<?php
namespace AntivirusAI\V1;

/** Read authentic repository ZIPs without extracting or executing any package code. */
final class RepositoryPackage {
	private const MAX_DOWNLOAD = 33554432;

	/** Public reference archives only; never stage source, credentials or extracted code. */
	private static function staging(): array {
		$uploads = wp_upload_dir( null, false );
		$base = is_array( $uploads ) && is_string( $uploads['basedir'] ?? null ) ? rtrim( wp_normalize_path( $uploads['basedir'] ), '/' ) : '';
		if ( ! empty( $uploads['error'] ) || '' === $base || ! str_starts_with( $base, '/' ) || str_contains( $base, "\0" ) || preg_match( '~(^|/)(?:\.|\.\.)(?:/|$)~', $base ) ) {
			throw new \RuntimeException( 'The configured uploads directory is unavailable for bounded repository references.' );
		}
		// Validate existing ancestors before WordPress creates a missing uploads root.
		$ancestor = $base;
		while ( ! file_exists( $ancestor ) && ! is_link( $ancestor ) && '/' !== $ancestor ) { $ancestor = dirname( $ancestor ); }
		PathGuard::noLinks( $ancestor );
		if ( ! wp_mkdir_p( $base ) ) { throw new \RuntimeException( 'Repository staging could not be created inside uploads.' ); }
		PathGuard::noLinks( $base );
		if ( realpath( $base ) !== $base ) { throw new \RuntimeException( 'Repository staging requires a canonical local uploads directory.' ); }
		$directory = $base;
		foreach ( array( 'shieldlume-security', 'repository' ) as $segment ) {
			$directory .= '/' . $segment;
			if ( is_link( $directory ) || ( file_exists( $directory ) && ! is_dir( $directory ) ) || ! wp_mkdir_p( $directory ) ) {
				throw new \RuntimeException( 'The plugin repository-staging directory is unavailable.' );
			}
			PathGuard::noLinks( $directory );
		}
		$directoryIdentity = @lstat( $directory );
		if ( ! is_array( $directoryIdentity ) ) { throw new \RuntimeException( 'Repository staging could not be verified.' ); }
		$path = $directory . '/reference-' . bin2hex( random_bytes( 16 ) ) . '.zip';
		// phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fopen -- Exclusive native creation binds this public ZIP to a unique inode; filesystem filters must not redirect its staging path.
		$stream = @fopen( $path, 'x+b' );
		if ( ! $stream ) { throw new \RuntimeException( 'Cannot allocate repository package staging inside uploads.' ); }
		$identity = fstat( $stream );
		$cleanup = static function () use ( $path, $identity, $stream ): bool {
			if ( ! is_resource( $stream ) ) { return true; }
			clearstatcache( true, $path );
			$current = @lstat( $path );
			$removed = false === $current;
			if ( $current && $current['ino'] === $identity['ino'] && $current['dev'] === $identity['dev'] && 0100000 === ( $current['mode'] & 0170000 ) && 1 === $current['nlink'] ) {
				// phpcs:ignore WordPress.WP.AlternativeFunctions.unlink_unlink -- Remove only this call's exact exclusively created archive inode; never follow a replacement path or deletion filter.
				$removed = @unlink( $path );
			}
			// phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fclose -- Close the same native staging handle after exact-file cleanup.
			fclose( $stream );
			return $removed;
		};
		// Also clean this exact public temporary file if PHP terminates outside finally.
		register_shutdown_function( $cleanup );
		try {
			// phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_chmod -- Protect the newly created native staging file before the HTTP API writes any archive bytes.
			if ( ! @chmod( $path, 0600 ) ) { throw new \RuntimeException( 'Cannot protect repository package staging.' ); }
			self::checkDirectory( $directory, $directoryIdentity );
			return array( $stream, $path, $directory, $directoryIdentity, $cleanup );
		} catch ( \Throwable $error ) { $cleanup(); throw $error; }
	}

	private static function checkDirectory( string $directory, array $expected ): void {
		PathGuard::noLinks( $directory );
		clearstatcache( true, $directory );
		$current = @lstat( $directory );
		if ( ! $current || realpath( $directory ) !== $directory || $current['ino'] !== $expected['ino'] || $current['dev'] !== $expected['dev'] ) {
			throw new \RuntimeException( 'Repository staging changed during the bounded reference request.' );
		}
	}

	public static function inspect( string $type, string $slug, string $version, callable $inspect ): array {
		if ( ! in_array( $type, array( 'plugin', 'theme' ), true ) || ! preg_match( '/^[a-z0-9][a-z0-9-]{0,99}$/D', $slug ) || ! Vulnerabilities::stableVersion( $version ) ) {
			throw new \RuntimeException( 'Unsupported repository package identity.' );
		}
		if ( ! class_exists( 'ZipArchive' ) ) { throw new \RuntimeException( 'Repository packages require the PHP ZIP extension.' ); }
		$url = 'https://downloads.wordpress.org/' . $type . '/' . rawurlencode( $slug ) . '.' . rawurlencode( $version ) . '.zip';
		list( $stream, $tmp, $directory, $directoryIdentity, $cleanup ) = self::staging();
		try {
			$before = fstat( $stream );
			$response = wp_remote_get( $url, array( 'timeout' => 20, 'redirection' => 0, 'sslverify' => true, 'stream' => true, 'filename' => $tmp, 'limit_response_size' => self::MAX_DOWNLOAD, 'user-agent' => 'Shieldlume Security/0.1' ) );
			self::checkDirectory( $directory, $directoryIdentity );
			clearstatcache( true, $tmp );
			$after = @lstat( $tmp );
			if ( is_wp_error( $response ) || 200 !== wp_remote_retrieve_response_code( $response ) || ! $after || $after['ino'] !== $before['ino'] || $after['dev'] !== $before['dev'] || 1 !== $after['nlink'] || 0100000 !== ( $after['mode'] & 0170000 ) || 0600 !== ( $after['mode'] & 0777 ) || $after['size'] >= self::MAX_DOWNLOAD ) {
				throw new \RuntimeException( 'Official repository package unavailable, unsafe or larger than the download budget.' );
			}
			$zip = new \ZipArchive();
			if ( true !== $zip->open( $tmp, \ZipArchive::RDONLY ) ) { throw new \RuntimeException( 'Invalid official repository package.' ); }
			try {
				$entries = self::entries( $zip, $slug );
				$result = $inspect( $zip, $entries );
				$result['source'] = array( 'provider' => 'WordPress.org', 'url' => $url, 'package_url' => $url, 'package_sha256' => hash_file( 'sha256', $tmp ), 'fetched_at' => gmdate( 'c' ), 'expires_at' => gmdate( 'c', time() + 86400 ), 'transport' => 'HTTPS certificate validation; redirects refused', 'reference_hash' => 'SHA-256 derived from the exact official package over authenticated HTTPS; no independent theme checksum service or safety guarantee.' );
				return $result;
			} finally { $zip->close(); }
		} finally {
			if ( ! $cleanup() ) { throw new \RuntimeException( 'The temporary repository archive could not be safely removed. Ask your host to review the plugin repository-staging directory.' ); }
		}
	}

	public static function entries( \ZipArchive $zip, string $slug ): array {
		if ( $zip->numFiles > 10000 ) { throw new \RuntimeException( 'Repository archive entry budget exceeded.' ); }
		$total = 0; $names = array(); $entries = array(); $deadline = microtime( true ) + 5;
		for ( $i = 0; $i < $zip->numFiles; $i++ ) {
			$entry = $zip->statIndex( $i );
			if ( ! is_array( $entry ) || microtime( true ) > $deadline ) { throw new \RuntimeException( 'Repository archive inspection budget exceeded.' ); }
			$zip->getExternalAttributesIndex( $i, $opsys, $attrs );
			PathGuard::archiveEntry( $entry['name'], $entry['size'], $entry['comp_size'], ( $attrs >> 16 ) & 0xffff, 16777216 );
			if ( ! str_starts_with( $entry['name'], $slug . '/' ) || isset( $names[ rtrim( $entry['name'], '/' ) ] ) || ! empty( $entry['encryption_method'] ) ) { throw new \RuntimeException( 'Repository archive contains unexpected, duplicate or encrypted entries.' ); }
			$names[ rtrim( $entry['name'], '/' ) ] = true;
			$total += $entry['size'];
			if ( $total > 134217728 ) { throw new \RuntimeException( 'Repository archive expansion budget exceeded.' ); }
			if ( str_ends_with( $entry['name'], '/' ) ) { continue; }
			$relative = substr( $entry['name'], strlen( $slug ) + 1 );
			PathGuard::relative( $relative );
			if ( strlen( $relative ) > 512 ) { throw new \RuntimeException( 'Repository archive path exceeds the reference budget.' ); }
			$entries[ $relative ] = $entry;
		}
		return $entries;
	}

	public static function content( \ZipArchive $zip, string $slug, string $path, array $entries, int $limit = 2097152 ): string {
		PathGuard::relative( $path );
		$entry = $entries[ $path ] ?? null;
		if ( ! $entry || $entry['size'] > $limit ) { throw new \RuntimeException( 'Reference file unavailable or too large.' ); }
		$content = $zip->getFromName( $slug . '/' . $path, $limit + 1 );
		if ( ! is_string( $content ) || strlen( $content ) !== $entry['size'] ) { throw new \RuntimeException( 'Reference package read failed.' ); }
		return $content;
	}

	public static function checkHeader( string $content, string $type, string $version, string $name ): void {
		$label = 'theme' === $type ? 'Theme Name' : 'Plugin Name';
		$header = substr( str_replace( "\r", "\n", $content ), 0, 8192 );
		foreach ( array( 'Version' => $version, $label => $name ) as $field => $expected ) {
			$value = preg_match( '/^[ \t\/*#@]*' . preg_quote( $field, '/' ) . ':\s*(.{0,500})$/mi', $header, $match ) ? substr( trim( preg_replace( '/\s*(?:\*\/|\?>).*$/', '', $match[1] ) ), 0, 200 ) : '';
			if ( $expected !== $value ) { throw new \RuntimeException( 'Official package header does not match the owner-confirmed component name and version.' ); }
		}
	}
}