Active storage add proxying

actiontext/test/template/form_helper_test.rb

@@ -33,7 +33,7 @@ def form_with(*, **)
     assert_dom_equal \
       '<form action="/messages" accept-charset="UTF-8" data-remote="true" method="post">' \
         '<input type="hidden" name="message[content]" id="message_content_trix_input_message" />' \
-        '<trix-editor id="message_content" input="message_content_trix_input_message" class="trix-content" data-direct-upload-url="http://test.host/rails/active_storage/direct_uploads" data-blob-url-template="http://test.host/rails/active_storage/blobs/:signed_id/:filename">' \
+        '<trix-editor id="message_content" input="message_content_trix_input_message" class="trix-content" data-direct-upload-url="http://test.host/rails/active_storage/direct_uploads" data-blob-url-template="http://test.host/rails/active_storage/blobs/redirect/:signed_id/:filename">' \
         "</trix-editor>" \
       "</form>",
       output_buffer
@@ -47,7 +47,7 @@ def form_with(*, **)
     assert_dom_equal \
       '<form action="/messages" accept-charset="UTF-8" data-remote="true" method="post">' \
         '<input type="hidden" name="message[content]" id="message_content_trix_input_message" />' \
-        '<trix-editor id="message_content" input="message_content_trix_input_message" class="custom-class" data-direct-upload-url="http://test.host/rails/active_storage/direct_uploads" data-blob-url-template="http://test.host/rails/active_storage/blobs/:signed_id/:filename">' \
+        '<trix-editor id="message_content" input="message_content_trix_input_message" class="custom-class" data-direct-upload-url="http://test.host/rails/active_storage/direct_uploads" data-blob-url-template="http://test.host/rails/active_storage/blobs/redirect/:signed_id/:filename">' \
         "</trix-editor>" \
       "</form>",
       output_buffer
@@ -61,7 +61,7 @@ def form_with(*, **)
     assert_dom_equal \
       '<form action="/messages" accept-charset="UTF-8" data-remote="true" method="post">' \
         '<input type="hidden" name="message[not_an_attribute]" id="message_not_an_attribute_trix_input_message" />' \
-        '<trix-editor id="message_not_an_attribute" input="message_not_an_attribute_trix_input_message" class="trix-content" data-direct-upload-url="http://test.host/rails/active_storage/direct_uploads" data-blob-url-template="http://test.host/rails/active_storage/blobs/:signed_id/:filename">' \
+        '<trix-editor id="message_not_an_attribute" input="message_not_an_attribute_trix_input_message" class="trix-content" data-direct-upload-url="http://test.host/rails/active_storage/direct_uploads" data-blob-url-template="http://test.host/rails/active_storage/blobs/redirect/:signed_id/:filename">' \
         "</trix-editor>" \
       "</form>",
       output_buffer
@@ -75,7 +75,7 @@ def form_with(*, **)
     assert_dom_equal \
       '<form action="/messages" accept-charset="UTF-8" data-remote="true" method="post">' \
         '<input type="hidden" name="message[content]" id="trix_input_1" />' \
-        '<trix-editor id="message_content" input="trix_input_1" class="trix-content" data-direct-upload-url="http://test.host/rails/active_storage/direct_uploads" data-blob-url-template="http://test.host/rails/active_storage/blobs/:signed_id/:filename">' \
+        '<trix-editor id="message_content" input="trix_input_1" class="trix-content" data-direct-upload-url="http://test.host/rails/active_storage/direct_uploads" data-blob-url-template="http://test.host/rails/active_storage/blobs/redirect/:signed_id/:filename">' \
         "</trix-editor>" \
       "</form>",
       output_buffer
@@ -89,7 +89,7 @@ def form_with(*, **)
     assert_dom_equal \
       '<form action="/messages" accept-charset="UTF-8" data-remote="true" method="post">' \
         '<input type="hidden" name="message[content]" id="message_content_trix_input_message" />' \
-        '<trix-editor placeholder="Content" id="message_content" input="message_content_trix_input_message" class="trix-content" data-direct-upload-url="http://test.host/rails/active_storage/direct_uploads" data-blob-url-template="http://test.host/rails/active_storage/blobs/:signed_id/:filename">' \
+        '<trix-editor placeholder="Content" id="message_content" input="message_content_trix_input_message" class="trix-content" data-direct-upload-url="http://test.host/rails/active_storage/direct_uploads" data-blob-url-template="http://test.host/rails/active_storage/blobs/redirect/:signed_id/:filename">' \
         "</trix-editor>" \
       "</form>",
       output_buffer
@@ -105,7 +105,7 @@ def form_with(*, **)
     assert_dom_equal \
       '<form action="/messages" accept-charset="UTF-8" data-remote="true" method="post">' \
         '<input type="hidden" name="message[title]" id="message_title_trix_input_message" />' \
-        '<trix-editor placeholder="Story title" id="message_title" input="message_title_trix_input_message" class="trix-content" data-direct-upload-url="http://test.host/rails/active_storage/direct_uploads" data-blob-url-template="http://test.host/rails/active_storage/blobs/:signed_id/:filename">' \
+        '<trix-editor placeholder="Story title" id="message_title" input="message_title_trix_input_message" class="trix-content" data-direct-upload-url="http://test.host/rails/active_storage/direct_uploads" data-blob-url-template="http://test.host/rails/active_storage/blobs/redirect/:signed_id/:filename">' \
         "</trix-editor>" \
       "</form>",
       output_buffer

activestorage/README.md

@@ -106,6 +106,25 @@ Variation of image attachment:
 <%= image_tag user.avatar.variant(resize_to_limit: [100, 100]) %>
 ```
 
+## Delivery Routes
+Active storage provides two primary ways to route assets.
+
+### Redirect (default)
+`:rails_storage_redirect` Requests for files will redirect to a temporary service URL.
+
+### Proxy
+`:rails_storage_proxy` Files are proxied through the application server. Useful for serving assets from a CDN or HTML caching.
+
+### Changing the default resolver
+To make all assets cachable via a CDN you may change the default resolver for Active Storage models:
+```ruby
+config.active_storage.resolve_model_to_route = :rails_storage_proxy
+```
+If a more granular approach is needed the path or url helpers may be called from your views:
+```ruby
+<%= image_tag rails_storage_proxy_path(@user.avatar) %>
+```
+
 ## Direct uploads
 
 Active Storage, with its included JavaScript library, supports uploading directly from the client to the cloud.

activestorage/app/controllers/active_storage/blobs/proxy_controller.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+# Take a signed permanent reference for a blob representation and turn it into an expiring service URL for download.
+# Note: These URLs are publicly accessible. If you need to enforce access protection beyond the
+# security-through-obscurity factor of the signed blob and variation reference, you'll need to implement your own
+# authenticated redirection controller.
+class ActiveStorage::Blobs::ProxyController < ActiveStorage::BaseController
+  include ActiveStorage::SetBlob
+  include ActiveStorage::SetHeaders
+
+  def show
+    set_headers(@blob)
+
+    @blob.download do |chunk|
+      response.stream.write(chunk)
+    end
+  ensure
+    response.stream.close
+  end
+end

activestorage/app/controllers/active_storage/blobs_controller.rb → activestorage/app/controllers/active_storage/blobs/redirection_controller.rb

@@ -4,7 +4,7 @@
 # Note: These URLs are publicly accessible. If you need to enforce access protection beyond the
 # security-through-obscurity factor of the signed blob references, you'll need to implement your own
 # authenticated redirection controller.
-class ActiveStorage::BlobsController < ActiveStorage::BaseController
+class ActiveStorage::Blobs::RedirectionController < ActiveStorage::BaseController
   include ActiveStorage::SetBlob
 
   def show

activestorage/app/controllers/active_storage/representations/proxy_controller.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+class ActiveStorage::Representations::ProxyController < ActiveStorage::BaseController
+  include ActiveStorage::SetBlob
+  include ActiveStorage::SetHeaders
+
+  def show
+    representation = @blob.representation(params[:variation_key]).processed
+
+    set_headers(representation.image.blob)
+
+    @blob.service.download(representation.key) do |chunk|
+      response.stream.write(chunk)
+    end
+  ensure
+    response.stream.close
+  end
+end

activestorage/app/controllers/active_storage/representations_controller.rb → activestorage/app/controllers/active_storage/representations/redirection_controller.rb

@@ -4,7 +4,7 @@
 # Note: These URLs are publicly accessible. If you need to enforce access protection beyond the
 # security-through-obscurity factor of the signed blob and variation reference, you'll need to implement your own
 # authenticated redirection controller.
-class ActiveStorage::RepresentationsController < ActiveStorage::BaseController
+class ActiveStorage::Representations::RedirectionController < ActiveStorage::BaseController
   include ActiveStorage::SetBlob
 
   def show

activestorage/app/controllers/concerns/active_storage/set_headers.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+module ActiveStorage::SetHeaders #:nodoc:
+  extend ActiveSupport::Concern
+
+  private
+    def set_headers(blob)
+      expires_in 1.year, public: true
+
+      response.headers["Content-Type"] = blob.content_type
+      response.headers["Content-Disposition"] = ActionDispatch::Http::ContentDisposition.format(
+        disposition: params[:disposition] || "inline",
+        filename: blob.filename.sanitized
+      )
+    end
+end

activestorage/app/models/active_storage/preview.rb

@@ -66,6 +66,12 @@ def url(**options)
     end
   end
 
+  # Returns a combination key of the blob and the variation that together identifies a specific variant.
+  def key
+    variant
+    "variants/#{image.key}/#{Digest::SHA256.hexdigest(variation.key)}"
+  end
+
   alias_method :service_url, :url
   deprecate service_url: :url
 

activestorage/config/routes.rb

@@ -2,9 +2,11 @@
 
 Rails.application.routes.draw do
   scope ActiveStorage.routes_prefix do
-    get "/blobs/:signed_id/*filename" => "active_storage/blobs#show", as: :rails_service_blob
+    get "/blobs/redirect/:signed_id/*filename" => "active_storage/blobs/redirection#show", as: :rails_service_blob
+    get "/blobs/proxy/:signed_id/*filename" => "active_storage/blobs/proxy#show", as: :rails_service_blob_proxy
 
-    get "/representations/:signed_blob_id/:variation_key/*filename" => "active_storage/representations#show", as: :rails_blob_representation
+    get "/representations/redirect/:signed_blob_id/:variation_key/*filename" => "active_storage/representations/redirection#show", as: :rails_blob_representation
+    get "/representations/proxy/:signed_blob_id/:variation_key/*filename" => "active_storage/representations/proxy#show", as: :rails_blob_representation_proxy
 
     get  "/disk/:encoded_key/*filename" => "active_storage/disk#show", as: :rails_disk_service
     put  "/disk/:encoded_token" => "active_storage/disk#update", as: :update_rails_disk_service
@@ -19,15 +21,60 @@
     route_for(:rails_blob_representation, signed_blob_id, variation_key, filename, options)
   end
 
-  resolve("ActiveStorage::Variant") { |variant, options| route_for(:rails_representation, variant, options) }
-  resolve("ActiveStorage::VariantWithRecord") { |variant, options| route_for(:rails_representation, variant, options) }
-  resolve("ActiveStorage::Preview") { |preview, options| route_for(:rails_representation, preview, options) }
-
+  resolve("ActiveStorage::Variant") { |variant, options| route_for(ActiveStorage.resolve_model_to_route, variant, options) }
+  resolve("ActiveStorage::VariantWithRecord") { |variant, options| route_for(ActiveStorage.resolve_model_to_route, variant, options) }
+  resolve("ActiveStorage::Preview") { |preview, options| route_for(ActiveStorage.resolve_model_to_route, preview, options) }
 
   direct :rails_blob do |blob, options|
     route_for(:rails_service_blob, blob.signed_id, blob.filename, options)
   end
 
-  resolve("ActiveStorage::Blob")       { |blob, options| route_for(:rails_blob, blob, options) }
-  resolve("ActiveStorage::Attachment") { |attachment, options| route_for(:rails_blob, attachment.blob, options) }
+  resolve("ActiveStorage::Blob")       { |blob, options| route_for(ActiveStorage.resolve_model_to_route, blob, options) }
+  resolve("ActiveStorage::Attachment") { |attachment, options| route_for(ActiveStorage.resolve_model_to_route, attachment.blob, options) }
+
+  direct :rails_storage_proxy do |model, options|
+    if model.respond_to?(:signed_id)
+      route_for(
+        :rails_service_blob_proxy,
+        model.signed_id,
+        model.filename,
+        options
+      )
+    else
+      signed_blob_id = model.blob.signed_id
+      variation_key  = model.variation.key
+      filename       = model.blob.filename
+
+      route_for(
+        :rails_blob_representation_proxy,
+        signed_blob_id,
+        variation_key,
+        filename,
+        options
+      )
+    end
+  end
+
+  direct :rails_storage_redirect do |model, options|
+    if model.respond_to?(:signed_id)
+      route_for(
+        :rails_service_blob,
+        model.signed_id,
+        model.filename,
+        options
+      )
+    else
+      signed_blob_id = model.blob.signed_id
+      variation_key  = model.variation.key
+      filename       = model.blob.filename
+
+      route_for(
+        :rails_blob_representation,
+        signed_blob_id,
+        variation_key,
+        filename,
+        options
+      )
+    end
+  end
 end if ActiveStorage.draw_routes

activestorage/lib/active_storage.rb

@@ -61,6 +61,7 @@ module ActiveStorage
 
   mattr_accessor :routes_prefix, default: "/rails/active_storage"
   mattr_accessor :draw_routes, default: true
+  mattr_accessor :resolve_model_to_route, default: :rails_storage_redirect
 
   mattr_accessor :replace_on_assign_to_many, default: false
   mattr_accessor :track_variants, default: false

activestorage/lib/active_storage/engine.rb

@@ -77,6 +77,7 @@ class Engine < Rails::Engine # :nodoc:
         ActiveStorage.paths             = app.config.active_storage.paths || {}
         ActiveStorage.routes_prefix     = app.config.active_storage.routes_prefix || "/rails/active_storage"
         ActiveStorage.draw_routes       = app.config.active_storage.draw_routes != false
+        ActiveStorage.resolve_model_to_route = app.config.active_storage.resolve_model_to_route || :rails_storage_redirect
 
         ActiveStorage.variable_content_types = app.config.active_storage.variable_content_types || []
         ActiveStorage.content_types_to_serve_as_binary = app.config.active_storage.content_types_to_serve_as_binary || []

activestorage/test/controllers/blobs_controller_test.rb

@@ -19,4 +19,11 @@ class ActiveStorage::BlobsControllerTest < ActionDispatch::IntegrationTest
     assert_redirected_to(/racecar\.jpg/)
     assert_equal "max-age=300, private", @response.headers["Cache-Control"]
   end
+
+  test "proxying responds with long max-age" do
+    get rails_storage_proxy_url(@blob)
+
+    assert_response(:success)
+    assert_equal "max-age=31556952, public", @response.headers["Cache-Control"]
+  end
 end

activestorage/test/controllers/representations_controller_test.rb

@@ -31,6 +31,12 @@ class ActiveStorage::RepresentationsControllerWithVariantsTest < ActionDispatch:
 
     assert_response :not_found
   end
+
+  test "proxying variant" do
+    get rails_storage_proxy_url(@blob.variant(resize: "100x100"))
+
+    assert_response(:success)
+  end
 end
 
 class ActiveStorage::RepresentationsControllerWithPreviewsTest < ActionDispatch::IntegrationTest
@@ -54,6 +60,12 @@ class ActiveStorage::RepresentationsControllerWithPreviewsTest < ActionDispatch:
     assert_equal 100, image.height
   end
 
+  test "proxying preview" do
+    get rails_storage_proxy_url(@blob.preview(resize: "100x100"))
+
+    assert_response(:success)
+  end
+
   test "showing preview with invalid signed blob ID" do
     get rails_blob_representation_url(
       filename: @blob.filename,

guides/source/configuring.md

@@ -952,6 +952,16 @@ text/javascript image/svg+xml application/postscript application/x-shockwave-fla
 
 * `config.active_storage.draw_routes` can be used to toggle Active Storage route generation. The default is `true`.
 
+* `config.active_storage.resolve_model_to_route` can be used to globally change how Active Storage files are delivered.
+
+  ```ruby
+  config.active_storage.resolve_name = :rails_storage_proxy
+  ```
+
+  The default is `:rails_storage_redirect`.
+    * `:rails_storage_redirect` - Redirect files to temporary service URL.
+    * `:rails_storage_proxy` - Proxy assets through rails.
+
 ### Results of `config.load_defaults`
 
 `config.load_defaults` sets new defaults up to and including the version passed. Such that passing, say, '6.0' also gets the new defaults from every version before it.

railties/test/application/configuration_test.rb

@@ -2562,12 +2562,14 @@ class MyLogger < ::Logger
 
       output = rails("routes", "-g", "active_storage")
       assert_equal <<~MESSAGE, output
-                           Prefix Verb URI Pattern                                                               Controller#Action
-               rails_service_blob GET  /files/blobs/:signed_id/*filename(.:format)                               active_storage/blobs#show
-        rails_blob_representation GET  /files/representations/:signed_blob_id/:variation_key/*filename(.:format) active_storage/representations#show
-               rails_disk_service GET  /files/disk/:encoded_key/*filename(.:format)                              active_storage/disk#show
-        update_rails_disk_service PUT  /files/disk/:encoded_token(.:format)                                      active_storage/disk#update
-             rails_direct_uploads POST /files/direct_uploads(.:format)                                           active_storage/direct_uploads#create
+                               Prefix Verb URI Pattern                                                                        Controller#Action
+                   rails_service_blob GET  /files/blobs/redirect/:signed_id/*filename(.:format)                               active_storage/blobs/redirection#show
+             rails_service_blob_proxy GET  /files/blobs/proxy/:signed_id/*filename(.:format)                                  active_storage/blobs/proxy#show
+            rails_blob_representation GET  /files/representations/redirect/:signed_blob_id/:variation_key/*filename(.:format) active_storage/representations/redirection#show
+      rails_blob_representation_proxy GET  /files/representations/proxy/:signed_blob_id/:variation_key/*filename(.:format)    active_storage/representations/proxy#show
+                   rails_disk_service GET  /files/disk/:encoded_key/*filename(.:format)                                       active_storage/disk#show
+            update_rails_disk_service PUT  /files/disk/:encoded_token(.:format)                                               active_storage/disk#update
+                 rails_direct_uploads POST /files/direct_uploads(.:format)                                                    active_storage/direct_uploads#create
       MESSAGE
     end