peptide-repo/pr-vision
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

PR Vision v0.2.3: UI-editable provider API key, encrypted + write-only

Browse Source 
Add PRV_Key_Store (resolver), PRV_Crypto_Helper (libsodium/OpenSSL),
PRV_Key_Manager_Renderer (write-only Settings card), PRV_Key_Test_Ajax.

Key resolver: PRV_OPENROUTER_API_KEY constant > prv_provider_key_enc
option > none. All probe + test paths read key through PRV_Key_Store::get_key().

Security:
- Ciphertext only in prv_provider_key_enc (hex nonce:hex ciphertext).
- Enc key from SHA-256(AUTH_KEY+SECURE_AUTH_KEY) — never stored.
- Plaintext never in options, logs, exceptions, page source, REST, or JS.
- manage_options + nonce on set/remove/test. wp-config precedence enforced.
- write-only UI: password input always renders empty; status text only.
- uninstall.php prv_ wildcard DELETE covers prv_provider_key_enc.

Files: 4 new (all ≤300 lines), 14 modified. Tests: test-key-store.php
(encrypt/decrypt round-trip, wrong-key fails silently, resolver precedence,
write-only render, Remove, constant wins). ARCHITECTURE/CONVENTIONS/CONTEXT/
CHANGELOG all updated in this commit.

Agent-Session: 2026-06-15-pr-vision-v0.2.3-api-key-ui
This commit is contained in:
peptiderepo
2026-06-15 03:08:54 +00:00
parent 28e3ce6576
commit 67499506ba
19 changed files with 1183 additions and 221 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
includes/core/class-prv-model-test-ajax.php
View File

@@ -15,10 +15,14 @@ declare(strict_types=1);
* This is a point-in-time check (not a monitor) -- the UI labels it as such.
* Never displays the API key.
*
* Key is resolved via PRV_Key_Store::get_key() (constant → admin option → none).
*
* Who triggers: wp_ajax_prv_test_model (registered by PRV_Settings_Page).
* Dependencies: PRV_Model_Registry, PRV_Perplexity_Provider, PRV_OpenRouter_Provider.
* Dependencies: PRV_Key_Store, PRV_Model_Registry, PRV_Perplexity_Provider,
* PRV_OpenRouter_Provider.
*
* @see class-prv-settings-page.php -- Registers the wp_ajax_ hook.
* @see class-prv-key-store.php -- Key resolution.
* @see class-prv-model-registry.php -- Provides model data by id.
* @package PrVision
*/
@@ -62,17 +66,23 @@ class PRV_Model_Test_Ajax {
}
set_transient( $lock_key, 1, self::RATE_LIMIT_SECONDS );
// Resolve key through the store — never bypass to a direct constant read.
$api_key = PRV_Key_Store::get_key();
if ( '' === $api_key ) {
wp_send_json_error( array( 'message' => 'API key not configured — set it in wp-config.php or via Settings → Provider API Key.' ) );
}
$start = microtime( true );
$provider = ( 'perplexity/sonar' === $slug )
? new PRV_Perplexity_Provider()
: new PRV_OpenRouter_Provider( $slug );
if ( ! $provider->is_configured() ) {
wp_send_json_error( array( 'message' => 'API key not configured (check wp-config.php).' ) );
}
try {
$provider->probe( 'what is BPC-157' );
if ( $provider instanceof PRV_OpenRouter_Provider ) {
$provider->probe_with_key( 'what is BPC-157', $api_key );
} else {
$provider->probe( 'what is BPC-157' );
}
$ms = (int) round( ( microtime( true ) - $start ) * 1000 );
wp_send_json_success(
array(