fix(security): enforce team access on mutable actions

Authorize cloud provider token access, audit sensitive operations, and
standardize public IDs across deployment and resource flows.

app/Mcp/Tools/GetDatabase.php

@@ -7,46 +7,46 @@ use App\Mcp\Concerns\ResolvesTeam;
 use Illuminate\Contracts\JsonSchema\JsonSchema;
 use Laravel\Mcp\Request;
 use Laravel\Mcp\Response;
-use Laravel\Mcp\Server\Attributes\Description;
-use Laravel\Mcp\Server\Attributes\Name;
 use Laravel\Mcp\Server\Tool;
 
-#[Name('get_database')]
-#[Description('Get full details for a standalone database by UUID. Detects type across postgresql, mysql, mariadb, mongodb, redis, keydb, dragonfly, clickhouse.')]
 class GetDatabase extends Tool
 {
+    protected string $name = 'get_database';
+
+    protected string $description = 'Get full details for a standalone database by UUID. Detects type across postgresql, mysql, mariadb, mongodb, redis, keydb, dragonfly, clickhouse.';
+
     use BuildsResponse;
     use ResolvesTeam;
 
     public function handle(Request $request): Response
     {
-        if ($error = $this->ensureAbility($request, 'read')) {
+        if ($error = $this->ensureAbility($request, 'read', $this->name)) {
             return $error;
         }
 
         $teamId = $this->resolveTeamId($request);
         if (is_null($teamId)) {
-            return Response::error('Invalid token.');
+            return $this->mcpError($request, 'Invalid token.');
         }
 
         $uuid = $request->get('uuid');
         if (! is_string($uuid) || $uuid === '') {
-            return Response::error('uuid argument is required.');
+            return $this->mcpError($request, 'uuid argument is required.');
         }
 
         $database = queryDatabaseByUuidWithinTeam($uuid, (string) $teamId);
         if (! $database) {
-            return Response::error("Database [{$uuid}] not found.");
+            return $this->mcpError($request, "Database [{$uuid}] not found.", ['resource_uuid' => $uuid]);
         }
 
         // Drop relations so deep server/destination data doesn't leak.
         $database->setRelations([]);
         $database->makeHidden(['destination', 'source', 'environment', 'environment_variables', 'environment_variables_preview']);
 
-        return $this->respond(
+        return $this->mcpSuccess($request, $this->respond(
             $this->scrubSensitive($database->toArray()),
             $this->actionsForDatabase($uuid, $database->status ?? null),
-        );
+        ), ['resource_uuid' => $uuid]);
     }
 
     public function schema(JsonSchema $schema): array