coolify/app/Mcp/Tools/ListProjects.php
Andras Bacsai 062ad57740 fix(security): enforce team access on mutable actions
Authorize cloud provider token access, audit sensitive operations, and
standardize public IDs across deployment and resource flows.
2026-06-04 11:03:06 +02:00

66 lines
1.8 KiB
PHP

<?php
namespace App\Mcp\Tools;
use App\Mcp\Concerns\BuildsResponse;
use App\Mcp\Concerns\ResolvesTeam;
use App\Models\Project;
use Illuminate\Contracts\JsonSchema\JsonSchema;
use Laravel\Mcp\Request;
use Laravel\Mcp\Response;
use Laravel\Mcp\Server\Tool;
class ListProjects extends Tool
{
protected string $name = 'list_projects';
protected string $description = 'List projects owned by the authenticated team. Returns summary (uuid, name, description).';
use BuildsResponse;
use ResolvesTeam;
public function handle(Request $request): Response
{
if ($error = $this->ensureAbility($request, 'read', $this->name)) {
return $error;
}
$teamId = $this->resolveTeamId($request);
if (is_null($teamId)) {
return $this->mcpError($request, 'Invalid token.');
}
$args = $this->paginationArgs($request);
$query = Project::whereTeamId($teamId);
$total = (clone $query)->count();
$summaries = $query
->select('name', 'description', 'uuid')
->orderBy('name')
->skip($args['offset'])
->take($args['per_page'])
->get()
->map(fn ($p) => [
'uuid' => $p->uuid,
'name' => $p->name,
'description' => $p->description,
])
->values()
->all();
return $this->mcpSuccess($request, $this->respond(
$summaries,
[],
$this->paginationMeta('list_projects', $args, $total),
));
}
public function schema(JsonSchema $schema): array
{
return [
'page' => $schema->integer()->description('Page number (default 1).'),
'per_page' => $schema->integer()->description('Items per page (default 50, max 100).'),
];
}
}