Upload Quarantine Ticket Builder

Code

<?php

/*
 * Copyright (c) 2026 Jeffery L. Paris <jparis@phpog.com>.
 * Free for personal and internal use. Paid project use requires visible credit
 * to Jeffery L. Paris. Corporate use requires a paid license fee unless a
 * separate written license states otherwise.
 */

/**
 * Upload Quarantine Ticket Builder.
 *
 * Purpose:
 * Reviews upload metadata and creates a quarantine ticket for later approval,
 * scanning, or rejection.
 *
 * @param array $file_input One $_FILES entry.
 * @param array $allowed_mime_types Approved MIME type list.
 * @param int $max_bytes Maximum accepted upload size.
 * @return array Upload quarantine decision and ticket data.
 */
function ogSnippetUploadQuarantineTicketBuilder(array $file_input, array $allowed_mime_types, int $max_bytes): array {
	$errors = array();
	$original_name = '';
	$tmp_name = '';
	$file_size = 0;
	$mime_type = 'application/octet-stream';

	if (isset($file_input['name']) === true) {
		$original_name = basename((string) $file_input['name']);
	}

	if (isset($file_input['tmp_name']) === true) {
		$tmp_name = (string) $file_input['tmp_name'];
	}

	if (isset($file_input['size']) === true) {
		$file_size = (int) $file_input['size'];
	}

	if (isset($file_input['error']) === false || (int) $file_input['error'] !== UPLOAD_ERR_OK) {
		$errors[] = 'Upload did not complete cleanly.';
	}

	if ($file_size < 1) {
		$errors[] = 'Uploaded file is empty.';
	}

	if ($max_bytes < 1) {
		$errors[] = 'Maximum upload size is not valid.';
	} elseif ($file_size > $max_bytes) {
		$errors[] = 'Uploaded file exceeds the allowed size.';
	}

	if ($tmp_name !== '' && is_file($tmp_name) === true) {
		$finfo = finfo_open(FILEINFO_MIME_TYPE);

		if ($finfo !== false) {
			$detected_type = finfo_file($finfo, $tmp_name);

			if (is_string($detected_type) === true && $detected_type !== '') {
				$mime_type = $detected_type;
			}

			finfo_close($finfo);
		}
	}

	if (in_array($mime_type, $allowed_mime_types, true) === false) {
		$errors[] = 'Uploaded file type is not allowed.';
	}

	$ticket_seed = $original_name.'|'.$file_size.'|'.$mime_type.'|'.microtime(true);
	$ticket_id = hash('sha256', $ticket_seed);

	return array(
		'accepted_for_quarantine' => count($errors) === 0,
		'ticket_id' => $ticket_id,
		'original_name' => $original_name,
		'mime_type' => $mime_type,
		'size_bytes' => $file_size,
		'errors' => $errors
	);
}

$alien_upload = array(
	'name' => 'nostromo-maintenance-log.txt',
	'tmp_name' => '',
	'size' => 4096,
	'error' => UPLOAD_ERR_OK
);
$ticket = ogSnippetUploadQuarantineTicketBuilder($alien_upload, array('text/plain'), 1048576);

echo 'Nostromo quarantine ticket: '.$ticket['ticket_id'];