Safe resume upload validation

<?php

namespace App\Http\Requests;

use Illuminate\Contracts\Validation\Validator;
use Illuminate\Foundation\Http\FormRequest;
use Illuminate\Http\UploadedFile;

class ResumeUploadRequest extends FormRequest
{
    /** Allowed extension => leading bytes every genuine file of that type starts with. */
    private const SIGNATURES = [
        'pdf' => '%PDF-',
        'docx' => "PK\x03\x04",
    ];

    public function authorize(): bool
    {
        return true;
    }

    public function rules(): array
    {
        return [
            'resume' => ['required', 'file', 'max:5120', 'extensions:pdf,docx'],
        ];
    }

    public function after(): array
    {
        return [function (Validator $validator) {
            $file = $this->file('resume');
            if (! $file instanceof UploadedFile || $validator->errors()->has('resume')) {
                return;
            }
            if (! $this->hasValidSignature($file)) {
                $validator->errors()->add('resume', 'This file does not look like a real PDF or DOCX.');
            }
        }];
    }

    private function hasValidSignature(UploadedFile $file): bool
    {
        $expected = self::SIGNATURES[strtolower($file->getClientOriginalExtension())] ?? null;
        $head = file_get_contents($file->getRealPath(), false, null, 0, 8);

        return $expected !== null && is_string($head) && str_starts_with($head, $expected);
    }

    /** Store under a random name on a non-public disk; keep the original name only as data. */
    public function storeResume(): array
    {
        $file = $this->file('resume');
        $ext = strtolower($file->getClientOriginalExtension());
        $path = $file->storeAs('resumes/'.now()->format('Y/m'), bin2hex(random_bytes(16)).'.'.$ext, 'private');

        return [
            'path' => $path,
            'original_name' => mb_substr(basename($file->getClientOriginalName()), 0, 120),
            'size' => $file->getSize(),
        ];
    }
}