From 3df407abfe346d9438079f46ec30ef5924a7b0e2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20B=C3=B6hmer?= Date: Sun, 2 Aug 2026 13:16:22 +0200 Subject: [PATCH] Check user permissions for search_parts MCP tool --- src/Entity/Parts/Part.php | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/Entity/Parts/Part.php b/src/Entity/Parts/Part.php index bbc0f8d1..2bcd84c1 100644 --- a/src/Entity/Parts/Part.php +++ b/src/Entity/Parts/Part.php @@ -115,8 +115,9 @@ use Symfony\Component\Validator\Context\ExecutionContextInterface; title: "Search parts by keyword", description: 'Search for parts', annotations: ['readOnlyHint' => true, 'destructiveHint' => false, 'idempotentHint' => true, 'openWorldHint' => false], + security: 'is_granted("@parts.read")', input: PartSearchFilter::class, - processor: SearchPartsProcessor::class, + processor: SearchPartsProcessor::class ), 'get_part_details' => new McpTool( title: 'Get part details by ID', @@ -126,6 +127,7 @@ use Symfony\Component\Validator\Context\ExecutionContextInterface; 'groups' => ['part:read', 'provider_reference:read', 'api:basic:read', 'part_lot:read', 'orderdetail:read', 'pricedetail:read', 'parameter:read', 'attachment:read', 'eda_info:read'], 'item_uri_template' => '/api/parts/{id}', ], + security: 'is_granted("edit", object)', input: ElementByIdInput::class, validate: true, processor: GetPartByIdProcessor::class