Four file jobs, and the policy that does each

class User < ApplicationRecord
  has_hutch :avatar, policy: "avatars"
end

# users.avatar_file_id => "file_3p7wn4c2"
image_tag user.avatar_transform_url("avatar")

// One string column: users.avatar_file_id
class User extends Model
{
    use HasHutch;

    protected function hutches(): array
    {
        return ['avatar' => 'avatars'];
    }
}

// $user->avatar_file_id => "file_3p7wn4c2"
$user->avatarTransformUrl('avatar');

const file = await hutch.upload(bytes, { policy: "avatars", filename: "me.png" })
await db.users.update(user.id, { avatarFileId: file.id }) // "file_3p7wn4c2"

// Public images carry their transform URLs on the file
file.transforms.avatar

# The stable URL: always the avatar crop, wherever the bytes live
curl -L https://filehutch.com/f/file_3p7wn4c2/avatar -o avatar.png

# Private stays private: this URL is dead in an hour.
def download
  authorize! :read, @invoice

  redirect_to @invoice.file.signed_url(
    expires_in: 1.hour,
    disposition: "attachment"
  ), allow_other_host: true
end

// Private stays private: this URL is dead in an hour.
public function download(Invoice $invoice)
{
    $this->authorize('view', $invoice);

    return redirect()->away(
        $invoice->fileSignedUrl(expiresIn: 3600, disposition: 'attachment')
    );
}

// Private stays private: this URL is dead in an hour.
app.get("/invoices/:id/download", async (req, res) => {
  const invoice = await authorize(req.user, "read", req.params.id)

  const { url } = await hutch.signedUrl(invoice.fileId, {
    expiresIn: 3600,
    disposition: "attachment"
  })
  res.redirect(url)
})

# Private stays private: this URL is dead in an hour.
curl -X POST https://filehutch.com/api/v1/files/file_8f2kq1x9/signed_url \
  -H "Authorization: Bearer $FILE_HUTCH_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "expires_in": 3600, "disposition": "attachment" }'