PR Vision v0.2.3: UI-editable provider API key, encrypted + write-only
Add PRV_Key_Store (resolver), PRV_Crypto_Helper (libsodium/OpenSSL), PRV_Key_Manager_Renderer (write-only Settings card), PRV_Key_Test_Ajax. Key resolver: PRV_OPENROUTER_API_KEY constant > prv_provider_key_enc option > none. All probe + test paths read key through PRV_Key_Store::get_key(). Security: - Ciphertext only in prv_provider_key_enc (hex nonce:hex ciphertext). - Enc key from SHA-256(AUTH_KEY+SECURE_AUTH_KEY) — never stored. - Plaintext never in options, logs, exceptions, page source, REST, or JS. - manage_options + nonce on set/remove/test. wp-config precedence enforced. - write-only UI: password input always renders empty; status text only. - uninstall.php prv_ wildcard DELETE covers prv_provider_key_enc. Files: 4 new (all ≤300 lines), 14 modified. Tests: test-key-store.php (encrypt/decrypt round-trip, wrong-key fails silently, resolver precedence, write-only render, Remove, constant wins). ARCHITECTURE/CONVENTIONS/CONTEXT/ CHANGELOG all updated in this commit. Agent-Session: 2026-06-15-pr-vision-v0.2.3-api-key-ui
This commit is contained in:
peptiderepo
@@ -8,24 +8,31 @@
|
||||
declare(strict_types=1);
|
||||
|
||||
/**
|
||||
* Handles the four settings POST actions: save config, and model CRUD.
|
||||
* Handles the six settings POST actions: save config, model CRUD, key set/remove.
|
||||
*
|
||||
* Extracted from PRV_Settings_Page to keep each file under the 300-line
|
||||
* limit. PRV_Settings_Page registers all hooks and delegates the four
|
||||
* admin_post_* handlers here.
|
||||
* limit. PRV_Settings_Page registers all hooks and delegates the handlers here.
|
||||
*
|
||||
* All actions require: current_user_can('manage_options') + valid nonce
|
||||
* (enforced by PRV_Settings_Page::require_admin_nonce(), passed in via
|
||||
* the $nonce_cb callable).
|
||||
*
|
||||
* Who triggers: PRV_Settings_Page -- via delegation in register_hooks().
|
||||
* Dependencies: PRV_Config, PRV_Config_Version, PRV_Cron,
|
||||
* PRV_Model_Registry.
|
||||
* Key security invariants:
|
||||
* - handle_key_set() reads the raw key from POST, encrypts it via PRV_Key_Store,
|
||||
* and immediately drops the reference. The plaintext is never stored in an
|
||||
* option, logged, or echoed.
|
||||
* - handle_key_remove() calls PRV_Key_Store::clear_key() -- no plaintext involved.
|
||||
* - The key value is NEVER included in any redirect URL or notice.
|
||||
*
|
||||
* @see class-prv-settings-page.php -- Page registration, dispatch, Run-now, AJAX.
|
||||
* Who triggers: PRV_Settings_Page -- via delegation in register_hooks().
|
||||
* Dependencies: PRV_Config, PRV_Config_Version, PRV_Cron, PRV_Model_Registry,
|
||||
* PRV_Key_Store.
|
||||
*
|
||||
* @see class-prv-settings-page.php -- Page registration, dispatch, Run-now, AJAX.
|
||||
* @see class-prv-key-store.php -- Encryption and storage.
|
||||
* @see class-prv-model-registry.php -- CRUD for prv_models.
|
||||
* @see class-prv-config-version.php -- Config-change versioning.
|
||||
* @see class-prv-cron.php -- Reschedule on cadence change.
|
||||
* @see class-prv-cron.php -- Reschedule on cadence change.
|
||||
* @package PrVision
|
||||
*/
|
||||
class PRV_Settings_Controller {
|
||||
@@ -64,7 +71,7 @@ class PRV_Settings_Controller {
|
||||
( $this->nonce_cb )( PRV_Settings_Page::NONCE_SAVE );
|
||||
$old_cadence = PRV_Config::get_cadence();
|
||||
|
||||
// phpcs:disable WordPress.Security.NonceVerification.Missing -- nonce verified above via require_admin_nonce().
|
||||
// phpcs:disable WordPress.Security.NonceVerification.Missing -- nonce verified above.
|
||||
$budget = isset( $_POST['prv_monthly_budget_usd'] )
|
||||
? max( 0.01, (float) sanitize_text_field( wp_unslash( (string) $_POST['prv_monthly_budget_usd'] ) ) )
|
||||
: PRV_DEFAULT_MONTHLY_BUDGET_USD;
|
||||
@@ -118,6 +125,71 @@ class PRV_Settings_Controller {
|
||||
exit;
|
||||
}
|
||||
|
||||
/**
|
||||
* Handle set/replace API key POST.
|
||||
*
|
||||
* Reads the raw key from POST, encrypts it via PRV_Key_Store, then
|
||||
* drops the plaintext reference. Empty submission (no-op) is silently
|
||||
* ignored. The key value NEVER appears in the redirect URL or notices.
|
||||
*
|
||||
* Side effects: Stores encrypted key in prv_provider_key_enc; redirects.
|
||||
*
|
||||
* @return void
|
||||
*/
|
||||
public function handle_key_set(): void {
|
||||
( $this->nonce_cb )( PRV_Settings_Page::NONCE_KEY );
|
||||
|
||||
// phpcs:disable WordPress.Security.NonceVerification.Missing -- nonce verified above.
|
||||
$raw_key = isset( $_POST['prv_api_key'] )
|
||||
? sanitize_text_field( wp_unslash( (string) $_POST['prv_api_key'] ) )
|
||||
: '';
|
||||
// phpcs:enable WordPress.Security.NonceVerification.Missing
|
||||
|
||||
$result_arg = 'prv_key_unchanged';
|
||||
|
||||
if ( '' !== $raw_key ) {
|
||||
$stored = PRV_Key_Store::store_key( $raw_key );
|
||||
$result_arg = $stored ? 'prv_key_set' : 'prv_key_error';
|
||||
// Explicitly unset to prevent the plaintext lingering in memory.
|
||||
unset( $raw_key );
|
||||
}
|
||||
|
||||
wp_safe_redirect(
|
||||
add_query_arg(
|
||||
array(
|
||||
'page' => self::MENU_SLUG,
|
||||
$result_arg => 1,
|
||||
),
|
||||
admin_url( 'admin.php' )
|
||||
)
|
||||
);
|
||||
exit;
|
||||
}
|
||||
|
||||
/**
|
||||
* Handle remove API key POST.
|
||||
*
|
||||
* Clears the encrypted option, reverting to constant or none.
|
||||
*
|
||||
* Side effects: Deletes prv_provider_key_enc; redirects.
|
||||
*
|
||||
* @return void
|
||||
*/
|
||||
public function handle_key_remove(): void {
|
||||
( $this->nonce_cb )( PRV_Settings_Page::NONCE_KEY );
|
||||
PRV_Key_Store::clear_key();
|
||||
wp_safe_redirect(
|
||||
add_query_arg(
|
||||
array(
|
||||
'page' => self::MENU_SLUG,
|
||||
'prv_key_removed' => 1,
|
||||
),
|
||||
admin_url( 'admin.php' )
|
||||
)
|
||||
);
|
||||
exit;
|
||||
}
|
||||
|
||||
/**
|
||||
* Handle Add model POST.
|
||||
*
|
||||
@@ -127,7 +199,7 @@ class PRV_Settings_Controller {
|
||||
*/
|
||||
public function handle_model_add(): void {
|
||||
( $this->nonce_cb )( PRV_Settings_Page::NONCE_MODEL );
|
||||
// phpcs:disable WordPress.Security.NonceVerification.Missing -- nonce verified above via require_admin_nonce().
|
||||
// phpcs:disable WordPress.Security.NonceVerification.Missing -- nonce verified above.
|
||||
$slug = sanitize_text_field( wp_unslash( (string) ( $_POST['prv_model_slug'] ?? '' ) ) );
|
||||
$provider = sanitize_text_field( wp_unslash( (string) ( $_POST['prv_model_provider'] ?? 'openrouter' ) ) );
|
||||
$note = sanitize_text_field( wp_unslash( (string) ( $_POST['prv_model_note'] ?? '' ) ) );
|
||||
@@ -158,7 +230,7 @@ class PRV_Settings_Controller {
|
||||
*/
|
||||
public function handle_model_update(): void {
|
||||
( $this->nonce_cb )( PRV_Settings_Page::NONCE_MODEL );
|
||||
// phpcs:disable WordPress.Security.NonceVerification.Missing -- nonce verified above via require_admin_nonce().
|
||||
// phpcs:disable WordPress.Security.NonceVerification.Missing -- nonce verified above.
|
||||
$id = sanitize_text_field( wp_unslash( (string) ( $_POST['prv_model_id'] ?? '' ) ) );
|
||||
$slug = sanitize_text_field( wp_unslash( (string) ( $_POST['prv_model_slug'] ?? '' ) ) );
|
||||
$enabled = ! empty( $_POST['prv_model_enabled'] );
|
||||
@@ -196,7 +268,7 @@ class PRV_Settings_Controller {
|
||||
*/
|
||||
public function handle_model_remove(): void {
|
||||
( $this->nonce_cb )( PRV_Settings_Page::NONCE_MODEL );
|
||||
// phpcs:disable WordPress.Security.NonceVerification.Missing -- nonce verified above via require_admin_nonce().
|
||||
// phpcs:disable WordPress.Security.NonceVerification.Missing -- nonce verified above.
|
||||
$id = sanitize_text_field( wp_unslash( (string) ( $_POST['prv_model_id'] ?? '' ) ) );
|
||||
// phpcs:enable WordPress.Security.NonceVerification.Missing
|
||||
if ( '' !== $id ) {
|
||||
|
||||
Reference in New Issue
Block a user