drupal-mcp-connector 1.8.1 → 2.1.0

package/src/lib/validate.js

@@ -8,6 +8,8 @@
  * coerce values in ways that could hide injection attempts.
  */
 
+import { existsSync, realpathSync } from "fs";
+import { basename, resolve, sep } from "path";
 import { SecurityError } from "./security.js";
 
 // ---------------------------------------------------------------------------
@@ -66,7 +68,13 @@ export function validateUuid(value, fieldName = "id") {
 // SQL query validation (read-only enforcement for Drush bridge)
 // ---------------------------------------------------------------------------
 
-const SAFE_SQL_PREFIXES = ["select ", "show ", "describe ", "explain ", "desc "];
+// SELECT only. SHOW / DESCRIBE / EXPLAIN used to be accepted here, but raw SQL
+// now runs through mcp_sentinel's governed command, which accepts SELECT alone
+// — schema introspection has a governed home on the /drupal-mcp/context
+// endpoint and the entity-schema tools. Keeping the wider list here would mean
+// this check passed statements the server then refused, i.e. two policies
+// disagreeing, which is the failure mode this whole change exists to remove.
+const SAFE_SQL_PREFIXES = ["select "];
 
 // Patterns that indicate write operations even within SELECT contexts
 const DANGEROUS_SQL_PATTERNS = [
@@ -80,7 +88,14 @@ const DANGEROUS_SQL_PATTERNS = [
 
 /**
  * Validate that a SQL query is read-only.
- * Checks both the query prefix AND secondary injection patterns.
+ *
+ * This is a fast local reject, NOT the authority. The authority is
+ * mcp_sentinel's McpRawSqlGuard, which runs inside Drupal where the policy
+ * profile lives and can resolve denied entity types and redacted fields down
+ * to real tables and columns — something no client-side check can do. This
+ * check exists only to fail obvious cases without an SSH round trip, so it is
+ * deliberately kept coarser than, and never wider than, the server's.
+ *
  * @param {string} query The SQL query to validate.
  * @returns {string} The validated query.
  * @throws {Error} if the query is empty or exceeds the length cap.
@@ -95,8 +110,9 @@ export function validateSqlQuery(query) {
 
   if (!SAFE_SQL_PREFIXES.some((prefix) => normalised.startsWith(prefix))) {
     throw new SecurityError(
-      "drupal_drush_sql_query only permits SELECT, SHOW, DESCRIBE, and EXPLAIN statements. " +
-      "Use the JSON:API tools for write operations."
+      "drupal_drush_sql_query only permits SELECT statements. " +
+      "Use the JSON:API tools for write operations, and the site-context or " +
+      "entity-schema tools for schema introspection."
     );
   }
 
@@ -200,6 +216,120 @@ export function clampLimit(value, defaultVal = 20) {
   return Math.min(n, MAX_PAGE_LIMIT);
 }
 
+// ---------------------------------------------------------------------------
+// Local file upload path allowlist (#137 / audit C1)
+// ---------------------------------------------------------------------------
+//
+// Upload tools must not be able to read arbitrary process-readable files
+// (SSH keys, .env, connector config). Paths must resolve under an allowed
+// root. Default root is process.cwd(); operators expand with MCP_UPLOAD_ROOT
+// (colon- or semicolon-separated absolute paths).
+
+/**
+ * Resolve an absolute path, following symlinks when the target exists.
+ * @param {string} p Path to resolve.
+ * @returns {string} Canonical absolute path.
+ */
+function resolveExistingPath(p) {
+  const abs = resolve(p);
+  try {
+    // eslint-disable-next-line security/detect-non-literal-fs-filename -- operator-configured upload root or cwd
+    return realpathSync(abs);
+  } catch {
+    return abs;
+  }
+}
+
+/**
+ * Allowed upload roots. From MCP_UPLOAD_ROOT when set; otherwise process.cwd().
+ * @returns {string[]} Absolute root paths (realpath when possible).
+ */
+export function getUploadRoots() {
+  const raw = process.env.MCP_UPLOAD_ROOT;
+  if (raw && String(raw).trim()) {
+    return String(raw)
+      .split(/[:;]/)
+      .map((s) => s.trim())
+      .filter(Boolean)
+      .map(resolveExistingPath);
+  }
+  return [resolveExistingPath(process.cwd())];
+}
+
+/**
+ * Sanitize a filename for Content-Disposition (no CR/LF/quotes; bounded length).
+ * @param {string} name Raw filename (often basename of a path).
+ * @returns {string} Safe filename for the header.
+ */
+export function sanitizeUploadFilename(name) {
+  const base = basename(String(name || "upload"));
+  const cleaned = base
+    .replace(/[\r\n"\\]/g, "")
+    .replace(/[^\w.\- ()[\]]+/g, "_")
+    .replace(/^\.+/, "")
+    .slice(0, 200);
+  return cleaned || "upload.bin";
+}
+
+/**
+ * Whether a resolved path sits under a sensitive location that must never
+ * be uploaded even when it is inside an allowed root.
+ * @param {string} real Absolute real path.
+ * @returns {boolean}
+ */
+function isSensitiveUploadPath(real) {
+  const n = real.split(sep).join("/");
+  if (n.includes("/.ssh/") || n.endsWith("/.ssh") || n.includes("/.gnupg/")) return true;
+  const base = basename(real);
+  if (base === "id_rsa" || base === "id_ed25519" || base === "id_ecdsa" || base === "id_dsa") return true;
+  if (base.startsWith(".env")) return true;
+  if (n.endsWith("/config/config.json")) return true;
+  return false;
+}
+
+/**
+ * Validate that a local file path may be uploaded: exists, under an allowed
+ * root, and not a known secret path. Returns the resolved real path for use
+ * with fs streams.
+ *
+ * @param {string} filePath Caller-supplied path.
+ * @returns {string} Real absolute path safe to read for upload.
+ * @throws {Error} if the path is missing or not a string.
+ * @throws {SecurityError} if the path is outside roots or sensitive.
+ */
+export function assertUploadPathAllowed(filePath) {
+  if (typeof filePath !== "string" || !filePath.trim()) {
+    throw new Error("filePath must be a non-empty string.");
+  }
+  const abs = resolve(filePath);
+  // eslint-disable-next-line security/detect-non-literal-fs-filename -- path is caller-supplied; allowlist enforced after realpath
+  if (!existsSync(abs)) {
+    throw new Error(`Upload path does not exist: ${filePath}`);
+  }
+  let real;
+  try {
+    // eslint-disable-next-line security/detect-non-literal-fs-filename -- path is caller-supplied; allowlist enforced next
+    real = realpathSync(abs);
+  } catch {
+    throw new Error(`Upload path is not readable: ${filePath}`);
+  }
+  const roots = getUploadRoots();
+  const allowed = roots.some((root) => real === root || real.startsWith(root.endsWith(sep) ? root : root + sep));
+  if (!allowed) {
+    throw new SecurityError(
+      "Upload path is outside allowed roots. Set MCP_UPLOAD_ROOT to an absolute " +
+      "directory (or several, colon-separated), or place the file under the " +
+      `connector working directory. Denied: ${filePath}`
+    );
+  }
+  if (isSensitiveUploadPath(real)) {
+    throw new SecurityError(
+      "Upload of sensitive paths (SSH keys, .env*, connector config.json) is not allowed."
+    );
+  }
+  return real;
+}
+
 // ---------------------------------------------------------------------------
 // Field name sanitization (prevent crafted field names in JSON:API filters)
 // ---------------------------------------------------------------------------

package/src/tools/bulk.js

@@ -14,6 +14,7 @@
 import { getSiteConfig } from "../lib/config.js";
 import { resolveBackend } from "../lib/backends/index.js";
 import { resolveSecurityConfig, assertWriteAllowed, assertPublishAllowed } from "../lib/security.js";
+import { applySafeDraftDefault } from "../lib/moderation-default.js";
 
 /**
  * Normalize an unknown thrown value into a human-readable message.
@@ -67,6 +68,11 @@ async function bulkCreate({ site: siteName, entityType, bundle, items = [] }) {
  * each item is updated independently so the batch continues past failures. An
  * item missing an id is reported as a per-item failure rather than aborting.
  *
+ * Safe default (#131): each published moderated target without an explicit
+ * `moderation_state` is rewritten to `moderation_state: draft` before the
+ * PATCH, so bulk relationship-wiring and field edits become forward revisions
+ * rather than live default-revision mutations.
+ *
  * @param {object} args - { site?, entityType, bundle, items: [{ id, attributes?, relationships? }] }.
  * @returns {Promise<{results: object[], summary: {updated: number, failed: number}}>}
  *   Per-item { index, success, id? | error } plus a roll-up summary.
@@ -85,10 +91,14 @@ async function bulkUpdate({ site: siteName, entityType, bundle, items = [] }) {
     const item = rawItem || {};
     try {
       if (!item.id) throw new Error("Missing 'id' for update item");
-      assertPublishAllowed(sec, item.attributes ?? {});
+      const attributes = await applySafeDraftDefault({
+        backend, entityType, bundle, id: item.id,
+        attributes: item.attributes ?? {},
+      });
+      assertPublishAllowed(sec, attributes);
       const entity = await backend.updateEntity({
         entityType, bundle, id: item.id,
-        attributes: item.attributes ?? {},
+        attributes,
         relationships: item.relationships ?? {},
       });
       updated += 1;
@@ -130,7 +140,7 @@ export const definitions = [
   },
   {
     name: "drupal_bulk_update",
-    description: "Update many entities of a single type + bundle in one call. Permission is checked once; each item is updated independently, so the batch continues past individual failures (partial success). Each item requires an 'id' (UUID); items missing an id are reported as per-item failures. Returns per-item { index, success, id | error } and a summary { updated, failed }.",
+    description: "Update many entities of a single type + bundle in one call. Permission is checked once; each item is updated independently, so the batch continues past individual failures (partial success). Each item requires an 'id' (UUID); items missing an id are reported as per-item failures. Published moderated targets without an explicit attributes.moderation_state default to moderation_state 'draft' (forward revision) so bulk edits do not mutate live default revisions. Returns per-item { index, success, id | error } and a summary { updated, failed }.",
     inputSchema: {
       type: "object", required: ["entityType", "bundle", "items"],
       properties: {

package/src/tools/drush.js

@@ -7,7 +7,11 @@
  *   1. SSH key auth only — password-based SSH is deliberately unsupported.
  *   2. All command arguments are validated before being passed to SSH.
  *   3. Module names are validated as machine names (a-z, 0-9, _) only.
- *   4. SQL tool enforces SELECT-only allowlist — no DDL/DML permitted.
+ *   4. Raw SQL runs ONLY through mcp_sentinel's governed command, and only for
+ *      a site that opts in with drushSsh.rawSql="governed". The SELECT-only
+ *      check here is a fast local reject; the site's policy profile is the
+ *      authority, because this process holds the SSH key and cannot police
+ *      itself.
  *   5. Key path is validated against path traversal.
  *   6. All operations are logged to stderr with site name and command.
  *   7. Write operations assert non-readOnly via the security layer.
@@ -58,6 +62,32 @@ function assertCommandAllowed(sshCfg, subcommand) {
   }
 }
 
+/**
+ * Enforce the per-site opt-in for raw SQL.
+ *
+ * Raw SQL is off unless a site sets `drushSsh.rawSql: "governed"`. There is no
+ * ungoverned mode: the previous behaviour — running the statement through
+ * `drush sql:query` — bypassed the site's entire policy and left no audit
+ * record, so it was removed rather than kept behind a flag. A flag would have
+ * meant the bypass was one config key away and still invisible when used.
+ *
+ * @param {object} sshCfg Resolved drushSsh config block.
+ * @param {string} siteName Site name, for the error message.
+ * @returns {void}
+ * @throws {SecurityError} if the site has not opted in.
+ */
+function assertGovernedRawSql(sshCfg, siteName) {
+  if (sshCfg.rawSql !== "governed") {
+    throw new SecurityError(
+      `Raw SQL is disabled for site "${siteName}". Raw SQL reads underneath Drupal's ` +
+      "entity API, so it is only available through mcp_sentinel's governed command. " +
+      "To enable it: install mcp_sentinel on the site, set `allow_raw_sql` on the policy " +
+      "profile that governs the agent, and set `rawSql: \"governed\"` in this site's " +
+      "drushSsh config (plus `mcp-sentinel:sql-query` in allowedCommands if that list is set)."
+    );
+  }
+}
+
 /**
  * Resolve and validate the SSH key path. Prevents path traversal.
  */
@@ -400,18 +430,45 @@ async function drushCreateUser({ site: siteName, name, mail, password, roles = [
 }
 
 /**
- * Run a read-only SQL query (`drush sql:query`). The query is validated against
- * a SELECT-only allowlist before execution.
+ * Run a read-only SQL query through mcp_sentinel's governed command.
+ *
+ * This used to call `drush sql:query`, which was a hole straight through the
+ * site's policy: `sql:query` runs below Drupal's entity API, so no policy
+ * profile, no denied_entity_types, no redacted_fields and no audit entry ever
+ * applied to it. That is not a fixable property of the command — Drush caps
+ * its bootstrap below the level at which Drupal discovers module command
+ * files, so no module code can run on its path at all.
+ *
+ * `mcp-sentinel:sql-query` is a module-provided command, so Drupal is fully
+ * bootstrapped: the policy profile applies, the statement is checked against
+ * the same deny and redaction lists that govern JSON:API, and every attempt —
+ * permitted or refused — is written to the tamper-evident audit chain with its
+ * statement text. Enforcement is therefore server-side, which matters because
+ * this process holds the SSH key and cannot be trusted to police itself.
+ *
  * @param {object} args - { site?, query }.
- * @returns {Promise<{rows: *}>}
- * @throws {SecurityError} If the query is not read-only.
+ * @returns {Promise<object>} The server's payload: { rows, row_count, truncated, profile }.
+ * @throws {SecurityError} If the site has not opted in, or the query is not read-only.
  */
 async function sqlQuery({ site: siteName, query }) {
-  const site = getSiteConfig(siteName);
-  // Throws SecurityError if query is not read-only
+  const site   = getSiteConfig(siteName);
+  const sshCfg = getDrushConfig(site);
+  assertGovernedRawSql(sshCfg, site._name);
+  // Fast local reject only; mcp_sentinel's guard is the authority.
   validateSqlQuery(query);
-  const out = await sshDrush(site, ["sql:query", query]);
-  return { rows: parseDrush(out) };
+  const out = await sshDrush(site, ["mcp-sentinel:sql-query", query]);
+  // The command emits a JSON object; a non-JSON reply means the command was
+  // not found (mcp_sentinel absent or too old), which must not be reported as
+  // an empty result set.
+  const payload = parseDrush(out);
+  if (!payload || typeof payload !== "object" || Array.isArray(payload) || !Array.isArray(payload.rows)) {
+    throw new Error(
+      `Raw SQL on site "${site._name}" did not return a governed result. ` +
+      "Confirm mcp_sentinel >= 1.14 is installed and enabled on the target site — " +
+      "`drush mcp-sentinel:sql-query` must exist there."
+    );
+  }
+  return payload;
 }
 
 /**
@@ -477,7 +534,7 @@ export const definitions = [
   },
   {
     name: "drupal_drush_sql_query",
-    description: "Run a read-only SQL query (SELECT, SHOW, DESCRIBE, EXPLAIN only) via Drush. Write queries are blocked by the security layer.",
+    description: "Run a single read-only SELECT through mcp_sentinel's governed command (`drush mcp-sentinel:sql-query`). Requires the site to set drushSsh.rawSql=\"governed\" AND the site's policy profile to set allow_raw_sql; both are off by default. The server refuses statements touching a denied entity type, a non-entity table, or a redacted field, and records every attempt in the tamper-evident audit log. Use the site-context or entity-schema tools for schema introspection.",
     inputSchema: { type: "object", required: ["query"], properties: { site: { type: "string" }, query: { type: "string" } } },
   },
   {

package/src/tools/entities.js

@@ -11,6 +11,7 @@
 import { getSiteConfig } from "../lib/config.js";
 import { resolveBackend } from "../lib/backends/index.js";
 import { shapeWriteResponse, RETURNING_SCHEMA } from "../lib/entity-response.js";
+import { applySafeDraftDefault } from "../lib/moderation-default.js";
 import {
   resolveSecurityConfig, assertReadAllowed, assertWriteAllowed, assertDeleteAllowed, assertPublishAllowed,
   redactCanonicalEntity, getSecuritySummary,
@@ -70,6 +71,10 @@ async function createEntity({ site: siteName, entityType, bundle, attributes = {
 /**
  * Update an entity of any type/bundle (partial — only supplied fields are sent).
  *
+ * Safe default (#131): published moderated targets without an explicit
+ * `moderation_state` get `moderation_state: draft` so the write is a forward
+ * revision rather than a live default-revision mutation.
+ *
  * @param {object} args - { site?, entityType, bundle, id, attributes?, relationships? }.
  * @returns {Promise<object>} The updated entity descriptor.
  * @throws {SecurityError} If updating the type/bundle is not permitted.
@@ -78,10 +83,13 @@ async function updateEntity({ site: siteName, entityType, bundle, id, attributes
   const site = getSiteConfig(siteName);
   const sec = resolveSecurityConfig(site);
   assertWriteAllowed(sec, "update", entityType, bundle);
-  assertPublishAllowed(sec, attributes);
-  if (dryRun) return { dryRun: true, operation: "update", entityType, bundle, id, attributes, relationships };
   const backend = await resolveBackend(site);
-  return shapeWriteResponse(await backend.updateEntity({ entityType, bundle, id, attributes, relationships }), returning);
+  const safeAttributes = await applySafeDraftDefault({
+    backend, entityType, bundle, id, attributes,
+  });
+  assertPublishAllowed(sec, safeAttributes);
+  if (dryRun) return { dryRun: true, operation: "update", entityType, bundle, id, attributes: safeAttributes, relationships };
+  return shapeWriteResponse(await backend.updateEntity({ entityType, bundle, id, attributes: safeAttributes, relationships }), returning);
 }
 
 /**
@@ -222,7 +230,7 @@ export const definitions = [
   },
   {
     name: "drupal_entity_update",
-    description: "Update an existing entity of any Drupal entity type. Only include attributes/relationships you want to change.",
+    description: "Update an existing entity of any Drupal entity type. Only include attributes/relationships you want to change. Published moderated targets without an explicit attributes.moderation_state default to moderation_state 'draft' (forward revision).",
     inputSchema: {
       type: "object", required: ["entityType", "bundle", "id"],
       properties: {

package/src/tools/media.js

@@ -8,7 +8,10 @@
 
 import { getSiteConfig } from "../lib/config.js";
 import { resolveBackend } from "../lib/backends/index.js";
-import { resolveSecurityConfig, redactCanonicalEntity } from "../lib/security.js";
+import {
+  resolveSecurityConfig, redactCanonicalEntity,
+  assertReadAllowed, assertWriteAllowed, assertDeleteAllowed, assertPublishAllowed,
+} from "../lib/security.js";
 
 /**
  * List all media types (bundles of the media entity type).
@@ -17,6 +20,7 @@ import { resolveSecurityConfig, redactCanonicalEntity } from "../lib/security.js
  */
 async function listMediaTypes({ site: siteName }) {
   const site = getSiteConfig(siteName);
+  assertReadAllowed(resolveSecurityConfig(site), "media");
   const backend = await resolveBackend(site);
   return backend.listBundles("media");
 }
@@ -32,11 +36,13 @@ async function listMediaTypes({ site: siteName }) {
 async function listMedia({ site: siteName, type, status, name, limit = 20, offset = 0 }) {
   const site = getSiteConfig(siteName);
   const sec = resolveSecurityConfig(site);
+  const bundle = type || "image";
+  assertReadAllowed(sec, "media", bundle);
   const backend = await resolveBackend(site);
   const filters = [];
   if (status !== undefined) filters.push({ field: "status", op: "eq", value: status });
   if (name) filters.push({ field: "name", op: "contains", value: name });
-  const res = await backend.listEntities({ entityType: "media", bundle: type || "image", filters, sort: [{ field: "changed", dir: "desc" }], page: { limit, offset } });
+  const res = await backend.listEntities({ entityType: "media", bundle, filters, sort: [{ field: "changed", dir: "desc" }], page: { limit, offset } });
   const items = res.entities.map((e) => redactCanonicalEntity(e, sec, "media"));
   return { total: res.page?.total ?? items.length, approximate: res.approximate ?? false, offset, nextOffset: offset + items.length, media: items };
 }
@@ -49,6 +55,7 @@ async function listMedia({ site: siteName, type, status, name, limit = 20, offse
 async function getMedia({ site: siteName, type, id }) {
   const site = getSiteConfig(siteName);
   const sec = resolveSecurityConfig(site);
+  assertReadAllowed(sec, "media", type);
   const backend = await resolveBackend(site);
   const entity = await backend.getEntity({ entityType: "media", bundle: type, id });
   return entity ? redactCanonicalEntity(entity, sec, "media") : null;
@@ -56,15 +63,23 @@ async function getMedia({ site: siteName, type, id }) {
 
 /**
  * Create a media entity. Caller `fields` are spread into attributes; name and
- * status are layered on top.
+ * status are layered on top. Defaults to unpublished (`status: false`) so
+ * media is never auto-published under non-publishing presets (#139).
  *
  * @param {object} args - { site?, type, name, status?, fields? }.
  * @returns {Promise<object>} The created media descriptor.
  */
-async function createMedia({ site: siteName, type, name, status = true, fields = {} }) {
+async function createMedia({ site: siteName, type, name, status = false, fields = {} }) {
   const site = getSiteConfig(siteName);
+  const sec = resolveSecurityConfig(site);
+  assertWriteAllowed(sec, "create", "media", type);
+  const attributes = { name, status, ...fields };
+  // Layer name/status after fields so they win, matching prior behaviour.
+  attributes.name = name;
+  attributes.status = status;
+  assertPublishAllowed(sec, attributes);
   const backend = await resolveBackend(site);
-  return backend.createEntity({ entityType: "media", bundle: type, attributes: { name, status, ...fields } });
+  return backend.createEntity({ entityType: "media", bundle: type, attributes });
 }
 
 /**
@@ -74,10 +89,13 @@ async function createMedia({ site: siteName, type, name, status = true, fields =
  */
 async function updateMedia({ site: siteName, type, id, name, status, fields = {} }) {
   const site = getSiteConfig(siteName);
-  const backend = await resolveBackend(site);
+  const sec = resolveSecurityConfig(site);
+  assertWriteAllowed(sec, "update", "media", type);
   const attributes = { ...fields };
   if (name !== undefined) attributes.name = name;
   if (status !== undefined) attributes.status = status;
+  assertPublishAllowed(sec, attributes);
+  const backend = await resolveBackend(site);
   return backend.updateEntity({ entityType: "media", bundle: type, id, attributes });
 }
 
@@ -90,6 +108,7 @@ async function updateMedia({ site: siteName, type, id, name, status, fields = {}
  */
 async function deleteMedia({ site: siteName, type, id }) {
   const site = getSiteConfig(siteName);
+  assertDeleteAllowed(resolveSecurityConfig(site), "media", type, id);
   const backend = await resolveBackend(site);
   await backend.deleteEntity({ entityType: "media", bundle: type, id });
   return { success: true, deletedId: id };
@@ -104,6 +123,10 @@ async function deleteMedia({ site: siteName, type, id }) {
  */
 async function uploadFile({ site: siteName, filePath, entityType = "media", bundle, fieldName }) {
   const site = getSiteConfig(siteName);
+  const sec = resolveSecurityConfig(site);
+  // Host entity field write + file create (both required for JSON:API upload).
+  assertWriteAllowed(sec, "create", entityType, bundle);
+  assertWriteAllowed(sec, "create", "file");
   const backend = await resolveBackend(site);
   return backend.uploadFile({ entityType, bundle, fieldName, filePath });
 }
@@ -118,8 +141,14 @@ async function uploadFile({ site: siteName, filePath, entityType = "media", bund
  * @returns {Promise<{file: {id: string, filename: string}, media: object}>}
  * @throws {BackendCapabilityError} If the backend cannot upload files.
  */
-async function uploadFileAndCreateMedia({ site: siteName, filePath, mediaType, mediaName, fieldName, altText, status = true }) {
+async function uploadFileAndCreateMedia({ site: siteName, filePath, mediaType, mediaName, fieldName, altText, status = false }) {
   const site = getSiteConfig(siteName);
+  const sec = resolveSecurityConfig(site);
+  assertWriteAllowed(sec, "create", "media", mediaType);
+  assertWriteAllowed(sec, "create", "file");
+  const attributes = { name: mediaName || undefined, status };
+  // Gate publish before any upload I/O so a blocked publish does not leave an orphan file.
+  assertPublishAllowed(sec, attributes);
   const backend = await resolveBackend(site);
   const file = await backend.uploadFile({ entityType: "media", bundle: mediaType, fieldName, filePath });
   const fileData = altText
@@ -144,8 +173,9 @@ async function uploadFileAndCreateMedia({ site: siteName, filePath, mediaType, m
 async function findOrphanedMedia({ site: siteName, type, limit = 50 }) {
   const site = getSiteConfig(siteName);
   const sec = resolveSecurityConfig(site);
-  const backend = await resolveBackend(site);
   const bundle = type || "image";
+  assertReadAllowed(sec, "media", bundle);
+  const backend = await resolveBackend(site);
   const map = (res, method, note) => ({
     method, ...(note ? { note } : {}), count: res.entities.length,
     media: res.entities.map((e) => redactCanonicalEntity(e, sec, "media")),
@@ -208,7 +238,7 @@ export const definitions = [
         site:   { type: "string" },
         type:   { type: "string", description: "Media type machine name" },
         name:   { type: "string", description: "Media entity name / label" },
-        status: { type: "boolean", default: true },
+        status: { type: "boolean", default: false, description: "Published flag. Defaults to false (unpublished). Requires allowPublish when true." },
         fields: { type: "object", description: "Additional field values — include the source field (e.g. field_media_oembed_video: 'https://youtu.be/...')" },
       },
     },
@@ -247,7 +277,7 @@ export const definitions = [
       type: "object", required: ["filePath", "bundle", "fieldName"],
       properties: {
         site:       { type: "string" },
-        filePath:   { type: "string", description: "Absolute local path to the file to upload" },
+        filePath:   { type: "string", description: "Local path to the file (must resolve under MCP_UPLOAD_ROOT or the connector working directory)" },
         entityType: { type: "string", default: "media", description: "Drupal entity type (usually 'media' or 'node')" },
         bundle:     { type: "string", description: "Bundle machine name, e.g. 'image', 'article'" },
         fieldName:  { type: "string", description: "Field machine name, e.g. 'field_media_image', 'field_image'" },
@@ -256,17 +286,17 @@ export const definitions = [
   },
   {
     name: "drupal_upload_file_and_create_media",
-    description: "Convenience tool: upload a local file and immediately create a Media entity in one step. Best for the common 'add an image' workflow.",
+    description: "Convenience tool: upload a local file and immediately create a Media entity in one step. Best for the common 'add an image' workflow. Media defaults to unpublished.",
     inputSchema: {
       type: "object", required: ["filePath", "mediaType", "fieldName"],
       properties: {
         site:      { type: "string" },
-        filePath:  { type: "string", description: "Absolute local path to the file" },
+        filePath:  { type: "string", description: "Local path to the file (must resolve under MCP_UPLOAD_ROOT or the connector working directory)" },
         mediaType: { type: "string", description: "Media type machine name, e.g. 'image'" },
         mediaName: { type: "string", description: "Name for the media entity (defaults to filename)" },
         fieldName: { type: "string", description: "Source field machine name, e.g. 'field_media_image'" },
         altText:   { type: "string", description: "Alt text for image media" },
-        status:    { type: "boolean", default: true },
+        status:    { type: "boolean", default: false, description: "Published flag. Defaults to false. Requires allowPublish when true." },
       },
     },
   },

package/src/tools/moderation.js

@@ -16,7 +16,10 @@
 
 import { getSiteConfig } from "../lib/config.js";
 import { resolveBackend } from "../lib/backends/index.js";
-import { resolveSecurityConfig, assertReadAllowed, assertWriteAllowed, redactCanonicalEntity } from "../lib/security.js";
+import {
+  resolveSecurityConfig, assertReadAllowed, assertWriteAllowed, assertPublishAllowed,
+  redactCanonicalEntity,
+} from "../lib/security.js";
 
 /** Read a node's moderation_state from a canonical entity, tolerating shapes. */
 function moderationStateOf(entity) {
@@ -37,8 +40,10 @@ async function setModerationState({ site: siteName, type, id, state }) {
   const site = getSiteConfig(siteName);
   const sec = resolveSecurityConfig(site);
   assertWriteAllowed(sec, "update", "node", type);
+  const attributes = { moderation_state: state };
+  assertPublishAllowed(sec, attributes);
   const backend = await resolveBackend(site);
-  const entity = await backend.updateEntity({ entityType: "node", bundle: type, id, attributes: { moderation_state: state } });
+  const entity = await backend.updateEntity({ entityType: "node", bundle: type, id, attributes });
   return redactCanonicalEntity(entity, sec, "node");
 }