Manage projects, members and services through the API

/api/v1/projects, /members and /services: create, list, show, update,
delete and restore, with the panel's own rules — so the MCP server can
load the collective's work, people and offer without anyone retyping
them into forms. The MCP server picks the tools up from openapi.yaml.

- Relations travel as ids and are replaced whole when sent, left alone
  when not: a project's technology_ids, service_ids and members with
  each one's role; a member's technology_ids; a service's
  technology_ids and project_ids. Record and relations are saved in
  one transaction.
- Publishing stays a permission of its own. Without projects.publish
  or services.publish, published_at, unpublish_at and is_published are
  refused — the fields the panel disables for the same people.
- MemberPolicy still lets someone edit their own profile.
- Uploads accept `for: projects` and `for: members`, landing where the
  panel's own upload fields put them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/Http/Requests/Api/V1/Concerns/GuardsPublication.php

@@ -0,0 +1,33 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Requests\Api\V1\Concerns;
+
+use Illuminate\Validation\Validator;
+
+/**
+ * Publishing is a permission of its own, as in the panel — where these fields
+ * are disabled for whoever lacks it. Here they are refused, so someone who may
+ * write a record still cannot put it on the site, or take it off, alone.
+ */
+trait GuardsPublication
+{
+    /**
+     * @param  array<int, string>  $fields
+     */
+    protected function guardPublication(Validator $validator, string $permission, array $fields): void
+    {
+        $validator->after(function (Validator $validator) use ($permission, $fields): void {
+            if ($this->user()?->can($permission)) {
+                return;
+            }
+
+            foreach ($fields as $field) {
+                if ($this->has($field)) {
+                    $validator->errors()->add($field, __('rules.publication.forbidden'));
+                }
+            }
+        });
+    }
+}

app/Http/Requests/Api/V1/MemberRequest.php

@@ -0,0 +1,66 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Requests\Api\V1;
+
+use App\Models\Member;
+use App\Rules\Translatable;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+/**
+ * The panel's member form, as rules. A name is a person's, the same in every
+ * language, and so is the slug built from it; only the headline and the bio
+ * are translatable.
+ *
+ * `links` is a label → URL map (`{"github": "https://…"}`). `technology_ids`
+ * is replaced whole when sent. Which projects someone is on is set from the
+ * project, where the role belongs.
+ */
+class MemberRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function rules(): array
+    {
+        $member = $this->route('member');
+        $creating = ! $member instanceof Member;
+        $sometimes = $creating ? 'required' : 'sometimes';
+
+        return [
+            'name' => [$sometimes, 'string', 'max:255'],
+            'slug' => [
+                $sometimes,
+                'string',
+                'max:255',
+                'alpha_dash:ascii',
+                Rule::unique('members', 'slug')->ignore($member?->id),
+            ],
+            'headline' => ['sometimes', 'nullable', new Translatable(max: 255)],
+            'bio' => ['sometimes', 'nullable', new Translatable],
+
+            'avatar' => ['sometimes', 'nullable', 'string', 'max:2048'],
+            // Never shown on the site; the panel keeps it for the collective.
+            'email' => ['sometimes', 'nullable', 'email', 'max:255'],
+            'github_username' => ['sometimes', 'nullable', 'string', 'max:120'],
+            'links' => ['sometimes', 'nullable', 'array', 'max:10'],
+            'links.*' => ['nullable', 'url', 'max:2048'],
+
+            'is_public' => ['sometimes', 'boolean'],
+            'is_founder' => ['sometimes', 'boolean'],
+            'joined_at' => ['sometimes', 'nullable', 'date'],
+            'left_at' => ['sometimes', 'nullable', 'date', 'after_or_equal:joined_at'],
+            'position' => ['sometimes', 'integer', 'min:0'],
+
+            'technology_ids' => ['sometimes', 'array'],
+            'technology_ids.*' => ['integer', 'distinct', Rule::exists('technologies', 'id')],
+        ];
+    }
+}

app/Http/Requests/Api/V1/ProjectRequest.php

@@ -0,0 +1,84 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Requests\Api\V1;
+
+use App\Enums\ProjectStatus;
+use App\Http\Requests\Api\V1\Concerns\GuardsPublication;
+use App\Models\Project;
+use App\Rules\Translatable;
+use App\Rules\UniqueTranslatedSlug;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+use Illuminate\Validation\Validator;
+
+/**
+ * The panel's project form, as rules. On update every field is optional
+ * (PATCH semantics) but keeps the same shape.
+ *
+ * Relations travel as ids and are replaced whole when sent: `technology_ids`,
+ * `service_ids`, and `members` with each one's role on the project.
+ */
+class ProjectRequest extends FormRequest
+{
+    use GuardsPublication;
+
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function rules(): array
+    {
+        $project = $this->route('project');
+        $creating = ! $project instanceof Project;
+        $sometimes = $creating ? 'required' : 'sometimes';
+
+        return [
+            'title' => [$sometimes, new Translatable(requireDefaultLocale: $creating, max: 255)],
+            'slug' => [
+                $sometimes,
+                new Translatable(requireDefaultLocale: $creating, max: 255),
+                new UniqueTranslatedSlug(Project::class, $project?->id),
+            ],
+            'tagline' => ['sometimes', 'nullable', new Translatable(max: 300)],
+            'description' => ['sometimes', 'nullable', new Translatable],
+            'decisions' => ['sometimes', 'nullable', new Translatable],
+            'postmortem' => ['sometimes', 'nullable', new Translatable],
+            'meta_title' => ['sometimes', 'nullable', new Translatable(max: 60)],
+            'meta_description' => ['sometimes', 'nullable', new Translatable(max: 160)],
+
+            'status' => ['sometimes', Rule::enum(ProjectStatus::class)],
+            'is_featured' => ['sometimes', 'boolean'],
+            'needs_help' => ['sometimes', 'boolean'],
+            'demo_url' => ['sometimes', 'nullable', 'url', 'max:2048'],
+            'cover_image' => ['sometimes', 'nullable', 'string', 'max:2048'],
+            'cover_image_alt' => ['sometimes', 'nullable', new Translatable(max: 255)],
+            'started_at' => ['sometimes', 'nullable', 'date'],
+            'ended_at' => ['sometimes', 'nullable', 'date', 'after_or_equal:started_at'],
+            'published_at' => ['sometimes', 'nullable', 'date'],
+            'unpublish_at' => ['sometimes', 'nullable', 'date', 'after:published_at'],
+            'position' => ['sometimes', 'integer', 'min:0'],
+
+            'client_id' => ['sometimes', 'nullable', 'integer', Rule::exists('clients', 'id')->whereNull('deleted_at')],
+            'lead_member_id' => ['sometimes', 'nullable', 'integer', Rule::exists('members', 'id')->whereNull('deleted_at')],
+
+            'technology_ids' => ['sometimes', 'array'],
+            'technology_ids.*' => ['integer', 'distinct', Rule::exists('technologies', 'id')],
+            'service_ids' => ['sometimes', 'array'],
+            'service_ids.*' => ['integer', 'distinct', Rule::exists('services', 'id')->whereNull('deleted_at')],
+            'members' => ['sometimes', 'array'],
+            'members.*.id' => ['required', 'integer', 'distinct', Rule::exists('members', 'id')->whereNull('deleted_at')],
+            'members.*.role' => ['nullable', 'string', 'max:120'],
+        ];
+    }
+
+    public function withValidator(Validator $validator): void
+    {
+        $this->guardPublication($validator, 'projects.publish', ['published_at', 'unpublish_at']);
+    }
+}

app/Http/Requests/Api/V1/ServiceRequest.php

@@ -0,0 +1,68 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Requests\Api\V1;
+
+use App\Http\Requests\Api\V1\Concerns\GuardsPublication;
+use App\Models\Service;
+use App\Rules\Translatable;
+use App\Rules\UniqueTranslatedSlug;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+use Illuminate\Validation\Validator;
+
+/**
+ * The panel's service form, as rules. `technology_ids` and `project_ids` are
+ * replaced whole when sent.
+ */
+class ServiceRequest extends FormRequest
+{
+    use GuardsPublication;
+
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function rules(): array
+    {
+        $service = $this->route('service');
+        $creating = ! $service instanceof Service;
+        $sometimes = $creating ? 'required' : 'sometimes';
+
+        return [
+            'title' => [$sometimes, new Translatable(requireDefaultLocale: $creating, max: 255)],
+            'slug' => [
+                $sometimes,
+                new Translatable(requireDefaultLocale: $creating, max: 255),
+                new UniqueTranslatedSlug(Service::class, $service?->id),
+            ],
+            'tagline' => ['sometimes', 'nullable', new Translatable(max: 255)],
+            'description' => ['sometimes', 'nullable', new Translatable],
+            'meta_title' => ['sometimes', 'nullable', new Translatable(max: 60)],
+            'meta_description' => ['sometimes', 'nullable', new Translatable(max: 160)],
+
+            // A name from the icon set the frontend resolves, e.g. `support`.
+            'icon' => ['sometimes', 'nullable', 'string', 'max:120'],
+            'is_featured' => ['sometimes', 'boolean'],
+            'position' => ['sometimes', 'integer', 'min:0'],
+            'is_published' => ['sometimes', 'boolean'],
+            'published_at' => ['sometimes', 'nullable', 'date'],
+            'unpublish_at' => ['sometimes', 'nullable', 'date', 'after:published_at'],
+
+            'technology_ids' => ['sometimes', 'array'],
+            'technology_ids.*' => ['integer', 'distinct', Rule::exists('technologies', 'id')],
+            'project_ids' => ['sometimes', 'array'],
+            'project_ids.*' => ['integer', 'distinct', Rule::exists('projects', 'id')->whereNull('deleted_at')],
+        ];
+    }
+
+    public function withValidator(Validator $validator): void
+    {
+        $this->guardPublication($validator, 'services.publish', ['is_published', 'published_at', 'unpublish_at']);
+    }
+}