Serve ActiveStorage attachments via the proxy endpoint (#9422)

Partner/advert logos are rendered with `image_tag advert.light_logo`, which
resolves to ActiveStorage's blob *redirect* endpoint. That endpoint 302s to a
presigned S3 URL, and Rails serves the redirect as `Cache-Control: max-age=...,
private` (`expires_in ActiveStorage.service_urls_expire_in`, no `public: true`),
capped at the signature's lifetime. Cloudflare never caches a `private`
response, so the two advert logos were hitting origin ~7k times each per 12h.

Switching `resolve_model_to_route` to `:rails_storage_proxy` gives a permanent
URL served by `ActiveStorage::Blobs::ProxyController`, which sets
`public, max-age=<forever>` and disables the session, so there's no `Set-Cookie`
to bypass the edge either. Cloudflare fetches each blob once per PoP.


Claude-Session: https://claude.ai/code/session_01JLa7RVZtKEECSsYczu458W

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: iHiD

config/application.rb

@@ -33,10 +33,18 @@ class Application < Rails::Application
     # Allow SVGs to render from active storage
     config.active_storage.content_types_to_serve_as_binary -= ['image/svg+xml']
 
-    # Public assets (partner logos, avatars) are served via ActiveStorage's
-    # blob redirect endpoint, which is hit on every page load. Extending the
-    # signed URL expiry lets browsers/CDNs cache the redirect for longer,
-    # cutting repeat hits to that endpoint.
+    # Public assets (partner logos, avatars) are hit on every page load, so
+    # they need to be cacheable at the edge. The default blob *redirect*
+    # endpoint can never be: it 302s to a presigned S3 URL, so Rails marks the
+    # redirect `private` and caps its max-age at the signature's lifetime.
+    #
+    # Proxying instead means the URL is permanent and the response is served
+    # with `public, max-age=<forever>` (ActiveStorage::Blobs::ProxyController),
+    # so Cloudflare fetches each blob once and never asks again.
+    config.active_storage.resolve_model_to_route = :rails_storage_proxy
+
+    # Still relevant for anything that asks a blob for its service URL directly
+    # (direct downloads, the admin UI) rather than going through a route.
     config.active_storage.service_urls_expire_in = 1.day
 
     Rails.autoloaders.main.ignore(Rails.root.join('app', 'css'))

test/integration/active_storage_caching_test.rb

@@ -0,0 +1,33 @@
+require 'test_helper'
+
+class ActiveStorageCachingTest < ActionDispatch::IntegrationTest
+  test "attachments route to the proxy endpoint, not the redirect endpoint" do
+    partner = create :partner
+    attach_logo(partner)
+
+    url = Rails.application.routes.url_helpers.url_for(partner.light_logo)
+
+    assert_includes url, "/rails/active_storage/blobs/proxy/"
+  end
+
+  test "proxied attachments are publicly cacheable at the edge" do
+    partner = create :partner
+    attach_logo(partner)
+
+    get Rails.application.routes.url_helpers.url_for(partner.light_logo)
+
+    assert_response :success
+    assert_includes response.headers["Cache-Control"], "public"
+    refute_includes response.headers["Cache-Control"].to_s, "private"
+    assert_nil response.headers["Set-Cookie"]
+  end
+
+  private
+  def attach_logo(partner)
+    partner.light_logo.attach(
+      io: File.open(Rails.root.join("test", "fixtures", "test.jpg")),
+      filename: "test.jpg",
+      content_type: "image/jpeg"
+    )
+  end
+end