Creating Private file directories inside public files directory

Question

I am developing a custom entity, which has a file field, which accepts .zip files. After the entity save, the contents of the zip file are decompressed into a folder specific to the .zip file, in the public files directory.

I'm am wondering if it is possible to create "private directories", which would act similar to standard Drupal private files...basically I want to restrict access to any file in the directory, but Drupal not knowing what files may be in the directory.

Basically the zip file will contain several .html files, javascript, and css files, which will be launched on the entity view page in an iframe.

Is this even possible?

Would anyone have some possible strategies to accomplish this goal?

I'm not asking how to setup a private file directory for storing and controlling access to single files, as is standard Drupal, I'm asking if it is possible to control access to any random file in a certain directory....inside the public files area.

I'm wanting to manage unmanaged files, by managing the parent directory, not the individual files

I'm open to using the Drupal core private file system, as long as Drupal doesn't have to manage the individual files specifically

Answer 1

Using just Drupal, it's not possible.

It's important to consider what setting store files as public means for Drupal. Essentially, it means Drupal relies on the web server for output of files URLs (vs. it being the gatekeeper to a directory non-accessible from the web server).

As such, to do what you want would require your zip processing code to do extra work of configuring your web server to restrict access (e.g. creating .htaccess files). You would also need some custom code to create proxy URLs paths to any file inside the unpacked zip directory. Lastly, you'd want to take a hard look at possible security vulnerabilities you're opening up by giving users unfettered access to run/view any arbitrary JS/HTML/CSS on your domain.