venus_media_library 1.1.0 → 1.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 53f9b683221215b76b95f0248dd87938ebba0a7066c36ccc7b02dc23fece50e0
-  data.tar.gz: acf9d06d3f9a7712568f9f05c9584ccc9fda2772de1bcad6e1b2090c1cf07e8f
+  metadata.gz: bcec0bd91adffafd52e55f0eecca9146046813df1fdde5252affd856a4584bf8
+  data.tar.gz: c84ee2c8fac6c7ac3faa00e7de4e4ae43ec4ab7bbb93b7213e466881e9ef8257
 SHA512:
-  metadata.gz: e1d247beff66e7d45750fcfa96813cdcb0bb7ed5a2cb0eb500486602f4b8354001ffc280fe399fbb504ad094b2e97b3715cb578b29e2aabce34d34b82fd4037f
-  data.tar.gz: e8928ccd013a969ff08cfef454886735297e5a74d84acc9b66a09335be91ede3a1a9f4f3dfbe59ede7a3b16acc4438b461b73b8c43c550e5ce01e989555b2999
+  metadata.gz: 15c65b27a87cc9e5e4b9d3d4e21050b3fcca50acffc9d0a36151f03b3d569a2cec51e15c9c1153454153518698ba189cb9f4c2bee54dd282305be2c5c60199f3
+  data.tar.gz: c5631b4d32836f90b2e4eb90ec982e331b2ffef76f0dafbd819b5779259d17941e8277f548c56260d85750d5bbc2317eb543bae1ab223bdf56981b6eb4c8ca9d

data/CHANGELOG.md

@@ -4,6 +4,16 @@ All notable changes to this project are documented here. The format is based on
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and this project adheres
 to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.1.1] - 2026-08-19
+
+### Fixed
+- The picker now hands host URL fields (via `media_picker_field`, e.g. an
+  `og:image`) an **absolute, public** Active Storage URL (honoring
+  `config.url_type`) instead of the relative, owner-gated `/…/assets/:id` engine
+  route. Since 1.0.0 that route was not fetchable by external crawlers, silently
+  breaking og:image, social cards, and image SEO. In-admin grid thumbnails keep
+  using the gated route, and owner-scoped access is unchanged.
+
 ## [1.1.0] - 2026-08-18
 
 ### Added

data/app/helpers/venus_media_library/images_helper.rb

@@ -19,16 +19,36 @@ module VenusMediaLibrary
       }
     end
 
-    # Permanent URL to the original file. Active Storage route helpers live on the
-    # host app, so they are reached through the `main_app` proxy. With
-    # url_type = :proxy the URL streams through Rails (works for private buckets
-    # and external crawlers); the default :redirect 302s to the storage URL.
+    # Permanent, PUBLIC URL to the original file — this is the value the picker
+    # writes into a host URL field (e.g. a page's og:image), so it must be
+    # absolute and fetchable by external crawlers (Facebook/Google/Twitter) with
+    # no session. It therefore uses Rails' public Active Storage routes, NOT the
+    # engine's owner-gated `asset_path` (an anonymous crawler hitting that route
+    # is bounced by the host's `authenticate_with` gate, silently breaking
+    # og:image / social cards). Owner-scoping still governs WHICH assets a member
+    # can SEE in the library (see visible_media_assets); it is orthogonal to the
+    # public URL a picked asset resolves to. Active Storage route helpers live on
+    # the host app, so they are reached through the `main_app` proxy. With
+    # url_type = :proxy the URL streams through Rails (works for private buckets);
+    # the default :redirect 302s to the storage URL. Mirrors PickerHelper's
+    # attach-mode preview so URL fields and attachment fields agree.
     def ml_blob_url(asset)
-      venus_media_library.asset_path(asset)
+      if VenusMediaLibrary.configuration.url_type == :proxy
+        main_app.rails_storage_proxy_url(asset.blob)
+      else
+        main_app.rails_blob_url(asset.blob)
+      end
+    rescue StandardError
+      # Last resort only: a relative path keeps the admin grid rendering when a
+      # URL host is unavailable. Absolute public URLs above are what host URL
+      # fields need; this fallback should not be the stored og:image value.
+      main_app.rails_blob_path(asset.blob)
     end
 
-    # Small variant used for the grid thumbnail. Falls back to the original URL
-    # when the blob can't be variated (e.g. SVG).
+    # Small variant used for the in-admin grid thumbnail. This runs behind the
+    # engine's auth in the admin library UI, so the owner-scoped engine route is
+    # correct here (it also honors the per-tenant visibility rules). Only the
+    # picked `url` above needs to be public.
     def ml_thumb_url(asset)
       venus_media_library.thumbnail_asset_path(asset)
     end

data/lib/venus_media_library/version.rb

@@ -1,3 +1,3 @@
 module VenusMediaLibrary
-  VERSION = "1.1.0"
+  VERSION = "1.1.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: venus_media_library
 version: !ruby/object:Gem::Version
-  version: 1.1.0
+  version: 1.1.1
 platform: ruby
 authors:
 - Good Works On Earth