package identity

import (
	"bytes"
	"image"
	_ "image/jpeg"
	_ "image/png"

	merrors "git.sendico.io/tech/sxchnge/shared/errors"
)

const MaxPhotoBytes = 10 << 20

// ValidatePhoto repeats client checks at the trust boundary and bounds decoder
// memory before decoding pixels. File names and client MIME types are ignored.
func ValidatePhoto(data []byte) error {
	if len(data) == 0 || len(data) > MaxPhotoBytes {
		return merrors.InvalidArgument("photo must be between 1 byte and 10 MiB")
	}
	config, format, err := image.DecodeConfig(bytes.NewReader(data))
	if err != nil || (format != "jpeg" && format != "png") {
		return merrors.InvalidArgument("readable JPEG or PNG required")
	}
	if config.Width < 600 || config.Height < 600 || int64(config.Width)*int64(config.Height) > 40000000 {
		return merrors.InvalidArgument("photo dimensions must be at least 600 by 600 and at most 40 megapixels")
	}
	if _, _, err = image.Decode(bytes.NewReader(data)); err != nil {
		return merrors.InvalidArgument("readable JPEG or PNG required")
	}
	return nil
}