e4c51ee89d
class-prv-key-manager-renderer.php rendered placeholder="sk-or-..." on
the write-only password input, leaking the provider key format in page HTML.
This caused the smoke-suite write-only invariant assertion to fail (CI run
2026-06-17 job 81824705096: expect(html).not.toContain("sk-or-")). The
placeholder now reads "Paste provider API key" — neutral, no key-format
prefix, no provider information exposed in rendered HTML.
The value="" write-only invariant was already correct. The encrypted-at-rest
storage was already correct. This fixes the sole remaining output surface.
Full-codebase audit confirms no other path emits the decrypted key:
- No wp_localize_script calls anywhere in the plugin
- No REST endpoints registered
- No data attributes containing key fields
- All get_key() callers use the plaintext server-side only (HTTP auth header)
- error_log() in probe executor logs HTTP status only, never the key value
Agent-Session: prv-key-leak-fix-20260619
76 lines
2.9 KiB
PHP
76 lines
2.9 KiB
PHP
<?php
|
|
/**
|
|
* Plugin Name: PR Vision
|
|
* Plugin URI: https://peptiderepo.com
|
|
* Description: Weekly server-side LLM probes for AI-visibility (GEO) tracking. Records whether peptiderepo.com is cited by LLMs across core peptides, stores time-series, and renders an admin dashboard + settings UI.
|
|
* Version: 0.3.3
|
|
* Author: peptiderepo
|
|
* Author URI: https://peptiderepo.com
|
|
* License: GPL-2.0-or-later
|
|
* Text Domain: pr-vision
|
|
* Requires PHP: 8.1
|
|
*
|
|
* @see ARCHITECTURE.md -- Full data flow and file tree.
|
|
* @see CONVENTIONS.md -- Naming patterns and extension guide.
|
|
* @see CONTEXT.md -- Domain glossary incl. the visibility score formula.
|
|
* @package PrVision
|
|
*/
|
|
|
|
declare(strict_types=1);
|
|
|
|
if ( ! defined( 'ABSPATH' ) ) {
|
|
exit;
|
|
}
|
|
|
|
/* ── Constants ────────────────────────────────────────────────────────── */
|
|
|
|
define( 'PRV_VERSION', '0.3.3' );
|
|
define( 'PRV_PLUGIN_FILE', __FILE__ );
|
|
define( 'PRV_PLUGIN_DIR', plugin_dir_path( __FILE__ ) );
|
|
define( 'PRV_PLUGIN_URL', plugin_dir_url( __FILE__ ) );
|
|
define( 'PRV_SCHEMA_VERSION', 3 );
|
|
|
|
/** Maximum HTTP retries for LLM API calls. @var int */
|
|
define( 'PRV_MAX_RETRIES', 3 );
|
|
|
|
/** API request timeout in seconds. @var int */
|
|
define( 'PRV_API_TIMEOUT_SECONDS', 60 );
|
|
|
|
/** Base backoff delay (seconds) between retries. @var int */
|
|
define( 'PRV_RETRY_BASE_DELAY_SECONDS', 2 );
|
|
|
|
/** Default monthly budget cap in USD. @var float */
|
|
define( 'PRV_DEFAULT_MONTHLY_BUDGET_USD', 5.0 );
|
|
|
|
/** WP-Cron hook name for the weekly probe run. @var string */
|
|
define( 'PRV_CRON_HOOK', 'prv_weekly_probe' );
|
|
|
|
/** The site we are tracking citations for. @var string */
|
|
define( 'PRV_TARGET_DOMAIN', 'peptiderepo.com' );
|
|
/** Default I/O retention window in days. @var int */
|
|
define( 'PRV_IO_RETENTION_DEFAULT_DAYS', 90 );
|
|
|
|
/** WP-Cron hook name for the daily prune run. @var string */
|
|
define( 'PRV_DAILY_PRUNE_HOOK', 'prv_daily_prune' );
|
|
|
|
|
|
/* ── Autoloader ───────────────────────────────────────────────────────── */
|
|
|
|
require_once PRV_PLUGIN_DIR . 'includes/core/class-prv-autoloader.php';
|
|
PRV_Autoloader::register();
|
|
|
|
/* ── Activation / Deactivation ────────────────────────────────────────── */
|
|
|
|
register_activation_hook( __FILE__, array( 'PRV_Activator', 'activate' ) );
|
|
register_deactivation_hook( __FILE__, array( 'PRV_Deactivator', 'deactivate' ) );
|
|
|
|
/* ── Boot ──────────────────────────────────────────────────────────────── */
|
|
|
|
add_action(
|
|
'plugins_loaded',
|
|
static function (): void {
|
|
$plugin = new PRV_Plugin();
|
|
$plugin->init();
|
|
}
|
|
);
|