SealShare/app/Http/Controllers/DownloadController.php

<?php

namespace App\Http\Controllers;

use App\Models\Share;
use App\Models\ShareFile;
use App\Services\FileEncryptionService;
use App\Services\ShareService;
use GuzzleHttp\Psr7\PumpStream;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Storage;
use Symfony\Component\HttpFoundation\HeaderUtils;
use Symfony\Component\HttpFoundation\StreamedResponse;
use ZipStream\CompressionMethod;
use ZipStream\ZipStream;

class DownloadController extends Controller
{
    public function __construct(
        private FileEncryptionService $encryptionService,
        private ShareService $shareService,
    ) {}

    /**
     * Download all files as a ZIP archive, streamed file by file as it is decrypted: stored without
     * compression, with ZIP64 for files over 4 GB, and never held in memory or written to disk. The
     * private text is left out: it is only ever shown on the page.
     */
    public function download(Request $request, Share $share): StreamedResponse
    {
        abort_if(! $share->isCompleted() || $share->isExpired(), 404);

        $share->load(['files' => fn ($query) => $query->where('is_text', false)]);
        abort_if($share->files->isEmpty(), 404);

        $key = $this->shareService->sessionDecryptionKey($share, $request->session());

        // Counted before the body streams: the session is saved by then.
        abort_unless($this->shareService->claimDownload($share, $request->session()), 404);

        return new StreamedResponse(function () use ($share, $key): void {
            $zip = new ZipStream(
                defaultCompressionMethod: CompressionMethod::STORE,
                defaultEnableZeroHeader: true,
                sendHttpHeaders: false,
                flushOutput: true,
            );

            foreach ($share->files as $file) {
                $chunks = $this->encryptionService->decryptedChunks(
                    Storage::disk('shares')->path($share->token.'/'.basename($file->stored_path)),
                    $key,
                );

                $zip->addFileFromPsr7Stream(fileName: $this->archiveName($file), stream: new PumpStream(function () use ($chunks): string|false {
                    while ($chunks->valid() && $chunks->current() === '') {
                        $chunks->next();
                    }

                    if (! $chunks->valid()) {
                        return false;
                    }

                    $chunk = $chunks->current();
                    $chunks->next();

                    return $chunk;
                }));
            }

            $zip->finish();
        }, 200, [
            'Content-Type' => 'application/zip',
            'Content-Disposition' => HeaderUtils::makeDisposition('attachment', 'share-'.$share->token.'.zip'),
        ]);
    }

    /**
     * Download a single file; never the private text, which is only ever shown on the page.
     */
    public function downloadFile(Request $request, Share $share, ShareFile $shareFile): StreamedResponse
    {
        abort_if(! $share->isCompleted() || $share->isExpired(), 404);
        abort_if($shareFile->share_id !== $share->id || $shareFile->is_text, 404);

        $key = $this->shareService->sessionDecryptionKey($share, $request->session());

        abort_unless($this->shareService->claimDownload($share, $request->session()), 404);

        $encryptedPath = Storage::disk('shares')->path($share->token.'/'.basename($shareFile->stored_path));
        $mimeType = $shareFile->mime_type ?? 'application/octet-stream';

        $headers = [
            'Content-Type' => $mimeType,
            'Content-Disposition' => HeaderUtils::makeDisposition(
                'attachment',
                $shareFile->original_name,
                'download',
            ),
        ];

        if ($shareFile->file_size !== null) {
            $headers['Content-Length'] = $shareFile->file_size;
        }

        return new StreamedResponse(function () use ($encryptedPath, $key): void {
            foreach ($this->encryptionService->decryptedChunks($encryptedPath, $key) as $chunk) {
                echo $chunk;
                flush();
            }
        }, 200, $headers);
    }

    /**
     * A file's path inside the archive: its folder path when it came from a dropped folder, never
     * one that could reach outside the archive.
     */
    private function archiveName(ShareFile $file): string
    {
        $filename = str_replace('\\', '/', $file->relative_path ?: $file->original_name);

        if (str_starts_with($filename, '/') || str_contains($filename, '..')) {
            return basename($filename);
        }

        return $filename;
    }
}