feat: media upload by URL and base64 with whitelist and size limit

MediaImporter streams URL imports via wp_safe_remote_get with limit_response_size, checks Content-Length, intersects the MIME whitelist with get_allowed_mime_types and validates real content; base64 is size-checked before decoding. Server-side failures are write_failed; a failed alt text deletes the new attachment again (or partial_write). MediaUploads is the shared permission/result helper of both upload abilities. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
2026-09-26 02:37:43 +02:00
parent f027da1785
commit 2e29a6cd4d
9 changed files with 1086 additions and 4 deletions
@@ -0,0 +1,88 @@
+<?php
+
+declare(strict_types=1);
+
+namespace LIT\MCP\Integrations\Media;
+
+use LIT\MCP\Abilities\Ability;
+use WP_Error;
+
+/**
+ * Imports a publicly reachable file into the media library (spec §6.3). Direct tool.
+ * Download, checks and cleanup: MediaImporter; permission and result: MediaUploads.
+ */
+final class MediaUploadFromUrlAbility implements Ability
+{
+    public function __construct(private MediaImporter $importer, private MediaUploads $uploads)
+    {
+    }
+
+    public function name(): string
+    {
+        return 'lit/media-upload-from-url';
+    }
+
+    public function label(): string
+    {
+        return 'Medium von URL importieren';
+    }
+
+    public function description(): string
+    {
+        return 'Lädt eine öffentlich erreichbare Datei (Bild, PDF, MP4, MP3) von einer http(s)-URL in die '
+            . 'Mediathek; optional mit Titel, Alt-Text und Zuordnung zu einem Eintrag (post_id). Interne Adressen '
+            . 'und Dateien über dem Upload-Limit werden abgelehnt. Nicht idempotent: jeder Aufruf legt ein neues '
+            . 'Medium an.';
+    }
+
+    public function inputSchema(): array
+    {
+        return [
+            'type' => 'object',
+            'properties' => array_merge(
+                [
+                    'url' => ['type' => 'string', 'minLength' => 1, 'description' => 'http(s)-URL der Datei.'],
+                    'filename' => [
+                        'type' => 'string',
+                        'description' => 'Optional: Dateiname mit Endung (Standard: aus der URL).',
+                    ],
+                ],
+                MediaUploads::metaProperties()
+            ),
+            'required' => ['url'],
+            'additionalProperties' => false,
+        ];
+    }
+
+    public function outputSchema(): ?array
+    {
+        return MediaUploads::outputSchema();
+    }
+
+    public function annotations(): array
+    {
+        return ['readonly' => false, 'destructive' => false, 'idempotent' => false];
+    }
+
+    public function isDirect(): bool
+    {
+        return true;
+    }
+
+    public function permission(array $input): bool|WP_Error
+    {
+        return $this->uploads->permission($input);
+    }
+
+    public function execute(array $input): mixed
+    {
+        $filename = isset($input['filename']) && $input['filename'] !== '' ? (string) $input['filename'] : null;
+        $url = (string) $input['url'];
+
+        return $this->uploads->run(
+            $this->name(),
+            fn (): int|WP_Error => $this->importer->fromUrl($url, $filename, MediaUploads::meta($input)),
+            'Datei "%s" von URL importiert (ID %d)'
+        );
+    }
+}