Manage technologies through the API, with SVG logos

/api/v1/technologies is a full CRUD with the panel's own rules: name and
slug are plain strings, the prose is translatable, `radar_ring: null`
takes one off the radar, and TechnologyPolicy still refuses to delete
one a project, member or call uses. The MCP server picks the tools up
from openapi.yaml on its own.

A logo is an SVG, so POST /v1/media now accepts one — sanitized with
enshrined/svg-sanitize (scripts, event handlers and remote references
removed), and served by Caddy under a Content-Security-Policy that
would stop a script regardless. `for` (pages or technologies) says what
an upload is for, which picks the directory the panel uses for it and
the permission it takes.

Creating a technology without a category answered 500: the column's
default never reached the model, so the response read a null enum. The
controller now states the default, as the panel does.

Beside a file, the MCP upload tool no longer demands the JSON body's
`url`: the body then carries the upload's other fields, such as `for`.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/Http/Controllers/Api/V1/MediaController.php

@@ -9,6 +9,7 @@ use App\Http\Requests\Api\V1\MediaRequest;
 use App\Http\Resources\MediaResource;
 use App\Models\Media;
 use App\Services\Media\RemoteImage;
+use enshrined\svgSanitize\Sanitizer;
 use finfo;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Support\Facades\Storage;
@@ -40,11 +41,14 @@ class MediaController extends Controller
         'image/webp' => 'webp',
         'image/gif' => 'gif',
         'image/avif' => 'avif',
+        'image/svg+xml' => 'svg',
     ];
 
     public function store(MediaRequest $request, RemoteImage $remote): JsonResponse
     {
-        $this->authorize('upload', Media::class);
+        $for = (string) $request->input('for', 'pages');
+
+        $this->authorize('upload', [Media::class, $for]);
 
         $field = $request->hasFile('file') ? 'file' : 'url';
 
@@ -53,16 +57,22 @@ class MediaController extends Controller
             : $remote->fetch((string) $request->string('url'));
 
         $mime = (new finfo(FILEINFO_MIME_TYPE))->buffer($contents) ?: null;
-        $size = @getimagesizefromstring($contents);
 
-        // Both, because each catches what the other misses: the type is read
-        // from the magic bytes, and a file that has them but does not decode
-        // is not an image anybody can render.
-        if ($size === false || ! in_array($mime, (array) config('media.upload.mimes'), true)) {
-            throw ValidationException::withMessages([$field => [__('rules.media.not_an_image')]]);
+        if (! in_array($mime, (array) config('media.upload.mimes'), true)) {
+            $this->refuse($field);
         }
 
-        $path = config('media.upload.directory').'/'.Str::random(40).'.'.self::EXTENSIONS[$mime];
+        if ($mime === 'image/svg+xml') {
+            $contents = $this->sanitize($contents) ?? $this->refuse($field);
+            // A vector has no pixel size; the processor copies it through.
+            $size = [null, null];
+        } else {
+            // The type is read from the magic bytes; this catches a file that
+            // has them but does not decode, which nobody could render either.
+            $size = @getimagesizefromstring($contents) ?: $this->refuse($field);
+        }
+
+        $path = config("media.upload.for.{$for}").'/'.Str::random(40).'.'.self::EXTENSIONS[$mime];
 
         Storage::disk((string) config('media.disk'))->put($path, $contents);
 
@@ -82,4 +92,24 @@ class MediaController extends Controller
 
         return MediaResource::make($media->fresh())->response()->setStatusCode(201);
     }
+
+    /**
+     * An SVG with what could run taken out: scripts, event handlers, and
+     * references to anything outside the file. Null when what is left is not
+     * an SVG at all.
+     */
+    protected function sanitize(string $svg): ?string
+    {
+        $sanitizer = new Sanitizer;
+        $sanitizer->removeRemoteReferences(true);
+
+        $clean = $sanitizer->sanitize($svg);
+
+        return is_string($clean) && str_contains($clean, '<svg') ? $clean : null;
+    }
+
+    protected function refuse(string $field): never
+    {
+        throw ValidationException::withMessages([$field => [__('rules.media.not_an_image')]]);
+    }
 }