product custom fields

app/Http/Controllers/CustomFieldUploadController.php

@@ -0,0 +1,74 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Crypt;
+use Illuminate\Support\Facades\Validator;
+
+/**
+ * Stores the shopper's photo for a product custom field of type `file` (see
+ * boboko-core's Product::$custom_fields) the moment it's picked on the product
+ * page — before add-to-cart, see custom-field-upload-controller.js.
+ *
+ * Which files are acceptable is a per-site decision (this site: photographs),
+ * so it lives here in the storefront, not in the checkout module. The module's
+ * add-to-cart endpoint only ever receives the opaque `reference` returned
+ * below — an encrypted {disk, path, name, mime} payload, so a shopper can
+ * neither forge a reference to some other private file nor read the path —
+ * and copies it onto the cart line's meta (see Checkout\CartController::
+ * customFieldsMeta()).
+ *
+ * Stored on the private `local` disk: these are customers' personal photos,
+ * never reachable by a public URL. Uploads nobody added to a cart are removed
+ * by the custom-fields:prune-uploads command (see PruneCustomFieldUploads).
+ */
+class CustomFieldUploadController extends Controller
+{
+    public const DISK = 'local';
+
+    public const DIRECTORY = 'custom-field-uploads';
+
+    public const MAX_KILOBYTES = 10240;
+
+    public const EXTENSIONS = ['jpg', 'jpeg', 'png', 'webp', 'heic', 'heif'];
+
+    /**
+     * For the file input's `accept` attribute — same list the server enforces.
+     */
+    public static function accept(): string
+    {
+        return '.'.implode(',.', self::EXTENSIONS);
+    }
+
+    public function store(string $locale, Request $request): JsonResponse
+    {
+        // `label` is the admin-authored field label, only used as the
+        // :attribute in the validation message shown next to that field.
+        $validator = Validator::make(
+            $request->all(),
+            ['file' => ['required', 'file', 'mimes:'.implode(',', self::EXTENSIONS), 'max:'.self::MAX_KILOBYTES]],
+            [],
+            ['file' => (string) $request->input('label', 'file')],
+        );
+
+        if ($validator->fails()) {
+            return response()->json(['error' => $validator->errors()->first('file')], 422);
+        }
+
+        $file = $request->file('file');
+        $path = $file->store(self::DIRECTORY, self::DISK);
+
+        abort_if($path === false, 500);
+
+        return response()->json([
+            'reference' => Crypt::encryptString(json_encode([
+                'disk' => self::DISK,
+                'path' => $path,
+                'name' => $file->getClientOriginalName(),
+                'mime' => $file->getMimeType(),
+            ])),
+        ]);
+    }
+}