# Permanent storage URLs must not bypass a resource's later discard boundary.
module HistoryStorageAccess
  extend ActiveSupport::Concern

  included do
    include RequestAccess
    prepend_before_action :authorise_history_storage!
  end

  private

  def authorise_history_storage!
    response.headers['Cache-Control'] = 'private, no-store'
    return unless request.get? || request.head?

    reject_banned_ip_address!
    return if performed?

    authenticate_user
    reject_banned_user!
    return if performed?

    signed = params[:signed_blob_id] || params[:signed_id]
    blob = if signed
             ActiveStorage::Blob.find_signed(signed)
           elsif params[:encoded_key]
             payload = ActiveStorage.verifier.verified(params[:encoded_key], purpose: :blob_key)
             key = payload && (payload[:key] || payload['key'])
             if key
               original = key.start_with?('variants/') ? key.split('/')[1] : key
               ActiveStorage::Blob.find_by(key: original)
             end
           end
    return head :not_found unless blob

    allowed = HistoryAccess.set(user: current_user) { HistoryAccess.blob_visible?(blob) }
    head :not_found unless allowed
  rescue ActiveSupport::MessageVerifier::InvalidSignature
    head :not_found
  end

  # Override the engine's public-forever caching before a streaming response commits.
  def http_cache_forever(**_options)
    response.headers['Cache-Control'] = 'private, no-store'
    yield
  end

  def expires_in(*arguments, **options)
    super
    response.headers['Cache-Control'] = 'private, no-store'
  end
end