<?php
/**
 * Safe filesystem helpers limited to the uploads directory.
 *
 * @package FlipWebP
 */

namespace FlipWebP;

defined( 'ABSPATH' ) || exit;

/**
 * Path checks and local file operations.
 */
class Filesystem {

	/**
	 * Real uploads directory, or an empty string when it cannot be resolved.
	 *
	 * @return string
	 */
	public static function uploads_dir() {
		$uploads = wp_upload_dir();
		if ( ! empty( $uploads['error'] ) || empty( $uploads['basedir'] ) ) {
			return '';
		}

		$real = realpath( $uploads['basedir'] );
		if ( false === $real ) {
			return '';
		}

		return self::normalize( $real );
	}

	/**
	 * Normalize a filesystem path for prefix comparisons.
	 *
	 * @param string $path Absolute or relative path.
	 * @return string
	 */
	public static function normalize( $path ) {
		$path = wp_normalize_path( (string) $path );
		if ( 'WIN' === strtoupper( substr( PHP_OS, 0, 3 ) ) ) {
			$path = strtolower( $path );
		}

		return $path;
	}

	/**
	 * Whether a real file or directory is inside the uploads directory.
	 *
	 * @param string $path Existing path.
	 * @return bool
	 */
	public static function is_inside_uploads( $path ) {
		$root = self::uploads_dir();
		$real = realpath( $path );
		if ( '' === $root || false === $real ) {
			return false;
		}

		return self::is_inside( self::normalize( $real ), $root );
	}

	/**
	 * Whether a path that may not exist yet would stay inside a root.
	 *
	 * @param string $path Destination path.
	 * @param string $root Existing root directory.
	 * @return bool
	 */
	public static function is_safe_destination( $path, $root ) {
		$path = wp_normalize_path( (string) $path );
		$name = wp_basename( $path );
		if ( ! self::is_safe_basename( $name ) ) {
			return false;
		}

		$parent = realpath( dirname( $path ) );
		$root   = realpath( $root );
		if ( false === $parent || false === $root ) {
			return false;
		}

		return self::is_inside( self::normalize( $parent ), self::normalize( $root ) );
	}

	/**
	 * Whether $path is the same as $root or a descendant of it.
	 *
	 * Both values must already be normalized.
	 *
	 * @param string $path Normalized path without a forced trailing slash.
	 * @param string $root Normalized root without a forced trailing slash.
	 * @return bool
	 */
	public static function is_inside( $path, $root ) {
		$path = rtrim( (string) $path, '/' );
		$root = rtrim( (string) $root, '/' );
		if ( '' === $path || '' === $root ) {
			return false;
		}

		return $path === $root || 0 === strpos( $path, $root . '/' );
	}

	/**
	 * Whether a single path segment is safe to use as a file or directory name.
	 *
	 * @param string $name Basename.
	 * @return bool
	 */
	public static function is_safe_basename( $name ) {
		if ( ! is_string( $name ) || '' === $name || '.' === $name || '..' === $name ) {
			return false;
		}

		if ( wp_basename( $name ) !== $name ) {
			return false;
		}

		return 1 !== preg_match( '/[\\\\\\/\\0\\r\\n]/', $name );
	}

	/**
	 * Whether a relative uploads path contains only safe segments.
	 *
	 * @param string $relative Path relative to the uploads directory.
	 * @return bool
	 */
	public static function is_safe_relative( $relative ) {
		$relative = ltrim( wp_normalize_path( (string) $relative ), '/' );
		if ( '' === $relative || 1 === preg_match( '#(^|/)\\.\\.(/|$)#', $relative ) ) {
			return false;
		}

		$segments = explode( '/', $relative );
		foreach ( $segments as $segment ) {
			if ( ! self::is_safe_basename( $segment ) ) {
				return false;
			}
		}

		return true;
	}

	/**
	 * Absolute path for a relative uploads path, when it stays inside uploads.
	 *
	 * @param string $relative Relative path.
	 * @return string Empty when the path is unsafe or the parent is missing.
	 */
	public static function absolute_from_relative( $relative ) {
		if ( ! self::is_safe_relative( $relative ) ) {
			return '';
		}

		$root = self::uploads_dir();
		if ( '' === $root ) {
			return '';
		}

		$path = wp_normalize_path( $root . '/' . ltrim( wp_normalize_path( $relative ), '/' ) );
		if ( ! self::is_safe_destination( $path, $root ) && ! self::is_inside_uploads( $path ) ) {
			return '';
		}

		return $path;
	}

	/**
	 * Relative uploads path for an absolute file, or an empty string.
	 *
	 * @param string $path Absolute file path.
	 * @return string
	 */
	public static function relative_from_absolute( $path ) {
		$root = self::uploads_dir();
		$real = realpath( $path );
		if ( '' === $root || false === $real || ! self::is_inside_uploads( $real ) ) {
			return '';
		}

		$real     = self::normalize( $real );
		$relative = ltrim( substr( $real, strlen( rtrim( $root, '/' ) ) ), '/' );

		return self::is_safe_relative( $relative ) ? $relative : '';
	}

	/**
	 * Sum the byte size of existing files.
	 *
	 * @param string[] $files Absolute file paths.
	 * @return int
	 */
	public static function total_size( $files ) {
		$total = 0;
		$seen  = array();

		foreach ( $files as $file ) {
			if ( ! is_string( $file ) || '' === $file || ! is_file( $file ) || is_link( $file ) ) {
				continue;
			}
			if ( ! self::is_inside_uploads( $file ) ) {
				continue;
			}

			$real = realpath( $file );
			if ( false === $real ) {
				continue;
			}

			$key = self::normalize( $real );
			if ( isset( $seen[ $key ] ) ) {
				continue;
			}
			$seen[ $key ] = true;

			$size = filesize( $real );
			if ( false !== $size ) {
				$total += (int) $size;
			}
		}

		return $total;
	}

	/**
	 * Copy a file into uploads, refusing destinations outside that directory.
	 *
	 * @param string $source Existing file.
	 * @param string $dest   Destination path.
	 * @return bool
	 */
	public static function copy_file( $source, $dest ) {
		$root = self::uploads_dir();
		if ( '' === $root || ! self::is_inside_uploads( $source ) || ! is_file( $source ) || is_link( $source ) ) {
			return false;
		}

		wp_mkdir_p( dirname( $dest ) );

		if ( ! self::is_safe_destination( $dest, $root ) ) {
			return false;
		}

		// phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_copy -- Copying within uploads; WP_Filesystem is not available during every request.
		$copied = copy( $source, $dest );

		return $copied && is_file( $dest );
	}

	/**
	 * Delete files that live in uploads and are not in the exception list.
	 *
	 * @param string[] $files  Absolute paths.
	 * @param string[] $except Normalized real paths that must be kept.
	 * @return void
	 */
	public static function delete_files( $files, $except = array() ) {
		$keep = array();
		foreach ( $except as $path ) {
			if ( is_string( $path ) && '' !== $path ) {
				$keep[ self::normalize( $path ) ] = true;
			}
		}

		foreach ( $files as $file ) {
			if ( ! is_string( $file ) || '' === $file || ! is_file( $file ) || is_link( $file ) ) {
				continue;
			}
			if ( ! self::is_inside_uploads( $file ) ) {
				continue;
			}

			$real = realpath( $file );
			if ( false === $real ) {
				continue;
			}

			if ( isset( $keep[ self::normalize( $real ) ] ) ) {
				continue;
			}

			wp_delete_file( $real );
		}
	}

	/**
	 * Create a directory inside uploads and block casual web access.
	 *
	 * @param string $relative Relative directory under uploads.
	 * @return string Absolute directory, or empty on failure.
	 */
	public static function ensure_private_dir( $relative ) {
		if ( ! self::is_safe_relative( $relative ) ) {
			return '';
		}

		$root = self::uploads_dir();
		if ( '' === $root ) {
			return '';
		}

		$dir = wp_normalize_path( $root . '/' . ltrim( wp_normalize_path( $relative ), '/' ) );
		if ( ! wp_mkdir_p( $dir ) ) {
			return '';
		}

		$real = realpath( $dir );
		if ( false === $real || ! self::is_inside_uploads( $real ) ) {
			return '';
		}

		self::protect_directory( wp_normalize_path( $real ) );

		return wp_normalize_path( $real );
	}

	/**
	 * Add index and server deny files. Failure here does not expose new data by itself.
	 *
	 * @param string $dir Absolute directory inside uploads.
	 * @return void
	 */
	public static function protect_directory( $dir ) {
		if ( ! self::is_inside_uploads( $dir ) || ! is_dir( $dir ) ) {
			return;
		}

		$legacy = wp_normalize_path( $dir . '/index.php' );
		if ( is_file( $legacy ) ) {
			// phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents -- Local file written earlier by this plugin, already constrained to uploads.
			$contents = file_get_contents( $legacy );
			if ( is_string( $contents ) && strlen( $contents ) < 80 && false !== strpos( $contents, 'Silence is golden' ) ) {
				wp_delete_file( $legacy );
			}
		}

		$index = wp_normalize_path( $dir . '/index.html' );
		if ( ! is_file( $index ) ) {
			// phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_file_put_contents -- Local deny index inside uploads. PHP files are not written here.
			file_put_contents( $index, "<!-- Silence is golden. -->\n" );
		}

		$htaccess = wp_normalize_path( $dir . '/.htaccess' );
		if ( ! is_file( $htaccess ) ) {
			$rules = "<IfModule mod_authz_core.c>\nRequire all denied\n</IfModule>\n<IfModule !mod_authz_core.c>\nDeny from all\n</IfModule>\n";
			// phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_file_put_contents
			file_put_contents( $htaccess, $rules );
		}

		$web_config = wp_normalize_path( $dir . '/web.config' );
		if ( ! is_file( $web_config ) ) {
			$xml = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<configuration>\n  <system.webServer>\n    <authorization>\n      <remove users=\"*\" roles=\"\" verbs=\"\" />\n      <add accessType=\"Deny\" users=\"*\" />\n    </authorization>\n  </system.webServer>\n</configuration>\n";
			// phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_file_put_contents
			file_put_contents( $web_config, $xml );
		}
	}

	/**
	 * Delete a directory tree that is strictly inside the given root.
	 *
	 * @param string $dir  Absolute directory to remove.
	 * @param string $root Absolute ancestor that must contain $dir.
	 * @return void
	 */
	public static function delete_tree( $dir, $root ) {
		$dir_real  = realpath( $dir );
		$root_real = realpath( $root );
		if ( false === $dir_real || false === $root_real ) {
			return;
		}

		$dir_real  = self::normalize( $dir_real );
		$root_real = self::normalize( $root_real );
		if ( $dir_real === $root_real || ! self::is_inside( $dir_real, $root_real ) ) {
			return;
		}

		self::delete_tree_normalized( $dir_real, trailingslashit( $root_real ) );
	}

	/**
	 * @param string $dir      Normalized real directory.
	 * @param string $root_slash Normalized real root with a trailing slash.
	 * @return void
	 */
	private static function delete_tree_normalized( $dir, $root_slash ) {
		if ( ! self::is_inside( $dir, rtrim( $root_slash, '/' ) ) ) {
			return;
		}

		$items = scandir( $dir );
		if ( ! is_array( $items ) ) {
			return;
		}

		foreach ( $items as $item ) {
			if ( '.' === $item || '..' === $item ) {
				continue;
			}

			$path = $dir . '/' . $item;
			if ( is_link( $path ) ) {
				continue;
			}

			if ( is_dir( $path ) ) {
				self::delete_tree_normalized( self::normalize( $path ), $root_slash );
				continue;
			}

			if ( is_file( $path ) ) {
				wp_delete_file( $path );
			}
		}

		// phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_rmdir -- Directory was constrained to a plugin folder inside uploads.
		rmdir( $dir );
	}
}