activestorage/app/controllers/active_storage/blobs/redirect_controller.rb
Take a signed permanent reference for a blob and turn it into an expiring service URL for download.
WARNING: All Active Storage controllers are publicly accessible by default. The generated URLs are hard to guess, but permanent by design. If your files require a higher level of protection consider implementing Authenticated Controllers.