MIME Policy Enforcement Map

Code

<?php

/*
 * Copyright (c) 2026 Jeffery L. Paris <jparis@phpog.com>.
 * Free for personal and internal use. Paid project use requires visible credit
 * to Jeffery L. Paris. Corporate use requires a paid license fee unless a
 * separate written license states otherwise.
 */

/**
 * MIME Policy Enforcement Map.
 *
 * Purpose:
 * Maps uploaded filenames and detected MIME values to allow, reject, or review decisions.
 *
 * @param array $upload_rows Upload rows with filename and mime values.
 * @param array $allowed_mime_by_extension MIME allowlist keyed by extension.
 * @return array Enforcement decisions.
 */
function ogSnippetMimePolicyEnforcementMap(array $upload_rows, array $allowed_mime_by_extension): array {
	$decisions = array();
	foreach ($upload_rows as $upload_row) {
		$filename = (string) $upload_row['filename'];
		$mime = strtolower(trim((string) $upload_row['mime']));
		$extension = strtolower(pathinfo($filename, PATHINFO_EXTENSION));
		$decision = 'reject';
		$reason = 'extension_not_allowed';
		if (isset($allowed_mime_by_extension[$extension])) {
			if (in_array($mime, $allowed_mime_by_extension[$extension], true)) {
				$decision = 'allow';
				$reason = 'mime_matches_extension';
			} else {
				$reason = 'mime_mismatch';
			}
		}
		$decisions[] = array('filename' => $filename, 'mime' => $mime, 'decision' => $decision, 'reason' => $reason);
	}
	return $decisions;
}

$uploads = array(array('filename' => 'chevron-map.svg', 'mime' => 'image/svg+xml'));
$policy = array('svg' => array('image/svg+xml'), 'webp' => array('image/webp'));
$mime_map = ogSnippetMimePolicyEnforcementMap($uploads, $policy);
echo $mime_map[0]['decision'];