Setup active storage defaults

[hasarindaKI]

1. Installs active_storage migrations
2. Disables direct upload routes

unless Rails.env.development? || Rails.env.test?
  put "/rails/active_storage/disk/:encoded_token", to: redirect("/404")
end
post "/rails/active_storage/direct_uploads", to: redirect("/404")

3. Configures service for active_storage in environments

Rails.application.configure do
  config.active_storage.service = :s3
end

4. Adds aws-sdk-s3 gem for AWS S3
5. Adds image_processing for variant support
6. Configures AWS S3 with defaults

s3:
  service: S3
  region: ap-southeast-2
  access_key_id: <%= ENV["RAILS_ASSETS_ACCESS_KEY"] %>
  secret_access_key: <%= ENV["RAILS_ASSETS_SECRET_KEY"] %>
  bucket: <%= ENV.fetch("RAILS_ASSETS_BUCKET_ID", "katalyst-[APP_NAME]-staging-assets") %>

7. Adds host to default_url_options

development: "https://localhost",
staging:     "https://#{@app_name}-staging.katalyst.com.au",
production:  "https://#{@app_name}-production.katalyst.com.au",
test:        "https://example.com",

[AlanCornthwaiteKatalyst]

Im not to familiar with the active storage config so i might lean on @sfnelson for that side, but i do have a comment on adding the gem from the template

[sfnelson]

@hasarindaKI I'd like to review this with you in person

[sfnelson]

This isn't a good long-term strategy. It will require manual changes for non-Katalyst projects.

I think that the staging and production environments should be getting this from their environment (ecs env). Please add a related PR to make that happen if it's not there already.

I think that the default_url_options setting should be in the environment files rather than here.

[sfnelson]

should be template

[sfnelson]

I don't think this PR is mergeable but we need to have a strategy for new apps. Leaving comments to document next steps.

[sfnelson]

Needs a strategy for connecting this app to the terraform configured bucket name. Could be manual.

[sfnelson]

local? in Rails 7

[sfnelson]

This should result in a routing error, not a redirect. That way the default rules apply.

Ideally we want to undefined the routes that ActiveStorage engine adds, but I don't know if that's possible. This is a hack approach that needs more thought imo.

Also needs documentation, as this is appropriate for Fringe and Koi but not generalisable to all situations (e.g. what if you have authenticated users and you want to allow them to upload files?

Finally, is this a realistic concern? Have the Rails team discussed why it's acceptable to allow arbitrary users to write to this endpoint? Is there any sort of nonce or CSFR protection that we're unaware of protecting these endpoints for DOS?

[sobakasu]

There is an open rails issue about this:
rails/rails#34961

A blog post with suggested workaround:
https://givenis.me/securing-rails-active-storage-direct-uploads

This blog post uses authenticate_user, but we could instead cause a 404 by raising a routing error in a before action?

[sobakasu]

Another related open rails issue:
rails/rails#52505

[hasarindaKI]

• There is no way to remove a specific route; but you can remove all active storage routes by setting the draw_routes config option to false or you could overwrite the default active storage route in your routes file
• There is CSRF protection in DirectUploads but it is available on all the pages as a meta content