fix(security): enforce team access on mutable actions

Authorize cloud provider token access, audit sensitive operations, and
standardize public IDs across deployment and resource flows.

app/Mcp/Concerns/ResolvesTeam.php

@@ -7,15 +7,19 @@ use Laravel\Mcp\Response;
 
 trait ResolvesTeam
 {
-    protected function ensureAbility(Request $request, string $ability = 'read'): ?Response
+    protected function ensureAbility(Request $request, string $ability = 'read', ?string $tool = null): ?Response
     {
         $user = $request->user();
         if (! $user) {
+            $this->auditMcpTool($request, $tool, 'denied', ['reason' => 'unauthenticated']);
+
             return Response::error('Unauthenticated.');
         }
 
         $token = $user->currentAccessToken();
         if (! $token) {
+            $this->auditMcpTool($request, $tool, 'denied', ['reason' => 'invalid_token']);
+
             return Response::error('Invalid token.');
         }
 
@@ -23,6 +27,11 @@ trait ResolvesTeam
             return null;
         }
 
+        $this->auditMcpTool($request, $tool, 'denied', [
+            'reason' => 'missing_ability',
+            'required_ability' => $ability,
+        ]);
+
         return Response::error("Missing required permissions: {$ability}");
     }
 
@@ -38,4 +47,28 @@ trait ResolvesTeam
 
         return (int) $teamId;
     }
+
+    protected function mcpSuccess(Request $request, Response $response, array $context = []): Response
+    {
+        $this->auditMcpTool($request, $this->name ?? null, 'success', $context);
+
+        return $response;
+    }
+
+    protected function mcpError(Request $request, string $message, array $context = []): Response
+    {
+        $this->auditMcpTool($request, $this->name ?? null, 'error', $context + ['reason' => $message]);
+
+        return Response::error($message);
+    }
+
+    protected function auditMcpTool(Request $request, ?string $tool, string $outcome, array $context = []): void
+    {
+        auditLog('mcp.tool.called', [
+            'tool' => $tool ?: 'unknown',
+            'team_id' => $this->resolveTeamId($request),
+            'outcome' => $outcome,
+            ...$context,
+        ]);
+    }
 }