Why Does ActiveStorage Blob.find_signed! Fail with InvalidSignature Using attachable_sgid in Rails 8?

I'm building a new Rails 8 application in local development and using ActiveStorage with R2 for image uploads. I'm integrating EditorJS for editing the Post model. When I upload an image via direct upload, I receive a blob JSON that includes an attachable_sgid. However, when I try to attach the new image to a Post using the attachable_sgid, I get the error:

RUBYCopied
ActiveSupport::MessageVerifier::InvalidSignature (mismatched digest):

The upload returns a blob object as follows:

JSONCopied
{
  "id": 2915,
  "key": "f3a2ai59s2dq8n4g3kem1cu00cvx",
  "filename": "Screenshot 2025-01-21 at 11.22.58.png",
  "content_type": "image/png",
  "metadata": {},
  "service_name": "cloudflare",
  "byte_size": 203125,
  "checksum": "jY7rPW1IfB9JtrVgGSof3Q==",
  "created_at": "2025-01-23T19:57:27.603Z",
  "attachable_sgid": "eyJfcmFpbHMiOnsiZGF0YSI6ImdpZDovL3JlYWxseWxvbDIvQWN0aXZlU3RvcmFnZTo6QmxvYi8yOTE1P2V4cGlyZXNfaW4iLCJwdXIiOiJhdHRhY2hhYmxlIn19--4d3aea4a5464a89aa2201d5eee1bfc32ae91b2b0",
  "signed_id": "eyJfcmFpbHMiOnsiZGF0YSI6MjkxNSwicHVyIjoiYmxvYl9pZCJ9fQ==--ca0d28362e47c499c8a6258407cd41e77828e865"
}

I request the image using both its:

• Redirect URL: http://localhost:3000/rails/active_storage/blobs/redirect/eyJ...

• Source URL: https://reallylol-images-development.f163765cc814ca4c341357f282e5d166.r2.cloudflarestorage.com/f3a2ai...

The code that attaches the image to the Post (via an update or create action) is:

RUBYCopied
def attach_uploaded_images(post, params)
      # Parse the JSON to get the image blocks
      blocks = JSON.parse(params["rich_body"])["blocks"]
      image_blocks = blocks.select { |block| block["type"] == "image" }

      image_blocks.each do |image_block|
        sgid = image_block["data"]["file"]["attachable_sgid"]
        puts "SGID: #{sgid}"

        # Attempt to find the blob using the SGID
        blob = ActiveStorage::Blob.find_signed!(sgid)

        # Attach the blob to the post
        post.images.attach(blob)
      end
end

The logs show a discrepancy between the SGID from the blob JSON and the one from the log, for example:

BASHCopied
  TRANSACTION (0.1ms)  COMMIT TRANSACTION /*action='update',application='Reallylol2',controller='posts'*/
  ↳ app/controllers/posts_controller.rb:64:in `block in PostsController#update'
SGID: eyJfcmFpbHMiOnsiZGF0YSI6ImdpZDovL3JlYWxseWxvbDIvQWN0aXZlU3RvcmFnZTo6QmxvYi8yOTE0P2V4cGlyZXNfaW4iLCJwdXIiOiJhdHRhY2hhYmxlIn19--8792310f1c388e6fce9707991bbc911a432a6553
Completed 500 Internal Server Error in 36ms (ActiveRecord: 0.8ms (3 queries, 0 cached) | GC: 0.0ms)
ActiveSupport::MessageVerifier::InvalidSignature (mismatched digest):

For completeness, here is the upload method used on the frontend:

JAVASCRIPTCopied
uploadImageByFile(file) {
    const url = "/rails/active_storage/direct_uploads"
    const upload = new DirectUpload(file, url);
    
    return new Promise(function(resolve, reject) {
      upload.create((error, blob) => {
        if (error) {
          reject(error);
        } else {
          console.log(blob)
          fetch(`/blocks/get_image_url?attachable_sgid=${blob.attachable_sgid}`)
          .then((response) => response.json())
          .then((imageUrlResp) => {
            console.log(imageUrlResp);
            resolve({
              success: 1,
              file: {
                url: imageUrlResp.url,
                attachable_sgid: blob.attachable_sgid,
              },
            });
          });
        }
      });
    });
  }

I’m unsure what variables are used in creating the SGID or where the mismatch is coming from. Any insights on troubleshooting the SGID generation and signature verification in ActiveStorage would be appreciated.