landing-api/app/Http/Controllers/Api/V1/MediaController.php

<?php

declare(strict_types=1);

namespace App\Http\Controllers\Api\V1;

use App\Http\Controllers\Controller;
use App\Http\Requests\Api\V1\MediaRequest;
use App\Http\Resources\MediaResource;
use App\Jobs\ProcessMedia;
use App\Models\Media;
use App\Services\Media\RemoteImage;
use enshrined\svgSanitize\Sanitizer;
use finfo;
use Illuminate\Http\JsonResponse;
use Illuminate\Http\Request;
use Illuminate\Http\Resources\Json\AnonymousResourceCollection;
use Illuminate\Support\Facades\Storage;
use Illuminate\Support\Str;
use Illuminate\Validation\ValidationException;

/**
 * The media library: every image on the media disk, and uploading new ones.
 *
 * `store` stores an image and answers with the path a record points at — what the
 * panel's upload field does on a form, without the form. It exists for the MCP
 * server, which otherwise could create a page but never give it a picture.
 *
 * The file lands where the panel puts a page's images and goes through
 * `Media::for()`, so it is processed, served and eventually pruned exactly
 * like one uploaded there.
 */
class MediaController extends Controller
{
    /**
     * Extension by detected type. Chosen from the bytes, never from the name
     * the client sent.
     *
     * @var array<string, string>
     */
    protected const EXTENSIONS = [
        'image/jpeg' => 'jpg',
        'image/png' => 'png',
        'image/webp' => 'webp',
        'image/gif' => 'gif',
        'image/avif' => 'avif',
        'image/svg+xml' => 'svg',
    ];

    /**
     * Filters: for (the kind of record it was uploaded for), mime, search
     * (path), pending, failed, orphans (what `content:prune --media` would
     * take away).
     */
    public function index(Request $request): AnonymousResourceCollection
    {
        $this->authorize('viewAny', Media::class);

        // Worked out once for the page rather than once per file: it reads
        // every record that can point at an image.
        $referenced = array_flip(Media::referencedPaths());

        $directory = config('media.upload.for.'.$request->string('for'));

        $media = Media::query()
            ->when(is_string($directory), fn ($q) => $q->where('path', 'like', $directory.'/%'))
            ->when($request->filled('mime'), fn ($q) => $q->where('mime', $request->string('mime')))
            ->when($request->filled('search'), fn ($q) => $q->where('path', 'like', '%'.$request->string('search').'%'))
            ->when($request->boolean('pending'), fn ($q) => $q->pending())
            ->when($request->boolean('failed'), fn ($q) => $q->whereNotNull('error'))
            ->when($request->boolean('orphans'), fn ($q) => $q->whereNotIn('path', array_keys($referenced)))
            ->latest('id')
            ->paginate(perPage: min($request->integer('per_page', 25), 100))
            ->withQueryString();

        $media->getCollection()->each(fn (Media $item) => $item->setAttribute('referenced', isset($referenced[$item->path])));

        return MediaResource::collection($media);
    }

    public function show(Media $media): MediaResource
    {
        $this->authorize('view', $media);

        return MediaResource::make($media->setAttribute('referenced', $media->isReferenced()));
    }

    /**
     * Only a file nothing points at: deleting one in use would put a broken
     * image on the public site. Its derived versions go with it.
     */
    public function destroy(Media $media): JsonResponse
    {
        // The permission first, so whether a file is in use is only told to
        // someone who could have deleted it.
        $this->authorize('media.delete');

        abort_if($media->isReferenced(), 409, __('rules.media.in_use'));

        $media->deleteDerived();
        Storage::disk($media->disk)->delete($media->path);
        $media->delete();

        return response()->json(status: 204);
    }

    /**
     * Derive the smaller versions and the placeholder again, on the queue.
     */
    public function reprocess(Media $media): JsonResponse
    {
        $this->authorize('view', $media);

        ProcessMedia::dispatch($media);

        return MediaResource::make($media)->response()->setStatusCode(202);
    }

    public function store(MediaRequest $request, RemoteImage $remote): JsonResponse
    {
        $for = (string) $request->input('for', 'pages');

        $this->authorize('upload', [Media::class, $for]);

        $field = $request->hasFile('file') ? 'file' : 'url';

        $contents = $field === 'file'
            ? (string) $request->file('file')->get()
            : $remote->fetch((string) $request->string('url'));

        $mime = (new finfo(FILEINFO_MIME_TYPE))->buffer($contents) ?: null;

        if (! in_array($mime, (array) config('media.upload.mimes'), true)) {
            $this->refuse($field);
        }

        if ($mime === 'image/svg+xml') {
            $contents = $this->sanitize($contents) ?? $this->refuse($field);
            // A vector has no pixel size; the processor copies it through.
            $size = [null, null];
        } else {
            // The type is read from the magic bytes; this catches a file that
            // has them but does not decode, which nobody could render either.
            $size = @getimagesizefromstring($contents) ?: $this->refuse($field);
        }

        $path = config("media.upload.for.{$for}").'/'.Str::random(40).'.'.self::EXTENSIONS[$mime];

        Storage::disk((string) config('media.disk'))->put($path, $contents);

        $media = Media::for($path);

        // What is already known, so the answer carries dimensions straight
        // away rather than after the queue has run. The processor writes the
        // same values, and the rest, when it does.
        if (! $media->isProcessed()) {
            $media->forceFill([
                'mime' => $mime,
                'size' => strlen($contents),
                'width' => $size[0],
                'height' => $size[1],
            ])->save();
        }

        return MediaResource::make($media->fresh())->response()->setStatusCode(201);
    }

    /**
     * An SVG with what could run taken out: scripts, event handlers, and
     * references to anything outside the file. Null when what is left is not
     * an SVG at all.
     */
    protected function sanitize(string $svg): ?string
    {
        $sanitizer = new Sanitizer;
        $sanitizer->removeRemoteReferences(true);

        $clean = $sanitizer->sanitize($svg);

        return is_string($clean) && str_contains($clean, '<svg') ? $clean : null;
    }

    protected function refuse(string $field): never
    {
        throw ValidationException::withMessages([$field => [__('rules.media.not_an_image')]]);
    }
}