How do I add permissions to ActiveStorage? - rails-activestorage

Question

I'm migrating to ActiveStorage an app that is permissions sensitive. I need to make sure files are only accessed by people with permissions, and that those permissions only last for a specified period of time.
With Paperclip, that was as easy as defining a route with a pundit authorization call:
def thumbnail
authorize #record
redirect_to #record.thumbnail.expiring_url(300)
end
Any call to /record/thumbnail would be authenticated by devise, authorized by pundit, and then redirected to S3 with an expiring url. It's a process that worked.
Moving to ActiveStorage, my initial thought was I'd use service_url, but it only works if I'm using S3 -- it doesn't work in testing, it doesn't work if I'm in local development with a disk service. The actual, 'correct' approach is to use url_for, or in the example above redirect_to url_for #record.thumbnail.
The problem is, url_for appears to issue a permanent url -- the url it generates is always valid, for anyone, without authentication or authorization. More importantly, once someone has that url, I can't revoke it, I can't say it's only good for a week. Once someone has that url, they have access to the file, forever. (Or, presumably, at least until the file is updated).
I don't think it's a huge security flaw, but it's definitely a step backward from what was achievable using Paperclip. Am I missing an important detail, or is this really all that's doable with ActiveStorage?

Answer 1

The documentation says:
If you need to enforce access protection beyond the security-through-obscurity factor of the signed blob references, you'll need to implement your own authenticated redirection controller.
Which is not particularly helpful. To do this you create your own controller to serve the blobs:
class BlobsController < ApplicationController
include ActiveStorage::SetBlob
before_action :authorize_blob
def show
expires_in ActiveStorage::Blob.service.url_expires_in
redirect_to #blob.service_url(disposition: params[:disposition])
end
private
def authorize_blob
# Your authorization code goes here
end
end
Then you will need to set up your routing:
get '/blobs/:signed_id/*filename' => "blobs#show", as: "service_blob"
direct :blob do |blob, options|
route_for(:service_blob, blob.signed_id, blob.filename, options)
end
resolve("ActiveStorage::Blob") { |blob, options| route_for(:blob, blob, options) }
Finally, you need to disable the insecure default controller so that a knowledgeable user cannot circumvent your authorization.
If you are in Rails 6.1+, you can do this by setting config.active_storage.draw_routes to false in your application.rb. But you will then need to make sure the rest of the ActiveStorage routes are drawn manually and there are quite a few of them. You can view them on Github.
Otherwise, you will need to add extend the controller to redirect to your new one (or just shut it down entirely). You can add the following to an initializer:
module ActiveStorageRedirect
def self.included(controller)
controller.before_action :redirect_to_authenticated
end
private
def redirect_to_authenticated
redirect_to Rails.application.routes.url_helpers.blob_path(#blob)
end
end
ActiveStorage::Blobs::RedirectController.include(ActiveStorageRedirect) # For Rails >= 6.1
ActiveStorage::Blobs::ProxyController.include(ActiveStorageRedirect) # For Rails >= 6.1
# ActiveStorage::BlobsController.include(ActiveStorageRedirect) # For Rails < 6.1