feat(entries): add revision-aware behavior to EntriesRouter

config/statamic/mcp.php

@@ -132,14 +132,15 @@
         | the gate for that domain. The '*' wildcard gates every action.
         |
         | Defaults preserve historical behaviour: 'delete' everywhere plus
-        | create/update on blueprints. Operators can widen the gate per
-        | domain — e.g. require confirmation on entries.update — without
-        | forking the package.
+        | create/update on blueprints, and destructive revision actions on
+        | entries. Operators can widen the gate per domain — e.g. require
+        | confirmation on entries.update — without forking the package.
         */
         'actions' => [
             'default' => ['delete'],
             'blueprints' => ['create', 'update', 'delete'],
-            // 'entries' => ['create', 'update', 'delete', 'publish', 'unpublish'],
+            'entries' => ['delete', 'restore_revision', 'publish_working_copy'],
+            // 'entries' => ['create', 'update', 'delete', 'publish', 'unpublish', 'restore_revision', 'publish_working_copy'],
             // 'globals' => ['update'],
             // 'terms'   => ['create', 'update', 'delete'],
             // 'assets'  => ['upload', 'update', 'delete', 'move', 'copy'],

src/Mcp/Tools/Concerns/EnforcesResourcePolicy.php

@@ -99,13 +99,53 @@ protected function filterOutputFields(array $result): array
             return $result;
         }
 
-        // Filter the 'data' key in the result
+        // Filter the 'data' key in the result (single-item responses)
         if (isset($result['data']) && is_array($result['data'])) {
             /** @var array<string, mixed> $resultData */
             $resultData = $result['data'];
             $result['data'] = $policy->filterFields($domain, $resultData);
         }
 
+        // Filter nested 'data' within domain-specific wrapper keys (e.g. entry.data, term.data)
+        foreach (['entry', 'term', 'global', 'asset', 'user'] as $wrapper) {
+            if (! isset($result[$wrapper]) || ! is_array($result[$wrapper])) {
+                continue;
+            }
+
+            /** @var array<string, mixed> $wrappedItem */
+            $wrappedItem = $result[$wrapper];
+
+            if (isset($wrappedItem['data']) && is_array($wrappedItem['data'])) {
+                /** @var array<string, mixed> $wrappedData */
+                $wrappedData = $wrappedItem['data'];
+                $wrappedItem['data'] = $policy->filterFields($domain, $wrappedData);
+                $result[$wrapper] = $wrappedItem;
+            }
+        }
+
+        // Filter list responses where items live under domain-specific keys
+        foreach (['entries', 'terms', 'globals', 'assets', 'users'] as $listKey) {
+            if (! isset($result[$listKey]) || ! is_array($result[$listKey])) {
+                continue;
+            }
+
+            /** @var array<int, mixed> $items */
+            $items = $result[$listKey];
+            $result[$listKey] = array_map(function (mixed $item) use ($policy, $domain): mixed {
+                if (! is_array($item)) {
+                    return $item;
+                }
+
+                if (isset($item['data']) && is_array($item['data'])) {
+                    /** @var array<string, mixed> $itemData */
+                    $itemData = $item['data'];
+                    $item['data'] = $policy->filterFields($domain, $itemData);
+                }
+
+                return $item;
+            }, $items);
+        }
+
         return $result;
     }
 
@@ -139,6 +179,7 @@ private function isWriteAction(string $action): bool
             'activate', 'deactivate', 'assign_role', 'remove_role',
             'move', 'copy', 'upload', 'configure',
             'cache_clear', 'cache_warm', 'config_set',
+            'restore_revision', 'publish_working_copy',
         ], true);
     }
 }