venus_media_library 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8bc0532620557b83e5d9441d9d7d3c8b6908e07de77b902387156212c5f34dbb
-  data.tar.gz: e55f2d5bd5698921d1725718c5fa3c744a3ee365c78fa17a2fcde0886e195bb8
+  metadata.gz: 1499112ecf8687cfa0f34bd242c7443117c945d4800e4d74a5d163e33d406c42
+  data.tar.gz: ac7593b69b25cd85b6e1c029320ab776bd02e65284559f3814c69a9136ff5c95
 SHA512:
-  metadata.gz: 8a5b72c1b7b0ba5efbaacfc3e6f2e3fc98e2bfbf1248d2c102c171231b9967e2ce37bf39696a5fcdf596129fc0623c19bbf240292f5c6f5f682956218b99edcc
-  data.tar.gz: bd469adfdf85aec05d9dd5dd6a69cb5188b5c1354ded20a85e040133c6f3bad3cb2aeaed0722c55ac75f4e5b5f29454b52269c05684ab6fd46dd40d7f3141e9c
+  metadata.gz: f4281c9f9c2b06fdab878293cf5607a181f3bc31e6db14ec5c83cf7f7e330ac5401e4e8a8855090f08367f2f29b6babf6440ed18a69e16427356b97cf66ba6a3
+  data.tar.gz: 10e093ac59f1622f0f952977aab386e92194b309caa3f669f7dc0e48b49b54b4b6bcb868d948f7a0856c16bf874a60cb250fc48cb9f9e8be81b1c1bc4ea19e60

data/CHANGELOG.md

@@ -4,6 +4,33 @@ All notable changes to this project are documented here. The format is based on
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and this project adheres
 to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.2.0] - 2026-08-17
+
+### Added
+- Owner-scoped media records with private-by-default uploads and optional
+  community sharing.
+- Host `current_user` and `current_user.admin?` conventions, configurable for
+  applications with a different authentication model.
+- Authorization-aware original and thumbnail delivery routes.
+- A tested Rails compatibility range through the 8.x series.
+
+## [0.1.1] - 2026-08-17
+
+### Added
+- A self-contained SQLite dummy app and test suite; contributors and CI no
+  longer need PostgreSQL.
+- CI coverage for RuboCop, the full RSpec suite, gem building, and package
+  validation.
+- SVG upload coverage. `image/svg+xml` remains part of the default upload
+  allowlist.
+
+### Changed
+- The dummy app and installation guide now mount the browsable library at
+  `/venus_media_library`; the engine root at that URL renders the image grid.
+- `allowed_content_types` now strictly controls uploads instead of implicitly
+  permitting every `image/*` MIME type.
+- JSON pagination is capped at 100 images per page.
+
 ## [0.1.0] - 2026-08-15
 
 ### Added

data/README.md

@@ -34,7 +34,7 @@ Active Storage must be installed in the host app (`bin/rails active_storage:inst
 In the host app's `config/routes.rb`:
 
 ```ruby
-mount VenusMediaLibrary::Engine, at: "/media"
+mount VenusMediaLibrary::Engine, at: "/venus_media_library"
 ```
 
 Include the picker JavaScript once in your layout (Propshaft/Sprockets):
@@ -92,14 +92,15 @@ permitting the attachment param (e.g. `params.permit(:cover)`).
 
 ### Endpoints
 
-Mounted at your chosen path (examples assume `/media`):
+Mounted at your chosen path (examples assume `/venus_media_library`):
 
 | Method | Path | Purpose |
 | --- | --- | --- |
-| `GET` | `/media/images` | HTML thumbnail grid (also `.json`) |
-| `GET` | `/media/images.json` | `{ images: [...], page:, has_more:, total: }` |
-| `POST` | `/media/images` | Upload a file (param `file`); returns the image JSON |
-| `GET` | `/media/picker?target=<input_id>` | Turbo Frame body for the modal |
+| `GET` | `/venus_media_library` | Browsable HTML thumbnail grid |
+| `GET` | `/venus_media_library/images` | HTML thumbnail grid (also `.json`) |
+| `GET` | `/venus_media_library/images.json` | `{ images: [...], page:, has_more:, total: }` |
+| `POST` | `/venus_media_library/images` | Upload a file (param `file`); returns the image JSON |
+| `GET` | `/venus_media_library/picker?target=<input_id>` | Turbo Frame body for the modal |
 
 Each image payload includes `id`, `signed_id`, `filename`, `content_type`, `byte_size`, `url`, and `thumb_url`.
 
@@ -109,7 +110,7 @@ In an initializer (e.g. `config/initializers/venus_media_library.rb`):
 
 ```ruby
 VenusMediaLibrary.configure do |config|
-  # Content types accepted by the uploader (any image/* is always allowed in the grid).
+  # Content types accepted by the uploader.
   config.allowed_content_types = %w[image/png image/jpeg image/webp image/gif image/svg+xml]
 
   # [width, height] for the grid thumbnail variant.
@@ -122,36 +123,39 @@ VenusMediaLibrary.configure do |config|
   # default service (Disk in dev, S3 in prod, etc.).
   config.storage_service = nil
 
-  # How image URLs are built. :redirect (default) uses rails_blob_url; :proxy
-  # uses rails_storage_proxy_url so images on a PRIVATE bucket in proxy mode are
-  # absolute and publicly fetchable by crawlers (e.g. for an og:image).
+  # Retained for compatibility. Library URLs are authorization-aware engine URLs.
   config.url_type = :redirect
 
   # Optional access gate. A proc run in the engine controller's context before
   # every action, so it can use host helpers (current_user, redirect_to, head,
-  # main_app). Left nil the engine is open — set it to restrict the picker and
-  # upload endpoints to admins:
+  # main_app). Use it for a custom precondition before engine actions:
   #
   #   config.authenticate_with = lambda do
   #     redirect_to main_app.root_path unless current_user&.admin?
   #   end
   config.authenticate_with = nil
+
+  # Ownership defaults to the host application's authentication convention.
+  config.current_user = -> { current_user }
+  config.admin = ->(user) { user.admin? }
 end
 ```
 
 ### Configuration Details
 
-- **`allowed_content_types`** — Restricts uploads to these MIME types. The grid always shows any blob with `image/*` content type regardless. Defaults to common image formats; customize only if you need to block certain types.
+- **`allowed_content_types`** — Restricts uploads to these exact MIME types. The default explicitly includes SVG (`image/svg+xml`).
 
 - **`thumbnail_size`** — Array of `[width, height]` for grid thumbnails. Larger values give better preview quality at the cost of image processing overhead and bandwidth.
 
-- **`per_page`** — Number of images to display per page. Smaller values suit mobile-friendly UIs; larger values reduce pagination clicks.
+- **`per_page`** — Number of images to display per page. Smaller values suit mobile-friendly UIs; larger values reduce pagination clicks. JSON callers can request up to 100 images per page.
 
 - **`storage_service`** — Active Storage service name (e.g. `:amazon`, `:google`). Leave `nil` to use the host app's default, making the engine truly storage-agnostic. Uploads automatically inherit the configured service.
 
-- **`url_type`** — Controls how image URLs are built:
-  - `:redirect` (default) — `rails_blob_url` returns a temporary redirect URL that points to your storage backend (S3, GCS, etc.). Works for public URLs but blocks crawlers if your bucket is private.
-  - `:proxy` — `rails_storage_proxy_url` returns a proxy URL through Rails, which streams bytes from storage. Useful for private buckets where external crawlers (e.g., social media bots fetching `og:image`) need public, absolute URLs.
+- **`current_user`** — A controller-context callback that returns the signed-in host user. It defaults to `current_user`; every engine endpoint requires it to return a user.
+
+- **`admin`** — A callback that determines whether that user can manage all media. It defaults to `->(user) { user.admin? }`.
+
+- **`url_type`** — Retained for backward-compatible host configuration. Browsing and picker URLs are always protected engine routes, so private uploads are never exposed via an Active Storage signed URL.
 
 - **`authenticate_with`** — A proc that gates access to the engine. Runs before every action in the engine's controller context, so you can call host helpers like `current_user`, `redirect_to`, and `head`. Return nothing to allow, or redirect/deny to block. Example:
   ```ruby
@@ -232,11 +236,11 @@ If you must support IE11, you'll need polyfills. No Turbo Drive requirement, but
 
 ### The Picker Flow
 
-1. **User clicks "Choose from library"** — Opens a modal via a Turbo Frame (`GET /media/picker?target=<input_id>`).
+1. **User clicks "Choose from library"** — Opens a modal via a Turbo Frame (`GET /venus_media_library/picker?target=<input_id>`).
 2. **Modal loads the image grid** — The frame fetches the index view, listing images newest-first with pagination.
 3. **User uploads or selects** —
    - **Select:** Click an image tile; JavaScript writes the blob's `signed_id` and URL into the form inputs and closes the modal.
-   - **Upload:** Click the upload button; JavaScript posts the file to `POST /media/images`, attaches the new blob to the same inputs, and reloads the grid.
+   - **Upload:** Click the upload button; JavaScript posts the file to `POST /venus_media_library/images`, attaches the new blob to the same inputs, and reloads the grid.
 4. **Form submission** — The host app form submits with the image data, storing it as a URL column or Active Storage attachment.
 
 ### URL Signing & Storage Agnosticism
@@ -256,7 +260,7 @@ cd spec/dummy && bundle exec rspec ../
 Or use the included Rakefile:
 
 ```bash
-bundle exec rake spec
+bundle exec rake app:spec
 ```
 
 When testing a host app that uses Media Library, you can:
@@ -275,6 +279,14 @@ When testing a host app that uses Media Library, you can:
 
 ## Troubleshooting
 
+### Ownership and community sharing
+
+Each upload is owned by the user returned by `config.current_user` and starts private. A member can browse and download their own uploads; checking **Share with community** during upload makes that item visible to other signed-in members. Admins, as determined by `config.admin`, can browse and download every engine-managed upload.
+
+The engine sends originals and thumbnails through its own authorization-aware routes. Do not use an Active Storage blob URL as a substitute for an engine media URL, because it bypasses the ownership check.
+
+Blobs that existed before the engine was installed have no owner and are intentionally invisible to normal members. Admins can use **Import unowned legacy uploads** from the library to claim an image into their private library, then use the normal community-sharing control if appropriate. Do not expose legacy blobs by direct Active Storage URLs.
+
 ### Thumbnails aren't generating
 
 **Symptom:** Gray placeholder squares instead of previews in the grid.
@@ -313,12 +325,12 @@ end
 
 **Solution:** Check browser console for errors. Verify:
 1. JavaScript is loaded: `<%= javascript_include_tag "venus_media_library/venus_media_library", defer: true %>`
-2. The engine is mounted and accessible at your chosen path (default: `/media`).
+2. The engine is mounted and accessible at your chosen path (recommended: `/venus_media_library`).
 3. No JavaScript errors in other assets are breaking the page.
 
 ## Development
 
-The engine ships with a dummy app under `spec/dummy` (Active Storage configured with the Disk service, engine mounted at `/media`).
+The engine ships with a dummy app under `spec/dummy` (Active Storage configured with the Disk service, engine mounted at `/venus_media_library`).
 
 ```bash
 bundle install

data/app/assets/javascripts/venus_media_library/venus_media_library.js

@@ -90,6 +90,8 @@
 
     var form = new FormData();
     form.append("file", file);
+    var share = document.querySelector("[data-ml-community-share]");
+    form.append("community_shared", share && share.checked ? "1" : "0");
 
     var headers = { "Accept": "application/json" };
     var token = csrfToken();

data/app/controllers/venus_media_library/application_controller.rb

@@ -1,9 +1,11 @@
 module VenusMediaLibrary
   class ApplicationController < ActionController::Base
+    helper_method :venus_media_library_admin?
     # Run the host-configured access gate (if any) before every engine action.
     # The engine ships open; the host restricts the picker/upload endpoints by
     # setting VenusMediaLibrary.configuration.authenticate_with to a proc.
     before_action :authenticate_venus_media_library_access!
+    before_action :require_venus_media_library_user!
 
     private
 
@@ -15,5 +17,39 @@ module VenusMediaLibrary
       # host helpers (current_user, redirect_to, head, main_app, ...).
       instance_exec(&gate)
     end
+
+    def venus_media_library_user
+      return @venus_media_library_user if defined?(@venus_media_library_user)
+
+      @venus_media_library_user = instance_exec(&VenusMediaLibrary.configuration.current_user)
+    end
+
+    def venus_media_library_admin?
+      instance_exec(venus_media_library_user, &VenusMediaLibrary.configuration.admin)
+    end
+
+    def visible_media_assets
+      scope = VenusMediaLibrary::Asset.includes(:blob)
+      return scope if venus_media_library_admin?
+
+      scope.where(community_shared: true).or(scope.where(owner: venus_media_library_user))
+    end
+
+    def unowned_legacy_image_blobs
+      ActiveStorage::Blob.where("content_type LIKE ?", "image/%")
+                         .where.not(id: VenusMediaLibrary::Asset.select(:blob_id))
+    end
+
+    def require_venus_media_library_admin!
+      return if venus_media_library_admin?
+
+      head :forbidden
+    end
+
+    def require_venus_media_library_user!
+      return if venus_media_library_user
+
+      head :unauthorized
+    end
   end
 end

data/app/controllers/venus_media_library/assets_controller.rb

@@ -0,0 +1,20 @@
+module VenusMediaLibrary
+  class AssetsController < ApplicationController
+    def show
+      asset = visible_media_assets.find(params[:id])
+      send_data asset.blob.download, filename: asset.blob.filename.to_s,
+        type: asset.blob.content_type, disposition: "inline"
+    end
+
+    def thumbnail
+      asset = visible_media_assets.find(params[:id])
+      blob = asset.blob
+      return redirect_to asset_path(asset) unless blob.variable?
+
+      width, height = VenusMediaLibrary.configuration.thumbnail_size
+      representation = blob.variant(resize_to_limit: [ width, height ]).processed
+      send_data representation.download, filename: blob.filename.to_s,
+        type: representation.image.content_type, disposition: "inline"
+    end
+  end
+end

data/app/controllers/venus_media_library/images_controller.rb

@@ -4,6 +4,8 @@ module VenusMediaLibrary
   class ImagesController < ApplicationController
     include VenusMediaLibrary::ImagesHelper
 
+    MAX_PER_PAGE = 100
+
     # GET /images
     # Lists image blobs, newest first, with simple offset pagination.
     # Responds with an HTML grid or a JSON payload for the picker.
@@ -12,11 +14,11 @@ module VenusMediaLibrary
       @per_page = per_page
       offset    = (@page - 1) * @per_page
 
-      scope        = image_blobs
+      scope        = visible_media_assets
       @total_count = scope.count
       @blobs       = scope.order(created_at: :desc).offset(offset).limit(@per_page).to_a
       @has_more    = offset + @blobs.size < @total_count
-      @images      = @blobs.map { |blob| ml_image_payload(blob) }
+      @images      = @blobs.map { |asset| ml_image_payload(asset) }
 
       respond_to do |format|
         format.html # index.html.erb
@@ -45,31 +47,33 @@ module VenusMediaLibrary
         content_type: uploaded.content_type,
         service_name: VenusMediaLibrary.configuration.storage_service
       )
+      asset = VenusMediaLibrary::Asset.create!(
+        blob: blob, owner: venus_media_library_user,
+        community_shared: ActiveModel::Type::Boolean.new.cast(params[:community_shared]) || false
+      )
 
       respond_to do |format|
-        format.json { render json: ml_image_payload(blob), status: :created }
+        format.json { render json: ml_image_payload(asset), status: :created }
         format.html { redirect_to images_path }
       end
+    rescue ActiveRecord::RecordInvalid
+      blob&.purge
+      raise
     end
 
     private
 
-    def image_blobs
-      ActiveStorage::Blob.where("content_type LIKE ?", "image/%")
-    end
-
     def per_page
-      value = params[:per_page].presence&.to_i
-      value && value.positive? ? value : VenusMediaLibrary.configuration.per_page
+      requested = params[:per_page].presence&.to_i
+      value = requested&.positive? ? requested : VenusMediaLibrary.configuration.per_page.to_i
+
+      value.clamp(1, MAX_PER_PAGE)
     end
 
     def allowed_content_type?(content_type)
       return false if content_type.blank?
 
-      allowed = VenusMediaLibrary.configuration.allowed_content_types
-      return content_type.start_with?("image/") if allowed.blank?
-
-      allowed.include?(content_type) || content_type.start_with?("image/")
+      Array(VenusMediaLibrary.configuration.allowed_content_types).include?(content_type)
     end
 
     def respond_error(message, status)

data/app/controllers/venus_media_library/legacy_assets_controller.rb

@@ -0,0 +1,54 @@
+module VenusMediaLibrary
+  class LegacyAssetsController < ApplicationController
+    include VenusMediaLibrary::ImagesHelper
+    before_action :require_venus_media_library_admin!
+
+    def index
+      @legacy_blobs = unowned_legacy_image_blobs.order(created_at: :desc)
+
+      respond_to do |format|
+        format.html
+        format.json { render json: { images: @legacy_blobs.map { |blob| legacy_image_payload(blob) } } }
+      end
+    end
+
+    def show
+      blob = unowned_legacy_image_blobs.find(params[:id])
+      send_data blob.download, filename: blob.filename.to_s, type: blob.content_type, disposition: "inline"
+    end
+
+    def thumbnail
+      blob = unowned_legacy_image_blobs.find(params[:id])
+      return redirect_to legacy_asset_path(blob) unless blob.variable?
+
+      width, height = VenusMediaLibrary.configuration.thumbnail_size
+      representation = blob.variant(resize_to_limit: [ width, height ]).processed
+      send_data representation.download, filename: blob.filename.to_s,
+        type: representation.image.content_type, disposition: "inline"
+    end
+
+    def import
+      blob = unowned_legacy_image_blobs.find(params[:id])
+      asset = VenusMediaLibrary::Asset.create!(blob: blob, owner: venus_media_library_user)
+
+      respond_to do |format|
+        format.html { redirect_to images_path, notice: "Legacy upload imported into your private library." }
+        format.json { render json: ml_image_payload(asset), status: :created }
+      end
+    end
+
+    private
+
+    def legacy_image_payload(blob)
+      {
+        id: blob.id,
+        filename: blob.filename.to_s,
+        content_type: blob.content_type,
+        byte_size: blob.byte_size,
+        created_at: blob.created_at,
+        url: legacy_asset_path(blob),
+        thumb_url: thumbnail_legacy_asset_path(blob)
+      }
+    end
+  end
+end

data/app/controllers/venus_media_library/pickers_controller.rb

@@ -7,12 +7,12 @@ module VenusMediaLibrary
     def show
       @target = params[:target].to_s
       @page   = [ params.fetch(:page, 1).to_i, 1 ].max
-      per     = VenusMediaLibrary.configuration.per_page
+      per     = [ VenusMediaLibrary.configuration.per_page.to_i, 1 ].max.clamp(1, ImagesController::MAX_PER_PAGE)
       offset  = (@page - 1) * per
 
-      scope     = ActiveStorage::Blob.where("content_type LIKE ?", "image/%")
+      scope     = visible_media_assets
       @has_more = offset + per < scope.count
-      @images   = scope.order(created_at: :desc).offset(offset).limit(per).map { |blob| ml_image_payload(blob) }
+      @images   = scope.order(created_at: :desc).offset(offset).limit(per).map { |asset| ml_image_payload(asset) }
 
       render partial: "venus_media_library/pickers/picker",
              locals: { target: @target, images: @images, page: @page, has_more: @has_more },

data/app/helpers/venus_media_library/images_helper.rb

@@ -3,16 +3,18 @@ module VenusMediaLibrary
   # ImagesController so the HTML grid and the JSON response stay in sync.
   module ImagesHelper
     # A serializable description of a blob used by the JSON API and the tiles.
-    def ml_image_payload(blob)
+    def ml_image_payload(asset)
+      blob = asset.blob
       {
-        id:           blob.id,
+        id:           asset.id,
         signed_id:    blob.signed_id,
         filename:     blob.filename.to_s,
         content_type: blob.content_type,
         byte_size:    blob.byte_size,
         created_at:   blob.created_at,
-        url:          ml_blob_url(blob),
-        thumb_url:    ml_thumb_url(blob)
+        community_shared: asset.community_shared,
+        url:          ml_blob_url(asset),
+        thumb_url:    ml_thumb_url(asset)
       }
     end
 
@@ -20,27 +22,14 @@ module VenusMediaLibrary
     # host app, so they are reached through the `main_app` proxy. With
     # url_type = :proxy the URL streams through Rails (works for private buckets
     # and external crawlers); the default :redirect 302s to the storage URL.
-    def ml_blob_url(blob)
-      if VenusMediaLibrary.configuration.url_type == :proxy
-        main_app.rails_storage_proxy_url(blob)
-      else
-        main_app.rails_blob_url(blob)
-      end
-    rescue StandardError
-      main_app.rails_blob_path(blob)
+    def ml_blob_url(asset)
+      venus_media_library.asset_path(asset)
     end
 
     # Small variant used for the grid thumbnail. Falls back to the original URL
     # when the blob can't be variated (e.g. SVG).
-    def ml_thumb_url(blob)
-      if blob.variable?
-        w, h = VenusMediaLibrary.configuration.thumbnail_size
-        main_app.rails_representation_url(blob.variant(resize_to_limit: [ w, h ]))
-      else
-        ml_blob_url(blob)
-      end
-    rescue StandardError
-      ml_blob_url(blob)
+    def ml_thumb_url(asset)
+      venus_media_library.thumbnail_asset_path(asset)
     end
   end
 end

data/app/models/venus_media_library/asset.rb

@@ -0,0 +1,8 @@
+module VenusMediaLibrary
+  class Asset < ApplicationRecord
+    belongs_to :blob, class_name: "ActiveStorage::Blob"
+    belongs_to :owner, polymorphic: true
+
+    validates :blob, uniqueness: true
+  end
+end

data/app/views/venus_media_library/images/index.html.erb

@@ -2,6 +2,9 @@
   <header class="ml-library__header">
     <h1>Media Library</h1>
     <p class="ml-library__count"><%= @total_count %> image<%= "s" unless @total_count == 1 %></p>
+    <% if venus_media_library_admin? %>
+      <p><%= link_to "Import unowned legacy uploads", legacy_assets_path, class: "ml-btn" %></p>
+    <% end %>
   </header>
 
   <% if @images.empty? %>

data/app/views/venus_media_library/legacy_assets/index.html.erb

@@ -0,0 +1,20 @@
+<div class="ml-library">
+  <header class="ml-library__header">
+    <h1>Unowned legacy uploads</h1>
+    <p class="ml-library__count"><%= @legacy_blobs.size %> image<%= "s" unless @legacy_blobs.size == 1 %> awaiting import</p>
+  </header>
+
+  <% if @legacy_blobs.empty? %>
+    <p class="ml-empty">No unowned legacy uploads found.</p>
+  <% else %>
+    <div class="ml-grid">
+      <% @legacy_blobs.each do |blob| %>
+        <article class="ml-tile">
+          <img src="<%= thumbnail_legacy_asset_path(blob) %>" alt="<%= blob.filename %>" loading="lazy">
+          <span class="ml-tile__name"><%= blob.filename %></span>
+          <%= button_to "Import into my private library", import_legacy_asset_path(blob), method: :post, class: "ml-btn" %>
+        </article>
+      <% end %>
+    </div>
+  <% end %>
+</div>

data/app/views/venus_media_library/pickers/_picker.html.erb

@@ -6,6 +6,7 @@
       Upload image
       <input type="file" accept="image/*" hidden data-ml-upload>
     </label>
+    <label class="ml-picker__share"><input type="checkbox" data-ml-community-share> Share with community</label>
     <span class="ml-picker__hint" data-ml-status></span>
   </div>
 

data/config/routes.rb

@@ -1,6 +1,13 @@
 VenusMediaLibrary::Engine.routes.draw do
   # Image library: index lists images (HTML grid + JSON), create handles uploads.
   resources :images, only: [ :index, :create ]
+  resources :assets, only: [ :show ] do
+    get :thumbnail, on: :member
+  end
+  resources :legacy_assets, only: [ :index, :show ] do
+    get :thumbnail, on: :member
+    post :import, on: :member
+  end
 
   # Turbo Frame that renders the picker modal body for a given target field.
   get "picker", to: "pickers#show", as: :picker

data/db/migrate/20260817190000_create_venus_media_library_assets.rb

@@ -0,0 +1,10 @@
+class CreateVenusMediaLibraryAssets < ActiveRecord::Migration[7.1]
+  def change
+    create_table :venus_media_library_assets do |t|
+      t.references :blob, null: false, foreign_key: { to_table: :active_storage_blobs }, index: { unique: true }
+      t.references :owner, null: false, polymorphic: true
+      t.boolean :community_shared, null: false, default: false
+      t.timestamps
+    end
+  end
+end

data/lib/venus_media_library/version.rb

@@ -1,3 +1,3 @@
 module VenusMediaLibrary
-  VERSION = "0.1.0"
+  VERSION = "0.2.0"
 end

data/lib/venus_media_library.rb

@@ -11,9 +11,7 @@ module VenusMediaLibrary
   #     config.storage_service       = :amazon
   #   end
   class Configuration
-    # Content types accepted by the uploader and shown in the library grid.
-    # Every entry is matched literally; the index additionally shows any blob
-    # whose content_type starts with "image/".
+    # Content types accepted by the uploader. Every entry is matched literally.
     attr_accessor :allowed_content_types
 
     # [width, height] used for the grid thumbnail variant.
@@ -27,12 +25,8 @@ module VenusMediaLibrary
     # the engine stays storage-agnostic (Disk in dev, S3 in prod, etc.).
     attr_accessor :storage_service
 
-    # How image URLs in the payload/picker are built:
-    #   :redirect (default) -> rails_blob_url          (302s to the storage URL)
-    #   :proxy              -> rails_storage_proxy_url  (Rails streams the bytes)
-    # Use :proxy when the bucket is private and images must be publicly fetchable
-    # by external crawlers (e.g. an og:image on a private S3 bucket in proxy mode).
-    # Still storage-agnostic: both are Active Storage route helpers.
+    # Retained for compatibility with older host configuration. Library URLs are
+    # always served through authorization-aware engine routes.
     attr_accessor :url_type
 
     # Optional access gate. A proc run in the engine controller's context before
@@ -44,6 +38,10 @@ module VenusMediaLibrary
     #     c.authenticate_with = -> { redirect_to main_app.root_path unless current_user&.admin? }
     #   end
     attr_accessor :authenticate_with
+    # The current signed-in host user and the role predicate. Both callbacks run
+    # in the engine controller context. By default this uses the host's
+    # `current_user` and `current_user.admin?` convention.
+    attr_accessor :current_user, :admin
 
     def initialize
       @allowed_content_types = %w[image/png image/jpeg image/jpg image/gif image/webp image/svg+xml]
@@ -52,6 +50,8 @@ module VenusMediaLibrary
       @storage_service       = nil
       @url_type              = :redirect
       @authenticate_with     = nil
+      @current_user          = -> { current_user }
+      @admin                 = ->(user) { user.admin? }
     end
   end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: venus_media_library
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - Good Works On Earth
@@ -16,6 +16,9 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '7.1'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '9.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -23,6 +26,9 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '7.1'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '9.0'
 - !ruby/object:Gem::Dependency
   name: image_processing
   requirement: !ruby/object:Gem::Requirement
@@ -57,7 +63,9 @@ files:
 - app/assets/stylesheets/venus_media_library/application.css
 - app/assets/stylesheets/venus_media_library/picker.css
 - app/controllers/venus_media_library/application_controller.rb
+- app/controllers/venus_media_library/assets_controller.rb
 - app/controllers/venus_media_library/images_controller.rb
+- app/controllers/venus_media_library/legacy_assets_controller.rb
 - app/controllers/venus_media_library/pickers_controller.rb
 - app/helpers/venus_media_library/application_helper.rb
 - app/helpers/venus_media_library/images_helper.rb
@@ -65,12 +73,15 @@ files:
 - app/jobs/venus_media_library/application_job.rb
 - app/mailers/venus_media_library/application_mailer.rb
 - app/models/venus_media_library/application_record.rb
+- app/models/venus_media_library/asset.rb
 - app/views/layouts/venus_media_library/application.html.erb
 - app/views/venus_media_library/images/_image.html.erb
 - app/views/venus_media_library/images/index.html.erb
+- app/views/venus_media_library/legacy_assets/index.html.erb
 - app/views/venus_media_library/pickers/_modal.html.erb
 - app/views/venus_media_library/pickers/_picker.html.erb
 - config/routes.rb
+- db/migrate/20260817190000_create_venus_media_library_assets.rb
 - lib/tasks/venus_media_library_tasks.rake
 - lib/venus_media_library.rb
 - lib/venus_media_library/engine.rb