fix(security): content-create divi follows the Divi group switches (audit M2)
The divi input of lit/content-create is refused with unsupported when lit/divi-insert is disabled or the Divi group is disabled or read-only (ExposurePolicy::allows as a cross-group gate, asked at execute time). content-create without divi keeps working. Adds a registrar test that read-only write tools are never registered, so execute-ability can't reach them either. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
This commit is contained in:
@@ -4,6 +4,7 @@ declare(strict_types=1);
|
||||
|
||||
namespace LIT\MCP\Integrations\Divi;
|
||||
|
||||
use Closure;
|
||||
use LIT\MCP\ChangeLog\ChangeLog;
|
||||
use LIT\MCP\Integrations\Divi\Design\DesignSystemReader;
|
||||
use LIT\MCP\Integrations\Divi\Design\DiviDesignSystemAbility;
|
||||
@@ -58,14 +59,20 @@ final class DiviIntegration implements Integration
|
||||
return DiviModules::isAvailable();
|
||||
}
|
||||
|
||||
/** Divi short form for lit/content-create; available() reports whether Divi 5 is loaded. */
|
||||
public function contentComposer(): ContentComposer
|
||||
/**
|
||||
* Divi short form for lit/content-create; available() reports whether Divi 5 is loaded,
|
||||
* writable() asks $writable (the Tools-tab gate, security M2).
|
||||
*
|
||||
* @param (Closure(): bool)|null $writable
|
||||
*/
|
||||
public function contentComposer(?Closure $writable = null): ContentComposer
|
||||
{
|
||||
return new DiviContentComposer(
|
||||
$this->schema,
|
||||
new DiviComposition($this->modules, $this->design),
|
||||
new DiviSaver(),
|
||||
$this->design
|
||||
$this->design,
|
||||
$writable
|
||||
);
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user