From 7246e12c4a1743e724d82778cd17e679dbb92771 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=EC=9C=A0=EC=B0=BD=EC=9A=B1?= <changukyu@gmail.com>
Date: Sat, 11 Jul 2026 23:50:08 +0900
Subject: [PATCH] feat(cloud): gd image re-encode (strip payload, uuid, hash)

---
 cloud/src/Ingest/ImageProcessor.php | 25 +++++++++++++++++++++++++
 cloud/tests/ImageProcessorTest.php  | 28 ++++++++++++++++++++++++++++
 2 files changed, 53 insertions(+)
 create mode 100644 cloud/src/Ingest/ImageProcessor.php
 create mode 100644 cloud/tests/ImageProcessorTest.php

diff --git a/cloud/src/Ingest/ImageProcessor.php b/cloud/src/Ingest/ImageProcessor.php
new file mode 100644
index 0000000..f2e4fff
--- /dev/null
+++ b/cloud/src/Ingest/ImageProcessor.php
@@ -0,0 +1,25 @@
+<?php
+declare(strict_types=1);
+namespace App\Ingest;
+
+final class ImageProcessor
+{
+    public static function reencode(string $base64, int $quality = 80): array
+    {
+        $raw = base64_decode($base64, true);
+        if ($raw === false || $raw === '') return ['ok' => false];
+        $im = @imagecreatefromstring($raw);
+        if ($im === false) return ['ok' => false];
+        ob_start();
+        $ok = imagejpeg($im, null, $quality);
+        $bytes = (string)ob_get_clean();
+        imagedestroy($im);
+        if (!$ok || $bytes === '') return ['ok' => false];
+        return [
+            'ok' => true,
+            'bytes' => $bytes,
+            'uuid' => bin2hex(random_bytes(16)),
+            'hash' => hash('sha256', $bytes),
+        ];
+    }
+}
diff --git a/cloud/tests/ImageProcessorTest.php b/cloud/tests/ImageProcessorTest.php
new file mode 100644
index 0000000..d21dfef
--- /dev/null
+++ b/cloud/tests/ImageProcessorTest.php
@@ -0,0 +1,28 @@
+<?php
+declare(strict_types=1);
+namespace App\Tests;
+use App\Ingest\ImageProcessor;
+use PHPUnit\Framework\TestCase;
+
+final class ImageProcessorTest extends TestCase
+{
+    private function tinyJpegBase64(): string {
+        $im = imagecreatetruecolor(8, 8);
+        ob_start(); imagejpeg($im); $bytes = ob_get_clean(); imagedestroy($im);
+        return base64_encode($bytes);
+    }
+    public function testReencodeProducesJpeg(): void {
+        $r = ImageProcessor::reencode($this->tinyJpegBase64());
+        $this->assertTrue($r['ok']);
+        $this->assertSame("\xFF\xD8", substr($r['bytes'], 0, 2)); // JPEG magic
+        $this->assertSame(32, strlen($r['uuid']));
+        $this->assertSame(64, strlen($r['hash']));
+    }
+    public function testRejectsNonImage(): void {
+        $r = ImageProcessor::reencode(base64_encode("not an image <?php echo 1; ?>"));
+        $this->assertFalse($r['ok']);
+    }
+    public function testRejectsBadBase64(): void {
+        $this->assertFalse(ImageProcessor::reencode('%%%not-base64%%%')['ok']);
+    }
+}