feat: media upload by URL and base64 with whitelist and size limit

MediaImporter streams URL imports via wp_safe_remote_get with limit_response_size, checks Content-Length, intersects the MIME whitelist with get_allowed_mime_types and validates real content; base64 is size-checked before decoding. Server-side failures are write_failed; a failed alt text deletes the new attachment again (or partial_write). MediaUploads is the shared permission/result helper of both upload abilities. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
2026-09-26 02:37:43 +02:00
parent f027da1785
commit 2e29a6cd4d
9 changed files with 1086 additions and 4 deletions
@@ -0,0 +1,96 @@
+<?php
+
+declare(strict_types=1);
+
+namespace LIT\MCP\Integrations\Media;
+
+use LIT\MCP\Abilities\Ability;
+use LIT\MCP\Limits;
+use WP_Error;
+
+/**
+ * Uploads a Base64-encoded file into the media library (spec §6.3), up to the configured
+ * upload limit. Checks and cleanup: MediaImporter; permission and result: MediaUploads.
+ */
+final class MediaUploadAbility implements Ability
+{
+    public function __construct(
+        private MediaImporter $importer,
+        private MediaUploads $uploads,
+        private Limits $limits
+    ) {
+    }
+
+    public function name(): string
+    {
+        return 'lit/media-upload';
+    }
+
+    public function label(): string
+    {
+        return 'Medium hochladen';
+    }
+
+    public function description(): string
+    {
+        return sprintf(
+            'Lädt eine Datei (Bild, PDF, MP4, MP3) als Base64 in die Mediathek, höchstens %d MB; optional mit '
+                . 'Titel, Alt-Text und Zuordnung zu einem Eintrag (post_id). Nicht idempotent: jeder Aufruf legt '
+                . 'ein neues Medium an.',
+            $this->limits->uploadMegabytes()
+        );
+    }
+
+    public function inputSchema(): array
+    {
+        return [
+            'type' => 'object',
+            'properties' => array_merge(
+                [
+                    'filename' => ['type' => 'string', 'minLength' => 1, 'description' => 'Dateiname mit Endung.'],
+                    'data' => [
+                        'type' => 'string',
+                        'minLength' => 1,
+                        'description' => 'Dateiinhalt als Base64 (ohne data:-Präfix).',
+                    ],
+                ],
+                MediaUploads::metaProperties()
+            ),
+            'required' => ['filename', 'data'],
+            'additionalProperties' => false,
+        ];
+    }
+
+    public function outputSchema(): ?array
+    {
+        return MediaUploads::outputSchema();
+    }
+
+    public function annotations(): array
+    {
+        return ['readonly' => false, 'destructive' => false, 'idempotent' => false];
+    }
+
+    public function isDirect(): bool
+    {
+        return false;
+    }
+
+    public function permission(array $input): bool|WP_Error
+    {
+        return $this->uploads->permission($input);
+    }
+
+    public function execute(array $input): mixed
+    {
+        return $this->uploads->run(
+            $this->name(),
+            fn (): int|WP_Error => $this->importer->fromBase64(
+                (string) $input['data'],
+                (string) $input['filename'],
+                MediaUploads::meta($input)
+            ),
+            'Datei "%s" hochgeladen (ID %d)'
+        );
+    }
+}