<?php
/**
 * Dedicated non-public transient review storage.
 *
 * @package CommentMate
 */

declare(strict_types=1);

namespace CommentMate;

defined('ABSPATH') || exit;

final class Private_Storage {
	private const DIRECTORY_PREFIX = 'commentmate-private-';
	private const MARKER = '.commentmate-storage';
	private const ROOTS_OPTION = 'commentmate_private_storage_roots';
	private const INSTALL_ID_OPTION = 'commentmate_private_storage_install_id';

	/**
	 * Returns an absolute non-webroot location. A site owner may define
	 * COMMENTMATE_PRIVATE_STORAGE_DIR in wp-config.php to select a durable parent
	 * location. CommentMate always creates and owns only its install-namespaced
	 * child, never the configured parent itself.
	 * The automatic paths are used only after ensure_directory() confirms that
	 * they cannot be served from the WordPress web root.
	 */
	public static function path(): string {
		$directory = self::directory_name();
		if ('' === $directory) {
			return '';
		}
		$configured = defined('COMMENTMATE_PRIVATE_STORAGE_DIR') ? constant('COMMENTMATE_PRIVATE_STORAGE_DIR') : '';
		if (is_string($configured) && '' !== trim($configured)) {
			$candidate = untrailingslashit(trim($configured)) . DIRECTORY_SEPARATOR . $directory;
			return self::candidate_is_outside_web_roots($candidate) && self::root_change_is_safe($candidate) ? $candidate : '';
		}

		// A conventional WordPress install has ABSPATH as its document root, so
		// this parent sibling is normally durable and outside public files. Do not
		// make that inference during CLI/cron contexts that cannot identify the
		// actual document root: a subdirectory WordPress install could otherwise
		// create encrypted files in its public parent.
		$parent = dirname(untrailingslashit(self::wordpress_root()));
		$candidate = $parent . DIRECTORY_SEPARATOR . $directory;
		if (self::automatic_parent_is_safe($candidate) && self::root_change_is_safe($candidate)) {
			return $candidate;
		}

		// Preserve a previously registered temporary location during an upgrade.
		// New installations must use durable private storage: system cleanup must
		// never silently remove their only copy of unsaved review attachments.
		$tmp = function_exists('sys_get_temp_dir') ? sys_get_temp_dir() : '';
		if (is_string($tmp) && '' !== trim($tmp)) {
			$candidate = untrailingslashit($tmp) . DIRECTORY_SEPARATOR . $directory;
			$registered = realpath($candidate);
			return is_string($registered) && in_array($registered, (array) get_option(self::ROOTS_OPTION, array()), true) && self::candidate_is_outside_web_roots($candidate) && self::root_change_is_safe($candidate) ? $candidate : '';
		}

		return '';
	}

	/**
	 * Creates and verifies a private storage root. Failing closed is intentional:
	 * encrypted blobs and plaintext export archives must never fall back to a
	 * publicly reachable WordPress directory merely because a host lacks Apache
	 * or IIS rule support.
	 */
	public static function ensure_directory(): bool {
		$directory = self::path();
		if (!self::candidate_is_outside_web_roots($directory) || is_link($directory)) {
			return false;
		}
		if (!is_dir($directory) && !wp_mkdir_p($directory)) {
			return false;
		}
		if (!is_dir($directory) || is_link($directory)) {
			return false;
		}

		$real = realpath($directory);
		if (false === $real || !self::candidate_is_outside_web_roots($real)) {
			return false;
		}
		@chmod($real, 0700); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_chmod -- exact private storage directory.
		$permissions = @fileperms($real); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged -- fail closed below.
		return false !== $permissions && 0 === ($permissions & 0077)
			&& self::ensure_marker($real)
			&& self::remember_directory($real);
	}

	/**
	 * Default cap is deliberately conservative and can be surfaced through an
	 * owner-only setting constrained to 25–250 MB.
	 */
	public static function byte_limit(): int {
		$megabytes = (int) get_option('commentmate_storage_limit_mb', 100);
		$megabytes = min(250, max(25, $megabytes));

		return $megabytes * 1024 * 1024;
	}

	private static function candidate_is_outside_web_roots(string $path): bool {
		$path = untrailingslashit(trim($path));
		if ('' === $path || !self::is_absolute_path($path)) {
			return false;
		}
		$parent = realpath(dirname($path));
		if (false === $parent || !is_dir($parent)) {
			return false;
		}
		$candidate = $parent . DIRECTORY_SEPARATOR . basename($path);
		foreach (self::public_roots() as $root) {
			if (DIRECTORY_SEPARATOR === $root || $candidate === $root || str_starts_with($candidate, $root . DIRECTORY_SEPARATOR)) {
				return false;
			}
		}

		return true;
	}

	/**
	 * Automatic durable storage is permitted only when this request can identify
	 * the actual document root. In WP-CLI and similar contexts, ABSPATH can be a
	 * subdirectory of an unknown public root; fall back to the temporary path or
	 * require COMMENTMATE_PRIVATE_STORAGE_DIR rather than guessing.
	 */
	private static function automatic_parent_is_safe(string $path): bool {
		return null !== self::document_root() && self::candidate_is_outside_web_roots($path);
	}

	/**
	 * The marker makes the exact child directory recognisable during uninstall.
	 * It prevents a configured parent directory, or another application's child,
	 * from being recursively treated as plugin-owned data.
	 */
	private static function ensure_marker(string $directory): bool {
		$marker = $directory . DIRECTORY_SEPARATOR . self::MARKER;
		if (is_link($marker)) {
			return false;
		}
		if (file_exists($marker)) {
			return is_file($marker) && hash_equals(self::marker_content(), (string) file_get_contents($marker));
		}
		$written = @file_put_contents($marker, self::marker_content(), LOCK_EX); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_file_put_contents -- controlled private marker.
		if (false === $written || !is_file($marker) || is_link($marker)) {
			return false;
		}
		@chmod($marker, 0600); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_chmod -- exact private marker.

		return hash_equals(self::marker_content(), (string) file_get_contents($marker));
	}

	/**
	 * A storage parent is configuration, not a migration mechanism. Private
	 * attachment keys deliberately do not encode an absolute path, so silently
	 * accepting a new parent while an old verified root still contains data
	 * would make exports and cleanup operate on the wrong files. Refuse that
	 * change until the owner restores the old configuration and completes the
	 * export/cleanup workflow. Empty historical roots are harmless and may be
	 * retained for uninstall discovery.
	 */
	private static function root_change_is_safe(string $candidate): bool {
		$candidate = untrailingslashit(trim($candidate));
		if ('' === $candidate || !self::is_absolute_path($candidate)) {
			return false;
		}
		$parent = realpath(dirname($candidate));
		if (false === $parent || !is_dir($parent)) {
			return false;
		}
		$current = $parent . DIRECTORY_SEPARATOR . basename($candidate);
		$roots = get_option(self::ROOTS_OPTION, array());
		if (!is_array($roots)) {
			return true;
		}

		foreach ($roots as $root) {
			if (!is_string($root)) {
				continue;
			}
			$root = untrailingslashit(trim($root));
			if ('' === $root || basename($root) !== self::directory_name() || !is_dir($root)) {
				continue;
			}
			if (is_link($root)) {
				return false;
			}
			$real = realpath($root);
			if (false === $real || $real === $current) {
				continue;
			}
			$marker = $real . DIRECTORY_SEPARATOR . self::MARKER;
			if (is_link($marker) || !is_file($marker) || !hash_equals(self::marker_content(), (string) file_get_contents($marker))) {
				continue;
			}
			if (self::directory_contains_payload($real)) {
				return false;
			}
		}

		return true;
	}

	private static function directory_contains_payload(string $directory): bool {
		try {
			$iterator = new \RecursiveIteratorIterator(
				new \RecursiveDirectoryIterator($directory, \FilesystemIterator::SKIP_DOTS),
				\RecursiveIteratorIterator::LEAVES_ONLY
			);
			foreach ($iterator as $item) {
				/** @var \SplFileInfo $item */
				if (self::MARKER !== $item->getFilename()) {
					return true;
				}
			}
		} catch (\Throwable) {
			// A directory we cannot inspect may contain private data. Failing closed
			// is safer than treating a configuration change as a migration.
			return true;
		}

		return false;
	}

	/**
	 * Records only a verified, plugin-created private root. If a site changes
	 * its configured parent later, uninstall can discover and marker-validate
	 * the old root instead of silently leaving encrypted review data behind.
	 */
	private static function remember_directory(string $directory): bool {
		$existing = get_option(self::ROOTS_OPTION, array());
		$roots = array();
		foreach (is_array($existing) ? $existing : array() as $root) {
			if (!is_string($root)) {
				continue;
			}
			$root = untrailingslashit(trim($root));
			if ('' !== $root && strlen($root) <= 4096 && self::is_absolute_path($root) && basename($root) === self::directory_name()) {
				$roots[$root] = true;
			}
		}
		$roots[$directory] = true;
		$stored = array_keys($roots);
		sort($stored, SORT_STRING);

		if (!add_option(self::ROOTS_OPTION, $stored, '', false)) {
			update_option(self::ROOTS_OPTION, $stored, false);
		}
		$verified = get_option(self::ROOTS_OPTION, array());
		return is_array($verified) && in_array($directory, $verified, true);
	}

	private static function directory_name(): string {
		return self::DIRECTORY_PREFIX . self::install_id();
	}

	private static function marker_content(): string {
		$install_id = self::install_id();
		return '' === $install_id ? '' : "CommentMate private storage\ninstall=" . $install_id . "\n";
	}

	private static function install_id(): string {
		$stored = get_option(self::INSTALL_ID_OPTION, '');
		if (is_string($stored) && preg_match('/\A[a-f0-9]{24}\z/', $stored)) {
			return $stored;
		}
		try {
			$generated = bin2hex(random_bytes(12));
		} catch (\Throwable) {
			return '';
		}
		if (!add_option(self::INSTALL_ID_OPTION, $generated, '', false)) {
			$stored = get_option(self::INSTALL_ID_OPTION, '');
			if (is_string($stored) && preg_match('/\A[a-f0-9]{24}\z/', $stored)) {
				return $stored;
			}
			// Do not overwrite a malformed/concurrent value with an untracked path.
			// Failing closed here is safer than allowing two installations to share a
			// deterministic storage directory or marker.
			return '';
		}

		return $generated;
	}

	private static function is_absolute_path(string $path): bool {
		return DIRECTORY_SEPARATOR === substr($path, 0, 1)
			|| (bool) preg_match('/\A[A-Za-z]:[\\\\\/]/', $path);
	}

	/**
	 * @return list<string>
	 */
	public static function public_roots(): array {
		$filesystem = self::local_filesystem();
		$uploads = wp_get_upload_dir();
		$candidates = array(
			$filesystem->abspath(),
			$filesystem->wp_content_dir(),
			$filesystem->wp_plugins_dir(),
			$uploads['basedir'] ?? '',
			self::document_root() ?? '',
		);
		$roots = array();
		foreach ($candidates as $candidate) {
			if (!is_string($candidate) || '' === trim($candidate)) {
				continue;
			}
			$real = realpath($candidate);
			if (false !== $real && is_dir($real)) {
				$roots[] = untrailingslashit($real) ?: DIRECTORY_SEPARATOR;
			}
		}

		return array_values(array_unique($roots));
	}

	/** Keep the existing install-root sibling default without guessing from URLs. */
	public static function wordpress_root(): string {
		$root = self::local_filesystem()->abspath();
		return is_string($root) ? $root : '';
	}

	/**
	 * Use core's directory helpers on the local filesystem explicitly. A global
	 * FTP/SSH transport may describe remote paths; never use those to authorize
	 * local storage or uninstall. Loading these classes makes no connection,
	 * asks for no credentials and does not replace the global filesystem object.
	 */
	private static function local_filesystem(): \WP_Filesystem_Direct {
		if (!class_exists('WP_Filesystem_Base')) {
			require_once ABSPATH . 'wp-admin/includes/class-wp-filesystem-base.php';
		}
		if (!class_exists('WP_Filesystem_Direct')) {
			require_once ABSPATH . 'wp-admin/includes/class-wp-filesystem-direct.php';
		}
		return new \WP_Filesystem_Direct(null);
	}

	private static function document_root(): ?string {
		if (!isset($_SERVER['DOCUMENT_ROOT']) || !is_string($_SERVER['DOCUMENT_ROOT']) || '' === trim(wp_unslash($_SERVER['DOCUMENT_ROOT']))) { // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Literal filesystem path is string-checked, unslashed and resolved with realpath before containment checks; text sanitization can change the protected path.
			return null;
		}
		$candidate = realpath((string) wp_unslash($_SERVER['DOCUMENT_ROOT'])); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Literal filesystem path is string-checked, unslashed and resolved with realpath before containment checks; text sanitization can change the protected path.

		return false !== $candidate && is_dir($candidate) ? untrailingslashit($candidate) : null;
	}
}