a932c51bbb
* Expose workspace webhooks through the API and MCP. The same create/update/test/rotate/replay/delete flow now lives in Actions so the web UI, REST API, and MCP tools stay in lockstep. * Keep webhook validation local to each web, API, and MCP entry point. * Extract MCP webhook rules into request classes and close remaining API/MCP review gaps. * Tighten webhook updates to a field whitelist and reset failures only on re-enable. * Treat a mismatched webhook replay as not found and mark secret rotation destructive.
45 lines
1.2 KiB
PHP
45 lines
1.2 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Mcp\Tools\Webhook;
|
|
|
|
use App\Http\Resources\Api\WebhookResource;
|
|
use App\Mcp\Concerns\AuthorizesMcpTool;
|
|
use App\Models\Webhook;
|
|
use App\Models\Workspace;
|
|
use Laravel\Mcp\Request;
|
|
use Laravel\Mcp\Response;
|
|
use Laravel\Mcp\ResponseFactory;
|
|
use Laravel\Mcp\Server\Attributes\Description;
|
|
use Laravel\Mcp\Server\Tool;
|
|
use Laravel\Mcp\Server\Tools\Annotations\IsReadOnly;
|
|
|
|
#[IsReadOnly]
|
|
#[Description('List outgoing webhooks for the current workspace. Signing secrets are omitted — use get-webhook-tool to read a secret.')]
|
|
class ListWebhooksTool extends Tool
|
|
{
|
|
use AuthorizesMcpTool;
|
|
|
|
public function handle(Request $request): Response|ResponseFactory
|
|
{
|
|
$workspace = $this->authorizeCurrentWorkspace(
|
|
$request,
|
|
'manageWebhooks',
|
|
'Not authorized to manage webhooks.',
|
|
);
|
|
|
|
if (! $workspace instanceof Workspace) {
|
|
return $workspace;
|
|
}
|
|
|
|
$webhooks = Webhook::query()
|
|
->where('workspace_id', $workspace->id)
|
|
->orderByDesc('created_at')
|
|
->get();
|
|
|
|
return Response::structured([
|
|
'webhooks' => WebhookResource::collection($webhooks)->resolve(),
|
|
]);
|
|
}
|
|
}
|