FlowFuse / FlowFuse/flowfuse

5.12-c Delete and destructive tools (phase 2)

Open
#7,710 0 comments 0 reactions 0 assignees View on GitHub
story
Dominant language
JavaScript
Stars
400
Forks
89
Avg merge
1d 20h
Merged PRs (30d)
149

Description

**Parent:** #7681 (5.12 Team data and packages)
**Tool file:** new `forge/ee/lib/mcp/tools/teamData.js`

`destructiveHint: true`. Kept separate from ordinary writes so MCP clients gate them behind confirmation by default. One tool per delete endpoint.

| Tool | Endpoint | Scope | Annotation |
|---|---|---|---|
| `platform_delete_database_table` | `DELETE /teams/:teamId/databases/:databaseId/tables/:tableName` | `team:database:create` | destructive |
| `platform_delete_team_database` | `DELETE /teams/:teamId/databases/:databaseId` | `team:database:delete` | destructive |
| `platform_delete_library_entry` | `DELETE /storage/library/:libraryId/*` | `library:entry:delete` | destructive |
| `platform_delete_git_token` | `DELETE /teams/:teamId/git/tokens/:tokenId` | `team:git:tokens:delete` | destructive |

**Design notes:**
- `DELETE .../tables/:tableName` reuses the `team:database:create` scope (scope reuse).
- Shared-library `DELETE` skips the permission check for non-user tokens; for user PATs it requires `library:entry:delete`.

**Tool definitions (description + zod inputSchema):**
```js
platform_delete_database_table: {
description: 'Deletes a table from a database.',
inputSchema: z.object({
teamId: z.string().describe('team hashid'),
databaseId: z.string().describe('database hashid'),
tableName: z.string().describe('Name of the database table')
})
},
platform_delete_team_database: {
description: 'Deletes a team database.',
inputSchema: z.object({
teamId: z.string().describe('team hashid'),
databaseId: z.string().describe('database hashid')
})
},
platform_delete_library_entry: {
description: 'Deletes an entry from the team shared library.',
inputSchema: z.object({
libraryId: z.string().describe('shared-library hashid (the team hashid)'),
path: z.string().describe('Library entry path'),
type: z.string().optional().describe('entry type filter query param')
})
},
platform_delete_git_token: {
description: 'Deletes a git token.',
inputSchema: z.object({
teamId: z.string().describe('team hashid'),
tokenId: z.string().describe('git token hashid')
})
}
```

**Tests:**
- Every tool carries `destructiveHint: true`.
- Read-only PAT rejected.
- Feature-disabled team returns the descriptive gate error.

---

Contributor guide

Open the contributing guide

Research direction

Start with the new forge/ee/lib/mcp/tools/teamData.js file and map the four listed DELETE endpoints to their tool definitions and input schemas. Verify that each tool has destructiveHint: true, read-only PATs are rejected, and feature-disabled teams receive the descriptive gate error; also preserve the documented scope and shared-library permission behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
api, backend
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.