@strapi/upload 5.53.0 → 5.54.0

package/dist/server/mcp/handlers/write-handlers.mjs

@@ -0,0 +1,311 @@
+import { errors } from '@strapi/utils';
+import { getService } from '../../utils/index.mjs';
+import { ACTIONS, FILE_MODEL_UID, FOLDER_MODEL_UID } from '../../constants.mjs';
+import { findEntityAndCheckPermissions } from '../../controllers/utils/find-entity-and-check-permissions.mjs';
+import { assertAmbientInstance } from '../ambient-instance.mjs';
+import { assertMediaPermission } from '../permissions.mjs';
+import { sanitizeMediaAsset } from '../sanitizers/sanitize-media.mjs';
+import { MCP_UPDATE_ASSET_NO_FIELDS, MCP_NOT_FOUND_ASSET, MCP_MOVE_ASSETS_ID_FAILED, MCP_DELETE_ASSETS_ID_FAILED, MCP_MOVE_ASSETS_DESTINATION_NOT_FOUND, MCP_MOVE_ASSETS_ID_NOT_FOUND, MCP_MOVE_ASSETS_ID_FORBIDDEN, MCP_DELETE_ASSETS_ID_NOT_FOUND, MCP_DELETE_ASSETS_ID_FORBIDDEN } from './constants.mjs';
+import { ok } from '../utils.mjs';
+
+/** The metadata keys `media_update_asset` may write. Everything else is rejected by the schema. */ const WRITABLE_FIELDS = [
+    'name',
+    'alternativeText',
+    'caption'
+];
+/**
+ * Picks the metadata the caller actually sent.
+ *
+ * `updateFileInfo` treats nil as "keep the stored value" (`_.isNil`), so an explicit
+ * `alternativeText: null` cannot be forwarded as null — it would be read as "unchanged"
+ * instead of "clear it". Clearing is expressed as an empty string, which is what the admin
+ * panel writes when the field is emptied.
+ */ const buildFileInfo = (args)=>{
+    const fileInfo = {};
+    for (const field of WRITABLE_FIELDS){
+        const value = args[field];
+        if (value !== undefined) {
+            fileInfo[field] = value === null ? '' : value;
+        }
+    }
+    return fileInfo;
+};
+/**
+ * `media_update_asset` — edits the writable metadata of one asset.
+ *
+ * Gated on `plugin::upload.assets.update` and mirrors `PUT /upload/files/:id`: the same
+ * `findEntityAndCheckPermissions` row-level check, the same `updateFileInfo` service call, and
+ * the same `updatedBy` attribution from the session user.
+ *
+ * The response carries the updated asset through the read sanitizer, so a client can confirm
+ * the write without a second `media_get_asset` round-trip — and so provider fields stay
+ * invisible on the write path too.
+ */ const createMediaUpdateAssetHandler = (strapi, context)=>{
+    assertAmbientInstance(strapi);
+    return async ({ args })=>{
+        const { id, ...metadata } = args;
+        const fileInfo = buildFileInfo(metadata);
+        // A patch with no writable field is a caller error, not a no-op success: the schema cannot
+        // express "at least one of" without becoming a ZodEffects the registry can't publish.
+        if (Object.keys(fileInfo).length === 0) {
+            throw new errors.ValidationError(MCP_UPDATE_ASSET_NO_FIELDS);
+        }
+        // Model-level gate first, so a token without the action is refused before any DB read.
+        // `findEntityAndCheckPermissions` only covers the row-level check.
+        assertMediaPermission(strapi, context, ACTIONS.update, FILE_MODEL_UID);
+        // Row-level check, shared with the admin controller: resolves the creator's roles so an
+        // owner-scoped permission condition is evaluated against the same subject the REST API
+        // would build, and throws Forbidden when a condition excludes this asset.
+        //
+        // Its NotFoundError carries no message, which would reach the agent as a bare "Not Found";
+        // rethrowing adds the same wording the read tools use.
+        try {
+            await findEntityAndCheckPermissions(context.userAbility, ACTIONS.update, FILE_MODEL_UID, id, strapi);
+        } catch (error) {
+            if (error instanceof errors.NotFoundError) {
+                throw new errors.NotFoundError(MCP_NOT_FOUND_ASSET);
+            }
+            throw error;
+        }
+        const written = await getService('upload', strapi).updateFileInfo(id, fileInfo, {
+            user: context.user
+        });
+        const updated = await getService('upload', strapi).findOne(id, [
+            'folder'
+        ]);
+        return ok({
+            data: sanitizeMediaAsset(updated ?? written)
+        });
+    };
+};
+/**
+ * Resolves the destination folder for `media_move_assets`, and rejects one that does not exist.
+ *
+ * `null` is the media library root and always valid. A named folder is looked up so a typo — or a
+ * folder id passed where the agent meant an asset — is refused before anything is moved, matching
+ * the `folder-exists` test the admin bulk-move validation applies to `destinationFolderId`.
+ *
+ * A bad destination is the one failure that rejects the whole call rather than being reported per
+ * id: it is a property of the request, not of any single asset, so every id would fail for the
+ * same reason and a per-id report would say nothing the agent could act on.
+ */ const resolveDestinationFolder = async (strapi, folder)=>{
+    if (folder === null) {
+        return null;
+    }
+    const destination = await strapi.db.query(FOLDER_MODEL_UID).findOne({
+        select: [
+            'id',
+            'name'
+        ],
+        where: {
+            id: folder
+        }
+    });
+    if (destination === null || destination === undefined) {
+        throw new errors.ValidationError(MCP_MOVE_ASSETS_DESTINATION_NOT_FOUND);
+    }
+    return {
+        id: Number(destination.id),
+        name: String(destination.name ?? '')
+    };
+};
+/**
+ * `media_move_assets` — moves assets between folders in bulk.
+ *
+ * Bulk with a per-id report, rather than all-or-nothing: an agent reorganising a library moves
+ * many assets at once, and one bad id among good ones must not discard the valid moves. Each
+ * asset is moved on its own, so a failure is confined to its own id and the response says exactly
+ * which ids to retry.
+ *
+ * That is why this does not reuse the admin `/actions/bulk-move` controller path, whose single
+ * transaction is all-or-nothing by construction (and which also handles folders, out of scope
+ * here). It goes through `updateFileInfo` instead — the same service `media_update_asset` and
+ * `PUT /upload/files/:id` use — which sets the `folder` relation, recomputes the private
+ * `folderPath`, attributes `updatedBy`, and emits `media.update` per asset. Replicating the
+ * controller's raw join-table writes would skip all four.
+ *
+ * The moves are sequential on purpose. Each one writes the join table and `folderPath` for its
+ * asset, and a bounded reorganisation (100 ids max, per the input schema) is not worth the
+ * connection-pool contention of firing them in parallel.
+ */ const createMediaMoveAssetsHandler = (strapi, context)=>{
+    assertAmbientInstance(strapi);
+    return async ({ args })=>{
+        const { ids, folder } = args;
+        // Model-level gate first, so a token without the action is refused before any DB read.
+        assertMediaPermission(strapi, context, ACTIONS.update, FILE_MODEL_UID);
+        const destinationFolder = await resolveDestinationFolder(strapi, folder);
+        const moved = [];
+        const failed = [];
+        // `ids` can repeat an id; de-duplicating keeps the report one entry per id rather than
+        // reporting the same asset twice for a request that moved it once.
+        for (const id of new Set(ids)){
+            try {
+                // Row-level check, shared with the admin controller: an owner-scoped permission
+                // condition is evaluated against the same subject the REST API would build.
+                await findEntityAndCheckPermissions(context.userAbility, ACTIONS.update, FILE_MODEL_UID, id, strapi);
+                const updated = await getService('upload', strapi).updateFileInfo(id, // `updateFileInfo` reads `undefined` as "keep the stored folder" and null as the root,
+                // so the destination is forwarded as-is.
+                {
+                    folder
+                }, {
+                    user: context.user
+                });
+                // `updateFileInfo` resolves the row it wrote without the `folder` relation populated, so
+                // the destination is attached here instead of costing a read-back per asset.
+                moved.push(sanitizeMediaAsset({
+                    ...updated,
+                    folder: destinationFolder
+                }));
+            } catch (error) {
+                if (error instanceof errors.NotFoundError) {
+                    failed.push({
+                        id,
+                        reason: MCP_MOVE_ASSETS_ID_NOT_FOUND
+                    });
+                    continue;
+                }
+                if (error instanceof errors.ForbiddenError) {
+                    failed.push({
+                        id,
+                        reason: MCP_MOVE_ASSETS_ID_FORBIDDEN
+                    });
+                    continue;
+                }
+                /**
+         * Any other failure — a DB error, a provider fault — is reported against this id too,
+         * rather than thrown.
+         *
+         * Throwing here would be the one way to lose committed work silently: a tool error
+         * reaches the client as `{ content: [text], isError: true }` with NO
+         * `structuredContent` (see `tool-registry.ts`), so an error on the third id would
+         * discard the report saying the first two had already moved. The agent would be left
+         * unable to tell which ids to retry — exactly the recoverability this tool exists to
+         * provide.
+         *
+         * The message is carried through verbatim so the real fault is still legible, and the
+         * loop continues: one broken asset must not strand the rest of a reorganisation.
+         */ failed.push({
+                    id,
+                    reason: MCP_MOVE_ASSETS_ID_FAILED(error instanceof Error ? error.message : String(error))
+                });
+            }
+        }
+        /**
+     * A request where nothing moved still returns the per-id report.
+     *
+     * `moved: []` alongside a populated `failed` is not ambiguous — it says plainly that nothing
+     * moved and why, per id. Throwing instead would drop `structuredContent` entirely (a tool
+     * error carries text only), so `ids: [999]` would get prose while `ids: [1, 999]` got a
+     * machine-readable entry, for the same class of mistake.
+     *
+     * The only failure that still rejects the whole call is an invalid destination folder, which
+     * is checked before the loop: nothing has moved, so there is no report to preserve.
+     */ return ok({
+            destinationFolder,
+            moved,
+            failed
+        });
+    };
+};
+/**
+ * `media_delete_assets` — previews or performs the permanent deletion of assets, in bulk.
+ *
+ * Two branches behind one tool, for the same reason as `media_delete_folder`: the preview and the
+ * deletion must agree on what would be destroyed, and splitting them across tools would both let
+ * the two drift apart and let an agent reach the destructive one without ever seeing a preview.
+ * `dryRun` defaults to true (see the input schema), so omitting the flag previews and deleting
+ * takes an explicit `dryRun: false`.
+ *
+ * Per-id, not all-or-nothing — the opposite of `media_delete_folder`, on purpose. A folder delete
+ * cascades, so a mixed id list there is refused outright rather than half-applied over an unknown
+ * amount of content. Here each id is exactly one asset, the blast radius of a bad one is nil, and
+ * the requirement is explicit: a bad id among good ones must not discard the valid deletions.
+ * The dry run reports the same per-id split, so an agent sees which ids will not resolve *before*
+ * anything is destroyed rather than after.
+ *
+ * This does not reuse `file.deleteByIds` (the admin `/actions/bulk-delete` path). That helper
+ * fires `upload.remove` under a single `Promise.all`, so the first rejection discards the report
+ * of everything already deleted — unrecoverable for an operation with no undo. The removals are
+ * driven one at a time here instead, through the same `upload.remove` service, which deletes the
+ * provider file and every generated format, emits `media.delete`, and then deletes the row.
+ *
+ * The deletions are sequential on purpose: each one performs provider I/O, and a bounded batch
+ * (100 ids max, per the input schema) is not worth firing at a provider in parallel.
+ */ const createMediaDeleteAssetsHandler = (strapi, context)=>{
+    assertAmbientInstance(strapi);
+    return async ({ args })=>{
+        const { ids, dryRun = true } = args;
+        // Model-level gate first, so a token without the action is refused before any DB read.
+        // The preview takes the same gate: it reveals which assets exist and what they are.
+        assertMediaPermission(strapi, context, ACTIONS.update, FILE_MODEL_UID);
+        const deleted = [];
+        const failed = [];
+        // `ids` can repeat an id; de-duplicating keeps the report one entry per id, and stops the
+        // second occurrence of an already-deleted asset from being reported as a missing one.
+        for (const id of new Set(ids)){
+            let file;
+            try {
+                // Row-level check, shared with the admin controller: an owner-scoped permission
+                // condition is evaluated against the same subject the REST API would build. Run on the
+                // dry run too — a preview must not list an asset the executing call would refuse.
+                ({ file } = await findEntityAndCheckPermissions(context.userAbility, ACTIONS.update, FILE_MODEL_UID, id, strapi));
+            } catch (error) {
+                if (error instanceof errors.NotFoundError) {
+                    failed.push({
+                        id,
+                        reason: MCP_DELETE_ASSETS_ID_NOT_FOUND
+                    });
+                    continue;
+                }
+                if (error instanceof errors.ForbiddenError) {
+                    failed.push({
+                        id,
+                        reason: MCP_DELETE_ASSETS_ID_FORBIDDEN
+                    });
+                    continue;
+                }
+                failed.push({
+                    id,
+                    reason: MCP_DELETE_ASSETS_ID_FAILED(error instanceof Error ? error.message : String(error))
+                });
+                continue;
+            }
+            // The preview stops here: the asset resolved and this token may delete it, which is
+            // everything the agent needs to confirm — reported in the same shape the real run uses.
+            if (dryRun) {
+                deleted.push(sanitizeMediaAsset(file));
+                continue;
+            }
+            try {
+                await getService('upload', strapi).remove(file);
+                // Reported from the row read before the delete: the asset no longer exists, so this is
+                // the only description of it the agent will ever get.
+                deleted.push(sanitizeMediaAsset(file));
+            } catch (error) {
+                /**
+         * A failed removal is reported against its own id rather than thrown, for the reason
+         * spelled out on `media_move_assets` — a tool error carries no `structuredContent`, so throwing
+         * on the third id would discard the report saying the first two are gone. Here that
+         * matters more: the earlier deletions cannot be re-read, undone or discovered afterwards.
+         */ failed.push({
+                    id,
+                    reason: MCP_DELETE_ASSETS_ID_FAILED(error instanceof Error ? error.message : String(error))
+                });
+            }
+        }
+        /**
+     * A request where nothing was deleted still returns the per-id report, on both branches:
+     * `deleted: []` with every id in `failed` says plainly that nothing happened and why, per id.
+     * Throwing instead would drop `structuredContent` entirely, so `ids: [999]` would get prose
+     * where `ids: [1, 999]` gets a machine-readable entry, for the same class of mistake.
+     */ return ok({
+            dryRun,
+            deleted,
+            failed,
+            totalFileNumber: deleted.length
+        });
+    };
+};
+
+export { createMediaDeleteAssetsHandler, createMediaMoveAssetsHandler, createMediaUpdateAssetHandler };
+//# sourceMappingURL=write-handlers.mjs.map

package/dist/server/mcp/handlers/write-handlers.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"write-handlers.mjs","sources":["../../../../server/src/mcp/handlers/write-handlers.ts"],"sourcesContent":["import { errors } from '@strapi/utils';\nimport type { Core, Modules } from '@strapi/types';\n\nimport { getService } from '../../utils';\nimport { ACTIONS, FILE_MODEL_UID, FOLDER_MODEL_UID } from '../../constants';\nimport { findEntityAndCheckPermissions } from '../../controllers/utils/find-entity-and-check-permissions';\nimport { assertAmbientInstance } from '../ambient-instance';\nimport { assertMediaPermission } from '../permissions';\nimport { sanitizeMediaAsset } from '../sanitizers/sanitize-media';\nimport {\n  MCP_NOT_FOUND_ASSET,\n  MCP_UPDATE_ASSET_NO_FIELDS,\n  MCP_MOVE_ASSETS_DESTINATION_NOT_FOUND,\n  MCP_MOVE_ASSETS_ID_NOT_FOUND,\n  MCP_MOVE_ASSETS_ID_FORBIDDEN,\n  MCP_MOVE_ASSETS_ID_FAILED,\n  MCP_DELETE_ASSETS_ID_NOT_FOUND,\n  MCP_DELETE_ASSETS_ID_FORBIDDEN,\n  MCP_DELETE_ASSETS_ID_FAILED,\n} from './constants';\nimport { ok } from '../utils';\n\n// Type-level only: the MCP SDK validates `args` against the tool's strict Zod input schema\n// before the handler runs, so unknown keys never reach here.\ntype MediaUpdateAssetArgs = {\n  id: number;\n  name?: string;\n  alternativeText?: string | null;\n  caption?: string | null;\n};\n\ntype MediaMoveAssetsArgs = {\n  ids: number[];\n  folder: number | null;\n};\n\ntype MediaDeleteAssetsArgs = {\n  ids: number[];\n  dryRun?: boolean;\n};\n\n/** The metadata keys `media_update_asset` may write. Everything else is rejected by the schema. */\nconst WRITABLE_FIELDS = ['name', 'alternativeText', 'caption'] as const;\n\n/**\n * Picks the metadata the caller actually sent.\n *\n * `updateFileInfo` treats nil as \"keep the stored value\" (`_.isNil`), so an explicit\n * `alternativeText: null` cannot be forwarded as null — it would be read as \"unchanged\"\n * instead of \"clear it\". Clearing is expressed as an empty string, which is what the admin\n * panel writes when the field is emptied.\n */\nconst buildFileInfo = (args: MediaUpdateAssetArgs): Record<string, string> => {\n  const fileInfo: Record<string, string> = {};\n\n  for (const field of WRITABLE_FIELDS) {\n    const value = args[field];\n\n    if (value !== undefined) {\n      fileInfo[field] = value === null ? '' : value;\n    }\n  }\n\n  return fileInfo;\n};\n\n/**\n * `media_update_asset` — edits the writable metadata of one asset.\n *\n * Gated on `plugin::upload.assets.update` and mirrors `PUT /upload/files/:id`: the same\n * `findEntityAndCheckPermissions` row-level check, the same `updateFileInfo` service call, and\n * the same `updatedBy` attribution from the session user.\n *\n * The response carries the updated asset through the read sanitizer, so a client can confirm\n * the write without a second `media_get_asset` round-trip — and so provider fields stay\n * invisible on the write path too.\n */\nexport const createMediaUpdateAssetHandler = (\n  strapi: Core.Strapi,\n  context: Modules.MCP.McpHandlerContext\n) => {\n  assertAmbientInstance(strapi);\n\n  return async ({\n    args,\n  }: {\n    args: Record<string, unknown>;\n  }): Promise<Modules.MCP.McpToolHandlerReturn> => {\n    const { id, ...metadata } = args as MediaUpdateAssetArgs;\n    const fileInfo = buildFileInfo(metadata as MediaUpdateAssetArgs);\n\n    // A patch with no writable field is a caller error, not a no-op success: the schema cannot\n    // express \"at least one of\" without becoming a ZodEffects the registry can't publish.\n    if (Object.keys(fileInfo).length === 0) {\n      throw new errors.ValidationError(MCP_UPDATE_ASSET_NO_FIELDS);\n    }\n\n    // Model-level gate first, so a token without the action is refused before any DB read.\n    // `findEntityAndCheckPermissions` only covers the row-level check.\n    assertMediaPermission(strapi, context, ACTIONS.update, FILE_MODEL_UID);\n\n    // Row-level check, shared with the admin controller: resolves the creator's roles so an\n    // owner-scoped permission condition is evaluated against the same subject the REST API\n    // would build, and throws Forbidden when a condition excludes this asset.\n    //\n    // Its NotFoundError carries no message, which would reach the agent as a bare \"Not Found\";\n    // rethrowing adds the same wording the read tools use.\n    try {\n      await findEntityAndCheckPermissions(\n        context.userAbility,\n        ACTIONS.update,\n        FILE_MODEL_UID,\n        id,\n        strapi\n      );\n    } catch (error) {\n      if (error instanceof errors.NotFoundError) {\n        throw new errors.NotFoundError(MCP_NOT_FOUND_ASSET);\n      }\n\n      throw error;\n    }\n\n    const written = await getService('upload', strapi).updateFileInfo(id, fileInfo, {\n      user: context.user,\n    });\n\n    const updated = await getService('upload', strapi).findOne(id, ['folder']);\n\n    return ok({ data: sanitizeMediaAsset(updated ?? written) });\n  };\n};\n\n/**\n * Resolves the destination folder for `media_move_assets`, and rejects one that does not exist.\n *\n * `null` is the media library root and always valid. A named folder is looked up so a typo — or a\n * folder id passed where the agent meant an asset — is refused before anything is moved, matching\n * the `folder-exists` test the admin bulk-move validation applies to `destinationFolderId`.\n *\n * A bad destination is the one failure that rejects the whole call rather than being reported per\n * id: it is a property of the request, not of any single asset, so every id would fail for the\n * same reason and a per-id report would say nothing the agent could act on.\n */\nconst resolveDestinationFolder = async (strapi: Core.Strapi, folder: number | null) => {\n  if (folder === null) {\n    return null;\n  }\n\n  const destination = await strapi.db.query(FOLDER_MODEL_UID).findOne({\n    select: ['id', 'name'],\n    where: { id: folder },\n  });\n\n  if (destination === null || destination === undefined) {\n    throw new errors.ValidationError(MCP_MOVE_ASSETS_DESTINATION_NOT_FOUND);\n  }\n\n  return { id: Number(destination.id), name: String(destination.name ?? '') };\n};\n\n/**\n * `media_move_assets` — moves assets between folders in bulk.\n *\n * Bulk with a per-id report, rather than all-or-nothing: an agent reorganising a library moves\n * many assets at once, and one bad id among good ones must not discard the valid moves. Each\n * asset is moved on its own, so a failure is confined to its own id and the response says exactly\n * which ids to retry.\n *\n * That is why this does not reuse the admin `/actions/bulk-move` controller path, whose single\n * transaction is all-or-nothing by construction (and which also handles folders, out of scope\n * here). It goes through `updateFileInfo` instead — the same service `media_update_asset` and\n * `PUT /upload/files/:id` use — which sets the `folder` relation, recomputes the private\n * `folderPath`, attributes `updatedBy`, and emits `media.update` per asset. Replicating the\n * controller's raw join-table writes would skip all four.\n *\n * The moves are sequential on purpose. Each one writes the join table and `folderPath` for its\n * asset, and a bounded reorganisation (100 ids max, per the input schema) is not worth the\n * connection-pool contention of firing them in parallel.\n */\nexport const createMediaMoveAssetsHandler = (\n  strapi: Core.Strapi,\n  context: Modules.MCP.McpHandlerContext\n) => {\n  assertAmbientInstance(strapi);\n\n  return async ({\n    args,\n  }: {\n    args: Record<string, unknown>;\n  }): Promise<Modules.MCP.McpToolHandlerReturn> => {\n    const { ids, folder } = args as MediaMoveAssetsArgs;\n\n    // Model-level gate first, so a token without the action is refused before any DB read.\n    assertMediaPermission(strapi, context, ACTIONS.update, FILE_MODEL_UID);\n\n    const destinationFolder = await resolveDestinationFolder(strapi, folder);\n\n    const moved: ReturnType<typeof sanitizeMediaAsset>[] = [];\n    const failed: { id: number; reason: string }[] = [];\n\n    // `ids` can repeat an id; de-duplicating keeps the report one entry per id rather than\n    // reporting the same asset twice for a request that moved it once.\n    for (const id of new Set(ids)) {\n      try {\n        // Row-level check, shared with the admin controller: an owner-scoped permission\n        // condition is evaluated against the same subject the REST API would build.\n        await findEntityAndCheckPermissions(\n          context.userAbility,\n          ACTIONS.update,\n          FILE_MODEL_UID,\n          id,\n          strapi\n        );\n        const updated = await getService('upload', strapi).updateFileInfo(\n          id,\n          // `updateFileInfo` reads `undefined` as \"keep the stored folder\" and null as the root,\n          // so the destination is forwarded as-is.\n          { folder },\n          { user: context.user }\n        );\n\n        // `updateFileInfo` resolves the row it wrote without the `folder` relation populated, so\n        // the destination is attached here instead of costing a read-back per asset.\n        moved.push(sanitizeMediaAsset({ ...updated, folder: destinationFolder }));\n      } catch (error) {\n        if (error instanceof errors.NotFoundError) {\n          failed.push({ id, reason: MCP_MOVE_ASSETS_ID_NOT_FOUND });\n          continue;\n        }\n\n        if (error instanceof errors.ForbiddenError) {\n          failed.push({ id, reason: MCP_MOVE_ASSETS_ID_FORBIDDEN });\n          continue;\n        }\n\n        /**\n         * Any other failure — a DB error, a provider fault — is reported against this id too,\n         * rather than thrown.\n         *\n         * Throwing here would be the one way to lose committed work silently: a tool error\n         * reaches the client as `{ content: [text], isError: true }` with NO\n         * `structuredContent` (see `tool-registry.ts`), so an error on the third id would\n         * discard the report saying the first two had already moved. The agent would be left\n         * unable to tell which ids to retry — exactly the recoverability this tool exists to\n         * provide.\n         *\n         * The message is carried through verbatim so the real fault is still legible, and the\n         * loop continues: one broken asset must not strand the rest of a reorganisation.\n         */\n        failed.push({\n          id,\n          reason: MCP_MOVE_ASSETS_ID_FAILED(error instanceof Error ? error.message : String(error)),\n        });\n      }\n    }\n\n    /**\n     * A request where nothing moved still returns the per-id report.\n     *\n     * `moved: []` alongside a populated `failed` is not ambiguous — it says plainly that nothing\n     * moved and why, per id. Throwing instead would drop `structuredContent` entirely (a tool\n     * error carries text only), so `ids: [999]` would get prose while `ids: [1, 999]` got a\n     * machine-readable entry, for the same class of mistake.\n     *\n     * The only failure that still rejects the whole call is an invalid destination folder, which\n     * is checked before the loop: nothing has moved, so there is no report to preserve.\n     */\n    return ok({ destinationFolder, moved, failed });\n  };\n};\n\n/**\n * `media_delete_assets` — previews or performs the permanent deletion of assets, in bulk.\n *\n * Two branches behind one tool, for the same reason as `media_delete_folder`: the preview and the\n * deletion must agree on what would be destroyed, and splitting them across tools would both let\n * the two drift apart and let an agent reach the destructive one without ever seeing a preview.\n * `dryRun` defaults to true (see the input schema), so omitting the flag previews and deleting\n * takes an explicit `dryRun: false`.\n *\n * Per-id, not all-or-nothing — the opposite of `media_delete_folder`, on purpose. A folder delete\n * cascades, so a mixed id list there is refused outright rather than half-applied over an unknown\n * amount of content. Here each id is exactly one asset, the blast radius of a bad one is nil, and\n * the requirement is explicit: a bad id among good ones must not discard the valid deletions.\n * The dry run reports the same per-id split, so an agent sees which ids will not resolve *before*\n * anything is destroyed rather than after.\n *\n * This does not reuse `file.deleteByIds` (the admin `/actions/bulk-delete` path). That helper\n * fires `upload.remove` under a single `Promise.all`, so the first rejection discards the report\n * of everything already deleted — unrecoverable for an operation with no undo. The removals are\n * driven one at a time here instead, through the same `upload.remove` service, which deletes the\n * provider file and every generated format, emits `media.delete`, and then deletes the row.\n *\n * The deletions are sequential on purpose: each one performs provider I/O, and a bounded batch\n * (100 ids max, per the input schema) is not worth firing at a provider in parallel.\n */\nexport const createMediaDeleteAssetsHandler = (\n  strapi: Core.Strapi,\n  context: Modules.MCP.McpHandlerContext\n) => {\n  assertAmbientInstance(strapi);\n\n  return async ({\n    args,\n  }: {\n    args: Record<string, unknown>;\n  }): Promise<Modules.MCP.McpToolHandlerReturn> => {\n    const { ids, dryRun = true } = args as MediaDeleteAssetsArgs;\n\n    // Model-level gate first, so a token without the action is refused before any DB read.\n    // The preview takes the same gate: it reveals which assets exist and what they are.\n    assertMediaPermission(strapi, context, ACTIONS.update, FILE_MODEL_UID);\n\n    const deleted: ReturnType<typeof sanitizeMediaAsset>[] = [];\n    const failed: { id: number; reason: string }[] = [];\n\n    // `ids` can repeat an id; de-duplicating keeps the report one entry per id, and stops the\n    // second occurrence of an already-deleted asset from being reported as a missing one.\n    for (const id of new Set(ids)) {\n      let file;\n\n      try {\n        // Row-level check, shared with the admin controller: an owner-scoped permission\n        // condition is evaluated against the same subject the REST API would build. Run on the\n        // dry run too — a preview must not list an asset the executing call would refuse.\n        ({ file } = await findEntityAndCheckPermissions(\n          context.userAbility,\n          ACTIONS.update,\n          FILE_MODEL_UID,\n          id,\n          strapi\n        ));\n      } catch (error) {\n        if (error instanceof errors.NotFoundError) {\n          failed.push({ id, reason: MCP_DELETE_ASSETS_ID_NOT_FOUND });\n          continue;\n        }\n\n        if (error instanceof errors.ForbiddenError) {\n          failed.push({ id, reason: MCP_DELETE_ASSETS_ID_FORBIDDEN });\n          continue;\n        }\n\n        failed.push({\n          id,\n          reason: MCP_DELETE_ASSETS_ID_FAILED(\n            error instanceof Error ? error.message : String(error)\n          ),\n        });\n        continue;\n      }\n\n      // The preview stops here: the asset resolved and this token may delete it, which is\n      // everything the agent needs to confirm — reported in the same shape the real run uses.\n      if (dryRun) {\n        deleted.push(sanitizeMediaAsset(file));\n        continue;\n      }\n\n      try {\n        await getService('upload', strapi).remove(file);\n\n        // Reported from the row read before the delete: the asset no longer exists, so this is\n        // the only description of it the agent will ever get.\n        deleted.push(sanitizeMediaAsset(file));\n      } catch (error) {\n        /**\n         * A failed removal is reported against its own id rather than thrown, for the reason\n         * spelled out on `media_move_assets` — a tool error carries no `structuredContent`, so throwing\n         * on the third id would discard the report saying the first two are gone. Here that\n         * matters more: the earlier deletions cannot be re-read, undone or discovered afterwards.\n         */\n        failed.push({\n          id,\n          reason: MCP_DELETE_ASSETS_ID_FAILED(\n            error instanceof Error ? error.message : String(error)\n          ),\n        });\n      }\n    }\n\n    /**\n     * A request where nothing was deleted still returns the per-id report, on both branches:\n     * `deleted: []` with every id in `failed` says plainly that nothing happened and why, per id.\n     * Throwing instead would drop `structuredContent` entirely, so `ids: [999]` would get prose\n     * where `ids: [1, 999]` gets a machine-readable entry, for the same class of mistake.\n     */\n    return ok({ dryRun, deleted, failed, totalFileNumber: deleted.length });\n  };\n};\n"],"names":["WRITABLE_FIELDS","buildFileInfo","args","fileInfo","field","value","undefined","createMediaUpdateAssetHandler","strapi","context","assertAmbientInstance","id","metadata","Object","keys","length","errors","ValidationError","MCP_UPDATE_ASSET_NO_FIELDS","assertMediaPermission","ACTIONS","update","FILE_MODEL_UID","findEntityAndCheckPermissions","userAbility","error","NotFoundError","MCP_NOT_FOUND_ASSET","written","getService","updateFileInfo","user","updated","findOne","ok","data","sanitizeMediaAsset","resolveDestinationFolder","folder","destination","db","query","FOLDER_MODEL_UID","select","where","MCP_MOVE_ASSETS_DESTINATION_NOT_FOUND","Number","name","String","createMediaMoveAssetsHandler","ids","destinationFolder","moved","failed","Set","push","reason","MCP_MOVE_ASSETS_ID_NOT_FOUND","ForbiddenError","MCP_MOVE_ASSETS_ID_FORBIDDEN","MCP_MOVE_ASSETS_ID_FAILED","Error","message","createMediaDeleteAssetsHandler","dryRun","deleted","file","MCP_DELETE_ASSETS_ID_NOT_FOUND","MCP_DELETE_ASSETS_ID_FORBIDDEN","MCP_DELETE_ASSETS_ID_FAILED","remove","totalFileNumber"],"mappings":";;;;;;;;;;AAyCA,oGACA,MAAMA,eAAAA,GAAkB;AAAC,IAAA,MAAA;AAAQ,IAAA,iBAAA;AAAmB,IAAA;AAAU,CAAA;AAE9D;;;;;;;IAQA,MAAMC,gBAAgB,CAACC,IAAAA,GAAAA;AACrB,IAAA,MAAMC,WAAmC,EAAC;IAE1C,KAAK,MAAMC,SAASJ,eAAAA,CAAiB;QACnC,MAAMK,KAAAA,GAAQH,IAAI,CAACE,KAAAA,CAAM;AAEzB,QAAA,IAAIC,UAAUC,SAAAA,EAAW;AACvBH,YAAAA,QAAQ,CAACC,KAAAA,CAAM,GAAGC,KAAAA,KAAU,OAAO,EAAA,GAAKA,KAAAA;AAC1C,QAAA;AACF,IAAA;IAEA,OAAOF,QAAAA;AACT,CAAA;AAEA;;;;;;;;;;AAUC,IACM,MAAMI,6BAAAA,GAAgC,CAC3CC,MAAAA,EACAC,OAAAA,GAAAA;IAEAC,qBAAAA,CAAsBF,MAAAA,CAAAA;IAEtB,OAAO,OAAO,EACZN,IAAI,EAGL,GAAA;AACC,QAAA,MAAM,EAAES,EAAE,EAAE,GAAGC,UAAU,GAAGV,IAAAA;AAC5B,QAAA,MAAMC,WAAWF,aAAAA,CAAcW,QAAAA,CAAAA;;;AAI/B,QAAA,IAAIC,OAAOC,IAAI,CAACX,QAAAA,CAAAA,CAAUY,MAAM,KAAK,CAAA,EAAG;YACtC,MAAM,IAAIC,MAAAA,CAAOC,eAAe,CAACC,0BAAAA,CAAAA;AACnC,QAAA;;;AAIAC,QAAAA,qBAAAA,CAAsBX,MAAAA,EAAQC,OAAAA,EAASW,OAAAA,CAAQC,MAAM,EAAEC,cAAAA,CAAAA;;;;;;;QAQvD,IAAI;YACF,MAAMC,6BAAAA,CACJd,QAAQe,WAAW,EACnBJ,QAAQC,MAAM,EACdC,gBACAX,EAAAA,EACAH,MAAAA,CAAAA;AAEJ,QAAA,CAAA,CAAE,OAAOiB,KAAAA,EAAO;YACd,IAAIA,KAAAA,YAAiBT,MAAAA,CAAOU,aAAa,EAAE;gBACzC,MAAM,IAAIV,MAAAA,CAAOU,aAAa,CAACC,mBAAAA,CAAAA;AACjC,YAAA;YAEA,MAAMF,KAAAA;AACR,QAAA;QAEA,MAAMG,OAAAA,GAAU,MAAMC,UAAAA,CAAW,QAAA,EAAUrB,QAAQsB,cAAc,CAACnB,IAAIR,QAAAA,EAAU;AAC9E4B,YAAAA,IAAAA,EAAMtB,QAAQsB;AAChB,SAAA,CAAA;AAEA,QAAA,MAAMC,UAAU,MAAMH,UAAAA,CAAW,UAAUrB,MAAAA,CAAAA,CAAQyB,OAAO,CAACtB,EAAAA,EAAI;AAAC,YAAA;AAAS,SAAA,CAAA;AAEzE,QAAA,OAAOuB,EAAAA,CAAG;AAAEC,YAAAA,IAAAA,EAAMC,mBAAmBJ,OAAAA,IAAWJ,OAAAA;AAAS,SAAA,CAAA;AAC3D,IAAA,CAAA;AACF;AAEA;;;;;;;;;;IAWA,MAAMS,wBAAAA,GAA2B,OAAO7B,MAAAA,EAAqB8B,MAAAA,GAAAA;AAC3D,IAAA,IAAIA,WAAW,IAAA,EAAM;QACnB,OAAO,IAAA;AACT,IAAA;IAEA,MAAMC,WAAAA,GAAc,MAAM/B,MAAAA,CAAOgC,EAAE,CAACC,KAAK,CAACC,gBAAAA,CAAAA,CAAkBT,OAAO,CAAC;QAClEU,MAAAA,EAAQ;AAAC,YAAA,IAAA;AAAM,YAAA;AAAO,SAAA;QACtBC,KAAAA,EAAO;YAAEjC,EAAAA,EAAI2B;AAAO;AACtB,KAAA,CAAA;IAEA,IAAIC,WAAAA,KAAgB,IAAA,IAAQA,WAAAA,KAAgBjC,SAAAA,EAAW;QACrD,MAAM,IAAIU,MAAAA,CAAOC,eAAe,CAAC4B,qCAAAA,CAAAA;AACnC,IAAA;IAEA,OAAO;QAAElC,EAAAA,EAAImC,MAAAA,CAAOP,YAAY5B,EAAE,CAAA;QAAGoC,IAAAA,EAAMC,MAAAA,CAAOT,WAAAA,CAAYQ,IAAI,IAAI,EAAA;AAAI,KAAA;AAC5E,CAAA;AAEA;;;;;;;;;;;;;;;;;;AAkBC,IACM,MAAME,4BAAAA,GAA+B,CAC1CzC,MAAAA,EACAC,OAAAA,GAAAA;IAEAC,qBAAAA,CAAsBF,MAAAA,CAAAA;IAEtB,OAAO,OAAO,EACZN,IAAI,EAGL,GAAA;AACC,QAAA,MAAM,EAAEgD,GAAG,EAAEZ,MAAM,EAAE,GAAGpC,IAAAA;;AAGxBiB,QAAAA,qBAAAA,CAAsBX,MAAAA,EAAQC,OAAAA,EAASW,OAAAA,CAAQC,MAAM,EAAEC,cAAAA,CAAAA;QAEvD,MAAM6B,iBAAAA,GAAoB,MAAMd,wBAAAA,CAAyB7B,MAAAA,EAAQ8B,MAAAA,CAAAA;AAEjE,QAAA,MAAMc,QAAiD,EAAE;AACzD,QAAA,MAAMC,SAA2C,EAAE;;;AAInD,QAAA,KAAK,MAAM1C,EAAAA,IAAM,IAAI2C,GAAAA,CAAIJ,GAAAA,CAAAA,CAAM;YAC7B,IAAI;;;gBAGF,MAAM3B,6BAAAA,CACJd,QAAQe,WAAW,EACnBJ,QAAQC,MAAM,EACdC,gBACAX,EAAAA,EACAH,MAAAA,CAAAA;gBAEF,MAAMwB,OAAAA,GAAU,MAAMH,UAAAA,CAAW,QAAA,EAAUrB,QAAQsB,cAAc,CAC/DnB;;AAGA,gBAAA;AAAE2B,oBAAAA;iBAAO,EACT;AAAEP,oBAAAA,IAAAA,EAAMtB,QAAQsB;AAAK,iBAAA,CAAA;;;gBAKvBqB,KAAAA,CAAMG,IAAI,CAACnB,kBAAAA,CAAmB;AAAE,oBAAA,GAAGJ,OAAO;oBAAEM,MAAAA,EAAQa;AAAkB,iBAAA,CAAA,CAAA;AACxE,YAAA,CAAA,CAAE,OAAO1B,KAAAA,EAAO;gBACd,IAAIA,KAAAA,YAAiBT,MAAAA,CAAOU,aAAa,EAAE;AACzC2B,oBAAAA,MAAAA,CAAOE,IAAI,CAAC;AAAE5C,wBAAAA,EAAAA;wBAAI6C,MAAAA,EAAQC;AAA6B,qBAAA,CAAA;AACvD,oBAAA;AACF,gBAAA;gBAEA,IAAIhC,KAAAA,YAAiBT,MAAAA,CAAO0C,cAAc,EAAE;AAC1CL,oBAAAA,MAAAA,CAAOE,IAAI,CAAC;AAAE5C,wBAAAA,EAAAA;wBAAI6C,MAAAA,EAAQG;AAA6B,qBAAA,CAAA;AACvD,oBAAA;AACF,gBAAA;AAEA;;;;;;;;;;;;;YAcAN,MAAAA,CAAOE,IAAI,CAAC;AACV5C,oBAAAA,EAAAA;AACA6C,oBAAAA,MAAAA,EAAQI,0BAA0BnC,KAAAA,YAAiBoC,KAAAA,GAAQpC,KAAAA,CAAMqC,OAAO,GAAGd,MAAAA,CAAOvB,KAAAA,CAAAA;AACpF,iBAAA,CAAA;AACF,YAAA;AACF,QAAA;AAEA;;;;;;;;;;AAUC,QACD,OAAOS,EAAAA,CAAG;AAAEiB,YAAAA,iBAAAA;AAAmBC,YAAAA,KAAAA;AAAOC,YAAAA;AAAO,SAAA,CAAA;AAC/C,IAAA,CAAA;AACF;AAEA;;;;;;;;;;;;;;;;;;;;;;;;AAwBC,IACM,MAAMU,8BAAAA,GAAiC,CAC5CvD,MAAAA,EACAC,OAAAA,GAAAA;IAEAC,qBAAAA,CAAsBF,MAAAA,CAAAA;IAEtB,OAAO,OAAO,EACZN,IAAI,EAGL,GAAA;AACC,QAAA,MAAM,EAAEgD,GAAG,EAAEc,MAAAA,GAAS,IAAI,EAAE,GAAG9D,IAAAA;;;AAI/BiB,QAAAA,qBAAAA,CAAsBX,MAAAA,EAAQC,OAAAA,EAASW,OAAAA,CAAQC,MAAM,EAAEC,cAAAA,CAAAA;AAEvD,QAAA,MAAM2C,UAAmD,EAAE;AAC3D,QAAA,MAAMZ,SAA2C,EAAE;;;AAInD,QAAA,KAAK,MAAM1C,EAAAA,IAAM,IAAI2C,GAAAA,CAAIJ,GAAAA,CAAAA,CAAM;YAC7B,IAAIgB,IAAAA;YAEJ,IAAI;;;;AAID,gBAAA,CAAA,EAAEA,IAAI,EAAE,GAAG,MAAM3C,6BAAAA,CAChBd,OAAAA,CAAQe,WAAW,EACnBJ,OAAAA,CAAQC,MAAM,EACdC,cAAAA,EACAX,IACAH,MAAAA,CACF;AACF,YAAA,CAAA,CAAE,OAAOiB,KAAAA,EAAO;gBACd,IAAIA,KAAAA,YAAiBT,MAAAA,CAAOU,aAAa,EAAE;AACzC2B,oBAAAA,MAAAA,CAAOE,IAAI,CAAC;AAAE5C,wBAAAA,EAAAA;wBAAI6C,MAAAA,EAAQW;AAA+B,qBAAA,CAAA;AACzD,oBAAA;AACF,gBAAA;gBAEA,IAAI1C,KAAAA,YAAiBT,MAAAA,CAAO0C,cAAc,EAAE;AAC1CL,oBAAAA,MAAAA,CAAOE,IAAI,CAAC;AAAE5C,wBAAAA,EAAAA;wBAAI6C,MAAAA,EAAQY;AAA+B,qBAAA,CAAA;AACzD,oBAAA;AACF,gBAAA;AAEAf,gBAAAA,MAAAA,CAAOE,IAAI,CAAC;AACV5C,oBAAAA,EAAAA;AACA6C,oBAAAA,MAAAA,EAAQa,4BACN5C,KAAAA,YAAiBoC,KAAAA,GAAQpC,KAAAA,CAAMqC,OAAO,GAAGd,MAAAA,CAAOvB,KAAAA,CAAAA;AAEpD,iBAAA,CAAA;AACA,gBAAA;AACF,YAAA;;;AAIA,YAAA,IAAIuC,MAAAA,EAAQ;gBACVC,OAAAA,CAAQV,IAAI,CAACnB,kBAAAA,CAAmB8B,IAAAA,CAAAA,CAAAA;AAChC,gBAAA;AACF,YAAA;YAEA,IAAI;AACF,gBAAA,MAAMrC,UAAAA,CAAW,QAAA,EAAUrB,MAAAA,CAAAA,CAAQ8D,MAAM,CAACJ,IAAAA,CAAAA;;;gBAI1CD,OAAAA,CAAQV,IAAI,CAACnB,kBAAAA,CAAmB8B,IAAAA,CAAAA,CAAAA;AAClC,YAAA,CAAA,CAAE,OAAOzC,KAAAA,EAAO;AACd;;;;;YAMA4B,MAAAA,CAAOE,IAAI,CAAC;AACV5C,oBAAAA,EAAAA;AACA6C,oBAAAA,MAAAA,EAAQa,4BACN5C,KAAAA,YAAiBoC,KAAAA,GAAQpC,KAAAA,CAAMqC,OAAO,GAAGd,MAAAA,CAAOvB,KAAAA,CAAAA;AAEpD,iBAAA,CAAA;AACF,YAAA;AACF,QAAA;AAEA;;;;;AAKC,QACD,OAAOS,EAAAA,CAAG;AAAE8B,YAAAA,MAAAA;AAAQC,YAAAA,OAAAA;AAASZ,YAAAA,MAAAA;AAAQkB,YAAAA,eAAAA,EAAiBN,QAAQlD;AAAO,SAAA,CAAA;AACvE,IAAA,CAAA;AACF;;;;"}

package/dist/server/mcp/permissions.js

@@ -0,0 +1,36 @@
+'use strict';
+
+var utils = require('@strapi/utils');
+
+/**
+ * Builds an admin permissions manager for a media model bound to the MCP session's ability.
+ *
+ * MCP tool handlers have no Koa context, so they cannot rely on route policies: each handler must
+ * re-check permissions itself, exactly as the admin controllers do via `ctx.state.userAbility`.
+ * The declarative `auth.policies` on a tool definition already gates registration and invocation;
+ * this second check is what keeps a handler safe if it is ever called from another entry point.
+ *
+ * It is also the only check bound to a model. `plugin::upload.read` is registered in the
+ * `plugins` section with no subject (see the upload plugin bootstrap), so a tool's policies
+ * carry an action only — a subject-less grant registers as CASL `subject: 'all'`. Passing a
+ * model UID as the policy subject is rejected by the admin-token validation, so the file /
+ * folder distinction is enforced here, where the permissions manager is bound to the UID.
+ */ const createMediaPermissionsManager = (strapi, context, action, model)=>strapi.service('admin::permission').createPermissionsManager({
+        ability: context.userAbility,
+        action,
+        model
+    });
+/**
+ * Throws `ForbiddenError` unless the session's ability permits `action` on `model`.
+ * Mirrors the `if (!pm.isAllowed) return ctx.forbidden()` guard in the admin controllers.
+ */ const assertMediaPermission = (strapi, context, action, model)=>{
+    const pm = createMediaPermissionsManager(strapi, context, action, model);
+    if (!pm.isAllowed) {
+        throw new utils.errors.ForbiddenError();
+    }
+    return pm;
+};
+
+exports.assertMediaPermission = assertMediaPermission;
+exports.createMediaPermissionsManager = createMediaPermissionsManager;
+//# sourceMappingURL=permissions.js.map

package/dist/server/mcp/permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.js","sources":["../../../server/src/mcp/permissions.ts"],"sourcesContent":["import { errors } from '@strapi/utils';\nimport type { Core, Modules } from '@strapi/types';\n\n/**\n * Builds an admin permissions manager for a media model bound to the MCP session's ability.\n *\n * MCP tool handlers have no Koa context, so they cannot rely on route policies: each handler must\n * re-check permissions itself, exactly as the admin controllers do via `ctx.state.userAbility`.\n * The declarative `auth.policies` on a tool definition already gates registration and invocation;\n * this second check is what keeps a handler safe if it is ever called from another entry point.\n *\n * It is also the only check bound to a model. `plugin::upload.read` is registered in the\n * `plugins` section with no subject (see the upload plugin bootstrap), so a tool's policies\n * carry an action only — a subject-less grant registers as CASL `subject: 'all'`. Passing a\n * model UID as the policy subject is rejected by the admin-token validation, so the file /\n * folder distinction is enforced here, where the permissions manager is bound to the UID.\n */\nexport const createMediaPermissionsManager = (\n  strapi: Core.Strapi,\n  context: Modules.MCP.McpHandlerContext,\n  action: string,\n  model: string\n) =>\n  strapi.service('admin::permission').createPermissionsManager({\n    ability: context.userAbility,\n    action,\n    model,\n  });\n\n/**\n * Throws `ForbiddenError` unless the session's ability permits `action` on `model`.\n * Mirrors the `if (!pm.isAllowed) return ctx.forbidden()` guard in the admin controllers.\n */\nexport const assertMediaPermission = (\n  strapi: Core.Strapi,\n  context: Modules.MCP.McpHandlerContext,\n  action: string,\n  model: string\n) => {\n  const pm = createMediaPermissionsManager(strapi, context, action, model);\n\n  if (!pm.isAllowed) {\n    throw new errors.ForbiddenError();\n  }\n\n  return pm;\n};\n"],"names":["createMediaPermissionsManager","strapi","context","action","model","service","createPermissionsManager","ability","userAbility","assertMediaPermission","pm","isAllowed","errors","ForbiddenError"],"mappings":";;;;AAGA;;;;;;;;;;;;;AAaC,IACM,MAAMA,6BAAAA,GAAgC,CAC3CC,MAAAA,EACAC,OAAAA,EACAC,MAAAA,EACAC,KAAAA,GAEAH,MAAAA,CAAOI,OAAO,CAAC,mBAAA,CAAA,CAAqBC,wBAAwB,CAAC;AAC3DC,QAAAA,OAAAA,EAASL,QAAQM,WAAW;AAC5BL,QAAAA,MAAAA;AACAC,QAAAA;KACF;AAEF;;;AAGC,IACM,MAAMK,qBAAAA,GAAwB,CACnCR,MAAAA,EACAC,SACAC,MAAAA,EACAC,KAAAA,GAAAA;AAEA,IAAA,MAAMM,EAAAA,GAAKV,6BAAAA,CAA8BC,MAAAA,EAAQC,OAAAA,EAASC,MAAAA,EAAQC,KAAAA,CAAAA;IAElE,IAAI,CAACM,EAAAA,CAAGC,SAAS,EAAE;QACjB,MAAM,IAAIC,aAAOC,cAAc,EAAA;AACjC,IAAA;IAEA,OAAOH,EAAAA;AACT;;;;;"}

package/dist/server/mcp/permissions.mjs

@@ -0,0 +1,33 @@
+import { errors } from '@strapi/utils';
+
+/**
+ * Builds an admin permissions manager for a media model bound to the MCP session's ability.
+ *
+ * MCP tool handlers have no Koa context, so they cannot rely on route policies: each handler must
+ * re-check permissions itself, exactly as the admin controllers do via `ctx.state.userAbility`.
+ * The declarative `auth.policies` on a tool definition already gates registration and invocation;
+ * this second check is what keeps a handler safe if it is ever called from another entry point.
+ *
+ * It is also the only check bound to a model. `plugin::upload.read` is registered in the
+ * `plugins` section with no subject (see the upload plugin bootstrap), so a tool's policies
+ * carry an action only — a subject-less grant registers as CASL `subject: 'all'`. Passing a
+ * model UID as the policy subject is rejected by the admin-token validation, so the file /
+ * folder distinction is enforced here, where the permissions manager is bound to the UID.
+ */ const createMediaPermissionsManager = (strapi, context, action, model)=>strapi.service('admin::permission').createPermissionsManager({
+        ability: context.userAbility,
+        action,
+        model
+    });
+/**
+ * Throws `ForbiddenError` unless the session's ability permits `action` on `model`.
+ * Mirrors the `if (!pm.isAllowed) return ctx.forbidden()` guard in the admin controllers.
+ */ const assertMediaPermission = (strapi, context, action, model)=>{
+    const pm = createMediaPermissionsManager(strapi, context, action, model);
+    if (!pm.isAllowed) {
+        throw new errors.ForbiddenError();
+    }
+    return pm;
+};
+
+export { assertMediaPermission, createMediaPermissionsManager };
+//# sourceMappingURL=permissions.mjs.map

package/dist/server/mcp/permissions.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.mjs","sources":["../../../server/src/mcp/permissions.ts"],"sourcesContent":["import { errors } from '@strapi/utils';\nimport type { Core, Modules } from '@strapi/types';\n\n/**\n * Builds an admin permissions manager for a media model bound to the MCP session's ability.\n *\n * MCP tool handlers have no Koa context, so they cannot rely on route policies: each handler must\n * re-check permissions itself, exactly as the admin controllers do via `ctx.state.userAbility`.\n * The declarative `auth.policies` on a tool definition already gates registration and invocation;\n * this second check is what keeps a handler safe if it is ever called from another entry point.\n *\n * It is also the only check bound to a model. `plugin::upload.read` is registered in the\n * `plugins` section with no subject (see the upload plugin bootstrap), so a tool's policies\n * carry an action only — a subject-less grant registers as CASL `subject: 'all'`. Passing a\n * model UID as the policy subject is rejected by the admin-token validation, so the file /\n * folder distinction is enforced here, where the permissions manager is bound to the UID.\n */\nexport const createMediaPermissionsManager = (\n  strapi: Core.Strapi,\n  context: Modules.MCP.McpHandlerContext,\n  action: string,\n  model: string\n) =>\n  strapi.service('admin::permission').createPermissionsManager({\n    ability: context.userAbility,\n    action,\n    model,\n  });\n\n/**\n * Throws `ForbiddenError` unless the session's ability permits `action` on `model`.\n * Mirrors the `if (!pm.isAllowed) return ctx.forbidden()` guard in the admin controllers.\n */\nexport const assertMediaPermission = (\n  strapi: Core.Strapi,\n  context: Modules.MCP.McpHandlerContext,\n  action: string,\n  model: string\n) => {\n  const pm = createMediaPermissionsManager(strapi, context, action, model);\n\n  if (!pm.isAllowed) {\n    throw new errors.ForbiddenError();\n  }\n\n  return pm;\n};\n"],"names":["createMediaPermissionsManager","strapi","context","action","model","service","createPermissionsManager","ability","userAbility","assertMediaPermission","pm","isAllowed","errors","ForbiddenError"],"mappings":";;AAGA;;;;;;;;;;;;;AAaC,IACM,MAAMA,6BAAAA,GAAgC,CAC3CC,MAAAA,EACAC,OAAAA,EACAC,MAAAA,EACAC,KAAAA,GAEAH,MAAAA,CAAOI,OAAO,CAAC,mBAAA,CAAA,CAAqBC,wBAAwB,CAAC;AAC3DC,QAAAA,OAAAA,EAASL,QAAQM,WAAW;AAC5BL,QAAAA,MAAAA;AACAC,QAAAA;KACF;AAEF;;;AAGC,IACM,MAAMK,qBAAAA,GAAwB,CACnCR,MAAAA,EACAC,SACAC,MAAAA,EACAC,KAAAA,GAAAA;AAEA,IAAA,MAAMM,EAAAA,GAAKV,6BAAAA,CAA8BC,MAAAA,EAAQC,OAAAA,EAASC,MAAAA,EAAQC,KAAAA,CAAAA;IAElE,IAAI,CAACM,EAAAA,CAAGC,SAAS,EAAE;QACjB,MAAM,IAAIC,OAAOC,cAAc,EAAA;AACjC,IAAA;IAEA,OAAOH,EAAAA;AACT;;;;"}