<?php
/**
 * Ghostscript, where the host has it (1.9.0, D-500 gap 15, D-504): the program PDF_Copy runs to write a smaller copy of
 * a PDF and to count, read and draw its pages. Found as a fixed binary outside the uploads folder that no one but its
 * owner may change (/usr/bin/gs or /usr/local/bin/gs, or the path in the constant AFSD_IM_GHOSTSCRIPT), and run as
 * Image Manager runs jpegtran: without a shell, with -dSAFER, a time limit and an output limit.
 *
 * @package AffStackDevImageManager
 */

namespace AffStackDev\ImageManager;

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/** The host's Ghostscript program. */
final class Ghostscript {
	/** The most standard output and error text read from one run (1 MB). */
	const MAX_LOG = 1048576;

	/**
	 * The program found, '' for none.
	 *
	 * @var string|null
	 */
	private static ?string $binary = null;

	/**
	 * The program's path, or '' when the host has no Ghostscript Image Manager may run.
	 *
	 * @return string
	 */
	public static function path(): string {
		if ( null !== self::$binary ) {
			return self::$binary;
		}
		self::$binary = '';
		if ( ! function_exists( 'proc_open' ) || DIRECTORY_SEPARATOR !== '/' ) {
			return '';
		}
		$paths   = defined( 'AFSD_IM_GHOSTSCRIPT' ) && is_string( AFSD_IM_GHOSTSCRIPT ) ? array( AFSD_IM_GHOSTSCRIPT ) : array( '/usr/bin/gs', '/usr/local/bin/gs' );
		$uploads = realpath( wp_get_upload_dir()['basedir'] );
		foreach ( $paths as $p ) {
			if ( ! str_starts_with( $p, '/' ) || preg_match( '/[\x00-\x1f]/', $p ) || is_link( $p ) || realpath( $p ) !== $p || ! is_file( $p ) || ! is_readable( $p ) || ! is_executable( $p ) || ( fileperms( $p ) & 0022 ) ) {
				continue;
			}
			if ( $uploads && str_starts_with( $p, $uploads . '/' ) ) {
				continue;
			}
			$parent = dirname( $p );
			$safe   = true;
			while ( '/' !== $parent && '.' !== $parent ) {
				if ( is_link( $parent ) || ( fileperms( $parent ) & 0022 ) ) {
					$safe = false;
					break;
				}
				$parent = dirname( $parent );
			}
			if ( $safe ) {
				self::$binary = $p;
				break;
			}
		}
		return self::$binary;
	}

	/**
	 * A short fingerprint of the program, for the capability cache.
	 *
	 * @return string
	 */
	public static function version(): string {
		$p = self::path();
		return $p ? 'gs-sha256:' . substr( hash_file( 'sha256', $p ), 0, 16 ) : 'unavailable';
	}

	/**
	 * Run Ghostscript once.
	 *
	 * @param string[] $args    Its arguments, each one whole (no shell reads them).
	 * @param string   $dir     The working folder (Image Manager's private folder); Ghostscript's own temporary files go
	 *                          there too.
	 * @param int      $seconds The time limit.
	 * @param string   $watch   A file whose size is limited while Ghostscript writes it ('' for none).
	 * @param int      $limit   That file's limit in bytes.
	 * @return array{exit:int,out:string,err:string}
	 * @throws \RuntimeException With ghostscript_unavailable, ghostscript_output_limit or ghostscript_timeout.
	 */
	public static function run( array $args, string $dir, int $seconds, string $watch = '', int $limit = 0 ): array {
		$binary = self::path();
		if ( ! $binary ) {
			throw new \RuntimeException( 'ghostscript_unavailable' );
		}
		$pipes = array();
		// phpcs:ignore Generic.PHP.ForbiddenFunctions.Found -- Fixed argv array and bypass_shell invoke only a validated non-writable local Ghostscript binary with -dSAFER; output, logs and runtime are bounded.
		$proc = proc_open(
			array_merge( array( $binary ), array_map( 'strval', $args ) ),
			array(
				0 => array( 'pipe', 'r' ),
				1 => array( 'pipe', 'w' ),
				2 => array( 'pipe', 'w' ),
			),
			$pipes,
			$dir,
			array(
				'LC_ALL' => 'C',
				'PATH'   => '/usr/bin:/bin',
				'TMPDIR' => $dir,
			),
			array( 'bypass_shell' => true )
		);
		if ( ! is_resource( $proc ) ) {
			throw new \RuntimeException( 'ghostscript_unavailable' );
		}
		// phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fclose -- Ghostscript reads no standard input; its pipe is closed at once.
		fclose( $pipes[0] );
		unset( $pipes[0] );
		$out    = '';
		$err    = '';
		$until  = microtime( true ) + $seconds;
		$status = null;
		foreach ( $pipes as $pipe ) {
			stream_set_blocking( $pipe, false );
		}
		try {
			do {
				$out .= (string) stream_get_contents( $pipes[1] );
				$err .= (string) stream_get_contents( $pipes[2] );
				if ( strlen( $out ) + strlen( $err ) > self::MAX_LOG ) {
					throw new \RuntimeException( 'ghostscript_output_limit' );
				}
				if ( '' !== $watch ) {
					clearstatcache( true, $watch );
					if ( is_file( $watch ) && filesize( $watch ) > $limit ) {
						throw new \RuntimeException( 'ghostscript_output_limit' );
					}
				}
				$status = proc_get_status( $proc );
				if ( ! $status['running'] ) {
					break;
				}
				if ( microtime( true ) >= $until ) {
					throw new \RuntimeException( 'ghostscript_timeout' );
				}
				usleep( 20000 );
			} while ( true );
			$out .= (string) stream_get_contents( $pipes[1] );
			$err .= (string) stream_get_contents( $pipes[2] );
		} finally {
			$st = proc_get_status( $proc );
			if ( $st['running'] ) {
				proc_terminate( $proc, 9 );
			}
			foreach ( $pipes as $pipe ) {
				if ( is_resource( $pipe ) ) {
					// phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fclose -- Ghostscript's own output pipes, closed after each bounded run.
					fclose( $pipe );
				}
			}
			proc_close( $proc );
		}
		return array(
			'exit' => (int) ( $status['exitcode'] ?? -1 ),
			'out'  => $out,
			'err'  => $err,
		);
	}
}