<?php
/**
 * Where packages live on disk.
 *
 * @package Transtrix
 */

namespace Transtrix\Package;

use WP_Error;

defined( 'ABSPATH' ) || exit;

/**
 * Packages are addressed by id, never by a path a client supplies.
 *
 * The directory is guarded twice: an .htaccess deny for Apache and an index.php
 * so a server that ignores .htaccess still cannot list it. Packages routinely
 * contain unpublished content, so a listable folder is a disclosure bug.
 *
 * On nginx, .htaccess does nothing — a package is reachable by URL to anyone
 * who knows its name. That is why the id is 128 bits of randomness rather than
 * a sequence, and why ids are only ever returned to a request that already
 * passed the capability check. A server-level deny rule is the real fix and it
 * cannot be written from inside a plugin; Phase 6's security pass documents it
 * for site owners.
 */
class Package_Store {

	/**
	 * Directory name inside uploads.
	 */
	const DIRNAME = 'transtrix';

	/**
	 * The storage directory, created and guarded on first use.
	 *
	 * @return string|WP_Error Trailing-slashed path.
	 */
	public static function dir() {
		$uploads = wp_upload_dir();

		if ( ! empty( $uploads['error'] ) ) {
			return new WP_Error( 'transtrix_uploads_unavailable', __( 'The uploads folder is not writable. Ask your host to make it writable.', 'transtrix' ) );
		}

		$root = trailingslashit( $uploads['basedir'] ) . self::DIRNAME . '/';
		$dir  = $root . self::store_key() . '/';

		if ( ! wp_mkdir_p( $dir ) ) {
			return new WP_Error( 'transtrix_package_dir_failed', __( 'The folder for packages could not be created. Check that the uploads folder is writable.', 'transtrix' ) );
		}

		self::guard( $root );
		self::guard( $dir );

		return $dir;
	}

	/**
	 * The unguessable name of the storage subdirectory, created once.
	 *
	 * Without it the directory is a fixed, public path, and on a server that
	 * ignores .htaccess anything inside is one guess away.
	 *
	 * @return string
	 */
	private static function store_key(): string {
		$key = (string) get_option( 'transtrix_store_key', '' );

		if ( 1 !== preg_match( '/^[a-f0-9]{32}$/', $key ) ) {
			$key = bin2hex( random_bytes( 16 ) );
			update_option( 'transtrix_store_key', $key, false );
		}

		return $key;
	}

	/**
	 * The path a package id resolves to.
	 *
	 * @param string $package_id Package id.
	 * @return string|WP_Error
	 */
	public static function path( string $package_id ) {
		if ( 1 !== preg_match( '/^[a-f0-9]{32}$/', $package_id ) ) {
			return new WP_Error( 'transtrix_invalid_package_id', __( 'That package could not be found.', 'transtrix' ) );
		}

		$dir = self::dir();

		if ( is_wp_error( $dir ) ) {
			return $dir;
		}

		return $dir . $package_id . '.zip';
	}

	/**
	 * A fresh package id.
	 *
	 * @return string
	 */
	public static function new_id(): string {
		return bin2hex( random_bytes( 16 ) );
	}

	/**
	 * Move an uploaded or generated file into the store.
	 *
	 * @param string $source     Path to the file to take over.
	 * @param string $package_id Package id to store it as.
	 * @return string|WP_Error The stored path.
	 */
	public static function put( string $source, string $package_id ) {
		$target = self::path( $package_id );

		if ( is_wp_error( $target ) ) {
			return $target;
		}

		if ( ! rename( $source, $target ) ) { // phpcs:ignore WordPress.WP.AlternativeFunctions.rename_rename -- direct file I/O; WP_Filesystem needs credentials a REST request does not have.
			return new WP_Error( 'transtrix_package_store_failed', __( 'The package could not be saved on this site. Check that the uploads folder is writable and the server has free space.', 'transtrix' ) );
		}

		return $target;
	}

	/**
	 * Whether a package id resolves to a readable file.
	 *
	 * @param string $package_id Package id.
	 * @return bool
	 */
	public static function exists( string $package_id ): bool {
		$path = self::path( $package_id );

		return ! is_wp_error( $path ) && is_readable( $path );
	}

	/**
	 * Delete part files from uploads nobody finished.
	 *
	 * Every piece appended touches the file, so an upload still in progress
	 * is never older than a day; one that is has been abandoned.
	 *
	 * @return void
	 */
	public static function sweep_parts(): void {
		$dir = self::dir();

		if ( is_wp_error( $dir ) ) {
			return;
		}

		foreach ( (array) glob( $dir . '*.part' ) as $part ) {
			if ( is_string( $part ) && filemtime( $part ) < time() - DAY_IN_SECONDS ) {
				wp_delete_file( $part );
			}
		}
	}

	/**
	 * Delete packages nothing uses that have sat for a day.
	 *
	 * A package uploaded and never restored has no job pointing at it, so
	 * nothing else would ever remove it.
	 *
	 * @param array<int,string> $keep Package ids a job still points at.
	 * @return void
	 */
	public static function sweep_unused( array $keep ): void {
		$dir = self::dir();

		if ( is_wp_error( $dir ) ) {
			return;
		}

		foreach ( (array) glob( $dir . '*.zip' ) as $zip ) {
			if ( is_string( $zip ) && ! in_array( basename( $zip, '.zip' ), $keep, true ) && filemtime( $zip ) < time() - DAY_IN_SECONDS ) {
				wp_delete_file( $zip );
			}
		}
	}

	/**
	 * Delete a stored package, and any part file an unfinished upload of it left.
	 *
	 * @param string $package_id Package id.
	 * @return void
	 */
	public static function delete( string $package_id ): void {
		$path = self::path( $package_id );

		if ( is_wp_error( $path ) ) {
			return;
		}

		foreach ( array( $path, substr( $path, 0, -4 ) . '.part' ) as $file ) {
			if ( is_file( $file ) ) {
				wp_delete_file( $file );
			}
		}
	}

	/**
	 * The readable name a job's package is offered under.
	 *
	 * Packages sit on disk as a hash. Module exports record a name at start;
	 * older and whole-site records get one built from the source and date.
	 *
	 * @param array<string,mixed> $record Job record.
	 * @return string
	 */
	public static function display_name( array $record ): string {
		if ( '' !== (string) ( $record['package_name'] ?? '' ) ) {
			return (string) $record['package_name'];
		}

		$stamp = strtotime( (string) ( $record['created_at'] ?? '' ) );

		return sanitize_file_name( ( $record['module_id'] ?? $record['kind'] ?? 'package' ) . '-' . gmdate( 'Y-m-d-His', $stamp ? $stamp : time() ) . '.zip' );
	}

	/**
	 * Where a package sits, relative to the WordPress root, for display only.
	 *
	 * @param string $package_id Package id.
	 * @return string Empty when the package is not stored.
	 */
	public static function relative_path( string $package_id ): string {
		if ( ! self::exists( $package_id ) ) {
			return '';
		}

		return ltrim( str_replace( wp_normalize_path( ABSPATH ), '', wp_normalize_path( (string) self::path( $package_id ) ) ), '/' );
	}

	/**
	 * Write the guard files if they are missing.
	 *
	 * @param string $dir Trailing-slashed directory to close to the web.
	 * @return void
	 */
	public static function guard( string $dir ): void {
		$guards = array(
			'index.php'  => "<?php\n// Silence is golden.\n",
			'.htaccess'  => "Require all denied\n<IfModule !mod_authz_core.c>\nDeny from all\n</IfModule>\n",
			'web.config' => "<?xml version=\"1.0\"?>\n<configuration><system.webServer><security><authorization><remove users=\"*\" roles=\"\" verbs=\"\" /><add accessType=\"Deny\" users=\"*\" /></authorization></security></system.webServer></configuration>\n",
		);

		foreach ( $guards as $name => $contents ) {
			if ( ! file_exists( $dir . $name ) ) {
				file_put_contents( $dir . $name, $contents ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_file_put_contents -- direct file I/O; WP_Filesystem needs credentials a REST request does not have.
			}
		}
	}
}