Displaying paperclip attachments stored in a non-public folder - ruby-on-rails

Question

My conundrum is how to embed in an html page an image whose source is not available to the Internet at large.
Let's say I have, in a Rails/Paperclip setup, the following model:
class Figure < ActiveRecord::Base
has_attached_file :image
...
end
class User < ActiveRecord::Base
... (authentication code here)
has_many :figures
end
In the controller:
class FiguresController < ActionController::Base
def show
# users must be authenticated, and they can only access their own figures
#figure = current_user.figures.find(params[:id])
end
end
In the view:
<%= image_tag(#figure.image.url) %>
The problem with this, of course, is that with the default Paperclip settings images are stored in the public directory, and anyone with the link can access the stored image bypassing authentication/authorization.
Now, if we tell Paperclip to store attachments at a private locations:
class Figure < ActiveRecord::Base
has_attached_file :image, path: ":rails_root/private/:class/:attachment/:id_partition/:style/:filename",
url: ":rails_root/private/:class/:attachment/:id_partition/:style/:filename"
...
end
Then it's easy to control who the image gets served to:
class FiguresController < ActionController::Base
def show
#figure = current_user.figures.find(params[:id])
send_file #figure.image.path, type: 'image/jpeg', disposition: 'inline'
end
end
The effect of this action is to display the image in its own browser window/tab.
On the other hand, image_tag(#figure.image.url) will understandably produce a routing error, because the source cannot be accessed!
Thus, is there a way to display the image via image_tag in a regular HTML page, while still restricting access to it?

Answer 1

You need to change the :url option passed to has_attached_file so that it matches the route for your figures controller.
For example, if the correct url is /figures/123 for the figure with is 123 then the url you pass to has_attached_file should be
'/figures/:id'
Or even
'/:class/:id'
Since the :class segment will be interpolated to the pluralized lowercase underscore form of the name. You could also append the extension or the filename if you wanted (but you would then have to change the controller code slightly to extract the id)