Geo: secondary fails to download LFS files from s3

Geo replication: Secondary fails to download LFS files
from the primary's S3 without proxy_download

ee/changelogs/unreleased/201995-geo-replication-secondary-fails-to-download-lfs-files-from-s3.yml

+---
+title: 'Geo: Fix Secondary fails to download LFS files from s3'
+merge_request: 37008
+author:
+type: fixed

ee/lib/gitlab/geo/replication/base_transfer.rb

@@ -188,7 +188,11 @@ module Gitlab
 
           begin
             # Make the request
-            response = ::HTTP.timeout(DOWNLOAD_TIMEOUT.dup).follow.get(url, headers: req_headers)
+            response = ::HTTP.timeout(DOWNLOAD_TIMEOUT.dup).get(url, headers: req_headers)
+
+            if response.status.redirect?
+              response = ::HTTP.timeout(DOWNLOAD_TIMEOUT.dup).get(response['Location'])
+            end
 
             # Check for failures
             unless response.status.success?

ee/spec/lib/gitlab/geo/replication/base_transfer_spec.rb

@@ -23,7 +23,7 @@ RSpec.describe Gitlab::Geo::Replication::BaseTransfer do
     end
   end
 
-  describe 'timeout' do
+  describe 'HTTP timeout when there are primary connection problems' do
     subject do
       described_class.new(file_type: :avatar, file_id: 1, filename: Tempfile.new,
                           expected_checksum: nil, request_data: nil, resource: nil)
@@ -94,4 +94,38 @@ RSpec.describe Gitlab::Geo::Replication::BaseTransfer do
       expect(subject.can_transfer?).to be_truthy
     end
   end
+
+  describe '#stream_from_primary_to_object_storage' do
+    let_it_be(:lfs_object) { create(:lfs_object, :with_file, :correct_oid) }
+    let(:auth_headers) { { 'Authorization' => 'Bearer 12345' } }
+    let(:download_link) { 'http://download.link' }
+
+    subject do
+      Gitlab::Geo::Replication::LfsTransfer.new(lfs_object)
+    end
+
+    before do
+      stub_current_geo_node(secondary_node)
+    end
+
+    it 'downloads file successfully' do
+      allow_next_instance_of(Gitlab::Geo::TransferRequest) do |request|
+        allow(request).to receive(:headers).and_return(auth_headers)
+      end
+
+      stub_request(:get, primary_node.geo_transfers_url(:lfs, lfs_object.id.to_s))
+        .to_return(status: 302, headers: { 'Location' => download_link })
+
+      # This stub acts as assertion that auth headers are not present,
+      # otherwise we would get 500 error
+      stub_request(:get, download_link)
+        .with(headers: auth_headers)
+        .to_return(status: 500)
+
+      stub_request(:get, download_link)
+        .to_return(status: 200)
+
+      expect(subject.stream_from_primary_to_object_storage.success).to be_truthy
+    end
+  end
 end