Manage projects, members and services through the API

/api/v1/projects, /members and /services: create, list, show, update,
delete and restore, with the panel's own rules — so the MCP server can
load the collective's work, people and offer without anyone retyping
them into forms. The MCP server picks the tools up from openapi.yaml.

- Relations travel as ids and are replaced whole when sent, left alone
  when not: a project's technology_ids, service_ids and members with
  each one's role; a member's technology_ids; a service's
  technology_ids and project_ids. Record and relations are saved in
  one transaction.
- Publishing stays a permission of its own. Without projects.publish
  or services.publish, published_at, unpublish_at and is_published are
  refused — the fields the panel disables for the same people.
- MemberPolicy still lets someone edit their own profile.
- Uploads accept `for: projects` and `for: members`, landing where the
  panel's own upload fields put them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/Http/Controllers/Api/V1/MemberController.php

@@ -0,0 +1,103 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers\Api\V1;
+
+use App\Http\Controllers\Controller;
+use App\Http\Requests\Api\V1\MemberRequest;
+use App\Http\Resources\MemberResource;
+use App\Models\Member;
+use App\Support\TranslatablePayload;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\AnonymousResourceCollection;
+use Illuminate\Support\Facades\DB;
+
+/**
+ * The people in the collective, as the panel edits them. MemberPolicy lets
+ * someone edit their own profile without `members.update`, as in the panel.
+ */
+class MemberController extends Controller
+{
+    protected const WITH = ['avatarMedia', 'technologies', 'projects'];
+
+    /**
+     * Filters: search (name), is_public, trashed.
+     */
+    public function index(Request $request): AnonymousResourceCollection
+    {
+        $this->authorize('viewAny', Member::class);
+
+        $members = Member::query()
+            ->with(self::WITH)
+            ->when($request->filled('search'), fn ($q) => $q->where('name', 'like', '%'.$request->string('search').'%'))
+            ->when($request->has('is_public'), fn ($q) => $q->where('is_public', $request->boolean('is_public')))
+            ->when($request->boolean('trashed'), fn ($q) => $q->onlyTrashed())
+            ->orderBy('position')
+            ->orderBy('name')
+            ->paginate(perPage: min($request->integer('per_page', 25), 100))
+            ->withQueryString();
+
+        return MemberResource::collection($members);
+    }
+
+    public function store(MemberRequest $request): JsonResponse
+    {
+        $this->authorize('create', Member::class);
+
+        return MemberResource::make($this->save(new Member, $request))->response()->setStatusCode(201);
+    }
+
+    public function show(Member $member): MemberResource
+    {
+        $this->authorize('view', $member);
+
+        return MemberResource::make($member->load(self::WITH));
+    }
+
+    public function update(MemberRequest $request, Member $member): MemberResource
+    {
+        $this->authorize('update', $member);
+
+        return MemberResource::make($this->save($member, $request));
+    }
+
+    public function destroy(Member $member): JsonResponse
+    {
+        $this->authorize('delete', $member);
+
+        $member->delete();
+
+        return response()->json(status: 204);
+    }
+
+    public function restore(Member $member): MemberResource
+    {
+        $this->authorize('restore', $member);
+
+        $member->restore();
+
+        return MemberResource::make($member->load(self::WITH));
+    }
+
+    protected function save(Member $member, MemberRequest $request): Member
+    {
+        $data = $request->validated();
+
+        DB::transaction(function () use ($member, $data): void {
+            $member->fill(TranslatablePayload::merge(
+                $member,
+                collect($data)->except('technology_ids')->all(),
+                $member->translatable,
+            ));
+            $member->save();
+
+            if (array_key_exists('technology_ids', $data)) {
+                $member->technologies()->sync($data['technology_ids']);
+            }
+        });
+
+        return $member->load(self::WITH);
+    }
+}

app/Http/Controllers/Api/V1/ProjectController.php

@@ -0,0 +1,122 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers\Api\V1;
+
+use App\Http\Controllers\Controller;
+use App\Http\Requests\Api\V1\ProjectRequest;
+use App\Http\Resources\ProjectResource;
+use App\Models\Project;
+use App\Support\TranslatablePayload;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\AnonymousResourceCollection;
+use Illuminate\Support\Facades\DB;
+
+/**
+ * Projects, as the panel edits them — so the MCP server can load the
+ * collective's work without anyone copying it into a form by hand.
+ */
+class ProjectController extends Controller
+{
+    /** Relations every answer carries, so a client can PATCH back what it read. */
+    protected const WITH = ['coverMedia', 'technologies', 'services', 'members'];
+
+    /**
+     * Filters: status, search (title in the active language), trashed.
+     */
+    public function index(Request $request): AnonymousResourceCollection
+    {
+        $this->authorize('viewAny', Project::class);
+
+        $locale = app()->getLocale();
+
+        $projects = Project::query()
+            ->with(self::WITH)
+            ->when($request->filled('status'), fn ($q) => $q->where('status', $request->string('status')))
+            ->when($request->filled('search'), fn ($q) => $q->where("title->{$locale}", 'like', '%'.$request->string('search').'%'))
+            ->when($request->boolean('trashed'), fn ($q) => $q->onlyTrashed())
+            ->orderBy('position')
+            ->orderByDesc('created_at')
+            ->paginate(perPage: min($request->integer('per_page', 25), 100))
+            ->withQueryString();
+
+        return ProjectResource::collection($projects);
+    }
+
+    public function store(ProjectRequest $request): JsonResponse
+    {
+        $this->authorize('create', Project::class);
+
+        $project = $this->save(new Project, $request);
+
+        return ProjectResource::make($project)->response()->setStatusCode(201);
+    }
+
+    public function show(Project $project): ProjectResource
+    {
+        $this->authorize('view', $project);
+
+        return ProjectResource::make($project->load(self::WITH));
+    }
+
+    public function update(ProjectRequest $request, Project $project): ProjectResource
+    {
+        $this->authorize('update', $project);
+
+        return ProjectResource::make($this->save($project, $request));
+    }
+
+    public function destroy(Project $project): JsonResponse
+    {
+        $this->authorize('delete', $project);
+
+        $project->delete();
+
+        return response()->json(status: 204);
+    }
+
+    public function restore(Project $project): ProjectResource
+    {
+        $this->authorize('restore', $project);
+
+        $project->restore();
+
+        return ProjectResource::make($project->load(self::WITH));
+    }
+
+    /**
+     * The record and its relations in one transaction: a project that saved
+     * but lost its team halfway would be worse than one that did not save.
+     */
+    protected function save(Project $project, ProjectRequest $request): Project
+    {
+        $data = $request->validated();
+
+        DB::transaction(function () use ($project, $data): void {
+            $project->fill(TranslatablePayload::merge(
+                $project,
+                collect($data)->except(['technology_ids', 'service_ids', 'members'])->all(),
+                $project->translatable,
+            ));
+            $project->save();
+
+            if (array_key_exists('technology_ids', $data)) {
+                $project->technologies()->sync($data['technology_ids']);
+            }
+
+            if (array_key_exists('service_ids', $data)) {
+                $project->services()->sync($data['service_ids']);
+            }
+
+            if (array_key_exists('members', $data)) {
+                $project->members()->sync(collect($data['members'])->mapWithKeys(
+                    fn (array $member) => [$member['id'] => ['role' => $member['role'] ?? null]],
+                )->all());
+            }
+        });
+
+        return $project->load(self::WITH);
+    }
+}

app/Http/Controllers/Api/V1/ServiceController.php

@@ -0,0 +1,107 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers\Api\V1;
+
+use App\Http\Controllers\Controller;
+use App\Http\Requests\Api\V1\ServiceRequest;
+use App\Http\Resources\ServiceResource;
+use App\Models\Service;
+use App\Support\TranslatablePayload;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\AnonymousResourceCollection;
+use Illuminate\Support\Facades\DB;
+
+/**
+ * What the collective offers, as the panel edits it.
+ */
+class ServiceController extends Controller
+{
+    protected const WITH = ['technologies', 'projects'];
+
+    /**
+     * Filters: is_published, search (title in the active language), trashed.
+     */
+    public function index(Request $request): AnonymousResourceCollection
+    {
+        $this->authorize('viewAny', Service::class);
+
+        $locale = app()->getLocale();
+
+        $services = Service::query()
+            ->with(self::WITH)
+            ->when($request->has('is_published'), fn ($q) => $q->where('is_published', $request->boolean('is_published')))
+            ->when($request->filled('search'), fn ($q) => $q->where("title->{$locale}", 'like', '%'.$request->string('search').'%'))
+            ->when($request->boolean('trashed'), fn ($q) => $q->onlyTrashed())
+            ->orderBy('position')
+            ->paginate(perPage: min($request->integer('per_page', 25), 100))
+            ->withQueryString();
+
+        return ServiceResource::collection($services);
+    }
+
+    public function store(ServiceRequest $request): JsonResponse
+    {
+        $this->authorize('create', Service::class);
+
+        return ServiceResource::make($this->save(new Service, $request))->response()->setStatusCode(201);
+    }
+
+    public function show(Service $service): ServiceResource
+    {
+        $this->authorize('view', $service);
+
+        return ServiceResource::make($service->load(self::WITH));
+    }
+
+    public function update(ServiceRequest $request, Service $service): ServiceResource
+    {
+        $this->authorize('update', $service);
+
+        return ServiceResource::make($this->save($service, $request));
+    }
+
+    public function destroy(Service $service): JsonResponse
+    {
+        $this->authorize('delete', $service);
+
+        $service->delete();
+
+        return response()->json(status: 204);
+    }
+
+    public function restore(Service $service): ServiceResource
+    {
+        $this->authorize('restore', $service);
+
+        $service->restore();
+
+        return ServiceResource::make($service->load(self::WITH));
+    }
+
+    protected function save(Service $service, ServiceRequest $request): Service
+    {
+        $data = $request->validated();
+
+        DB::transaction(function () use ($service, $data): void {
+            $service->fill(TranslatablePayload::merge(
+                $service,
+                collect($data)->except(['technology_ids', 'project_ids'])->all(),
+                $service->translatable,
+            ));
+            $service->save();
+
+            if (array_key_exists('technology_ids', $data)) {
+                $service->technologies()->sync($data['technology_ids']);
+            }
+
+            if (array_key_exists('project_ids', $data)) {
+                $service->projects()->sync($data['project_ids']);
+            }
+        });
+
+        return $service->load(self::WITH);
+    }
+}