multica/server/internal/storage/local.go

package storage

import (
	"bytes"
	"context"
	"encoding/json"
	"fmt"
	"io"
	"log/slog"
	"net/http"
	"net/url"
	"os"
	"path/filepath"
	"strings"
)

type LocalStorage struct {
	uploadDir string
	baseURL   string
}

// metaSuffix is the on-disk extension for the sidecar JSON file that
// captures an upload's original filename and sniffed content type. The
// sidecar exists so ServeFile can set Content-Disposition the way S3's
// PutObject path already does, instead of letting the browser fall back
// to the storage-key basename for the download filename.
const metaSuffix = ".meta.json"

// tempSuffix is the on-disk extension of the staging file writeAtomic renames
// into place. Deterministic per key so a crash leftover stays reclaimable —
// see tempPath.
const tempSuffix = ".tmp"

type localMeta struct {
	Filename    string `json:"filename"`
	ContentType string `json:"content_type"`
}

// NewLocalStorageFromEnv creates a LocalStorage from environment variables.
// Returns nil if upload directory cannot be created.
//
// Environment variables:
//   - LOCAL_UPLOAD_DIR (default: "./data/uploads")
//   - LOCAL_UPLOAD_BASE_URL (optional, e.g., "http://localhost:8080")
func NewLocalStorageFromEnv() *LocalStorage {
	uploadDir := os.Getenv("LOCAL_UPLOAD_DIR")
	if uploadDir == "" {
		uploadDir = "./data/uploads"
	}

	if err := os.MkdirAll(uploadDir, 0755); err != nil {
		slog.Error("failed to create upload directory", "dir", uploadDir, "error", err)
		return nil
	}

	baseURL := strings.TrimSuffix(os.Getenv("LOCAL_UPLOAD_BASE_URL"), "/")

	slog.Info("local storage initialized", "dir", uploadDir, "baseURL", baseURL)
	return &LocalStorage{
		uploadDir: uploadDir,
		baseURL:   baseURL,
	}
}

func (s *LocalStorage) CdnDomain() string {
	if s.baseURL == "" {
		return ""
	}
	u, err := url.Parse(s.baseURL)
	if err != nil {
		return ""
	}
	return u.Hostname()
}

func (s *LocalStorage) KeyFromURL(rawURL string) string {
	if s.baseURL != "" && strings.HasPrefix(rawURL, s.baseURL) {
		rawURL = strings.TrimPrefix(rawURL, s.baseURL)
	}

	prefix := "/uploads/"
	if idx := strings.Index(rawURL, prefix); idx >= 0 {
		return rawURL[idx+len(prefix):]
	}
	if i := strings.LastIndex(rawURL, "/"); i >= 0 {
		return rawURL[i+1:]
	}
	return rawURL
}

// GetReader opens the underlying file for streaming. Refuses keys that
// resolve outside uploadDir (defense against a stored key with traversal
// components) and refuses the sidecar suffix so /content can't be coaxed
// into leaking the .meta.json blob.
func (s *LocalStorage) GetReader(ctx context.Context, key string) (io.ReadCloser, error) {
	if key == "" {
		return nil, fmt.Errorf("local GetReader: empty key")
	}
	if isInternalLocalPath(key) {
		return nil, fmt.Errorf("local GetReader: refusing to serve internal key %q", key)
	}
	filePath := filepath.Join(s.uploadDir, key)
	if !isUnder(s.uploadDir, filePath) {
		return nil, fmt.Errorf("local GetReader: key escapes upload dir: %q", key)
	}
	f, err := os.Open(filePath)
	if err != nil {
		return nil, fmt.Errorf("local GetReader: %w", err)
	}
	return f, nil
}

func (s *LocalStorage) Delete(ctx context.Context, key string) {
	if err := s.DeleteObject(ctx, key); err != nil {
		slog.Error("local storage Delete failed", "key", key, "error", err)
	}
}

// DeleteObject is Delete with the error surfaced — the media reconciler needs
// it to keep the ledger row and schedule a retry instead of assuming success.
// A missing file is success (the delete is idempotent). The staging file is
// removed too: a crash between write and rename leaves one behind, and this is
// what reclaims it (the media ledger records the intent before the upload, so
// the reconciler always reaches this delete for an abandoned key).
func (s *LocalStorage) DeleteObject(_ context.Context, key string) error {
	if key == "" {
		return nil
	}
	filePath := filepath.Join(s.uploadDir, key)
	for _, p := range []string{filePath, filePath + metaSuffix, tempPath(filePath)} {
		if err := os.Remove(p); err != nil && !os.IsNotExist(err) {
			return err
		}
	}
	return nil
}

// ObjectURL returns the URL a successful Upload/UploadStream of key would
// return — a pure function of configuration, so the media intent ledger can
// persist it BEFORE the upload.
func (s *LocalStorage) ObjectURL(key string) string {
	if s.baseURL != "" {
		return fmt.Sprintf("%s/uploads/%s", s.baseURL, key)
	}
	return fmt.Sprintf("/uploads/%s", key)
}

func (s *LocalStorage) DeleteKeys(ctx context.Context, keys []string) {
	for _, key := range keys {
		s.Delete(ctx, key)
	}
}

func (s *LocalStorage) Upload(ctx context.Context, key string, data []byte, contentType string, filename string) (string, error) {
	dest := filepath.Join(s.uploadDir, key)
	if err := writeAtomic(dest, bytes.NewReader(data)); err != nil {
		return "", err
	}
	// Best-effort sidecar so ServeFile can restore the original filename in
	// Content-Disposition. A failure here is logged but does not fail the
	// upload — the file is still usable, just without the human-readable
	// download name. Skip when there's no filename to preserve: a sidecar
	// without a filename is dead weight, since ServeFile only reads it for
	// that field.
	if filename != "" {
		body, _ := json.Marshal(localMeta{Filename: filename, ContentType: contentType})
		if err := os.WriteFile(dest+metaSuffix, body, 0644); err != nil {
			slog.Error("local storage meta write failed", "key", key, "error", err)
		}
	}

	if s.baseURL != "" {
		return fmt.Sprintf("%s/uploads/%s", s.baseURL, key), nil
	}
	return fmt.Sprintf("/uploads/%s", key), nil
}

func (s *LocalStorage) UploadStream(ctx context.Context, key string, data io.Reader, _ int64, contentType string, filename string) (string, error) {
	dest := filepath.Join(s.uploadDir, key)
	if err := writeAtomic(dest, data); err != nil {
		return "", err
	}
	if filename != "" {
		body, _ := json.Marshal(localMeta{Filename: filename, ContentType: contentType})
		if err := os.WriteFile(dest+metaSuffix, body, 0644); err != nil {
			slog.Error("local storage meta write failed", "key", key, "error", err)
		}
	}

	if s.baseURL != "" {
		return fmt.Sprintf("%s/uploads/%s", s.baseURL, key), nil
	}
	return fmt.Sprintf("/uploads/%s", key), nil
}

// writeAtomic writes src through a temp file in the destination directory and
// renames it into place. Writing straight to dest would truncate an existing
// object up front, so a write that fails mid-copy would destroy a
// previously-successful upload of the same key (and the old cleanup even
// removed it outright) — an attachment row could then point at a file that no
// longer exists. With rename-into-place a failed write only discards its own
// temp file and the existing object survives untouched. Both upload paths go
// through here so neither can reintroduce the destructive shape.
func writeAtomic(dest string, src io.Reader) error {
	if err := os.MkdirAll(filepath.Dir(dest), 0755); err != nil {
		return fmt.Errorf("local storage MkdirAll: %w", err)
	}
	tmp := tempPath(dest)
	// 0644 at open, matching the mode the direct write used (os.CreateTemp
	// would make it 0600 and need a chmod that some mounts refuse).
	f, err := os.OpenFile(tmp, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0644)
	if err != nil {
		return fmt.Errorf("local storage create temp: %w", err)
	}
	if _, err := io.Copy(f, src); err != nil {
		_ = f.Close()
		_ = os.Remove(tmp)
		return fmt.Errorf("local storage stream copy: %w", err)
	}
	if err := f.Close(); err != nil {
		_ = os.Remove(tmp)
		return fmt.Errorf("local storage Close: %w", err)
	}
	if err := os.Rename(tmp, dest); err != nil {
		_ = os.Remove(tmp)
		return fmt.Errorf("local storage Rename: %w", err)
	}
	return nil
}

// tempPath is the staging file writeAtomic renames into place. It is derived
// from the object key rather than randomized (os.CreateTemp) so a crash
// between the write and the rename leaves a file the delete path can still
// find: DeleteObject removes it alongside the object, which means the media
// intent ledger reclaims it too — the ledger row is written before the upload,
// so the reconciler deletes the key and the leftover goes with it. A random
// suffix would leave an orphan nothing could name, up to the 100 MiB resource
// cap each, with no bound across crashes.
//
// The name is stable per key, so two concurrent writers of the SAME key would
// share it. That does not occur here — media keys are per (chat message,
// resource) and resolved once, and every other upload path mints a fresh UUID
// key — and such writers already raced on the destination itself.
func tempPath(dest string) string {
	return filepath.Join(filepath.Dir(dest), "."+filepath.Base(dest)+tempSuffix)
}

// isInternalLocalPath reports whether key names one of the local backend's own
// files — the .meta.json sidecar or a .<name>.tmp staging file — rather than an
// object. Read paths take the key straight from the request URL, so both must
// be unreachable: a staging file would otherwise expose a half-written body.
// Object keys are server-generated (UUID or hash basenames) and never start
// with a dot, so a user uploading "notes.tmp" (key "<uuid>.tmp") is unaffected.
func isInternalLocalPath(key string) bool {
	if strings.HasSuffix(key, metaSuffix) {
		return true
	}
	base := filepath.Base(key)
	return strings.HasPrefix(base, ".") && strings.HasSuffix(base, tempSuffix)
}

func (s *LocalStorage) GetFilePath(key string) string {
	return filepath.Join(s.uploadDir, key)
}

func (s *LocalStorage) ServeFile(w http.ResponseWriter, r *http.Request, filename string) {
	// The sidecar and the staging file are implementation details of the local
	// backend; refuse to serve them directly so /uploads/<key>.meta.json (or a
	// half-written .<key>.tmp) doesn't become a stable read API. Comes before
	// any disk work so a path-traversal attempt at a sibling can't trigger an
	// out-of-tree read.
	if isInternalLocalPath(filename) {
		http.NotFound(w, r)
		return
	}

	filePath := filepath.Join(s.uploadDir, filename)
	// filepath.Join cleans the path but doesn't enforce containment, so a
	// caller passing "../etc/passwd" lands outside uploadDir. http.ServeFile
	// rejects such requests on r.URL.Path, but readLocalMeta runs first —
	// without this guard a crafted path could trigger a stray disk read on
	// an arbitrary <some-path>.meta.json before the 400 lands.
	if !isUnder(s.uploadDir, filePath) {
		http.NotFound(w, r)
		return
	}
	slog.Info("serving file", "filename", filename, "filepath", filePath)

	// Mirror the S3 Upload path: when sidecar metadata exists for this key,
	// set Content-Disposition with the original uploaded filename. Without
	// it, browsers download the file under the storage-key basename (the
	// UUID + extension) instead of the human-readable name the uploader
	// chose. Uploads from before the sidecar landed have no .meta.json on
	// disk and fall through to the existing behavior.
	if meta, ok := readLocalMeta(filePath); ok && meta.Filename != "" {
		w.Header().Set("Content-Disposition", ContentDisposition(meta.ContentType, meta.Filename))
	}

	// Use http.ServeFile which has built-in path traversal protection
	// It sanitizes the path and prevents access outside the directory
	http.ServeFile(w, r, filePath)
}

// isUnder reports whether target resolves to a path inside dir (or equal to
// it). Both inputs are passed through filepath.Clean so trailing slashes and
// "." segments don't fool the comparison.
func isUnder(dir, target string) bool {
	rel, err := filepath.Rel(filepath.Clean(dir), filepath.Clean(target))
	if err != nil {
		return false
	}
	return rel != ".." && !strings.HasPrefix(rel, ".."+string(filepath.Separator))
}

func readLocalMeta(filePath string) (localMeta, bool) {
	body, err := os.ReadFile(filePath + metaSuffix)
	if err != nil {
		return localMeta{}, false
	}
	var meta localMeta
	if err := json.Unmarshal(body, &meta); err != nil {
		return localMeta{}, false
	}
	return meta, true
}

func (s *LocalStorage) UploadFromReader(ctx context.Context, key string, reader io.Reader, contentType string, filename string) (string, error) {
	data, err := io.ReadAll(reader)
	if err != nil {
		return "", fmt.Errorf("local storage ReadAll: %w", err)
	}

	return s.Upload(ctx, key, data, contentType, filename)
}