
+              ActiveStorage::Blob.includes(:attachments, :active_storage_extensions)
+            end
           end
 
           ActiveStorage::Representations::RedirectController.class_eval do
             before_action :authorize_active_storage_redirect!, only: [:show]
+
+            private
+
+            def blob_scope
+              ActiveStorage::Blob.scope_for_strict_loading.includes(:attachments, :active_storage_extensions)
+            end
           end
         end
       end

data/lib/effective_storage/version.rb

@@ -1,3 +1,3 @@
 module EffectiveStorage
-  VERSION = '0.4.5'.freeze
+  VERSION = '0.4.7'.freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: effective_storage
 version: !ruby/object:Gem::Version
-  version: 0.4.5
+  version: 0.4.7
 platform: ruby
 authors:
 - Code and Effect
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-11-29 00:00:00.000000000 Z
+date: 2026-02-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails