Josep Piguillem
ac546eba2b
/api/v1/technologies is a full CRUD with the panel's own rules: name and slug are plain strings, the prose is translatable, `radar_ring: null` takes one off the radar, and TechnologyPolicy still refuses to delete one a project, member or call uses. The MCP server picks the tools up from openapi.yaml on its own. A logo is an SVG, so POST /v1/media now accepts one — sanitized with enshrined/svg-sanitize (scripts, event handlers and remote references removed), and served by Caddy under a Content-Security-Policy that would stop a script regardless. `for` (pages or technologies) says what an upload is for, which picks the directory the panel uses for it and the permission it takes. Creating a technology without a category answered 500: the column's default never reached the model, so the response read a null enum. The controller now states the default, as the panel does. Beside a file, the MCP upload tool no longer demands the JSON body's `url`: the body then carries the upload's other fields, such as `for`. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
47 lines
1.4 KiB
PHP
47 lines
1.4 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Http\Requests\Api\V1;
|
|
|
|
use Illuminate\Foundation\Http\FormRequest;
|
|
|
|
/**
|
|
* An image arrives one of two ways: as the request's `file` (multipart), or as
|
|
* a `url` the API downloads itself (JSON). Exactly one.
|
|
*
|
|
* What the declared type says is only a first filter. The controller looks at
|
|
* the bytes, because a client names the type of what it sends and a URL's
|
|
* server names the type of what it answers — and neither has to be telling
|
|
* the truth.
|
|
*/
|
|
class MediaRequest extends FormRequest
|
|
{
|
|
/**
|
|
* Authorisation is the controller's, as everywhere else in this API — and
|
|
* it has to happen before a URL is fetched, which is after validation.
|
|
*/
|
|
public function authorize(): bool
|
|
{
|
|
return true;
|
|
}
|
|
|
|
/**
|
|
* @return array<string, mixed>
|
|
*/
|
|
public function rules(): array
|
|
{
|
|
return [
|
|
'file' => [
|
|
'required_without:url',
|
|
'prohibits:url',
|
|
'file',
|
|
'max:'.(int) config('media.upload.max_kb'),
|
|
'mimetypes:'.implode(',', (array) config('media.upload.mimes')),
|
|
],
|
|
'url' => ['required_without:file', 'string', 'url:https', 'max:2048'],
|
|
'for' => ['sometimes', 'string', 'in:'.implode(',', array_keys((array) config('media.upload.for')))],
|
|
];
|
|
}
|
|
}
|