drupal-mcp-connector 2.4.1 → 2.6.0

package/src/tools/entities.js

@@ -10,8 +10,8 @@
 
 import { getSiteConfig } from "../lib/config.js";
 import { resolveBackend } from "../lib/backends/index.js";
-import { shapeWriteResponse, RETURNING_SCHEMA } from "../lib/entity-response.js";
-import { applySafeDraftDefault } from "../lib/moderation-default.js";
+import { shapeWriteResponse, flagUnrequestedStatusChange, RETURNING_SCHEMA } from "../lib/entity-response.js";
+import { applySafeDraftDefault, hasExplicitModerationState } from "../lib/moderation-default.js";
 import {
   resolveSecurityConfig, assertReadAllowed, assertWriteAllowed, assertDeleteAllowed, assertPublishAllowed,
   redactCanonicalEntity, getSecuritySummary,
@@ -75,6 +75,10 @@ async function createEntity({ site: siteName, entityType, bundle, attributes = {
  * `moderation_state` get `moderation_state: draft` so the write is a forward
  * revision rather than a live default-revision mutation.
  *
+ * Live-state mediation (#171): `status` is never added to the PATCH unless the
+ * caller passed it, and an unrequested published-state flip in the write result
+ * is reported via `_statusChanged` rather than returned silently.
+ *
  * @param {object} args - { site?, entityType, bundle, id, attributes?, relationships? }.
  * @returns {Promise<object>} The updated entity descriptor.
  * @throws {SecurityError} If updating the type/bundle is not permitted.
@@ -84,12 +88,24 @@ async function updateEntity({ site: siteName, entityType, bundle, id, attributes
   const sec = resolveSecurityConfig(site);
   assertWriteAllowed(sec, "update", entityType, bundle);
   const backend = await resolveBackend(site);
+  // One pre-write read serves both the #131 draft default and the #171
+  // unrequested-status-change flag. Skipped when the caller pinned the
+  // moderation state explicitly (same condition the draft default uses).
+  let existing = null;
+  if (!hasExplicitModerationState(attributes)) {
+    try {
+      existing = (await backend.getEntity({ entityType, bundle, id })) ?? null;
+    } catch {
+      existing = null; // Unreadable target: server-side gates stay authoritative.
+    }
+  }
   const safeAttributes = await applySafeDraftDefault({
-    backend, entityType, bundle, id, attributes,
+    backend, entityType, bundle, id, attributes, existingEntity: existing,
   });
   assertPublishAllowed(sec, safeAttributes);
   if (dryRun) return { dryRun: true, operation: "update", entityType, bundle, id, attributes: safeAttributes, relationships };
-  return shapeWriteResponse(await backend.updateEntity({ entityType, bundle, id, attributes: safeAttributes, relationships }), returning);
+  const result = await backend.updateEntity({ entityType, bundle, id, attributes: safeAttributes, relationships });
+  return shapeWriteResponse(flagUnrequestedStatusChange(result, existing, safeAttributes), returning);
 }
 
 /**

package/src/tools/media.js

@@ -8,6 +8,8 @@
 
 import { getSiteConfig } from "../lib/config.js";
 import { resolveBackend } from "../lib/backends/index.js";
+import { splitReferenceFields } from "../lib/canonical.js";
+import { flagUnrequestedStatusChange } from "../lib/entity-response.js";
 import {
   resolveSecurityConfig, redactCanonicalEntity,
   assertReadAllowed, assertWriteAllowed, assertDeleteAllowed, assertPublishAllowed,
@@ -62,9 +64,10 @@ async function getMedia({ site: siteName, type, id }) {
 }
 
 /**
- * Create a media entity. Caller `fields` are spread into attributes; name and
- * status are layered on top. Defaults to unpublished (`status: false`) so
- * media is never auto-published under non-publishing presets (#139).
+ * Create a media entity. Caller `fields` are split into attributes and
+ * relationship-shaped references (#171); name and status are layered on top of
+ * the attributes. Defaults to unpublished (`status: false`) so media is never
+ * auto-published under non-publishing presets (#139).
  *
  * @param {object} args - { site?, type, name, status?, fields? }.
  * @returns {Promise<object>} The created media descriptor.
@@ -73,17 +76,23 @@ async function createMedia({ site: siteName, type, name, status = false, fields
   const site = getSiteConfig(siteName);
   const sec = resolveSecurityConfig(site);
   assertWriteAllowed(sec, "create", "media", type);
-  const attributes = { name, status, ...fields };
+  const { attributes, relationships } = splitReferenceFields(fields);
   // Layer name/status after fields so they win, matching prior behaviour.
   attributes.name = name;
   attributes.status = status;
   assertPublishAllowed(sec, attributes);
   const backend = await resolveBackend(site);
-  return backend.createEntity({ entityType: "media", bundle: type, attributes });
+  return backend.createEntity({
+    entityType: "media", bundle: type, attributes,
+    ...(relationships ? { relationships } : {}),
+  });
 }
 
 /**
- * Update a media entity (partial — omitted fields are left untouched).
+ * Update a media entity (partial — omitted fields are left untouched; `status`
+ * is strictly opt-in, #171). Reference-shaped `fields` values are routed to
+ * relationships — see splitReferenceFields.
+ *
  * @param {object} args - { site?, type, id, name?, status?, fields? }.
  * @returns {Promise<object>} The updated media descriptor.
  */
@@ -91,12 +100,25 @@ async function updateMedia({ site: siteName, type, id, name, status, fields = {}
   const site = getSiteConfig(siteName);
   const sec = resolveSecurityConfig(site);
   assertWriteAllowed(sec, "update", "media", type);
-  const attributes = { ...fields };
+  const { attributes, relationships } = splitReferenceFields(fields);
   if (name !== undefined) attributes.name = name;
   if (status !== undefined) attributes.status = status;
   assertPublishAllowed(sec, attributes);
   const backend = await resolveBackend(site);
-  return backend.updateEntity({ entityType: "media", bundle: type, id, attributes });
+  // #171: pre-read so an unrequested published-state flip is reported, not silent.
+  let existing = null;
+  if (status === undefined) {
+    try {
+      existing = (await backend.getEntity({ entityType: "media", bundle: type, id })) ?? null;
+    } catch {
+      existing = null; // Unreadable target: server-side gates stay authoritative.
+    }
+  }
+  const result = await backend.updateEntity({
+    entityType: "media", bundle: type, id, attributes,
+    ...(relationships ? { relationships } : {}),
+  });
+  return flagUnrequestedStatusChange(result, existing, attributes);
 }
 
 /**
@@ -239,13 +261,13 @@ export const definitions = [
         type:   { type: "string", description: "Media type machine name" },
         name:   { type: "string", description: "Media entity name / label" },
         status: { type: "boolean", default: false, description: "Published flag. Defaults to false (unpublished). Requires allowPublish when true." },
-        fields: { type: "object", description: "Additional field values — include the source field (e.g. field_media_oembed_video: 'https://youtu.be/...')" },
+        fields: { type: "object", description: "Additional field values — include the source field (e.g. field_media_oembed_video: 'https://youtu.be/...'). Entity-reference values in JSON:API linkage shape ({ data: { type, id } }) are sent as relationships automatically." },
       },
     },
   },
   {
     name: "drupal_update_media",
-    description: "Update a media entity's name, status, or field values.",
+    description: "Update a media entity's name, status, or field values. Partial: omitted fields (status included) are left untouched.",
     inputSchema: {
       type: "object", required: ["type", "id"],
       properties: {
@@ -253,8 +275,8 @@ export const definitions = [
         type:   { type: "string" },
         id:     { type: "string" },
         name:   { type: "string" },
-        status: { type: "boolean" },
-        fields: { type: "object" },
+        status: { type: "boolean", description: "Published flag. Only sent when provided; requires allowPublish when true." },
+        fields: { type: "object", description: "Field values. Entity-reference values in JSON:API linkage shape ({ data: { type, id } }) are sent as relationships automatically." },
       },
     },
   },

package/src/tools/nodes.js

@@ -13,8 +13,8 @@ import {
   resolveSecurityConfig, redactCanonicalEntity,
   assertReadAllowed, assertWriteAllowed, assertDeleteAllowed, assertPublishAllowed,
 } from "../lib/security.js";
-import { applySafeDraftDefault } from "../lib/moderation-default.js";
-import { shapeWriteResponse, RETURNING_SCHEMA } from "../lib/entity-response.js";
+import { applySafeDraftDefault, hasExplicitModerationState } from "../lib/moderation-default.js";
+import { shapeWriteResponse, flagUnrequestedStatusChange, RETURNING_SCHEMA } from "../lib/entity-response.js";
 import { buildRedirectAttributes, REDIRECT_ENTITY_TYPE } from "./redirects.js";
 
 /** Fallback language for an alias when the node exposes none. */
@@ -318,10 +318,20 @@ async function updateNode({ site: siteName, type, id, title, body, summary, form
   else if (status !== undefined) attributes.status = status;
   const bodyAttr = buildBodyAttribute(body, summary, format, site);
   if (bodyAttr) attributes.body = bodyAttr;
+  // One pre-read serves the #131 draft default and the #171 unrequested-
+  // status-change flag. Skipped when the caller pinned the moderation state.
+  let existing = null;
+  if (!hasExplicitModerationState(attributes)) {
+    try {
+      existing = (await backend.getEntity({ entityType: "node", bundle: type, id })) ?? null;
+    } catch {
+      existing = null; // Unreadable target: server-side gates stay authoritative.
+    }
+  }
   // #131: published moderated nodes without an explicit state → draft forward revision.
   // Runs before the publish gate and on dryRun so previews match the real write.
   attributes = await applySafeDraftDefault({
-    backend, entityType: "node", bundle: type, id, attributes,
+    backend, entityType: "node", bundle: type, id, attributes, existingEntity: existing,
   });
   assertPublishAllowed(sec, attributes);
   if (dryRun) return { dryRun: true, operation: "update", entityType: "node", bundle: type, id, attributes, relationships };
@@ -337,8 +347,11 @@ async function updateNode({ site: siteName, type, id, title, body, summary, form
   // Honest response: re-read persisted state so the returned `url` is the alias
   // that actually resolves, never the just-sent value.
   const fresh = await backend.getEntity({ entityType: "node", bundle: type, id }).catch(() => null);
-  if (fresh && redirectResult) return shapeWriteResponse({ ...fresh, _redirect: redirectResult }, returning);
-  return shapeWriteResponse(fresh ?? { id }, returning);
+  // #171: an unrequested published-state flip in the persisted node is
+  // reported via _statusChanged rather than returned as a clean success.
+  const flagged = flagUnrequestedStatusChange(fresh, existing, attributes);
+  if (flagged && redirectResult) return shapeWriteResponse({ ...flagged, _redirect: redirectResult }, returning);
+  return shapeWriteResponse(flagged ?? { id }, returning);
 }
 
 /**