"""Decode attachments rather than trusting names or browser MIME types."""
import warnings
from PIL import Image
from pypdf import PdfReader


def validate_medical_file(upload, extension):
    stream = upload.stream
    try:
        if extension == 'pdf':
            if stream.read(5) != b'%PDF-':
                return False
            stream.seek(0)
            reader = PdfReader(stream, strict=True)
            if reader.is_encrypted or not 1 <= len(reader.pages) <= 100:
                return False
            root = reader.trailer['/Root']
            if any(key in root for key in ('/OpenAction','/AA','/AcroForm')):
                return False
            names = root.get('/Names', {})
            names = names.get_object() if hasattr(names,'get_object') else names
            if '/JavaScript' in names or '/EmbeddedFiles' in names:
                return False
            for page in reader.pages:
                if '/AA' in page or page.get('/Annots'):
                    return False
            return True
        with warnings.catch_warnings():
            warnings.simplefilter('error', Image.DecompressionBombWarning)
            with Image.open(stream) as img:
                expected = 'PNG' if extension == 'png' else 'JPEG'
                if img.format != expected or img.width * img.height > 25000000:
                    return False
                img.verify()
            stream.seek(0)
            with Image.open(stream) as img:
                img.load()
            return True
    except Exception:
        return False
    finally:
        stream.seek(0)