<?php

namespace ChargeForms\Includes;

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

/**
 * Shared upload validation for ChargeForms's import entry points — JSON forms
 * import and CSV entries import, both in admin/class-tools-page.php and
 * admin/class-entries-page.php. Previously each handler only checked
 * $_FILES[...]['tmp_name']/['error'], which passes as long as the HTTP
 * upload itself succeeded: an oversized file, or a renamed .php/.exe
 * pretending to be .csv/.json by extension alone, would both get through
 * to json_decode()/fgetcsv(). Roadmap issue #35.
 */
class Import_Validator {

	/**
	 * @param array    $file       A $_FILES[...] entry (name, tmp_name, error, size).
	 * @param string[] $extensions Allowed lowercase extensions, no dot (e.g. [ 'csv' ]).
	 * @param string[] $mime_types Allowed MIME types the sniffed content must match one of.
	 * @param int      $max_bytes  Maximum allowed file size, in bytes.
	 * @return string Empty string if the upload is valid, otherwise a user-facing error message.
	 */
	public static function validate( array $file, array $extensions, array $mime_types, $max_bytes ) {
		if ( empty( $file['tmp_name'] ) || UPLOAD_ERR_OK !== ( $file['error'] ?? UPLOAD_ERR_NO_FILE ) ) {
			return __( 'No file was uploaded, or the upload failed.', 'chargeforms' );
		}

		// A freshly-written temporary upload can still have a cached zero-byte
		// stat result on some PHP versions (notably 8.2). Always invalidate the
		// path-specific cache before enforcing the size and empty-file checks.
		clearstatcache( true, $file['tmp_name'] );
		$size = @filesize( $file['tmp_name'] ); // phpcs:ignore WordPress.PHP.NoSilencedErrors -- tmp_name may not exist yet in a test/CLI context; false is handled below.
		if ( false !== $size && 0 === $size ) {
			$contents = @file_get_contents( $file['tmp_name'] ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents -- temporary upload inspection.
			if ( false !== $contents ) {
				$size = strlen( $contents );
			}
		}
		if ( false === $size || 0 === $size ) {
			return __( 'The uploaded file is empty.', 'chargeforms' );
		}
		if ( $size > $max_bytes ) {
			return sprintf(
				/* translators: %s: the maximum allowed file size, e.g. "10 MB" */
				__( 'The uploaded file is too large. Maximum size: %s.', 'chargeforms' ),
				self::format_bytes( $max_bytes )
			);
		}

		$ext = strtolower( pathinfo( (string) ( $file['name'] ?? '' ), PATHINFO_EXTENSION ) );
		if ( ! in_array( $ext, $extensions, true ) ) {
			return sprintf(
				/* translators: %s: comma-separated list of allowed file extensions */
				__( 'That file type is not allowed. Expected: %s.', 'chargeforms' ),
				implode( ', ', $extensions )
			);
		}
		// CSV is a text interchange format; libmagic's label varies by PHP and
		// platform. Validate the bytes directly and avoid rejecting valid CSV
		// solely because its sniffed MIME is not one of the browser labels.
		if ( 'csv' === $ext ) {
			$csv_contents = @file_get_contents( $file['tmp_name'] ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents -- temporary upload inspection.
			if ( false === $csv_contents || 1 === preg_match( '/[^\x09\x0A\x0D\x20-\x7E]/', $csv_contents ) ) {
				return __( "The file's contents do not match its file type.", 'chargeforms' );
			}
			return '';
		}

		// Belt-and-braces against a file merely renamed to look like the right
		// extension — sniff its actual content type where the fileinfo
		// extension is available (it's a core PHP extension, but not
		// guaranteed present in every environment).
		if ( function_exists( 'finfo_open' ) ) {
			$finfo = finfo_open( FILEINFO_MIME_TYPE );
			$mime  = $finfo ? finfo_file( $finfo, $file['tmp_name'] ) : false;
			if ( $finfo ) {
				finfo_close( $finfo );
			}
			// Some PHP/libmagic combinations classify a small, extension-named
			// CSV made only of ASCII text as an unexpected MIME type.
			// Keep the content check strict: only printable text files with a
			// CSV extension get this compatibility fallback; binary payloads and
			// JSON imports still fail closed.
			$is_printable_csv = 'csv' === $ext && self::is_printable_text( $file['tmp_name'] );
			if ( $mime && ! in_array( $mime, $mime_types, true ) && ! $is_printable_csv ) {
				return __( "The file's contents do not match its file type.", 'chargeforms' );
			}
		}

		return '';
	}

	private static function format_bytes( $bytes ) {
		if ( function_exists( 'size_format' ) ) {
			return size_format( $bytes );
		}
		return round( $bytes / 1048576, 1 ) . ' MB';
	}

	private static function is_printable_text( $path ) {
		$contents = @file_get_contents( $path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents -- bounded temporary upload inspection.
		return false !== $contents && '' !== $contents && false === preg_match( '/[^\x09\x0A\x0D\x20-\x7E]/', $contents );
	}
}