# Emergency blanket removal (strip all EXIF)
exiftool -all= *.jpg
# Or with ImageMagick
magick mogrify -strip *.jpg

// Node.js + sharp selective handling
import sharp from 'sharp'

export async function safeMetadataClean(inputPath, outputPath) {
  const metadata = await sharp(inputPath).metadata()
  
  // Remove risky EXIF fields while retaining minimal safe info
  await sharp(inputPath)
    .rotate() // normalize orientation from EXIF flag
    .withMetadata({
      // Retain only safe essentials
      icc: 'sRGB', // unify color profile to sRGB
      // Keep or remove copyright based on business policy
    })
    .jpeg({ quality: 90 })
    .toFile(outputPath)
}

#!/bin/bash
# Watch a folder and process incoming files automatically

WATCH_DIR="/path/to/incoming"
OUTPUT_DIR="/path/to/cleaned"
BACKUP_DIR="/path/to/backup"

# Watch for new files via inotify
inotifywait -m -e create --format '%w%f' "$WATCH_DIR" | while read FILE
do
  if [[ "$FILE" =~ \.(jpg|jpeg|png|tiff)$ ]]; then
    echo "Processing: $FILE"
    
    # 1) Backup original
    cp "$FILE" "$BACKUP_DIR/"
    
    # 2) Strip EXIF + apply autorotate
    exiftool -all= -tagsFromFile @ -ColorSpace -Orientation "$FILE"
    
    # 3) Normalize to sRGB + resize
    magick "$FILE" -colorspace sRGB -auto-orient -resize 1920x1920\> \
           -quality 85 "$OUTPUT_DIR/$(basename "$FILE")"
    
    echo "Cleaned: $(basename "$FILE")"
  fi
done

name: Image Metadata Security Check
on: [pull_request]
jobs:
  metadata-audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Install ExifTool
        run: sudo apt-get install -y libimage-exiftool-perl
      - name: Scan for sensitive metadata
        run: |
          if exiftool -r -GPS* . | grep -q "GPS"; then
            echo "::error::GPS metadata found in images" && exit 1
          fi
          if exiftool -r -SerialNumber -CameraOwnerName . | grep -v "ExifTool" | grep -q ":"; then
            echo "::error::Device-specific metadata found" && exit 1
          fi
          echo "Metadata security check passed"

// Example business policy exceptions
const ALLOWED_METADATA_FIELDS = [
  'ImageWidth', 'ImageHeight', 'BitsPerSample',
  'Copyright' // keep company copyright if needed
]

async function businessMetadataPolicy(imagePath, businessContext) {
  const metadata = await extractMetadata(imagePath)
  if (businessContext.type === 'marketing') {
    // Marketing assets may retain copyright and artist
    return cleanMetadata(metadata, [...ALLOWED_METADATA_FIELDS, 'Artist'])
  } else if (businessContext.type === 'user_generated') {
    // UGC: keep only the bare minimum
    return cleanMetadata(metadata, ALLOWED_METADATA_FIELDS.slice(0, 3))
  }
  // Default: strip aggressively
  return stripAllMetadata(metadata)
}

import pLimit from 'p-limit'
const limit = pLimit(4)

async function batchCleanMetadata(imagePaths) {
  const promises = imagePaths.map((p) => limit(() => safeMetadataClean(p, `cleaned_${p}`)))
  const results = await Promise.allSettled(promises)
  results.forEach((r, i) => {
    if (r.status === 'rejected') console.error(`Failed: ${imagePaths[i]}`, r.reason)
  })
}

export const handler = async (event: S3Event) => {
  for (const record of event.Records) {
    const bucket = record.s3.bucket.name
    const key = record.s3.object.key
    if (!isImageFile(key)) continue
    try {
      const imageBuffer = await s3.getObject({ Bucket: bucket, Key: key }).promise()
      const cleanedBuffer = await cleanImageMetadata(imageBuffer.Body)
      await s3.putObject({
        Bucket: `${bucket}-cleaned`,
        Key: key,
        Body: cleanedBuffer,
        ContentType: 'image/jpeg'
      }).promise()
    } catch (error) {
      console.error(`Processing failed for ${key}:`, error)
    }
  }
}

async function auditableMetadataProcessing(imagePath, policy) {
  const startTime = Date.now()
  const originalMetadata = await extractMetadata(imagePath)
  try {
    const cleanedMetadata = await applyPolicy(originalMetadata, policy)
    await logMetadataOperation({
      timestamp: new Date().toISOString(),
      filePath: imagePath,
      operation: 'metadata_cleaning',
      policy: policy.name,
      fieldsRemoved: Object.keys(originalMetadata).filter((k) => !(k in cleanedMetadata)),
      processingTimeMs: Date.now() - startTime,
      status: 'success'
    })
    return cleanedMetadata
  } catch (error) {
    await logMetadataOperation({
      timestamp: new Date().toISOString(),
      filePath: imagePath,
      operation: 'metadata_cleaning',
      status: 'failed',
      error: error.message
    })
    throw error
  }
}