Private File Upload Handler

<?php

declare(strict_types=1);

function uploadErrorMessage(int $error): string
{
    return match ($error) {
        UPLOAD_ERR_INI_SIZE, UPLOAD_ERR_FORM_SIZE => 'The file is too large.',
        UPLOAD_ERR_PARTIAL => 'The upload was incomplete.',
        UPLOAD_ERR_NO_FILE => 'Choose a file to upload.',
        UPLOAD_ERR_NO_TMP_DIR => 'The server upload directory is unavailable.',
        UPLOAD_ERR_CANT_WRITE => 'The server could not write the upload.',
        UPLOAD_ERR_EXTENSION => 'A PHP extension stopped the upload.',
        UPLOAD_ERR_OK => 'The upload succeeded.',
        default => 'The upload failed for an unknown reason.',
    };
}

function inspectDocumentUpload(array $file): array
{
    $error = $file['error'] ?? UPLOAD_ERR_NO_FILE;
    if (!is_int($error)) {
        throw new InvalidArgumentException('The upload field has an invalid shape.');
    }
    if ($error !== UPLOAD_ERR_OK) {
        throw new InvalidArgumentException(uploadErrorMessage($error));
    }

    $size = $file['size'] ?? null;
    $temporaryPath = $file['tmp_name'] ?? null;
    $originalName = $file['name'] ?? null;
    if (!is_int($size) || !is_string($temporaryPath) || !is_string($originalName)) {
        throw new InvalidArgumentException('The upload field has an invalid shape.');
    }
    if ($size < 1 || $size > 2_000_000) {
        throw new InvalidArgumentException('The file must be between 1 byte and 2 MB.');
    }
    if (!is_uploaded_file($temporaryPath)) {
        throw new InvalidArgumentException('The temporary file is not an HTTP upload.');
    }

    $mime = (new finfo(FILEINFO_MIME_TYPE))->file($temporaryPath);
    if (!is_string($mime) || !in_array($mime, ['application/pdf', 'image/png'], true)) {
        throw new InvalidArgumentException('Only PDF and PNG files are accepted.');
    }

    $displayName = basename(str_replace('\\', '/', $originalName));
    $displayName = preg_replace('/[\x00-\x1F\x7F]/', '', $displayName) ?? '';
    if ($displayName === '') {
        $displayName = 'document';
    }

    return ['size' => $size, 'mime' => $mime, 'display_name' => $displayName];
}

<?php

declare(strict_types=1);

function storeDocument(array $file, array $metadata, int $ownerId, string $directory): string
{
    if (!is_dir($directory) || !is_writable($directory)) {
        throw new RuntimeException('Private storage is not writable.');
    }

    $id = bin2hex(random_bytes(16));
    $contentPath = $directory . '/' . $id . '.bin';
    $metadataPath = $directory . '/' . $id . '.json';

    if (!move_uploaded_file($file['tmp_name'], $contentPath)) {
        throw new RuntimeException('The uploaded file could not be stored.');
    }

    try {
        $document = [
            'id' => $id,
            'owner_id' => $ownerId,
            'display_name' => $metadata['display_name'],
            'mime' => $metadata['mime'],
            'size' => $metadata['size'],
        ];
        $json = json_encode($document, JSON_THROW_ON_ERROR);
        $handle = fopen($metadataPath, 'x');
        if ($handle === false) {
            throw new RuntimeException('Document metadata could not be created.');
        }

        try {
            if (fwrite($handle, $json) !== strlen($json) || !fflush($handle)) {
                throw new RuntimeException('Document metadata could not be written.');
            }
        } finally {
            fclose($handle);
        }
    } catch (Throwable $exception) {
        @unlink($metadataPath);
        @unlink($contentPath);
        throw $exception;
    }

    return $id;
}

<?php

declare(strict_types=1);

// no-execute: requires authenticated session state and a requested document ID.
$id = $_GET['id'] ?? null;
$currentUserId = $_SESSION['user_id'] ?? null;

if (!is_string($id) || preg_match('/\A[a-f0-9]{32}\z/', $id) !== 1 || !is_int($currentUserId)) {
    http_response_code(404);
    exit('Not Found');
}

$directory = dirname(__DIR__) . '/storage/documents';
$metadataPath = $directory . '/' . $id . '.json';
$contentPath = $directory . '/' . $id . '.bin';

try {
    $metadata = json_decode(file_get_contents($metadataPath), true, flags: JSON_THROW_ON_ERROR);
} catch (Throwable) {
    http_response_code(404);
    exit('Not Found');
}

if (!is_array($metadata)
    || ($metadata['owner_id'] ?? null) !== $currentUserId
    || !is_file($contentPath)) {
    http_response_code(404);
    exit('Not Found');
}

$size = filesize($contentPath);
if ($size === false) {
    http_response_code(500);
    exit('Download unavailable.');
}

$displayName = is_string($metadata['display_name'] ?? null)
    ? $metadata['display_name']
    : 'document';
$mime = is_string($metadata['mime'] ?? null)
    ? $metadata['mime']
    : 'application/octet-stream';

header('Content-Type: ' . $mime);
header('Content-Length: ' . $size);
header('X-Content-Type-Options: nosniff');
header("Content-Disposition: attachment; filename=\"download\"; filename*=UTF-8''" . rawurlencode($displayName));
readfile($contentPath);
exit;