<?php

declare(strict_types=1);

namespace app\common\service {
    /** Route synthetic public storage to loopback AFTER recording real security options. */
    function curl_setopt_array($handle, array $options): bool
    {
        $original = $options;
        $url = (string) ($options[CURLOPT_URL] ?? '');
        if (str_starts_with($url, 'https://storage.synthetic.test/')) {
            $options[CURLOPT_URL] = 'http://127.0.0.1:' . $GLOBALS['attachmentFixturePort'] . substr($url, strlen('https://storage.synthetic.test'));
            unset($options[CURLOPT_RESOLVE]);
        } elseif (!str_starts_with($url, 'http://127.0.0.1:' . $GLOBALS['attachmentFixturePort'] . '/')) {
            throw new \RuntimeException('The synthetic test forbids external connections');
        }
        $GLOBALS['attachmentCurlOptions'][] = $original;
        return \curl_setopt_array($handle, $options);
    }
}

namespace {
    // This same file is a loopback-only fixture router. It never loads application config.
    if (PHP_SAPI === 'cli-server') {
        $root = (string) getenv('DIFY_ATTACHMENT_FIXTURE_ROOT');
        $path = parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH);
        $append = static function (array $entry) use ($root): void {
            file_put_contents($root . '/requests.jsonl', json_encode($entry) . "\n", FILE_APPEND | LOCK_EX);
        };
        if ($_SERVER['REQUEST_METHOD'] === 'POST' && str_ends_with($path, '/files/upload')) {
            $upload = $_FILES['file'] ?? [];
            $temporary = $upload['tmp_name'] ?? '';
            $id = bin2hex(random_bytes(16));
            $append(['kind' => 'upload', 'user' => $_POST['user'] ?? '', 'name' => $upload['name'] ?? '',
                'mime' => $upload['type'] ?? '', 'size' => $upload['size'] ?? 0,
                'hash' => is_file($temporary) ? hash_file('sha256', $temporary) : '', 'id' => $id,
                'authorization' => $_SERVER['HTTP_AUTHORIZATION'] ?? '', 'path' => $path]);
            if (str_starts_with($path, '/slow-headers/')) usleep(1200000);
            if (str_starts_with($path, '/budget/')) usleep(650000);
            header('Content-Type: application/json');
            if (str_starts_with($path, '/fail/')) { http_response_code(422); echo '{"error":"fixture-private-path-url-key-body"}'; return; }
            if (str_starts_with($path, '/fail-second/')) {
                $entries = array_map(static fn (string $line): array => json_decode($line, true), file($root . '/requests.jsonl', FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES));
                $uploads = array_filter($entries, static fn (array $entry): bool => ($entry['kind'] ?? '') === 'upload');
                if (count($uploads) === 2) { http_response_code(422); echo '{"error":"fixture-private-path-url-key-body"}'; return; }
            }
            if (str_starts_with($path, '/bad-id/')) { http_response_code(201); echo '{"id":"invalid/id"}'; return; }
            if (str_starts_with($path, '/large-response/')) { http_response_code(201); echo str_repeat('x', 300000); return; }
            http_response_code(201);
            if (str_starts_with($path, '/slow-body/')) { echo '{"id":"'; flush(); usleep(1200000); echo $id . '"}'; return; }
            echo json_encode(['id' => $id]);
            return;
        }
        $append(['kind' => 'download', 'path' => $path, 'authorization' => $_SERVER['HTTP_AUTHORIZATION'] ?? '']);
        if ($path === '/redirect') { header('Location: http://169.254.169.254/latest/meta-data/'); http_response_code(302); echo 'redirect'; return; }
        if ($path === '/oversize-header') { header('Content-Length: 2000000'); echo 'x'; return; }
        if ($path === '/oversize-stream') { echo str_repeat('x', 30000); return; }
        if ($path === '/slow-download') usleep(1200000);
        if ($path === '/budget-download') usleep(650000);
        header('Content-Type: image/png');
        readfile($root . '/public/uploads/first.png');
        return;
    }

    require dirname(__DIR__) . '/app/common/service/DifyRequiredAttachmentUpload.php';
    use app\common\service\DifyRequiredAttachmentUpload;

    function attachmentExpect(bool $ok, string $message): void
    {
        if (!$ok) throw new RuntimeException($message);
    }
    function attachmentError(array $result, string $code, string $message): void
    {
        attachmentExpect(empty($result['ok']) && ($result['error_code'] ?? '') === $code && !isset($result['files']),
            $message . ' (' . ($result['error_code'] ?? 'no error') . ')');
        attachmentExpect(!str_contains(json_encode($result), 'fixture-private-path-url-key-body'), 'upstream body never escapes');
    }
    function attachmentRemoveTree(string $path, string $workspace): void
    {
        $resolved = realpath($path); $root = realpath($workspace);
        if ($resolved === false || $root === false || ($resolved !== $root && !str_starts_with(str_replace('\\', '/', $resolved), str_replace('\\', '/', $root) . '/'))) {
            throw new RuntimeException('Refusing to clean outside synthetic test workspace');
        }
        foreach (new DirectoryIterator($resolved) as $item) {
            if ($item->isDot()) continue;
            if ($item->isDir() && !$item->isLink()) attachmentRemoveTree($item->getPathname(), $workspace);
            else unlink($item->getPathname());
        }
        rmdir($resolved);
    }

    $root = sys_get_temp_dir() . '/dify-required-synthetic-' . bin2hex(random_bytes(8));
    mkdir($root . '/public/uploads/nested', 0700, true);
    mkdir($root . '/private', 0700);
    mkdir($root . '/public/uploads-evil', 0700);
    $image = imagecreatetruecolor(64, 64);
    imagefill($image, 0, 0, imagecolorallocate($image, 50, 130, 180));
    imagepng($image, $root . '/public/uploads/first.png');
    imagefill($image, 0, 0, imagecolorallocate($image, 180, 130, 50));
    imagepng($image, $root . '/public/uploads/nested/second.png');
    imagedestroy($image);
    file_put_contents($root . '/public/uploads/report.pdf', "%PDF-1.4\n1 0 obj<</Type/Catalog>>endobj\n%%EOF\n");
    file_put_contents($root . '/public/uploads/audio.wav', 'RIFF' . pack('V', 38) . 'WAVEfmt ' . pack('VvvVVvv', 16, 1, 1, 8000, 16000, 2, 16) . 'data' . pack('V', 2) . "\0\0");
    file_put_contents($root . '/public/uploads/large.txt', str_repeat('x', 30000));
    file_put_contents($root . '/private/do-not-read.txt', 'synthetic-private-file');
    file_put_contents($root . '/public/uploads-evil/escape.txt', 'synthetic-private-file');
    $socket = stream_socket_server('tcp://127.0.0.1:0', $errno, $error);
    attachmentExpect(is_resource($socket), 'allocate loopback fixture port');
    $address = stream_socket_get_name($socket, false);
    fclose($socket);
    $port = (int) substr($address, strrpos($address, ':') + 1);
    $attachmentFixturePort = $port;
    $attachmentCurlOptions = [];
    $process = proc_open([PHP_BINARY, '-S', '127.0.0.1:' . $port, __FILE__],
        [['pipe', 'r'], ['file', $root . '/fixture-output.log', 'ab'], ['file', $root . '/fixture-error.log', 'ab']],
        $pipes, $root, ['DIFY_ATTACHMENT_FIXTURE_ROOT' => $root,
            'SystemRoot' => (string) getenv('SystemRoot'), 'TEMP' => (string) getenv('TEMP'), 'TMP' => (string) getenv('TMP')], ['bypass_shell' => true]);
    try {
        attachmentExpect(is_resource($process), 'start loopback fixture');
        if (isset($pipes[0]) && is_resource($pipes[0])) fclose($pipes[0]);
        $ready = false;
        for ($attempt = 0; $attempt < 150; ++$attempt) {
            $probe = @fsockopen('127.0.0.1', $port, $errno, $error, 0.02);
            if (is_resource($probe)) { fclose($probe); $ready = true; break; }
            usleep(20000);
        }
        attachmentExpect($ready, 'loopback fixture becomes ready');
        $endpoint = 'http://127.0.0.1:' . $port . '/v1/chat-messages';
        $options = ['local_origins' => ['https://site.synthetic.test', 'https://admin.synthetic.test'],
            'storage_origins' => ['https://storage.synthetic.test'], 'public_root' => $root . '/public',
            'temp_root' => $root . '/private/uploads', 'max_file_bytes' => 20000,
            'resolve_host' => static fn (string $host): array => ['8.8.8.8', '2606:4700:4700::1111']];
        $files = [
            ['type' => 'image', 'transfer_method' => 'remote_url', 'url' => 'https://site.synthetic.test/uploads/first.png'],
            ['type' => 'image', 'url' => 'https://admin.synthetic.test/uploads/nested/second.png'],
            ['type' => 'document', 'url' => 'https://site.synthetic.test/uploads/report.pdf'],
        ];
        $requests = static function () use ($root): array {
            if (!is_file($root . '/requests.jsonl')) return [];
            return array_map(static fn (string $line): array => json_decode($line, true), file($root . '/requests.jsonl', FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES));
        };
        $clear = static function () use ($root, &$attachmentCurlOptions): void {
            file_put_contents($root . '/requests.jsonl', ''); $attachmentCurlOptions = [];
        };
        $clean = static function () use ($root): void {
            attachmentExpect((glob($root . '/private/uploads/required-*') ?: []) === [], 'temporary files are removed after every terminal outcome');
        };
        $run = static function (array $input, array $extra = [], ?callable $abort = null, string $user = 'synthetic-user', ?string $target = null, int $timeout = 5) use ($endpoint, $options): array {
            return DifyRequiredAttachmentUpload::prepare($target ?? $endpoint, 'fixture-only-key', $user, $input, $timeout, $abort, array_replace($options, $extra));
        };

        $clear(); $events = [];
        $result = $run(array_merge($files, [
            ['type' => 'video', 'url' => 'https://untrusted.invalid/record.mp4'],
            ['type' => 'document', 'url' => 'https://untrusted.invalid/record.MOV'],
            ['type' => 'image', 'url' => 'https://untrusted.invalid/opaque', 'mime_type' => 'video/webm'],
        ]), ['on_upload' => static function (array $event) use (&$events): void { $events[] = $event; }]);
        attachmentExpect(!empty($result['ok']) && count($result['files']) === 3 && $result['attachment_transport'] === 'uploaded_files', 'two images and PDF all become local_file references');
        attachmentExpect(array_column($result['files'], 'type') === ['image', 'image', 'document']
            && array_unique(array_column($result['files'], 'transfer_method')) === ['local_file'], 'types and attachment order preserved');
        attachmentExpect(count($requests()) === 3 && array_unique(array_column($requests(), 'user')) === ['synthetic-user'], 'every multipart upload has the exact chat user');
        attachmentExpect(array_column($requests(), 'hash') === [hash_file('sha256', $root . '/public/uploads/first.png'),
            hash_file('sha256', $root . '/public/uploads/nested/second.png'), hash_file('sha256', $root . '/public/uploads/report.pdf')], 'multipart contains complete binary bytes');
        attachmentExpect(count($events) === 6 && array_column($events, 'status') === ['uploading', 'uploaded', 'uploading', 'uploaded', 'uploading', 'uploaded'], 'safe one-based progress follows each actual upload');
        foreach ($events as $event) attachmentExpect(array_keys($event) === ['index', 'total', 'status'] && $event['total'] === 3, 'progress contains safe counts/status only');
        foreach ($attachmentCurlOptions as $curlOptions) {
            $temporary = $curlOptions[CURLOPT_POSTFIELDS]['file']->getFilename();
            attachmentExpect(str_starts_with(str_replace('\\', '/', $temporary), str_replace('\\', '/', $root) . '/private/uploads/') && !is_file($temporary), 'CURLFile uses cleaned nonpublic snapshot');
            attachmentExpect($curlOptions[CURLOPT_SSL_VERIFYPEER] === true && $curlOptions[CURLOPT_SSL_VERIFYHOST] === 2 && $curlOptions[CURLOPT_PROXY] === '', 'transport verifies TLS and ignores environment proxies');
        }
        $clean();

        $clear();
        $duplicates = $run([$files[0], $files[0]]);
        attachmentExpect(!empty($duplicates['ok']) && count($duplicates['files']) === 2 && count($requests()) === 1
            && $duplicates['files'][0]['upload_file_id'] === $duplicates['files'][1]['upload_file_id'], 'same request reuses ID while preserving both references');
        $otherUser = $run([$files[0]], [], null, 'another-synthetic-user');
        attachmentExpect(!empty($otherUser['ok']) && count($requests()) === 2
            && $otherUser['files'][0]['upload_file_id'] !== $duplicates['files'][0]['upload_file_id']
            && $requests()[1]['user'] === 'another-synthetic-user', 'no upload IDs or cache cross user boundaries');
        $sameUserNextRequest = $run([$files[0]]);
        attachmentExpect(!empty($sameUserNextRequest['ok']) && count($requests()) === 3
            && $sameUserNextRequest['files'][0]['upload_file_id'] !== $duplicates['files'][0]['upload_file_id'], 'even same-user requests have no global ID cache');
        $clean();
        $clear();
        $audio = $run([['type' => 'audio', 'url' => 'https://site.synthetic.test/uploads/audio.wav']]);
        attachmentExpect(!empty($audio['ok']) && $audio['files'][0]['type'] === 'audio' && $requests()[0]['mime'] === 'audio/x-wav', 'audio bytes retain audio type');
        $clean();

        $clear();
        $source = static fn (string $url): array => [['type' => 'document', 'url' => $url]];
        foreach ([
            'https://evil.synthetic.test/uploads/first.png',
            'https://site.synthetic.test.evil.invalid/uploads/first.png',
            'http://site.synthetic.test/uploads/first.png',
            'https://site.synthetic.test:444/uploads/first.png',
        ] as $url) attachmentError($run($source($url)), 'REQUIRED_FILES_SOURCE_UNTRUSTED', 'exact origin prevents alias/scheme/port bypass');
        foreach ([
            'https://site.synthetic.test/uploads/../private/do-not-read.txt',
            'https://site.synthetic.test/uploads/%2e%2e/private/do-not-read.txt',
            'https://site.synthetic.test/uploads/%252e%252e/private/do-not-read.txt',
            'https://site.synthetic.test/uploads/nested%2fsecond.png',
            'https://site.synthetic.test/uploads/nested%5csecond.png',
            'https://site.synthetic.test/uploads//first.png',
            'https://site.synthetic.test/uploads/first.png::$DATA',
            'https://site.synthetic.test/uploads/first.png.',
            'https://site.synthetic.test/uploads-evil/escape.txt',
            'https://site.synthetic.test/private/do-not-read.txt',
            'https://site.synthetic.test@evil.invalid/uploads/first.png',
            'https://site.synthetic.test/uploads/first.png#fragment',
            'file:///private/do-not-read.txt',
            '/uploads/first.png',
        ] as $url) attachmentError($run($source($url)), 'REQUIRED_FILES_INVALID', 'local path/URL bypass rejected before network');
        attachmentError($run($source('https://site.synthetic.test/uploads/missing.png')), 'REQUIRED_FILES_SOURCE_UNAVAILABLE', 'missing local files do not trigger network fallback');
        attachmentExpect($requests() === [], 'origin/path failures never upload or download');
        if (@symlink($root . '/private/do-not-read.txt', $root . '/public/uploads/link.txt')) {
            attachmentError($run($source('https://site.synthetic.test/uploads/link.txt')), 'REQUIRED_FILES_SOURCE_UNAVAILABLE', 'realpath rejects symlink escape');
        }
        $clean();

        $clear();
        $remote = [['type' => 'image', 'url' => 'https://storage.synthetic.test/download.png']];
        $downloaded = $run($remote);
        attachmentExpect(!empty($downloaded['ok']) && count($requests()) === 2 && $requests()[0]['kind'] === 'download'
            && $requests()[0]['authorization'] === '' && $requests()[1]['authorization'] === 'Bearer fixture-only-key', 'remote bytes upload without sharing Dify key with storage');
        attachmentExpect($attachmentCurlOptions[0][CURLOPT_RESOLVE] === ['storage.synthetic.test:443:8.8.8.8']
            && $attachmentCurlOptions[0][CURLOPT_FOLLOWLOCATION] === false, 'validated DNS address is pinned and redirect following disabled');
        $clear(); $dnsCalls = 0;
        $rebound = $run($remote, ['resolve_host' => static function () use (&$dnsCalls): array { return [++$dnsCalls === 1 ? '8.8.8.8' : '127.0.0.1']; }]);
        attachmentExpect(!empty($rebound['ok']) && $dnsCalls === 1
            && $attachmentCurlOptions[0][CURLOPT_RESOLVE] === ['storage.synthetic.test:443:8.8.8.8'], 'a rebound DNS answer cannot replace the pinned validated address');
        $clean();

        foreach (['127.0.0.1', '10.0.0.1', '172.16.0.1', '192.168.1.1', '169.254.169.254', '100.100.100.200',
            '0.0.0.0', '224.0.0.1', '::1', 'fc00::1', 'fe80::1', '::ffff:127.0.0.1', '64:ff9b::7f00:1', '2002:7f00:1::', '2001:db8::1'] as $ip) {
            $clear();
            attachmentError($run($remote, ['resolve_host' => static fn (): array => [$ip]]), 'REQUIRED_FILES_SOURCE_UNTRUSTED', 'private/metadata/transition DNS addresses rejected');
            attachmentExpect($requests() === [] && $attachmentCurlOptions === [], 'unsafe DNS never opens a connection');
        }
        $clear();
        attachmentError($run($remote, ['resolve_host' => static fn (): array => ['8.8.8.8', '127.0.0.1']]), 'REQUIRED_FILES_SOURCE_UNTRUSTED', 'mixed public/private DNS is rejected in full');
        attachmentError($run($remote, ['resolve_host' => static fn (): array => []]), 'REQUIRED_FILES_DOWNLOAD_FAILED', 'unresolvable storage fails explicitly');
        foreach (['https://storage.synthetic.test/redirect', 'https://storage.synthetic.test/oversize-header', 'https://storage.synthetic.test/oversize-stream'] as $url) {
            $clear();
            attachmentError($run($source($url)), str_ends_with($url, '/redirect') ? 'REQUIRED_FILES_DOWNLOAD_FAILED' : 'REQUIRED_FILES_TOO_LARGE', 'redirect/oversize downloads fail without dropping mandatory file');
            attachmentExpect(count($requests()) === 1 && $requests()[0]['kind'] === 'download', 'redirect is never followed and bad download is never uploaded');
            $clean();
        }
        $clear();
        attachmentError($run($source('https://site.synthetic.test/uploads/large.txt')), 'REQUIRED_FILES_TOO_LARGE', 'local file copy has the same byte limit');
        attachmentExpect($requests() === [], 'oversize local file never uploads');
        $clean();

        foreach (['fail', 'bad-id', 'large-response'] as $mode) {
            $clear(); $failedEvents = [];
            $failed = $run($files, ['on_upload' => static function (array $event) use (&$failedEvents): void { $failedEvents[] = $event; }], null, 'synthetic-user',
                'http://127.0.0.1:' . $port . '/' . $mode . '/v1/chat-messages');
            attachmentError($failed, 'REQUIRED_FILES_UPLOAD_FAILED', 'provider upload error never returns a partial attachment list');
            attachmentExpect(count($requests()) === 1 && $failedEvents[count($failedEvents) - 1]['status'] === 'failed', 'upload failure stops before a model request and marks safe progress failed');
            $clean();
        }
        $clear();
        $midway = $run($files, [], null, 'synthetic-user', 'http://127.0.0.1:' . $port . '/fail-second/v1/chat-messages');
        attachmentError($midway, 'REQUIRED_FILES_UPLOAD_FAILED', 'failure after a successful upload still returns no partial files');
        attachmentExpect(count($requests()) === 2 && $midway['failed_index'] === 2 && $midway['attachment_count'] === 3, 'failure identifies safe index and never skips ahead to remaining attachment');
        $clean();
        $clear();
        attachmentError($run($files, [], static fn (): bool => true), 'AI_ASSISTANT_CANCELLED', 'cancellation before preparation opens no transport');
        attachmentExpect($requests() === [], 'early cancellation has no network side effects');
        $cancelDuringCopy = false;
        attachmentError($run([$files[0]], ['on_upload' => static function () use (&$cancelDuringCopy): void { $cancelDuringCopy = true; }],
            static function () use (&$cancelDuringCopy): bool { return $cancelDuringCopy; }), 'AI_ASSISTANT_CANCELLED', 'cancellation during local copy cleans its new temporary file');
        attachmentExpect($requests() === [], 'cancelled local preparation never uploads');
        $clean();
        foreach (['slow-headers', 'slow-body'] as $mode) {
            $clear(); $start = microtime(true);
            $cancelled = $run([$files[0]], [], static fn (): bool => microtime(true) - $start > 0.15, 'synthetic-user',
                'http://127.0.0.1:' . $port . '/' . $mode . '/v1/chat-messages');
            attachmentError($cancelled, 'AI_ASSISTANT_CANCELLED', 'cancellation interrupts upload response ' . $mode);
            attachmentExpect(microtime(true) - $start < 0.7, 'curl_multi observes cancellation while waiting for headers/body');
            $clean(); usleep(1250000);
        }
        $clear(); $start = microtime(true);
        attachmentError($run($source('https://storage.synthetic.test/slow-download'), [], static fn (): bool => microtime(true) - $start > 0.15),
            'AI_ASSISTANT_CANCELLED', 'cancellation interrupts remote download header wait');
        attachmentExpect(microtime(true) - $start < 0.7, 'download cancellation does not wait for its full timeout');
        $clean(); usleep(1250000);
        $clear(); $start = microtime(true);
        $budget = $run(array_slice($files, 0, 2), [], null, 'synthetic-user', 'http://127.0.0.1:' . $port . '/budget/v1/chat-messages', 1);
        attachmentError($budget, 'REQUIRED_FILES_TIMEOUT', 'multiple uploads share one deadline');
        attachmentExpect(microtime(true) - $start < 1.4 && count($requests()) === 2, 'second upload receives only remaining request budget');
        $clean(); usleep(700000);
        $clear(); $start = microtime(true);
        $combinedBudget = $run($source('https://storage.synthetic.test/budget-download'), [], null, 'synthetic-user',
            'http://127.0.0.1:' . $port . '/budget/v1/chat-messages', 1);
        attachmentError($combinedBudget, 'REQUIRED_FILES_TIMEOUT', 'download and subsequent upload consume the same deadline');
        attachmentExpect(microtime(true) - $start < 1.4 && count($requests()) === 2, 'upload does not receive a fresh budget after downloading');
        $clean(); usleep(700000);
        $clear();
        attachmentError($run([$files[0]], ['temp_root' => $root . '/public/unsafe-temp']), 'CONFIG_INVALID', 'temporary files cannot be created in public');
        attachmentExpect($requests() === [], 'unsafe temp configuration opens no connection');
        attachmentError($run([['type' => 'image', 'transfer_method' => 'local_file', 'url' => $files[0]['url']]]), 'REQUIRED_FILES_INVALID', 'callers cannot inject upload IDs from other requests');
        $clean();
        echo "Dify required attachment upload: binary multipart, all sources, origins/paths/DNS/pinning/redirects/limits, isolation, cancellation/deadline, cleanup: OK\n";
    } finally {
        if (is_resource($process)) { proc_terminate($process); proc_close($process); }
        attachmentRemoveTree($root, $root);
    }
}