elementor / vendor / wordpress / mcp-adapter / includes / Abilities / DiscoverAbilitiesAbility.php

DiscoverAbilitiesAbility.php in Elementor Website Builder – more than just a page builder 4.3.2, at vendor/wordpress/mcp-adapter/includes/Abilities/DiscoverAbilitiesAbility.php

152 lines 4.6 KB

Raw Download Zip

1	<?php
2	/**
3	* Ability for discovering available WordPress abilities.
4	*
5	* @package McpAdapter
6	*/
7
8	declare( strict_types=1 );
9
10	namespace WP\MCP\Abilities;
11
12	use WP_Error;
13
14	/**
15	* Discover Abilities - Lists all available WordPress abilities in the system.
16	*
17	* This ability provides discovery functionality for the MCP protocol.
18	* It discovers all registered WordPress abilities in the system.
19	*
20	* SECURITY CONSIDERATIONS:
21	* - This ability exposes information about all registered abilities in the system
22	* - Only abilities with effective MCP public exposure will be returned
23	* - Requires proper WordPress capability checks for secure operation
24	*
25	* @see https://developer.wordpress.org/apis/security/ for detailed security guidance
26	*/
27	final class DiscoverAbilitiesAbility {
28	use McpAbilityHelperTrait;
29
30	/**
31	* Register the ability.
32	*/
33	public static function register(): void {
34	wp_register_ability(
35	'mcp-adapter/discover-abilities',
36	array(
37	'label' => 'Discover Abilities',
38	'description' => 'Discover all available WordPress abilities in the system. Returns a list of all registered abilities with their basic information.',
39	'category' => 'mcp-adapter',
40	'output_schema' => array(
41	'type' => 'object',
42	'properties' => array(
43	'abilities' => array(
44	'type' => 'array',
45	'items' => array(
46	'type' => 'object',
47	'properties' => array(
48	'name' => array( 'type' => 'string' ),
49	'label' => array( 'type' => 'string' ),
50	'description' => array( 'type' => 'string' ),
51	),
52	'required' => array( 'name', 'label', 'description' ),
53	),
54	),
55	),
56	'required' => array( 'abilities' ),
57	),
58	'permission_callback' => array( self::class, 'check_permission' ),
59	'execute_callback' => array( self::class, 'execute' ),
60	'meta' => array(
61	'annotations' => array(
62	'readonly' => true,
63	'destructive' => false,
64	'idempotent' => true,
65	),
66	),
67	)
68	);
69	}
70
71	/**
72	* Execute the discover abilities functionality.
73	*
74	* Note: Permission checks are handled by the WP_Ability::execute() framework method
75	* before this callback is invoked.
76	*
77	* @see \WP_Ability::execute()
78	*
79	* @param array $input Input parameters (unused for this ability).
80	*
81	* @return array Array containing public MCP abilities.
82	*/
83	// phpcs:ignore Generic.CodeAnalysis.UnusedFunctionParameter.Found -- Required by the ability callback.
84	public static function execute( $input = array() ): array {
85	// Get all abilities and filter for publicly exposed ones
86	$abilities = wp_get_abilities();
87
88	$ability_list = array();
89	foreach ( $abilities as $ability ) {
90	$ability_name = $ability->get_name();
91
92	// Check if ability is publicly exposed via MCP
93	if ( ! self::is_ability_mcp_public( $ability ) ) {
94	continue;
95	}
96
97	// Only discover abilities with type='tool' (default type)
98	if ( self::get_ability_mcp_type( $ability ) !== 'tool' ) {
99	continue;
100	}
101
102	$ability_list[] = array(
103	'name' => $ability_name,
104	'label' => $ability->get_label(),
105	'description' => $ability->get_description(),
106	);
107	}
108
109	return array(
110	'abilities' => $ability_list,
111	);
112	}
113
114	/**
115	* Check permissions for discovering abilities.
116	*
117	* Validates user capabilities and caller identity.
118	*
119	* @param array $input Input parameters (unused for this ability).
120	*
121	* @return bool\|\WP_Error True if the user has permission to discover abilities.
122	*/
123	// phpcs:ignore Generic.CodeAnalysis.UnusedFunctionParameter.Found -- Required by the ability callback.
124	public static function check_permission( $input = array() ) {
125	// Verify caller identity - ensure user is authenticated
126	if ( ! is_user_logged_in() ) {
127	return new WP_Error( 'authentication_required', 'User must be authenticated to access this ability' );
128	}
129
130	/**
131	* Filters the capability required to discover available abilities.
132	*
133	* This capability is checked before listing all registered WordPress abilities
134	* through the mcp-adapter-discover-abilities tool.
135	*
136	* @since 0.3.0
137	*
138	* @param string $capability The required capability. Default 'read'.
139	*/
140	$required_capability = apply_filters( 'mcp_adapter_discover_abilities_capability', 'read' );
141	// phpcs:ignore WordPress.WP.Capabilities.Undetermined -- Capability is determined dynamically via filter
142	if ( ! current_user_can( $required_capability ) ) {
143	return new WP_Error(
144	'insufficient_capability',
145	sprintf( 'User lacks required capability: %s', $required_capability )
146	);
147	}
148
149	return true;
150	}
151	}
152