presseportale/app/Services/PressRelease/PressReleaseAttachmentStorage.php

<?php

namespace App\Services\PressRelease;

use Illuminate\Contracts\Filesystem\Filesystem;
use Illuminate\Http\UploadedFile;
use Illuminate\Support\Facades\Storage;
use Illuminate\Support\Str;
use RuntimeException;

/**
 * Storage for press release attachments (PDFs and other documents).
 *
 * Files are stored on the private `local` disk under
 *   press-releases/{id}/attachments/{uuid}-{slug}.{ext}
 *
 * Access is served through a controller which checks publication state or the
 * authenticated user's policy.
 */
class PressReleaseAttachmentStorage
{
    public const MAX_BYTES = 25 * 1024 * 1024;

    /** @var list<string> */
    public const ALLOWED_EXTENSIONS = ['pdf', 'doc', 'docx', 'xls', 'xlsx', 'ppt', 'pptx', 'zip', 'txt'];

    /** @var list<string> */
    public const ALLOWED_MIMES = [
        'application/pdf',
        'application/msword',
        'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
        'application/vnd.ms-excel',
        'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
        'application/vnd.ms-powerpoint',
        'application/vnd.openxmlformats-officedocument.presentationml.presentation',
        'application/zip',
        'application/x-zip-compressed',
        'text/plain',
    ];

    /**
     * Store the uploaded attachment for the given press release.
     *
     * @return array{disk:string,path:string,original_name:string,mime:string,size:int}
     */
    public function store(UploadedFile $upload, int $pressReleaseId, string $diskName = 'local'): array
    {
        $this->assertValidUpload($upload);

        $extension = strtolower($upload->getClientOriginalExtension() ?: $upload->extension());
        $originalName = $upload->getClientOriginalName();
        $baseSlug = Str::slug(pathinfo($originalName, PATHINFO_FILENAME)) ?: 'attachment';
        $baseSlug = Str::limit($baseSlug, 60, '');

        $directory = sprintf('press-releases/%d/attachments', $pressReleaseId);
        $filename = Str::uuid()->toString().'-'.$baseSlug.'.'.$extension;
        $relativePath = $directory.'/'.$filename;

        $disk = $this->disk($diskName);
        $stream = fopen($upload->getRealPath(), 'r');

        if ($stream === false) {
            throw new RuntimeException('Could not open uploaded file stream.');
        }

        try {
            $written = $disk->put($relativePath, $stream, $diskName === 'public' ? 'public' : 'private');
        } finally {
            if (is_resource($stream)) {
                fclose($stream);
            }
        }

        // Die Disks sind mit throw=false konfiguriert: Ein fehlgeschlagener
        // Schreibvorgang (voller Datenträger, Rechte) kommt nur als false
        // zurück. Ohne Prüfung entstünde ein Datensatz, dessen Datei nie
        // existiert hat (F23).
        if (! $written) {
            throw new RuntimeException('Der Anhang konnte nicht gespeichert werden.');
        }

        return [
            'disk' => $diskName,
            'path' => $relativePath,
            'original_name' => $originalName,
            'mime' => $upload->getMimeType() ?: 'application/octet-stream',
            'size' => $upload->getSize() ?: 0,
        ];
    }

    public function delete(string $disk, string $path): void
    {
        if (blank($path)) {
            return;
        }

        try {
            Storage::disk($disk)->delete($path);
        } catch (\Throwable) {
            // Swallow — deletion is best-effort; a missing file is acceptable.
        }
    }

    private function assertValidUpload(UploadedFile $upload): void
    {
        $extension = strtolower($upload->getClientOriginalExtension() ?: $upload->extension());

        if (! in_array($extension, self::ALLOWED_EXTENSIONS, true)) {
            throw new RuntimeException('Unsupported attachment extension: '.$extension);
        }

        $mime = $upload->getMimeType();

        if ($mime === null || ! in_array($mime, self::ALLOWED_MIMES, true)) {
            throw new RuntimeException('Unsupported attachment MIME type: '.($mime ?? 'unknown'));
        }

        if ($upload->getSize() > self::MAX_BYTES) {
            throw new RuntimeException('Attachment exceeds maximum size.');
        }
    }

    private function disk(string $diskName): Filesystem
    {
        return Storage::disk($diskName);
    }
}