<?php
namespace AntivirusAI\V1;

/** Read-only private-directory validation used by safe removal after Pro is deleted. */
final class EarlyStorage {
	public static function directory(): string {
		if ( ! defined( 'ANTIVIRUS_AI_EARLY_DIR' ) || ! defined( 'ANTIVIRUS_AI_PRIVATE_STORAGE_VERIFIED' ) || true !== ANTIVIRUS_AI_PRIVATE_STORAGE_VERIFIED ) { throw new \RuntimeException( 'Ask your host to configure ANTIVIRUS_AI_EARLY_DIR as verified private storage outside all served directories.' ); }
		$dir = rtrim( (string) ANTIVIRUS_AI_EARLY_DIR, '/' );
		PathGuard::noLinks( $dir );
		// phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_is_writable -- Read-only validation of retained Pro storage before removal; native ownership and permissions must be checked without redirecting the host path.
		if ( ! is_dir( $dir ) || realpath( $dir ) !== $dir || 0700 !== ( fileperms( $dir ) & 0777 ) || ! is_writable( $dir ) || ! function_exists( 'posix_geteuid' ) || fileowner( $dir ) !== posix_geteuid() || ! function_exists( 'fsync' ) ) { throw new \RuntimeException( 'Early filtering needs canonical, owner-only private storage, POSIX ownership and durable writes.' ); }
		$roots = InstallationPaths::roots();
		if ( isset( $_SERVER['DOCUMENT_ROOT'] ) ) {
			// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized,WordPress.Security.ValidatedSanitizedInput.MissingUnslash -- This is only the size/unchanged-byte guard around the immediately sanitized document-root exclusion boundary; changed metadata is refused, never accepted as a storage path.
			if ( ! is_string( $_SERVER['DOCUMENT_ROOT'] ) || strlen( $_SERVER['DOCUMENT_ROOT'] ) > 4096 ) { throw new \RuntimeException( 'Invalid server document root metadata.' ); }
			$documentRoot = sanitize_text_field( wp_unslash( $_SERVER['DOCUMENT_ROOT'] ) );
			// An exclusion boundary must never be silently rewritten or dropped.
			// phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- This is only the size/unchanged-byte guard around the immediately sanitized document-root exclusion boundary; changed metadata is refused, never accepted as a storage path.
			if ( $documentRoot !== wp_unslash( $_SERVER['DOCUMENT_ROOT'] ) || str_contains( $documentRoot, "\0" ) ) { throw new \RuntimeException( 'Invalid server document root metadata.' ); }
			if ( '' !== $documentRoot ) {
				if ( '/' !== $documentRoot[0] || ! is_dir( $documentRoot ) || false === realpath( $documentRoot ) ) { throw new \RuntimeException( 'Server document root must identify an existing absolute directory.' ); }
				$roots[] = rtrim( $documentRoot, '/' ) ?: '/';
			}
		}
		if ( function_exists( 'wp_upload_dir' ) ) { $uploads = wp_upload_dir( null, false ); if ( ! empty( $uploads['basedir'] ) ) { $roots[] = $uploads['basedir']; } }
		foreach ( $roots as $root ) {
			foreach ( array_unique( array( rtrim( (string) $root, '/' ), realpath( (string) $root ) ?: rtrim( (string) $root, '/' ) ) ) as $candidate ) {
				if ( PathGuard::beneath( $dir, $candidate ) || PathGuard::beneath( $candidate, $dir ) ) { throw new \RuntimeException( 'Early-filter storage must be separate from every served and WordPress directory.' ); }
			}
		}
		for ( $path = $dir; '/' !== $path; $path = dirname( $path ) ) { if ( 0 !== ( fileperms( $path ) & 022 ) ) { throw new \RuntimeException( 'Private storage ancestors must not be writable by other accounts.' ); } }
		return $dir;
	}
}