Josep Piguillem
ac546eba2b
/api/v1/technologies is a full CRUD with the panel's own rules: name and slug are plain strings, the prose is translatable, `radar_ring: null` takes one off the radar, and TechnologyPolicy still refuses to delete one a project, member or call uses. The MCP server picks the tools up from openapi.yaml on its own. A logo is an SVG, so POST /v1/media now accepts one — sanitized with enshrined/svg-sanitize (scripts, event handlers and remote references removed), and served by Caddy under a Content-Security-Policy that would stop a script regardless. `for` (pages or technologies) says what an upload is for, which picks the directory the panel uses for it and the permission it takes. Creating a technology without a category answered 500: the column's default never reached the model, so the response read a null enum. The controller now states the default, as the panel does. Beside a file, the MCP upload tool no longer demands the JSON body's `url`: the body then carries the upload's other fields, such as `for`. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
116 lines
3.8 KiB
PHP
116 lines
3.8 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Http\Controllers\Api\V1;
|
|
|
|
use App\Http\Controllers\Controller;
|
|
use App\Http\Requests\Api\V1\MediaRequest;
|
|
use App\Http\Resources\MediaResource;
|
|
use App\Models\Media;
|
|
use App\Services\Media\RemoteImage;
|
|
use enshrined\svgSanitize\Sanitizer;
|
|
use finfo;
|
|
use Illuminate\Http\JsonResponse;
|
|
use Illuminate\Support\Facades\Storage;
|
|
use Illuminate\Support\Str;
|
|
use Illuminate\Validation\ValidationException;
|
|
|
|
/**
|
|
* POST /api/v1/media
|
|
*
|
|
* Stores an image and answers with the path a record points at — what the
|
|
* panel's upload field does on a form, without the form. It exists for the MCP
|
|
* server, which otherwise could create a page but never give it a picture.
|
|
*
|
|
* The file lands where the panel puts a page's images and goes through
|
|
* `Media::for()`, so it is processed, served and eventually pruned exactly
|
|
* like one uploaded there.
|
|
*/
|
|
class MediaController extends Controller
|
|
{
|
|
/**
|
|
* Extension by detected type. Chosen from the bytes, never from the name
|
|
* the client sent.
|
|
*
|
|
* @var array<string, string>
|
|
*/
|
|
protected const EXTENSIONS = [
|
|
'image/jpeg' => 'jpg',
|
|
'image/png' => 'png',
|
|
'image/webp' => 'webp',
|
|
'image/gif' => 'gif',
|
|
'image/avif' => 'avif',
|
|
'image/svg+xml' => 'svg',
|
|
];
|
|
|
|
public function store(MediaRequest $request, RemoteImage $remote): JsonResponse
|
|
{
|
|
$for = (string) $request->input('for', 'pages');
|
|
|
|
$this->authorize('upload', [Media::class, $for]);
|
|
|
|
$field = $request->hasFile('file') ? 'file' : 'url';
|
|
|
|
$contents = $field === 'file'
|
|
? (string) $request->file('file')->get()
|
|
: $remote->fetch((string) $request->string('url'));
|
|
|
|
$mime = (new finfo(FILEINFO_MIME_TYPE))->buffer($contents) ?: null;
|
|
|
|
if (! in_array($mime, (array) config('media.upload.mimes'), true)) {
|
|
$this->refuse($field);
|
|
}
|
|
|
|
if ($mime === 'image/svg+xml') {
|
|
$contents = $this->sanitize($contents) ?? $this->refuse($field);
|
|
// A vector has no pixel size; the processor copies it through.
|
|
$size = [null, null];
|
|
} else {
|
|
// The type is read from the magic bytes; this catches a file that
|
|
// has them but does not decode, which nobody could render either.
|
|
$size = @getimagesizefromstring($contents) ?: $this->refuse($field);
|
|
}
|
|
|
|
$path = config("media.upload.for.{$for}").'/'.Str::random(40).'.'.self::EXTENSIONS[$mime];
|
|
|
|
Storage::disk((string) config('media.disk'))->put($path, $contents);
|
|
|
|
$media = Media::for($path);
|
|
|
|
// What is already known, so the answer carries dimensions straight
|
|
// away rather than after the queue has run. The processor writes the
|
|
// same values, and the rest, when it does.
|
|
if (! $media->isProcessed()) {
|
|
$media->forceFill([
|
|
'mime' => $mime,
|
|
'size' => strlen($contents),
|
|
'width' => $size[0],
|
|
'height' => $size[1],
|
|
])->save();
|
|
}
|
|
|
|
return MediaResource::make($media->fresh())->response()->setStatusCode(201);
|
|
}
|
|
|
|
/**
|
|
* An SVG with what could run taken out: scripts, event handlers, and
|
|
* references to anything outside the file. Null when what is left is not
|
|
* an SVG at all.
|
|
*/
|
|
protected function sanitize(string $svg): ?string
|
|
{
|
|
$sanitizer = new Sanitizer;
|
|
$sanitizer->removeRemoteReferences(true);
|
|
|
|
$clean = $sanitizer->sanitize($svg);
|
|
|
|
return is_string($clean) && str_contains($clean, '<svg') ? $clean : null;
|
|
}
|
|
|
|
protected function refuse(string $field): never
|
|
{
|
|
throw ValidationException::withMessages([$field => [__('rules.media.not_an_image')]]);
|
|
}
|
|
}
|