Josep Piguillem
a49816eb46
POST /api/v1/media stores an image where the panel keeps a page's and answers with the path to send as `featured_image`. Without it the MCP server could create a page but never give it a picture. The file goes through Media::for(), so it is processed, served and pruned like one uploaded in the panel. Two ways in, one per request: a multipart `file`, or JSON with a `url` the API downloads itself. JPEG, PNG, WebP, GIF or AVIF only, decided from the bytes; no SVG, which is a document that can carry script. The URL is fetched from inside the stack's network, so RemoteImage guards it: HTTPS only, every resolved address must be public, the connection is pinned to the checked address with CURLOPT_RESOLVE so a changing DNS answer cannot swap in a private one, redirects are not followed, and the body is read to a ceiling whatever its headers say. Uploading needs permission to write pages. MediaPolicy::create stays false, so the panel gains no free-standing "new file" button. In the MCP server a multipart binary field becomes `<field>_path` over stdio: the server reads the file from the caller's disk and sends it as multipart, instead of the model pushing base64 through its context. Over HTTP the server's disk is not the caller's, so only `body.url` is offered. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
86 lines
2.9 KiB
PHP
86 lines
2.9 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Http\Controllers\Api\V1;
|
|
|
|
use App\Http\Controllers\Controller;
|
|
use App\Http\Requests\Api\V1\MediaRequest;
|
|
use App\Http\Resources\MediaResource;
|
|
use App\Models\Media;
|
|
use App\Services\Media\RemoteImage;
|
|
use finfo;
|
|
use Illuminate\Http\JsonResponse;
|
|
use Illuminate\Support\Facades\Storage;
|
|
use Illuminate\Support\Str;
|
|
use Illuminate\Validation\ValidationException;
|
|
|
|
/**
|
|
* POST /api/v1/media
|
|
*
|
|
* Stores an image and answers with the path a record points at — what the
|
|
* panel's upload field does on a form, without the form. It exists for the MCP
|
|
* server, which otherwise could create a page but never give it a picture.
|
|
*
|
|
* The file lands where the panel puts a page's images and goes through
|
|
* `Media::for()`, so it is processed, served and eventually pruned exactly
|
|
* like one uploaded there.
|
|
*/
|
|
class MediaController extends Controller
|
|
{
|
|
/**
|
|
* Extension by detected type. Chosen from the bytes, never from the name
|
|
* the client sent.
|
|
*
|
|
* @var array<string, string>
|
|
*/
|
|
protected const EXTENSIONS = [
|
|
'image/jpeg' => 'jpg',
|
|
'image/png' => 'png',
|
|
'image/webp' => 'webp',
|
|
'image/gif' => 'gif',
|
|
'image/avif' => 'avif',
|
|
];
|
|
|
|
public function store(MediaRequest $request, RemoteImage $remote): JsonResponse
|
|
{
|
|
$this->authorize('upload', Media::class);
|
|
|
|
$field = $request->hasFile('file') ? 'file' : 'url';
|
|
|
|
$contents = $field === 'file'
|
|
? (string) $request->file('file')->get()
|
|
: $remote->fetch((string) $request->string('url'));
|
|
|
|
$mime = (new finfo(FILEINFO_MIME_TYPE))->buffer($contents) ?: null;
|
|
$size = @getimagesizefromstring($contents);
|
|
|
|
// Both, because each catches what the other misses: the type is read
|
|
// from the magic bytes, and a file that has them but does not decode
|
|
// is not an image anybody can render.
|
|
if ($size === false || ! in_array($mime, (array) config('media.upload.mimes'), true)) {
|
|
throw ValidationException::withMessages([$field => [__('rules.media.not_an_image')]]);
|
|
}
|
|
|
|
$path = config('media.upload.directory').'/'.Str::random(40).'.'.self::EXTENSIONS[$mime];
|
|
|
|
Storage::disk((string) config('media.disk'))->put($path, $contents);
|
|
|
|
$media = Media::for($path);
|
|
|
|
// What is already known, so the answer carries dimensions straight
|
|
// away rather than after the queue has run. The processor writes the
|
|
// same values, and the rest, when it does.
|
|
if (! $media->isProcessed()) {
|
|
$media->forceFill([
|
|
'mime' => $mime,
|
|
'size' => strlen($contents),
|
|
'width' => $size[0],
|
|
'height' => $size[1],
|
|
])->save();
|
|
}
|
|
|
|
return MediaResource::make($media->fresh())->response()->setStatusCode(201);
|
|
}
|
|
}
|