I am aware of the ActiveStorage `url_for(user.avatar)` method. Example:

```
<%= link_to "Download this file", url_for(@user.avatar) %>

```

This is great, but it appears like it has no authorization built around it. Anyone with this link can download this document.

In the past when I used [paperclip](https://rubygems.org/gems/paperclip), I had a link that went to a custom controller action. That custom controller action did authorization, and if all is good, then I used `send_file` to send the file to the user. It was something like this:

```
def deliver_the_file
  authorize :my_authorization
  send_file @user.avatar.path
end

```

How can I do this with active\_storage? All I have gotten to work is the `url_for` implementation which does not authorize the user at all. 

I am looking specifically at the [Download Files](http://edgeguides.rubyonrails.org/active_storage_overview.html#downloading-files) part of the Rails Guides on ActiveStorage.

Relevant example code:

```
# model 
class Book < ApplicationRecord
  has_one_attached :book_cover
end

class BooksController < ApplicationController
 ... 

  # custom action to authorize and then deliver the active_storage file
  def deliver_it
    # ... assume authorization already happened
    send_file rails_blob_path(@book.book_cover, disposition: "attachment")
  end
end

```

This errors out and says: 

> 
> Cannot read file 
> 
> 
> 

I also attempted this:

```
def deliver_it
  # ... assume authorization already happened
  send_file @book.book_cover.download
end

```

This returned the error:

> 
> string contains null byte
> 
> 
> 

And I also attempted this:

```
def deliver_it
  @book.book_cover.download
end

```

This returned the error:

> 
> BooksController#deliver\_it is missing a template for this request
> 
> 
> 

I have also tried this:

```
def deliver_it
  send_file @book.book_cover.blob
end

```

This errors out and says:

> 
> no implicit conversion of ActiveStorage::Blob into String
> 
> 
>