lato_cms 3.2.6 → 3.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cdc7dae92de55a7a6e1e1290ee957bbf0b63fdf16404524c3f1803bd68123d0e
-  data.tar.gz: 1bc853f4846e25c41db7bddc0d53ac55f05699a06cf97a221abf6b7573458a7e
+  metadata.gz: '094c93e8f96929b8abc542b096f60de09e69165f3158c3b17a1bedd0815b3645'
+  data.tar.gz: 77ddc4feb76c37b9d1f6bb5f13230a18cc452a30d4435aee38188fb93853c74d
 SHA512:
-  metadata.gz: 0117c7af5986170ce154bee821263a5ac8da6759d71a8fd682624e59b84d31a4f368d15d8c12d05549cd38d08baee38aa5a09550cad85a2bfaf9e30071baa50a
-  data.tar.gz: f18ef5c8dcaf4c2a3e2cd66e031bd2853eca12e69fc9aab6afcbe93989a90de362948317a526a45c08fe0ba38a647220505f95282e7e2b1910bc32c864386ca0
+  metadata.gz: 91438e0eba689387d221a7f27ceb24fae3b249a3f154e5fff1ceca4f7812242e9278488e247c0f59adad09b30ab5ca02b383b90dc05a8ed3528f32449dc798c2
+  data.tar.gz: 85b62b2734785e61ee3e4b88f74a2b487d6fd6bd6cd533f9a39dfe26bef85b7971dfbe8dc34b9de57c139bc5ee5c8889c8e2b43495e3799049a135cd9540a747

data/README.md

@@ -43,6 +43,31 @@ import "lato_cms/application";
 // ....
 ```
 
+## Media URLs
+
+By default a media URL is an Active Storage **redirect** URL: Rails answers 302 with a
+signed address that expires. On a remote service (S3 and friends) that is what you want —
+the file then comes from the service itself.
+
+On a **disk** service it is the wrong trade: the redirect costs a second request, and its
+target is served `private, must-revalidate`, so no browser, proxy or CDN can keep it. A
+video of a few dozen MB is then downloaded again on every visit, from a thread of your app
+server. Switch the mode:
+
+```ruby
+LatoCms.configure do |config|
+  config.media_url_mode = :proxy
+end
+```
+
+Media URLs (the blob and every variant) then point at Active Storage's proxy controller:
+no redirect, and `Cache-Control: public, immutable`, which a cache in front of the app can
+actually use. The address carries the signature of the blob, so a replaced file is a
+different address and can never be served stale.
+
+Both modes ask for an `inline` disposition: a media of the library is content to show, and
+the default for a video would otherwise turn opening its address into a download.
+
 ## Development
 
 Clone repository, install dependencies, run migrations and start:

data/app/models/lato_cms/media.rb

@@ -154,11 +154,27 @@ module LatoCms
     end
 
     def url
-      Rails.application.routes.url_helpers.rails_blob_path(file, only_path: true) if file.attached?
+      attachment_url(file) if file.attached?
     end
 
     def poster_url
-      Rails.application.routes.url_helpers.rails_blob_path(poster_file, only_path: true) if poster_file.attached?
+      attachment_url(poster_file) if poster_file.attached?
+    end
+
+    # The URL of an attachment or of one of its variants, in the mode the host
+    # app asked for (see LatoCms::Config::MEDIA_URL_MODES).
+    #
+    # `inline` in both modes: a media of the library is content to show — a
+    # picture in a page, a video in a player — and the default disposition of a
+    # video is `attachment`, which turns opening its address into a download.
+    # Whoever wants a download asks for it explicitly, as the panel does.
+    def attachment_url(attachable)
+      helpers = Rails.application.routes.url_helpers
+      if LatoCms.config.media_url_proxy?
+        helpers.rails_storage_proxy_path(attachable, only_path: true, disposition: :inline)
+      else
+        helpers.rails_blob_path(attachable, only_path: true, disposition: :inline)
+      end
     end
 
     # Swaps the underlying file while keeping the same record, so every field
@@ -248,9 +264,7 @@ module LatoCms
     def thumbnail_url
       return nil unless image? && file.attached? && file.variable?
 
-      Rails.application.routes.url_helpers.rails_representation_path(
-        file.variant(resize_to_fill: [200, 200]), only_path: true
-      )
+      attachment_url(file.variant(resize_to_fill: [200, 200]))
     rescue StandardError => e
       Rails.logger.error("LatoCms: Failed to build thumbnail for media #{id}: #{e.message}")
       nil
@@ -263,9 +277,7 @@ module LatoCms
       return nil unless image? && file.attached?
       return url unless file.variable?
 
-      Rails.application.routes.url_helpers.rails_representation_path(
-        file.variant(resize_to_limit: [1200, 1200]), only_path: true
-      )
+      attachment_url(file.variant(resize_to_limit: [1200, 1200]))
     rescue StandardError => e
       Rails.logger.error("LatoCms: Failed to build preview for media #{id}: #{e.message}")
       url
@@ -278,12 +290,11 @@ module LatoCms
     def variant_urls(sizes_config)
       return {} if sizes_config.blank? || !sizes_config.respond_to?(:each_pair) || !file.attached? || !file.variable?
 
-      url_helpers = Rails.application.routes.url_helpers
       sizes_config.each_with_object({}) do |(name, opts), acc|
         transformation = self.class.variant_transformation(opts)
         next if transformation.blank?
 
-        acc[name] = url_helpers.rails_representation_path(file.variant(transformation), only_path: true)
+        acc[name] = attachment_url(file.variant(transformation))
       end
     rescue StandardError => e
       Rails.logger.error("LatoCms: Failed to build image variants for media #{id}: #{e.message}")

data/lib/lato_cms/config.rb

@@ -3,8 +3,19 @@ module LatoCms
   # This class contains the default configuration of the engine.
   ##
   class Config
-    attr_accessor :locales, :templates_path, :admin_roles, :llm_api_url, :llm_model, :llm_api_key,
-                  :llm_generate_alt_text, :llm_generate_title, :llm_alt_text_prompt, :llm_title_prompt
+    attr_accessor :locales, :templates_path, :admin_roles, :media_url_mode, :llm_api_url, :llm_model,
+                  :llm_api_key, :llm_generate_alt_text, :llm_generate_title, :llm_alt_text_prompt,
+                  :llm_title_prompt
+
+    # How the URLs of media files are built (see LatoCms::Media#url).
+    # - :redirect — Rails answers 302 with a signed URL that expires; on a
+    #   remote service (S3 and friends) the file then comes from the service
+    #   itself, which is what you want there.
+    # - :proxy — the file is served through the app, with no redirect and with
+    #   `Cache-Control: public, immutable`, so browsers and any cache in front
+    #   can keep it. On a disk service this is strictly better: the redirect
+    #   costs a second request and its target can be cached by nobody.
+    MEDIA_URL_MODES = %i[redirect proxy].freeze
 
     # Placeholders substituted at request time in both default and custom LLM
     # prompts (see LatoCms::Media#llm_prompt):
@@ -37,6 +48,11 @@ module LatoCms
       # (create, update, delete) and translation links.
       @admin_roles = { none: 0, operator: 1, admin: 2 }
 
+      # Default is :redirect, which is how it always worked: switching the way
+      # every media URL is built is a decision for the host app, not something
+      # an upgrade should do on its own. See MEDIA_URL_MODES.
+      @media_url_mode = :redirect
+
       # Optional OpenAI-compatible endpoint used to auto-generate alt text and
       # title for uploaded images (see LatoCms::Media#generate_text!). All
       # three must be set for the feature to activate; unset by default.
@@ -56,6 +72,10 @@ module LatoCms
       @llm_title_prompt = nil
     end
 
+    def media_url_proxy?
+      media_url_mode.to_sym == :proxy
+    end
+
     def llm_configured?
       llm_api_url.present? && llm_model.present? && llm_api_key.present?
     end

data/lib/lato_cms/version.rb

@@ -1,3 +1,3 @@
 module LatoCms
-  VERSION = "3.2.6"
+  VERSION = "3.3.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: lato_cms
 version: !ruby/object:Gem::Version
-  version: 3.2.6
+  version: 3.3.0
 platform: ruby
 authors:
 - Gregorio Galante