Files
WP-LIT-MCP/src/Integrations/Media/MediaGetAbility.php
T
janniclas.loosenandClaude Opus 5.5 b24eb6c3e9 fix(security): no direct HTTP access to plugin PHP files (audit L2, cheap part)
Every file under src/ exits outside WordPress (defined('ABSPATH') ||
exit; after the use block, so a direct request no longer prints a fatal
error with the server path); divi-convert-fixture.php gets the WP_CLI
guard the other integration scripts have. A unit test keeps both true;
PSR1 side-effects warning excluded for the guard.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
2026-09-26 19:32:12 +02:00

92 lines
2.7 KiB
PHP

<?php
declare(strict_types=1);
namespace LIT\MCP\Integrations\Media;
use LIT\MCP\Abilities\Ability;
use LIT\MCP\Abilities\Annotations;
use WP_Error;
defined('ABSPATH') || exit;
final class MediaGetAbility implements Ability
{
public function __construct(private MediaPresenter $presenter, private MediaUsageFinder $finder)
{
}
public function name(): string
{
return 'lit/media-get';
}
public function label(): string
{
return 'Medium ansehen';
}
public function description(): string
{
return 'Liefert Metadaten eines Mediums: Datei, Maße, Größe, alle Bildgrößen mit URL, Alt-Text, '
. 'Bildunterschrift, Beschreibung und die Verwendungsorte (Beitragsbild, Inhalte inkl. Divi, '
. 'Bildfelder, Website-Icon, Logo). certainty "sicher" = per ID eingebunden, "möglicherweise" = nur '
. 'die Datei-URL gefunden. Einträge ohne Leserecht erscheinen als "(nicht lesbar)". '
. 'usages_truncated: true = es gibt mehr Verwendungen als gelistet; usages_complete: false = die '
. 'Inhaltssuche wurde begrenzt, weitere Verwendungen sind möglich. '
. 'Vorschaubild über lit-media-preview.';
}
public function inputSchema(): array
{
return [
'type' => 'object',
'properties' => ['id' => ['type' => 'integer', 'minimum' => 1]],
'required' => ['id'],
'additionalProperties' => false,
];
}
public function outputSchema(): ?array
{
$schema = MediaPresenter::fullSchema();
$schema['properties']['usages_complete'] = ['type' => 'boolean'];
$schema['properties']['usages_truncated'] = ['type' => 'boolean'];
$schema['required'] = array_merge($schema['required'], ['usages_complete', 'usages_truncated']);
return $schema;
}
public function annotations(): array
{
return Annotations::read();
}
public function isDirect(): bool
{
return false;
}
public function permission(array $input): bool|WP_Error
{
$attachment = MediaGuard::attachment($input['id'] ?? null, 'edit_post', true);
return $attachment instanceof WP_Error ? $attachment : true;
}
public function execute(array $input): mixed
{
$attachment = MediaGuard::attachment($input['id'] ?? null, 'edit_post', true);
if ($attachment instanceof WP_Error) {
return $attachment;
}
$scan = $this->finder->scan((int) $attachment->ID);
return array_merge($this->presenter->full($attachment, $scan['usages']), [
'usages_complete' => $scan['complete'],
'usages_truncated' => $scan['truncated'],
]);
}
}