add require file links auth toggle

app/controllers/api/active_storage_blobs_proxy_controller.rb

@@ -20,6 +20,8 @@ module Api
 
       blob = ActiveStorage::Blob.find_by!(uuid: blob_uuid)
 
+      authorization_check!(blob) if exp.blank?
+
       if request.headers['Range'].present?
         send_blob_byte_range_data blob, request.headers['Range']
       else
@@ -31,5 +33,20 @@ module Api
         end
       end
     end
+
+    private
+
+    def authorization_check!(blob)
+      is_authorized =
+        blob.attachments.all? do |a|
+          a.name.in?(%w[logo preview_images]) ||
+            (current_user && a.record.account.id == current_user.account_id) ||
+            !a.record.account.account_configs.find_or_initialize_by(key: AccountConfig::DOWNLOAD_LINKS_AUTH_KEY).value
+        end
+
+      return if is_authorized
+
+      raise CanCan::AccessDenied
+    end
   end
 end

app/controllers/api/api_base_controller.rb

@@ -50,16 +50,18 @@ module Api
     end
 
     def authenticate_user!
-      @current_user ||=
-        if request.headers['X-Auth-Token'].present?
-          sha256 = Digest::SHA256.hexdigest(request.headers['X-Auth-Token'])
-
-          User.joins(:access_token).active.find_by(access_token: { sha256: })
-        end
-
       render json: { error: 'Not authenticated' }, status: :unauthorized unless current_user
     end
 
+    def current_user
+      super || @current_user ||=
+                 if request.headers['X-Auth-Token'].present?
+                   sha256 = Digest::SHA256.hexdigest(request.headers['X-Auth-Token'])
+
+                   User.joins(:access_token).active.find_by(access_token: { sha256: })
+                 end
+    end
+
     def current_account
       current_user&.account
     end