[BUG] Anonymous can't see images in Fedora that use Image Styles.

[rosiel]

Drupal's built-in image styles are very useful for on-demand resizing images to the size you want them to display on the page. However, when we store images in Fedora, then Drupal tries to make its image style "derivatives" in Fedora. If the user viewing the page is anonymous then Drupal can't create its resized images and no images show up.

The simplest solution so far has been to display images at original size. For the Islandora Demo Objects, this means resizing the collection thumbnails down to a reasonable display size.

A better solution was proposed by @adam-vessey on Slack (more than once):

https://islandora.slack.com/archives/CM5PPAV28/p1707233262017769?thread_ts=1707232512.928749&cid=CM5PPAV28

… could look at reworking image styles to explicitly write to other schemes (as in, to write the derived image style images under a different scheme instead of the same). I could look at pulling this out into something more redistributable if there’s interest there. Alternatively, if the Fedora adapter indeed identified itself as not being writable, it appears that it would happen automatically? [emphasis added]

He further elaborated...

Looks like Flysystem indicates its (global) writability in https://git.drupalcode.org/project/flysystem/-/blob/2.0.x/src/FlysystemBridge.php?ref_type=heads#L20-22
… so would possibly want to get into dynamically changing what’s returned there as a result of checking the current user, or something of the like? Might be able to get away with decorating the service that flysystem ends up defining (https://git.drupalcode.org/project/flysystem/-/blob/2.0.x/src/FlysystemServiceProvider.php?ref_type=heads#L33), adding whatever appropriate check in an implementation which otherwise proxies all other calls through to the original FlysystemBridge class?

What steps does it take to reproduce the issue?

• When does this issue occur?
  Viewing the front page of the sandbox, or any other page where anonymous views an image appears that is resized from its original size, where the image lives in Fedora.

[ajstanley]

When testing this you'll need a fresh install. Anonymous viewers can already see the thumbnail images if anyone with fedoraAdmin in their roles has been there first.

[alxp]

There looks like there's a need for potentially a separate stream wrapper for image derivatives in Drupal core.

Apparently S3FS does a lot of acrobatics to avoid this issue by having PHP generate the image until it gets into the remote file system and then it is served from there.

Related Drupal.org issue:

https://www.drupal.org/project/drupal/issues/3354207#content

There's well-founded concerns about potential bandwidth waste if the same image is triggered to be generated on multiple edge servers.

The above issue has good discussion on the problem, but was closed as a duplicate of:

https://www.drupal.org/project/drupal/issues/2670404

This is an actively-developed feature currently against Drupal 11.x branch to add public-cache:// and private-cache:// stream wrappers for derivative files.

[rosiel]

Though the PR was merged, there are enough good ideas in here for better solving the problem that I propose leaving this ticket open as a potential improvement.