direct uploads ctrl

app/controllers/active_storage/direct_uploads_controller.rb

+# frozen_string_literal: true
+
+# Creates a new blob on the server side in anticipation of a direct-to-service upload from the client side.
+# When the client-side upload is completed, the signed_blob_id can be submitted as part of the form to reference
+# the blob that was created up front.
+class ActiveStorage::DirectUploadsController < ActiveStorage::BaseController
+  include ActiveStorage::CheckAbilities
+
+  def create
+    blob = ActiveStorage::Blob.create_before_direct_upload!(**blob_args)
+    render json: direct_upload_json(blob)
+  end
+
+  private
+    def blob_args
+      params.require(:blob)
+            .permit(:filename, :byte_size, :checksum, :content_type, metadata: {})
+            .to_h
+            .symbolize_keys
+            .merge({ university_id: current_university&.id })
+    end
+
+    def direct_upload_json(blob)
+      blob.as_json(root: false, methods: :signed_id).merge(direct_upload: {
+        url: blob.service_url_for_direct_upload,
+        headers: blob.service_headers_for_direct_upload
+      })
+    end
+end

app/controllers/concerns/active_storage/check_abilities.rb

@@ -4,7 +4,10 @@ module ActiveStorage::CheckAbilities
   private
 
   def check_abilities
-    university = University.with_host(request.host)
-    render(file: Rails.root.join('public/403.html'), formats: [:html], status: 403, layout: false) and return if university.present? && @blob.university_id != university.id
+    render(file: Rails.root.join('public/403.html'), formats: [:html], status: 403, layout: false) and return if current_university.present? && @blob.university_id != current_university.id
+  end
+
+  def current_university
+    @current_university ||= University.with_host(request.host)
   end
 end