Josep Piguillem
ac546eba2b
/api/v1/technologies is a full CRUD with the panel's own rules: name and slug are plain strings, the prose is translatable, `radar_ring: null` takes one off the radar, and TechnologyPolicy still refuses to delete one a project, member or call uses. The MCP server picks the tools up from openapi.yaml on its own. A logo is an SVG, so POST /v1/media now accepts one — sanitized with enshrined/svg-sanitize (scripts, event handlers and remote references removed), and served by Caddy under a Content-Security-Policy that would stop a script regardless. `for` (pages or technologies) says what an upload is for, which picks the directory the panel uses for it and the permission it takes. Creating a technology without a category answered 500: the column's default never reached the model, so the response read a null enum. The controller now states the default, as the panel does. Beside a file, the MCP upload tool no longer demands the JSON body's `url`: the body then carries the upload's other fields, such as `for`. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
48 lines
1.3 KiB
PHP
48 lines
1.3 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Policies;
|
|
|
|
use App\Models\User;
|
|
|
|
class MediaPolicy extends ResourcePolicy
|
|
{
|
|
protected function resource(): string
|
|
{
|
|
return 'media';
|
|
}
|
|
|
|
/**
|
|
* Files arrive by being uploaded on a record, not by being created here.
|
|
*/
|
|
public function create(User $user): bool
|
|
{
|
|
return false;
|
|
}
|
|
|
|
/**
|
|
* Uploading through the API, which has no form to attach a file to.
|
|
*
|
|
* Still true to the rule above in spirit: an upload says which kind of
|
|
* record it is for — a page, a technology — and whoever may write that kind
|
|
* of record may upload its image. Nobody else, whatever their `media.*`
|
|
* permissions, which only ever described looking after files that already
|
|
* exist.
|
|
*/
|
|
public function upload(User $user, string $for = 'pages'): bool
|
|
{
|
|
return $user->can("{$for}.create") || $user->can("{$for}.update");
|
|
}
|
|
|
|
/**
|
|
* A file something still points at cannot be deleted from here: doing so
|
|
* would leave a broken image on the public site, which is precisely what
|
|
* the health check exists to complain about.
|
|
*/
|
|
public function delete(User $user, $model): bool
|
|
{
|
|
return parent::delete($user, $model) && ! $model->isReferenced();
|
|
}
|
|
}
|