3dealer/app/Http/Controllers/CustomFieldUploadController.php

<?php

namespace App\Http\Controllers;

use Illuminate\Http\Request;
use Modules\Core\File\Http\Controllers\UploadFileController;

/**
 * Stores the shopper's photo for a product custom field of type `file` (see
 * boboko-core's Product::$custom_fields) the moment it's picked on the product
 * page — before add-to-cart, see custom-field-upload-controller.js.
 *
 * Which files are acceptable (extensions, size) is a per-site decision — this
 * site: photographs — so it lives here as this app's own policy, extending
 * boboko-core's Modules\Core\File\Http\Controllers\UploadFileController for
 * the actual store()/validate()/respond() mechanics. The module's add-to-cart
 * endpoint only ever receives the stored File row's own `id` — FileService is
 * the single source of truth for disk/path/name/mime, never duplicated into
 * cart/order line meta (see Checkout\CartController::customFieldsMeta()). A
 * shopper can't point a cart line at someone else's file: CartController only
 * accepts an id that is both unowned and tagged with this exact PURPOSE.
 *
 * Stored on the private `local` disk: these are customers' personal photos,
 * never reachable by a public URL except through FileService's own signed
 * download route. Uploads nobody adds to a cart are removed by core's
 * `boboko:file:prune-unowned custom-field-upload` command.
 */
class CustomFieldUploadController extends UploadFileController
{
    public const PURPOSE = 'custom-field-upload';

    public const MAX_KILOBYTES = 10240;

    public const EXTENSIONS = ['jpg', 'jpeg', 'png', 'webp', 'heic', 'heif'];

    /**
     * For the file input's `accept` attribute — same list the server enforces.
     */
    public static function accept(): string
    {
        return '.'.implode(',.', self::EXTENSIONS);
    }

    protected function purpose(): string
    {
        return self::PURPOSE;
    }

    protected function validationRules(Request $request): array
    {
        return [
            'file' => ['required', 'file', 'mimes:'.implode(',', self::EXTENSIONS), 'max:'.self::MAX_KILOBYTES],
        ];
    }

    // `label` is the admin-authored field label, only used as the
    // :attribute in the validation message shown next to that field.
    protected function validationAttributes(Request $request): array
    {
        return ['file' => (string) $request->input('label', 'file')];
    }
}