Manage technologies through the API, with SVG logos

/api/v1/technologies is a full CRUD with the panel's own rules: name and
slug are plain strings, the prose is translatable, `radar_ring: null`
takes one off the radar, and TechnologyPolicy still refuses to delete
one a project, member or call uses. The MCP server picks the tools up
from openapi.yaml on its own.

A logo is an SVG, so POST /v1/media now accepts one — sanitized with
enshrined/svg-sanitize (scripts, event handlers and remote references
removed), and served by Caddy under a Content-Security-Policy that
would stop a script regardless. `for` (pages or technologies) says what
an upload is for, which picks the directory the panel uses for it and
the permission it takes.

Creating a technology without a category answered 500: the column's
default never reached the model, so the response read a null enum. The
controller now states the default, as the panel does.

Beside a file, the MCP upload tool no longer demands the JSON body's
`url`: the body then carries the upload's other fields, such as `for`.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/Feature/Api/AdminApiContractTest.php

@@ -6,6 +6,7 @@ namespace Tests\Feature\Api;
 
 use App\Models\Category;
 use App\Models\Page;
+use App\Models\Technology;
 use App\Models\User;
 use Database\Seeders\RolePermissionSeeder;
 use Illuminate\Foundation\Testing\RefreshDatabase;
@@ -64,6 +65,7 @@ class AdminApiContractTest extends TestCase
             'pages' => ['path' => '/v1/pages'],
             'categories' => ['path' => '/v1/categories'],
             'users' => ['path' => '/v1/users'],
+            'technologies' => ['path' => '/v1/technologies'],
         ];
     }
 
@@ -72,6 +74,7 @@ class AdminApiContractTest extends TestCase
     {
         $page = Page::factory()->create();
         $category = Category::factory()->create();
+        $technology = Technology::factory()->create();
 
         // One request, one documented path — the URL a real caller hits and
         // the path key that describes it, side by side rather than derived
@@ -82,6 +85,8 @@ class AdminApiContractTest extends TestCase
             'page' => ["/v1/pages/{$page->id}", '/v1/pages/{page}'],
             'categories' => ['/v1/categories', '/v1/categories'],
             'category' => ["/v1/categories/{$category->id}", '/v1/categories/{category}'],
+            'technologies' => ['/v1/technologies', '/v1/technologies'],
+            'technology' => ["/v1/technologies/{$technology->id}", '/v1/technologies/{technology}'],
             'users' => ['/v1/users', '/v1/users'],
             'user' => ["/v1/users/{$this->caller->id}", '/v1/users/{user}'],
             'me' => ['/v1/me', '/v1/me'],

tests/Feature/Api/MediaUploadTest.php

@@ -240,8 +240,7 @@ class MediaUploadTest extends TestCase
     {
         return [
             'text renamed to .jpg' => ['photo.jpg', 'not an image at all'],
-            // Served from this domain, an SVG is a document that can run script.
-            'an SVG' => ['logo.svg', '<svg xmlns="http://www.w3.org/2000/svg"><script>alert(1)</script></svg>'],
+            'HTML renamed to .svg' => ['logo.svg', '<html><body>not a vector</body></html>'],
         ];
     }
 
@@ -260,6 +259,73 @@ class MediaUploadTest extends TestCase
         $this->assertDatabaseCount('media', 0);
     }
 
+    #[Test]
+    public function an_svg_is_stored_with_whatever_could_run_taken_out(): void
+    {
+        $this->actingWithRole('editor');
+
+        $svg = '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 10 10" onload="alert(1)">'
+            .'<script>alert(2)</script>'
+            .'<a href="javascript:alert(3)"><rect width="10" height="10" fill="#21759B"/></a>'
+            .'<image href="https://tracker.example.test/pixel.png"/>'
+            .'</svg>';
+
+        $response = $this->post('/api/v1/media', [
+            'file' => UploadedFile::fake()->createWithContent('logo.svg', $svg),
+        ], ['Accept' => 'application/json'])
+            ->assertCreated()
+            ->assertJsonPath('data.mime', 'image/svg+xml')
+            ->assertJsonPath('data.width', null);
+
+        $stored = Storage::disk((string) config('media.disk'))->get($response->json('data.path'));
+
+        $this->assertStringEndsWith('.svg', $response->json('data.path'));
+        $this->assertStringContainsString('#21759B', $stored);
+
+        foreach (['<script', 'onload', 'javascript:', 'tracker.example.test'] as $removed) {
+            $this->assertStringNotContainsString($removed, $stored);
+        }
+    }
+
+    #[Test]
+    public function an_upload_for_a_technology_lands_where_the_panel_puts_their_logos(): void
+    {
+        $this->actingWithRole('editor');
+
+        $this->post('/api/v1/media', [
+            'file' => UploadedFile::fake()->image('logo.png'),
+            'for' => 'technologies',
+        ], ['Accept' => 'application/json'])
+            ->assertCreated()
+            ->assertJsonPath('data.path', fn (string $path) => str_starts_with($path, 'technologies/'));
+    }
+
+    #[Test]
+    public function it_takes_the_permission_of_the_record_it_is_for(): void
+    {
+        // A writer authors pages but only reads technologies.
+        $this->actingWithRole('writer');
+
+        $this->post('/api/v1/media', [
+            'file' => UploadedFile::fake()->image('logo.png'),
+            'for' => 'technologies',
+        ], ['Accept' => 'application/json'])
+            ->assertForbidden();
+    }
+
+    #[Test]
+    public function it_only_knows_the_records_it_is_told_about(): void
+    {
+        $this->actingWithRole('super_admin');
+
+        $this->post('/api/v1/media', [
+            'file' => UploadedFile::fake()->image('logo.png'),
+            'for' => '../../etc',
+        ], ['Accept' => 'application/json'])
+            ->assertUnprocessable()
+            ->assertJsonValidationErrors('for');
+    }
+
     #[Test]
     public function it_wants_exactly_one_source(): void
     {

tests/Feature/Api/TechnologyApiTest.php

@@ -0,0 +1,165 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests\Feature\Api;
+
+use App\Enums\RadarRing;
+use App\Models\Project;
+use App\Models\Technology;
+use App\Models\User;
+use Database\Seeders\RolePermissionSeeder;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Http\UploadedFile;
+use Illuminate\Support\Facades\Storage;
+use PHPUnit\Framework\Attributes\Test;
+use Tests\FakesPireon;
+use Tests\TestCase;
+
+class TechnologyApiTest extends TestCase
+{
+    use FakesPireon, RefreshDatabase;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        $this->seed(RolePermissionSeeder::class);
+    }
+
+    protected function actingWithRole(string $role): void
+    {
+        $user = User::factory()->create();
+        $user->syncRoles([$role]);
+
+        $this->withHeaders($this->apiHeadersFor($user));
+    }
+
+    #[Test]
+    public function it_creates_a_technology_with_its_prose_in_several_languages(): void
+    {
+        $this->actingWithRole('editor');
+
+        $this->postJson('/api/v1/technologies?lang=es&with=translations', [
+            'name' => 'Kotlin Multiplatform',
+            'slug' => 'kotlin-multiplatform',
+            'category' => 'framework',
+            'radar_ring' => 'trial',
+            'color' => '#7F52FF',
+            'website' => 'https://kotlinlang.org/docs/multiplatform.html',
+            'description' => ['es' => 'Código Kotlin compartido.', 'en' => 'Shared Kotlin code.'],
+        ])
+            ->assertCreated()
+            ->assertJsonPath('data.name', 'Kotlin Multiplatform')
+            ->assertJsonPath('data.radar_ring', 'trial')
+            ->assertJsonPath('data.description', 'Código Kotlin compartido.')
+            ->assertJsonPath('data.translations.description.en', 'Shared Kotlin code.');
+
+        $this->assertSame(RadarRing::Trial, Technology::query()->sole()->radar_ring);
+    }
+
+    #[Test]
+    public function the_logo_is_a_path_from_the_upload_endpoint(): void
+    {
+        Storage::fake((string) config('media.disk'));
+        $this->actingWithRole('editor');
+
+        $path = $this->post('/api/v1/media', [
+            'file' => UploadedFile::fake()->createWithContent(
+                'angular.svg',
+                '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 10 10"><rect width="10" height="10"/></svg>',
+            ),
+            'for' => 'technologies',
+        ], ['Accept' => 'application/json'])->json('data.path');
+
+        $this->postJson('/api/v1/technologies', [
+            'name' => 'Angular',
+            'slug' => 'angular',
+            'logo' => $path,
+        ])
+            ->assertCreated()
+            ->assertJsonPath('data.logo', $path)
+            ->assertJsonPath('data.logo_media.url', fn (string $url) => str_ends_with($url, $path))
+            ->assertJsonPath('data.logo_media.alt', 'Angular');
+    }
+
+    #[Test]
+    public function a_partial_update_leaves_the_rest_alone(): void
+    {
+        $this->actingWithRole('editor');
+
+        $technology = Technology::factory()->create([
+            'name' => 'Laravel',
+            'radar_ring' => RadarRing::Assess,
+            'description' => ['es' => 'Framework PHP.', 'en' => 'PHP framework.'],
+        ]);
+
+        $this->patchJson("/api/v1/technologies/{$technology->id}", [
+            'radar_ring' => 'adopt',
+            'description' => ['ca' => 'Framework PHP.'],
+        ])
+            ->assertOk()
+            ->assertJsonPath('data.name', 'Laravel')
+            ->assertJsonPath('data.radar_ring', 'adopt');
+
+        $this->assertSame('PHP framework.', $technology->fresh()->getTranslation('description', 'en'));
+    }
+
+    #[Test]
+    public function a_ring_can_be_cleared_to_take_it_off_the_radar(): void
+    {
+        $this->actingWithRole('editor');
+
+        $technology = Technology::factory()->create(['radar_ring' => RadarRing::Hold]);
+
+        $this->patchJson("/api/v1/technologies/{$technology->id}", ['radar_ring' => null])
+            ->assertOk()
+            ->assertJsonPath('data.radar_ring', null);
+
+        $this->getJson('/api/v1/technologies?radar_ring=none')
+            ->assertOk()
+            ->assertJsonCount(1, 'data');
+    }
+
+    #[Test]
+    public function slugs_are_unique_and_url_safe(): void
+    {
+        $this->actingWithRole('editor');
+
+        Technology::factory()->create(['slug' => 'react']);
+
+        $this->postJson('/api/v1/technologies', ['name' => 'React', 'slug' => 'react'])
+            ->assertUnprocessable()
+            ->assertJsonValidationErrors('slug');
+
+        $this->postJson('/api/v1/technologies', ['name' => 'Spring Boot', 'slug' => 'spring boot'])
+            ->assertUnprocessable()
+            ->assertJsonValidationErrors('slug');
+    }
+
+    #[Test]
+    public function one_still_in_use_cannot_be_deleted(): void
+    {
+        $this->actingWithRole('editor');
+
+        $technology = Technology::factory()->create();
+        Project::factory()->create()->technologies()->attach($technology);
+
+        $this->deleteJson("/api/v1/technologies/{$technology->id}")->assertForbidden();
+
+        $this->assertModelExists($technology);
+    }
+
+    #[Test]
+    public function a_reader_can_list_but_not_write(): void
+    {
+        $this->actingWithRole('viewer');
+
+        Technology::factory()->create();
+
+        $this->getJson('/api/v1/technologies')->assertOk()->assertJsonCount(1, 'data');
+
+        $this->postJson('/api/v1/technologies', ['name' => 'Flutter', 'slug' => 'flutter'])
+            ->assertForbidden();
+    }
+}