ActiveStorage ProxyController crashes in API-only apps

[chvp]

Steps to reproduce

• Create an API-only rails app with activestorage enabled and using the proxy mode.
• Upload an attachment.
• Try to download it.
• See that this fails because it transitively calls this, and flash is not available in a default API-only rails app.

# frozen_string_literal: true

require "bundler/inline"

gemfile(true) do
  source "https://rubygems.org"

  git_source(:github) { |repo| "https://github.com/#{repo}.git" }

  gem "rails", github: "rails/rails", branch: "main"
  gem "sqlite3"
end

require "active_record/railtie"
require "active_storage/engine"
require "tmpdir"

class TestApp < Rails::Application

  # Important configuration
  config.api_only = true
  config.active_storage.resolve_model_to_route = :rails_storage_proxy
  
  config.root = __dir__
  config.hosts << "example.org"
  config.eager_load = false
  secrets.secret_key_base = "secret_key_base"


  config.logger = Logger.new($stdout)
  Rails.logger  = config.logger

  config.active_storage.service = :local
  config.active_storage.service_configurations = {
    local: {
      root: Dir.tmpdir,
      service: "Disk"
    }
  }
end

db_dir = Dir.mktmpdir("test", Dir.tmpdir)
ENV["DATABASE_URL"] = "sqlite3:#{db_dir}/db.sqlite3"

Rails.application.initialize!

require ActiveStorage::Engine.root.join("db/migrate/20170806125915_create_active_storage_tables.rb").to_s

ActiveRecord::Schema.define do
  CreateActiveStorageTables.new.change

  create_table :users, force: true
end

class User < ActiveRecord::Base
  has_one_attached :profile
end

require "minitest/autorun"

class BugTest < Minitest::Test
  include Rails.application.routes.url_helpers
  include Rack::Test::Methods

  def test_upload_and_fetch
    user = User.create!(
      profile: {
        content_type: "text/plain",
        filename: "dummy.txt",
        io: ::StringIO.new("dummy"),
      }
    )

    response = get rails_blob_url(user.profile, only_path: true)
    assert response.ok?
  end

  private

  def app
    Rails.application
  end
end

Expected behavior

The resource is requested without issues.

Actual behavior

It crashes here. Relevant part of stacktrace:

rails (0c97d1db023d) actionpack/lib/action_controller/metal/flash.rb:10:in `flash'
rails (0c97d1db023d) actionpack/lib/action_controller/metal/etag_with_flash.rb:15:in `block (2 levels) in <module:EtagWithFlash>'
rails (0c97d1db023d) actionpack/lib/action_controller/metal/conditional_get.rb:322:in `instance_exec'
rails (0c97d1db023d) actionpack/lib/action_controller/metal/conditional_get.rb:322:in `block in combine_etags'
rails (0c97d1db023d) actionpack/lib/action_controller/metal/conditional_get.rb:322:in `map'
rails (0c97d1db023d) actionpack/lib/action_controller/metal/conditional_get.rb:322:in `combine_etags'
rails (0c97d1db023d) actionpack/lib/action_controller/metal/conditional_get.rb:126:in `fresh_when'
rails (0c97d1db023d) actionpack/lib/action_controller/metal/conditional_get.rb:250:in `stale?'
rails (0c97d1db023d) actionpack/lib/action_controller/metal/conditional_get.rb:309:in `http_cache_forever'
rails (0c97d1db023d) activestorage/app/controllers/active_storage/blobs/proxy_controller.rb:17:in `show'

System configuration

Rails version: 7.0 / edge

Ruby version: 3.1

[skipkayhil]

Previous discussion #44181

[chvp]

Ah, I didn't search in the closed issues, that's my bad.

[skipkayhil]

Ah, I didn't search in the closed issues, that's my bad.

No problem at all! Commenting on closed issues tends to not get as much response, so opening a new one was the correct thing to do in my opinion

[jerbob92]

Any idea when this will end up in a release? We just hit this bug in an API application.