@ampless/mcp-server 1.0.0-alpha.36 → 1.0.0-alpha.37
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.js +24 -0
- package/package.json +2 -2
package/dist/index.js
CHANGED
|
@@ -564,10 +564,32 @@ var deleteMediaSchema = {
|
|
|
564
564
|
}
|
|
565
565
|
}
|
|
566
566
|
};
|
|
567
|
+
var MEDIA_PREFIX = "public/media/";
|
|
568
|
+
function assertMediaPrefix(key) {
|
|
569
|
+
if (key.includes("\\")) {
|
|
570
|
+
throw new Error(`delete_media: src must start with "${MEDIA_PREFIX}" \u2014 got: ${key}`);
|
|
571
|
+
}
|
|
572
|
+
const parts = key.split("/");
|
|
573
|
+
const resolved = [];
|
|
574
|
+
for (const part of parts) {
|
|
575
|
+
if (part === "..") {
|
|
576
|
+
resolved.pop();
|
|
577
|
+
} else {
|
|
578
|
+
resolved.push(part);
|
|
579
|
+
}
|
|
580
|
+
}
|
|
581
|
+
const normalised = resolved.join("/");
|
|
582
|
+
if (!normalised.startsWith(MEDIA_PREFIX)) {
|
|
583
|
+
throw new Error(`delete_media: src must start with "${MEDIA_PREFIX}" \u2014 got: ${key}`);
|
|
584
|
+
}
|
|
585
|
+
}
|
|
567
586
|
async function deleteMedia(graphql, storage, args) {
|
|
568
587
|
if (!args.mediaId && !args.src) {
|
|
569
588
|
throw new Error("delete_media: provide `mediaId` or `src`");
|
|
570
589
|
}
|
|
590
|
+
if (args.src !== void 0) {
|
|
591
|
+
assertMediaPrefix(args.src);
|
|
592
|
+
}
|
|
571
593
|
const dryRun = args.dryRun === true;
|
|
572
594
|
let mediaId;
|
|
573
595
|
let src;
|
|
@@ -576,12 +598,14 @@ async function deleteMedia(graphql, storage, args) {
|
|
|
576
598
|
if (data.getMedia) {
|
|
577
599
|
mediaId = data.getMedia.mediaId;
|
|
578
600
|
src = data.getMedia.src;
|
|
601
|
+
assertMediaPrefix(src);
|
|
579
602
|
}
|
|
580
603
|
} else {
|
|
581
604
|
const data = await graphql.query(GET_BY_SRC, { src: args.src });
|
|
582
605
|
if (data.getMediaBySrc) {
|
|
583
606
|
mediaId = data.getMediaBySrc.mediaId;
|
|
584
607
|
src = data.getMediaBySrc.src;
|
|
608
|
+
assertMediaPrefix(src);
|
|
585
609
|
}
|
|
586
610
|
}
|
|
587
611
|
if (!mediaId) {
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@ampless/mcp-server",
|
|
3
|
-
"version": "1.0.0-alpha.
|
|
3
|
+
"version": "1.0.0-alpha.37",
|
|
4
4
|
"description": "MCP tool registry shared by @ampless/backend mcp-handler Lambda. Installed transitively via @ampless/admin / @ampless/backend; no direct install needed.",
|
|
5
5
|
"publishConfig": {
|
|
6
6
|
"access": "public"
|
|
@@ -26,7 +26,7 @@
|
|
|
26
26
|
"bugs": "https://github.com/heavymoons/ampless/issues",
|
|
27
27
|
"dependencies": {
|
|
28
28
|
"fflate": "^0.8.3",
|
|
29
|
-
"ampless": "1.0.0-alpha.
|
|
29
|
+
"ampless": "1.0.0-alpha.31"
|
|
30
30
|
},
|
|
31
31
|
"keywords": [
|
|
32
32
|
"ampless",
|