<?php

namespace App\Filters;

use CodeIgniter\HTTP\RequestInterface;
use CodeIgniter\HTTP\ResponseInterface;
use CodeIgniter\Filters\FilterInterface;
use Config\Services;
use finfo;

class GlobalPostFileUploadGuard implements FilterInterface
{
    protected int $maxFileSize = 25 * 1024 * 1024;

    protected array $allowedMimeMap = [
        'image/jpeg'      => ['jpg', 'jpeg'],
        'image/png'       => ['png'],
        'image/gif'       => ['gif'],
        'image/webp'      => ['webp'],
        // SVG removed — dangerous without server-side sanitization
        'application/pdf' => ['pdf'],
        'application/msword' => ['doc'],
        'application/vnd.openxmlformats-officedocument.wordprocessingml.document' => ['docx'],
        'application/vnd.oasis.opendocument.text' => ['odt'],
        'text/rtf'        => ['rtf'],
        'application/rtf' => ['rtf'],
        'application/vnd.ms-excel' => ['xls'],           // removed xlsx from here — it has its own MIME
        'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet' => ['xlsx'],
        'application/vnd.oasis.opendocument.spreadsheet' => ['ods'],
        'text/csv'        => ['csv'],
        'application/csv' => ['csv'],
        'text/plain'      => ['txt'],                     // separated csv out — txt only
    ];

    protected array $magicBytes = [
        'image/jpeg'      => ["\xFF\xD8\xFF"],
        'image/png'       => ["\x89PNG\r\n\x1a\n"],
        'image/gif'       => ["GIF87a", "GIF89a"],
        'image/webp'      => ["RIFF"],
        'application/pdf' => ["%PDF-"],
        'application/vnd.openxmlformats-officedocument.wordprocessingml.document' => ["PK\x03\x04"],
        'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet'       => ["PK\x03\x04"],
        'application/vnd.oasis.opendocument.text'        => ["PK\x03\x04"],
        'application/vnd.oasis.opendocument.spreadsheet' => ["PK\x03\x04"],
        'application/msword'       => ["\xD0\xCF\x11\xE0"],
        'application/vnd.ms-excel' => ["\xD0\xCF\x11\xE0"],
    ];

    protected array $blockedExtensions = [
        'php', 'phtml', 'html', 'htm', 'pht', 'phar',
        'php3', 'php4', 'php5', 'php7', 'php8', 'phps',
        'cgi', 'fcgi', 'pl', 'py', 'rb', 'lua', 'tcl',
        'go', 'rs', 'jar', 'class',
        'exe', 'dll', 'com', 'bat', 'cmd', 'msi',
        'vbs', 'ps1', 'ps2', 'scr', 'hta',
        'sh', 'bash', 'zsh', 'fish',
        'apk', 'app', 'deb', 'rpm',
        'bin', 'run', 'elf',
        'js', 'mjs', 'ts', 'jsx', 'tsx',
        'jsp', 'jspx', 'asp', 'aspx', 'ascx', 'ashx', 'axd',
        'cer', 'swf', 'xhtml',
        'env', 'ini', 'user.ini', 'htaccess', 'htpasswd',
        'conf', 'config', 'log', 'sql', 'db', 'sqlite',
        'zip', 'rar', '7z', 'tar', 'gz', 'bz2', 'xz', 'iso', 'cab',
        'lnk', 'url', 'reg', 'sys', 'drv', 'vxd',
        'tmp', 'bak', 'old', 'backup',
        'key', 'pem', 'p12', 'pfx', 'crt', 'csr',
        'xml', 'xsl', 'xslt', 'svg',
    ];

    public function before(RequestInterface $request, $arguments = null)
    {
        if ($request->getMethod() !== 'post') {
            return;
        }

        $files = $request->getFiles();
        if (empty($files)) {
            return;
        }

        foreach ($files as $inputName => $fileData) {
            $this->validateFileInput($fileData, $inputName);
        }
    }

    private function validateFileInput($fileData, string $inputName): void
    {
        if (is_array($fileData)) {
            foreach ($fileData as $key => $item) {
                $this->validateFileInput($item, $inputName . '[' . $key . ']');
            }
        } else {
            $this->validateSingleFile($fileData, $inputName);
        }
    }

    private function validateSingleFile($file, string $inputName): void
    {
        $request  = Services::request();
        $clientIp = $request->getIPAddress();
        $uri      = $request->getUri()->getPath();

        if (!$file->isValid()) {
            if ($file->getError() === UPLOAD_ERR_INI_SIZE || $file->getError() === UPLOAD_ERR_FORM_SIZE) {
                $this->block("File exceeds server-side size limit", $clientIp, $uri, $inputName, $file->getClientName(), 'unknown', 'unknown', 0);
            }
            return;
        }

        $originalName    = $file->getClientName();
        $clientExtension = strtolower($file->getClientExtension());
        $tempPath        = $file->getTempName();
        $size            = $file->getSize();

        // echo $file->getExtension();
        // echo '@@@@@@@@@@@@@@@@@@@@@@@';
        // echo $file->getMimeType();
        // --- 1. Null Byte & Path Traversal Check ---
        if (preg_match('/\0|[\/\\\\]/', $originalName)) {
            $this->block("Malicious filename characters", $clientIp, $uri, $inputName, $originalName, 'unknown', $clientExtension, $size);
        }

        // --- 2. Filename length check ---
        if (strlen($originalName) > 255) {
            $this->block("Filename too long", $clientIp, $uri, $inputName, substr($originalName, 0, 100) . '...', 'unknown', $clientExtension, $size);
        }

        // --- 3. Double/Multiple Extension Attack ---
        $nameParts = explode('.', $originalName);
        if (count($nameParts) > 2) {
            $allExtensions = array_slice($nameParts, 1);
            foreach ($allExtensions as $part) {
                if (in_array(strtolower($part), $this->blockedExtensions, true)) {
                    $this->block("Double/multiple extension attack detected", $clientIp, $uri, $inputName, $originalName, 'unknown', $clientExtension, $size);
                }
            }
        }

        // --- 4. Forbidden Extension ---
        if (in_array($clientExtension, $this->blockedExtensions, true)) {
            $this->block("Forbidden extension", $clientIp, $uri, $inputName, $originalName, 'unknown', $clientExtension, $size);
        }

        // --- 5. File Size Limit ---
        if ($size > $this->maxFileSize) {
            $this->block("File too large", $clientIp, $uri, $inputName, $originalName, 'unknown', $clientExtension, $size);
        }

       // --- 6. Real MIME Detection via finfo on actual temp file ---
        $finfo        = new finfo(FILEINFO_MIME_TYPE);
        $detectedMime = $finfo->file($tempPath);
        
        // --- 7. Resolve Expected MIME From Extension ---
        $expectedMime = null;

        foreach ($this->allowedMimeMap as $mime => $extensions) {

            if (in_array($clientExtension, $extensions, true)) {
                $expectedMime = $mime;
                break;
            }
        }

        if ($expectedMime === null) {
            $this->block(
                "Extension not allowed",
                $clientIp,
                $uri,
                $inputName,
                $originalName,
                $detectedMime,
                $clientExtension,
                $size
            );
        }

        // --- 8. Magic Bytes Deep Validation ---
        // validate using EXPECTED MIME instead of detected MIME
        $this->validateMagicBytes(
            $tempPath,
            $expectedMime,
            $clientIp,
            $uri,
            $inputName,
            $originalName,
            $clientExtension,
            $size
        );

        // // --- 9. Embedded Code Scan ---
        // $this->scanForEmbeddedCode(
        //     $tempPath,
        //     $expectedMime,
        //     $clientIp,
        //     $uri,
        //     $inputName,
        //     $originalName,
        //     $clientExtension,
        //     $size
        // );

        // --- 10. Final MIME Validation ---
        // strict match only: generic octet-stream is not accepted
        if ($detectedMime !== $expectedMime) {
            $this->block(
                "MIME-extension mismatch",
                $clientIp,
                $uri,
                $inputName,
                $originalName,
                $detectedMime,
                $clientExtension,
                $size
            );
        }

        // --- 10. Embedded Code Scan ---
        // $this->scanForEmbeddedCode($tempPath, $detectedMime, $clientIp, $uri, $inputName, $originalName, $clientExtension, $size);
    }

    private function validateMagicBytes(
        string $tempPath,
        string $mime,
        string $ip,
        string $uri,
        string $field,
        string $filename,
        string $ext,
        int $size
    ): void {
        if (!isset($this->magicBytes[$mime])) {
            return;
        }
        // echo $mime;print_r($this->magicBytes[$mime]);
        $handle = fopen($tempPath, 'rb');
        if (!$handle) {
            $this->block("Cannot read uploaded file", $ip, $uri, $field, $filename, $mime, $ext, $size);
        }

        $header = fread($handle, 12);
        fclose($handle);

        $matched = false;
        foreach ($this->magicBytes[$mime] as $signature) {
            if (str_starts_with($header, $signature)) {
                $matched = true;
                break;
            }
        }
        // echo $matched;die;
        // WebP special case: RIFF....WEBP
        if ($mime === 'image/webp') {
            $matched = (substr($header, 0, 4) === 'RIFF' && substr($header, 8, 4) === 'WEBP');
        }

        if (!$matched) {
            $this->block("Magic bytes mismatch for MIME: $mime", $ip, $uri, $field, $filename, $mime, $ext, $size);
        }
    }

    private function scanForEmbeddedCode(
        string $tempPath,
        string $mime,
        string $ip,
        string $uri,
        string $field,
        string $filename,
        string $ext,
        int $size
    ): void {
        $scanLimit = 1024 * 1024;

        $content = '';
        if ($size <= $scanLimit) {
            $content = file_get_contents($tempPath);
        } else {
            $handle = fopen($tempPath, 'rb');
            if ($handle) {
                $content  = fread($handle, 10240);
                fseek($handle, -10240, SEEK_END);
                $content .= fread($handle, 10240);
                fclose($handle);
            }
        }

        if (empty($content)) {
            return;
        }

        $dangerousPatterns = [
            '/<\?php/i',
            '/<\?=/i',
            '/<\?/i',
            '/<%/i',
            '/<script\s+.*?runat\s*=\s*["\']?server/i',
            '/eval\s*\(/i',
            '/base64_decode\s*\(/i',
            '/system\s*\(/i',
            '/exec\s*\(/i',
            '/passthru\s*\(/i',
            '/shell_exec\s*\(/i',
        ];

        foreach ($dangerousPatterns as $pattern) {
            if (preg_match($pattern, $content)) {
                $this->block("Embedded code pattern detected in file", $ip, $uri, $field, $filename, $mime, $ext, $size);
            }
        }
    }

    // block() signature and body kept EXACTLY as original — only $ext source changed upstream
    private function block(string $reason, string $ip, string $uri, string $field, string $filename, string $mime, string $ext, int $size): void
    {
        log_message('critical',
            '[UPLOAD_BLOCKED] {reason} | IP: {ip} | URI: {uri} | Field: {field} | File: {file} | MIME: {mime} | EXT: {ext} | SIZE: {size}',
            ['reason'=>$reason, 'ip'=>$ip, 'uri'=>$uri, 'field'=>$field, 'file'=>$filename, 'mime'=>$mime, 'ext'=>$ext, 'size'=>$size]
        );

        $response = Services::response();
        $response->setStatusCode(403)
                 ->setJSON([
                     'status'  => 'error',
                     'message' => 'File upload rejected: Security policy violation.' . ($reason ? " Reason: $reason." : ''),
                     'debug'   => (ENVIRONMENT === 'development') ? $reason : null
                 ])
                 ->send();
        exit;
    }

    public function after(RequestInterface $request, ResponseInterface $response, $arguments = null) {}
}