How do you protect files in RoR

You might be looking for this part of S3:

http://docs.amazonwebservices.com/AmazonS3/2006-03-01/index.html?S3_QSAuth.html

That will let you generate a URL that has an expiration date for a particular file; you may also be able to use Amazon FPS to handle the payment part of the system.