<?php

namespace App\Services;

use Illuminate\Http\UploadedFile;
use Illuminate\Support\Str;

/**
 * Scaffolded ahead of any actual upload feature (e.g. avatars) so hardening
 * isn't an afterthought bolted on later. Not wired to a route yet.
 */
class FileUploadValidator
{
    private const ALLOWED_MIME_TYPES = [
        'image/jpeg',
        'image/png',
        'image/webp',
    ];

    private const MAX_BYTES = 5 * 1024 * 1024; // 5MB

    public function validate(UploadedFile $file): bool
    {
        if ($file->getSize() > self::MAX_BYTES) {
            return false;
        }

        // Sniff actual content type rather than trusting the client-supplied
        // extension or Content-Type header.
        return in_array($file->getMimeType(), self::ALLOWED_MIME_TYPES, true);
    }

    /**
     * A randomized filename that never trusts the client-supplied name.
     */
    public function randomizedFilename(UploadedFile $file): string
    {
        return Str::uuid().'.'.$file->extension();
    }
}