Manage projects, members and services through the API
Some checks failed
Tests / lint (push) Has been cancelled
Tests / test (push) Has been cancelled
Tests / test-postgres (push) Has been cancelled
Tests / mcp (push) Has been cancelled

/api/v1/projects, /members and /services: create, list, show, update,
delete and restore, with the panel's own rules — so the MCP server can
load the collective's work, people and offer without anyone retyping
them into forms. The MCP server picks the tools up from openapi.yaml.

- Relations travel as ids and are replaced whole when sent, left alone
  when not: a project's technology_ids, service_ids and members with
  each one's role; a member's technology_ids; a service's
  technology_ids and project_ids. Record and relations are saved in
  one transaction.
- Publishing stays a permission of its own. Without projects.publish
  or services.publish, published_at, unpublish_at and is_published are
  refused — the fields the panel disables for the same people.
- MemberPolicy still lets someone edit their own profile.
- Uploads accept `for: projects` and `for: members`, landing where the
  panel's own upload fields put them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
2026-09-29 16:07:20 +02:00
parent 6b67c7afd4
commit 82ef2b38dd
19 changed files with 1660 additions and 1 deletions

View File

@@ -0,0 +1,103 @@
<?php
declare(strict_types=1);
namespace App\Http\Controllers\Api\V1;
use App\Http\Controllers\Controller;
use App\Http\Requests\Api\V1\MemberRequest;
use App\Http\Resources\MemberResource;
use App\Models\Member;
use App\Support\TranslatablePayload;
use Illuminate\Http\JsonResponse;
use Illuminate\Http\Request;
use Illuminate\Http\Resources\Json\AnonymousResourceCollection;
use Illuminate\Support\Facades\DB;
/**
* The people in the collective, as the panel edits them. MemberPolicy lets
* someone edit their own profile without `members.update`, as in the panel.
*/
class MemberController extends Controller
{
protected const WITH = ['avatarMedia', 'technologies', 'projects'];
/**
* Filters: search (name), is_public, trashed.
*/
public function index(Request $request): AnonymousResourceCollection
{
$this->authorize('viewAny', Member::class);
$members = Member::query()
->with(self::WITH)
->when($request->filled('search'), fn ($q) => $q->where('name', 'like', '%'.$request->string('search').'%'))
->when($request->has('is_public'), fn ($q) => $q->where('is_public', $request->boolean('is_public')))
->when($request->boolean('trashed'), fn ($q) => $q->onlyTrashed())
->orderBy('position')
->orderBy('name')
->paginate(perPage: min($request->integer('per_page', 25), 100))
->withQueryString();
return MemberResource::collection($members);
}
public function store(MemberRequest $request): JsonResponse
{
$this->authorize('create', Member::class);
return MemberResource::make($this->save(new Member, $request))->response()->setStatusCode(201);
}
public function show(Member $member): MemberResource
{
$this->authorize('view', $member);
return MemberResource::make($member->load(self::WITH));
}
public function update(MemberRequest $request, Member $member): MemberResource
{
$this->authorize('update', $member);
return MemberResource::make($this->save($member, $request));
}
public function destroy(Member $member): JsonResponse
{
$this->authorize('delete', $member);
$member->delete();
return response()->json(status: 204);
}
public function restore(Member $member): MemberResource
{
$this->authorize('restore', $member);
$member->restore();
return MemberResource::make($member->load(self::WITH));
}
protected function save(Member $member, MemberRequest $request): Member
{
$data = $request->validated();
DB::transaction(function () use ($member, $data): void {
$member->fill(TranslatablePayload::merge(
$member,
collect($data)->except('technology_ids')->all(),
$member->translatable,
));
$member->save();
if (array_key_exists('technology_ids', $data)) {
$member->technologies()->sync($data['technology_ids']);
}
});
return $member->load(self::WITH);
}
}

View File

@@ -0,0 +1,122 @@
<?php
declare(strict_types=1);
namespace App\Http\Controllers\Api\V1;
use App\Http\Controllers\Controller;
use App\Http\Requests\Api\V1\ProjectRequest;
use App\Http\Resources\ProjectResource;
use App\Models\Project;
use App\Support\TranslatablePayload;
use Illuminate\Http\JsonResponse;
use Illuminate\Http\Request;
use Illuminate\Http\Resources\Json\AnonymousResourceCollection;
use Illuminate\Support\Facades\DB;
/**
* Projects, as the panel edits them — so the MCP server can load the
* collective's work without anyone copying it into a form by hand.
*/
class ProjectController extends Controller
{
/** Relations every answer carries, so a client can PATCH back what it read. */
protected const WITH = ['coverMedia', 'technologies', 'services', 'members'];
/**
* Filters: status, search (title in the active language), trashed.
*/
public function index(Request $request): AnonymousResourceCollection
{
$this->authorize('viewAny', Project::class);
$locale = app()->getLocale();
$projects = Project::query()
->with(self::WITH)
->when($request->filled('status'), fn ($q) => $q->where('status', $request->string('status')))
->when($request->filled('search'), fn ($q) => $q->where("title->{$locale}", 'like', '%'.$request->string('search').'%'))
->when($request->boolean('trashed'), fn ($q) => $q->onlyTrashed())
->orderBy('position')
->orderByDesc('created_at')
->paginate(perPage: min($request->integer('per_page', 25), 100))
->withQueryString();
return ProjectResource::collection($projects);
}
public function store(ProjectRequest $request): JsonResponse
{
$this->authorize('create', Project::class);
$project = $this->save(new Project, $request);
return ProjectResource::make($project)->response()->setStatusCode(201);
}
public function show(Project $project): ProjectResource
{
$this->authorize('view', $project);
return ProjectResource::make($project->load(self::WITH));
}
public function update(ProjectRequest $request, Project $project): ProjectResource
{
$this->authorize('update', $project);
return ProjectResource::make($this->save($project, $request));
}
public function destroy(Project $project): JsonResponse
{
$this->authorize('delete', $project);
$project->delete();
return response()->json(status: 204);
}
public function restore(Project $project): ProjectResource
{
$this->authorize('restore', $project);
$project->restore();
return ProjectResource::make($project->load(self::WITH));
}
/**
* The record and its relations in one transaction: a project that saved
* but lost its team halfway would be worse than one that did not save.
*/
protected function save(Project $project, ProjectRequest $request): Project
{
$data = $request->validated();
DB::transaction(function () use ($project, $data): void {
$project->fill(TranslatablePayload::merge(
$project,
collect($data)->except(['technology_ids', 'service_ids', 'members'])->all(),
$project->translatable,
));
$project->save();
if (array_key_exists('technology_ids', $data)) {
$project->technologies()->sync($data['technology_ids']);
}
if (array_key_exists('service_ids', $data)) {
$project->services()->sync($data['service_ids']);
}
if (array_key_exists('members', $data)) {
$project->members()->sync(collect($data['members'])->mapWithKeys(
fn (array $member) => [$member['id'] => ['role' => $member['role'] ?? null]],
)->all());
}
});
return $project->load(self::WITH);
}
}

View File

@@ -0,0 +1,107 @@
<?php
declare(strict_types=1);
namespace App\Http\Controllers\Api\V1;
use App\Http\Controllers\Controller;
use App\Http\Requests\Api\V1\ServiceRequest;
use App\Http\Resources\ServiceResource;
use App\Models\Service;
use App\Support\TranslatablePayload;
use Illuminate\Http\JsonResponse;
use Illuminate\Http\Request;
use Illuminate\Http\Resources\Json\AnonymousResourceCollection;
use Illuminate\Support\Facades\DB;
/**
* What the collective offers, as the panel edits it.
*/
class ServiceController extends Controller
{
protected const WITH = ['technologies', 'projects'];
/**
* Filters: is_published, search (title in the active language), trashed.
*/
public function index(Request $request): AnonymousResourceCollection
{
$this->authorize('viewAny', Service::class);
$locale = app()->getLocale();
$services = Service::query()
->with(self::WITH)
->when($request->has('is_published'), fn ($q) => $q->where('is_published', $request->boolean('is_published')))
->when($request->filled('search'), fn ($q) => $q->where("title->{$locale}", 'like', '%'.$request->string('search').'%'))
->when($request->boolean('trashed'), fn ($q) => $q->onlyTrashed())
->orderBy('position')
->paginate(perPage: min($request->integer('per_page', 25), 100))
->withQueryString();
return ServiceResource::collection($services);
}
public function store(ServiceRequest $request): JsonResponse
{
$this->authorize('create', Service::class);
return ServiceResource::make($this->save(new Service, $request))->response()->setStatusCode(201);
}
public function show(Service $service): ServiceResource
{
$this->authorize('view', $service);
return ServiceResource::make($service->load(self::WITH));
}
public function update(ServiceRequest $request, Service $service): ServiceResource
{
$this->authorize('update', $service);
return ServiceResource::make($this->save($service, $request));
}
public function destroy(Service $service): JsonResponse
{
$this->authorize('delete', $service);
$service->delete();
return response()->json(status: 204);
}
public function restore(Service $service): ServiceResource
{
$this->authorize('restore', $service);
$service->restore();
return ServiceResource::make($service->load(self::WITH));
}
protected function save(Service $service, ServiceRequest $request): Service
{
$data = $request->validated();
DB::transaction(function () use ($service, $data): void {
$service->fill(TranslatablePayload::merge(
$service,
collect($data)->except(['technology_ids', 'project_ids'])->all(),
$service->translatable,
));
$service->save();
if (array_key_exists('technology_ids', $data)) {
$service->technologies()->sync($data['technology_ids']);
}
if (array_key_exists('project_ids', $data)) {
$service->projects()->sync($data['project_ids']);
}
});
return $service->load(self::WITH);
}
}

View File

@@ -0,0 +1,33 @@
<?php
declare(strict_types=1);
namespace App\Http\Requests\Api\V1\Concerns;
use Illuminate\Validation\Validator;
/**
* Publishing is a permission of its own, as in the panel — where these fields
* are disabled for whoever lacks it. Here they are refused, so someone who may
* write a record still cannot put it on the site, or take it off, alone.
*/
trait GuardsPublication
{
/**
* @param array<int, string> $fields
*/
protected function guardPublication(Validator $validator, string $permission, array $fields): void
{
$validator->after(function (Validator $validator) use ($permission, $fields): void {
if ($this->user()?->can($permission)) {
return;
}
foreach ($fields as $field) {
if ($this->has($field)) {
$validator->errors()->add($field, __('rules.publication.forbidden'));
}
}
});
}
}

View File

@@ -0,0 +1,66 @@
<?php
declare(strict_types=1);
namespace App\Http\Requests\Api\V1;
use App\Models\Member;
use App\Rules\Translatable;
use Illuminate\Foundation\Http\FormRequest;
use Illuminate\Validation\Rule;
/**
* The panel's member form, as rules. A name is a person's, the same in every
* language, and so is the slug built from it; only the headline and the bio
* are translatable.
*
* `links` is a label → URL map (`{"github": "https://…"}`). `technology_ids`
* is replaced whole when sent. Which projects someone is on is set from the
* project, where the role belongs.
*/
class MemberRequest extends FormRequest
{
public function authorize(): bool
{
return true;
}
/**
* @return array<string, mixed>
*/
public function rules(): array
{
$member = $this->route('member');
$creating = ! $member instanceof Member;
$sometimes = $creating ? 'required' : 'sometimes';
return [
'name' => [$sometimes, 'string', 'max:255'],
'slug' => [
$sometimes,
'string',
'max:255',
'alpha_dash:ascii',
Rule::unique('members', 'slug')->ignore($member?->id),
],
'headline' => ['sometimes', 'nullable', new Translatable(max: 255)],
'bio' => ['sometimes', 'nullable', new Translatable],
'avatar' => ['sometimes', 'nullable', 'string', 'max:2048'],
// Never shown on the site; the panel keeps it for the collective.
'email' => ['sometimes', 'nullable', 'email', 'max:255'],
'github_username' => ['sometimes', 'nullable', 'string', 'max:120'],
'links' => ['sometimes', 'nullable', 'array', 'max:10'],
'links.*' => ['nullable', 'url', 'max:2048'],
'is_public' => ['sometimes', 'boolean'],
'is_founder' => ['sometimes', 'boolean'],
'joined_at' => ['sometimes', 'nullable', 'date'],
'left_at' => ['sometimes', 'nullable', 'date', 'after_or_equal:joined_at'],
'position' => ['sometimes', 'integer', 'min:0'],
'technology_ids' => ['sometimes', 'array'],
'technology_ids.*' => ['integer', 'distinct', Rule::exists('technologies', 'id')],
];
}
}

View File

@@ -0,0 +1,84 @@
<?php
declare(strict_types=1);
namespace App\Http\Requests\Api\V1;
use App\Enums\ProjectStatus;
use App\Http\Requests\Api\V1\Concerns\GuardsPublication;
use App\Models\Project;
use App\Rules\Translatable;
use App\Rules\UniqueTranslatedSlug;
use Illuminate\Foundation\Http\FormRequest;
use Illuminate\Validation\Rule;
use Illuminate\Validation\Validator;
/**
* The panel's project form, as rules. On update every field is optional
* (PATCH semantics) but keeps the same shape.
*
* Relations travel as ids and are replaced whole when sent: `technology_ids`,
* `service_ids`, and `members` with each one's role on the project.
*/
class ProjectRequest extends FormRequest
{
use GuardsPublication;
public function authorize(): bool
{
return true;
}
/**
* @return array<string, mixed>
*/
public function rules(): array
{
$project = $this->route('project');
$creating = ! $project instanceof Project;
$sometimes = $creating ? 'required' : 'sometimes';
return [
'title' => [$sometimes, new Translatable(requireDefaultLocale: $creating, max: 255)],
'slug' => [
$sometimes,
new Translatable(requireDefaultLocale: $creating, max: 255),
new UniqueTranslatedSlug(Project::class, $project?->id),
],
'tagline' => ['sometimes', 'nullable', new Translatable(max: 300)],
'description' => ['sometimes', 'nullable', new Translatable],
'decisions' => ['sometimes', 'nullable', new Translatable],
'postmortem' => ['sometimes', 'nullable', new Translatable],
'meta_title' => ['sometimes', 'nullable', new Translatable(max: 60)],
'meta_description' => ['sometimes', 'nullable', new Translatable(max: 160)],
'status' => ['sometimes', Rule::enum(ProjectStatus::class)],
'is_featured' => ['sometimes', 'boolean'],
'needs_help' => ['sometimes', 'boolean'],
'demo_url' => ['sometimes', 'nullable', 'url', 'max:2048'],
'cover_image' => ['sometimes', 'nullable', 'string', 'max:2048'],
'cover_image_alt' => ['sometimes', 'nullable', new Translatable(max: 255)],
'started_at' => ['sometimes', 'nullable', 'date'],
'ended_at' => ['sometimes', 'nullable', 'date', 'after_or_equal:started_at'],
'published_at' => ['sometimes', 'nullable', 'date'],
'unpublish_at' => ['sometimes', 'nullable', 'date', 'after:published_at'],
'position' => ['sometimes', 'integer', 'min:0'],
'client_id' => ['sometimes', 'nullable', 'integer', Rule::exists('clients', 'id')->whereNull('deleted_at')],
'lead_member_id' => ['sometimes', 'nullable', 'integer', Rule::exists('members', 'id')->whereNull('deleted_at')],
'technology_ids' => ['sometimes', 'array'],
'technology_ids.*' => ['integer', 'distinct', Rule::exists('technologies', 'id')],
'service_ids' => ['sometimes', 'array'],
'service_ids.*' => ['integer', 'distinct', Rule::exists('services', 'id')->whereNull('deleted_at')],
'members' => ['sometimes', 'array'],
'members.*.id' => ['required', 'integer', 'distinct', Rule::exists('members', 'id')->whereNull('deleted_at')],
'members.*.role' => ['nullable', 'string', 'max:120'],
];
}
public function withValidator(Validator $validator): void
{
$this->guardPublication($validator, 'projects.publish', ['published_at', 'unpublish_at']);
}
}

View File

@@ -0,0 +1,68 @@
<?php
declare(strict_types=1);
namespace App\Http\Requests\Api\V1;
use App\Http\Requests\Api\V1\Concerns\GuardsPublication;
use App\Models\Service;
use App\Rules\Translatable;
use App\Rules\UniqueTranslatedSlug;
use Illuminate\Foundation\Http\FormRequest;
use Illuminate\Validation\Rule;
use Illuminate\Validation\Validator;
/**
* The panel's service form, as rules. `technology_ids` and `project_ids` are
* replaced whole when sent.
*/
class ServiceRequest extends FormRequest
{
use GuardsPublication;
public function authorize(): bool
{
return true;
}
/**
* @return array<string, mixed>
*/
public function rules(): array
{
$service = $this->route('service');
$creating = ! $service instanceof Service;
$sometimes = $creating ? 'required' : 'sometimes';
return [
'title' => [$sometimes, new Translatable(requireDefaultLocale: $creating, max: 255)],
'slug' => [
$sometimes,
new Translatable(requireDefaultLocale: $creating, max: 255),
new UniqueTranslatedSlug(Service::class, $service?->id),
],
'tagline' => ['sometimes', 'nullable', new Translatable(max: 255)],
'description' => ['sometimes', 'nullable', new Translatable],
'meta_title' => ['sometimes', 'nullable', new Translatable(max: 60)],
'meta_description' => ['sometimes', 'nullable', new Translatable(max: 160)],
// A name from the icon set the frontend resolves, e.g. `support`.
'icon' => ['sometimes', 'nullable', 'string', 'max:120'],
'is_featured' => ['sometimes', 'boolean'],
'position' => ['sometimes', 'integer', 'min:0'],
'is_published' => ['sometimes', 'boolean'],
'published_at' => ['sometimes', 'nullable', 'date'],
'unpublish_at' => ['sometimes', 'nullable', 'date', 'after:published_at'],
'technology_ids' => ['sometimes', 'array'],
'technology_ids.*' => ['integer', 'distinct', Rule::exists('technologies', 'id')],
'project_ids' => ['sometimes', 'array'],
'project_ids.*' => ['integer', 'distinct', Rule::exists('projects', 'id')->whereNull('deleted_at')],
];
}
public function withValidator(Validator $validator): void
{
$this->guardPublication($validator, 'services.publish', ['is_published', 'published_at', 'unpublish_at']);
}
}

View File

@@ -0,0 +1,65 @@
<?php
declare(strict_types=1);
namespace App\Http\Resources;
use App\Models\Member;
use App\Support\ImagePayload;
use App\Support\TranslatablePayload;
use Illuminate\Http\Request;
use Illuminate\Http\Resources\Json\JsonResource;
/**
* @mixin Member
*/
class MemberResource extends JsonResource
{
/**
* @return array<string, mixed>
*/
public function toArray(Request $request): array
{
$locale = $request->query(config('locales.query_parameter')) ?? app()->getLocale();
return [
'id' => $this->id,
'locale' => $locale,
'name' => $this->name,
'slug' => $this->slug,
...TranslatablePayload::resolve($this->resource, $this->translatable, $locale),
'avatar' => $this->avatar,
'avatar_media' => ImagePayload::make(
$this->avatar,
$this->resource->relationLoaded('avatarMedia') ? $this->resource->getRelation('avatarMedia') : null,
$this->name,
),
'email' => $this->email,
'github_username' => $this->github_username,
'links' => (object) ($this->links ?? []),
'is_public' => (bool) $this->is_public,
'is_founder' => (bool) $this->is_founder,
'joined_at' => $this->joined_at?->toDateString(),
'left_at' => $this->left_at?->toDateString(),
'position' => $this->position,
'technology_ids' => $this->whenLoaded('technologies', fn () => $this->technologies->pluck('id')->values()),
'projects' => $this->whenLoaded('projects', fn () => $this->projects->map(fn ($project) => [
'id' => $project->id,
'title' => $project->getTranslation('title', $locale),
'role' => $project->pivot->role,
])->values()),
'created_at' => $this->created_at?->toIso8601String(),
'updated_at' => $this->updated_at?->toIso8601String(),
'deleted_at' => $this->deleted_at?->toIso8601String(),
'translations' => $this->when(
in_array('translations', explode(',', (string) $request->query('with')), true),
fn () => TranslatablePayload::all($this->resource, $this->translatable),
),
];
}
}

View File

@@ -0,0 +1,70 @@
<?php
declare(strict_types=1);
namespace App\Http\Resources;
use App\Models\Project;
use App\Support\ImagePayload;
use App\Support\TranslatablePayload;
use Illuminate\Http\Request;
use Illuminate\Http\Resources\Json\JsonResource;
/**
* @mixin Project
*/
class ProjectResource extends JsonResource
{
/**
* @return array<string, mixed>
*/
public function toArray(Request $request): array
{
$locale = $request->query(config('locales.query_parameter')) ?? app()->getLocale();
$resolved = TranslatablePayload::resolve($this->resource, $this->translatable, $locale);
return [
'id' => $this->id,
'locale' => $locale,
...$resolved,
'status' => $this->status->value,
'is_featured' => (bool) $this->is_featured,
'needs_help' => (bool) $this->needs_help,
'demo_url' => $this->demo_url,
// The stored path, which is what a client PATCHes back; what was
// derived from it travels alongside, as on a page.
'cover_image' => $this->cover_image,
'cover_image_media' => ImagePayload::make(
$this->cover_image,
$this->resource->relationLoaded('coverMedia') ? $this->resource->getRelation('coverMedia') : null,
$resolved['cover_image_alt'] ?? null,
),
'started_at' => $this->started_at?->toDateString(),
'ended_at' => $this->ended_at?->toDateString(),
'published_at' => $this->published_at?->toIso8601String(),
'unpublish_at' => $this->unpublish_at?->toIso8601String(),
'position' => $this->position,
'client_id' => $this->client_id,
'lead_member_id' => $this->lead_member_id,
'technology_ids' => $this->whenLoaded('technologies', fn () => $this->technologies->pluck('id')->values()),
'service_ids' => $this->whenLoaded('services', fn () => $this->services->pluck('id')->values()),
'members' => $this->whenLoaded('members', fn () => $this->members->map(fn ($member) => [
'id' => $member->id,
'name' => $member->name,
'role' => $member->pivot->role,
])->values()),
'created_at' => $this->created_at?->toIso8601String(),
'updated_at' => $this->updated_at?->toIso8601String(),
'deleted_at' => $this->deleted_at?->toIso8601String(),
'translations' => $this->when(
in_array('translations', explode(',', (string) $request->query('with')), true),
fn () => TranslatablePayload::all($this->resource, $this->translatable),
),
];
}
}

View File

@@ -0,0 +1,50 @@
<?php
declare(strict_types=1);
namespace App\Http\Resources;
use App\Models\Service;
use App\Support\TranslatablePayload;
use Illuminate\Http\Request;
use Illuminate\Http\Resources\Json\JsonResource;
/**
* @mixin Service
*/
class ServiceResource extends JsonResource
{
/**
* @return array<string, mixed>
*/
public function toArray(Request $request): array
{
$locale = $request->query(config('locales.query_parameter')) ?? app()->getLocale();
return [
'id' => $this->id,
'locale' => $locale,
...TranslatablePayload::resolve($this->resource, $this->translatable, $locale),
'icon' => $this->icon,
'is_featured' => (bool) $this->is_featured,
'is_published' => (bool) $this->is_published,
'published_at' => $this->published_at?->toIso8601String(),
'unpublish_at' => $this->unpublish_at?->toIso8601String(),
'position' => $this->position,
'technology_ids' => $this->whenLoaded('technologies', fn () => $this->technologies->pluck('id')->values()),
'project_ids' => $this->whenLoaded('projects', fn () => $this->projects->pluck('id')->values()),
'created_at' => $this->created_at?->toIso8601String(),
'updated_at' => $this->updated_at?->toIso8601String(),
'deleted_at' => $this->deleted_at?->toIso8601String(),
'translations' => $this->when(
in_array('translations', explode(',', (string) $request->query('with')), true),
fn () => TranslatablePayload::all($this->resource, $this->translatable),
),
];
}
}