428a3d5861
Adds two WP options: prautoblogger_ai_gateway_base_url (routes OpenRouter calls through a Cloudflare AI Gateway when set to an https:// URL; empty = direct, the default) and prautoblogger_ai_gateway_cache_ttl (seconds for cf-aig-cache-ttl response caching; 0 = off). The gateway is a transparent OpenRouter-compatible proxy, so no consuming class, no provider abstraction, and no response-parsing path changes. The http_api_curl belt-and-suspenders Authorization filter is rescoped to the configured upstream host so it still runs under gateway.ai.cloudflare.com. Rationale: leverages existing Cloudflare infrastructure to satisfy the CTO cost-control rules (caching, cost tracking, rate limiting, fallback) without building equivalent middleware in-plugin. Fully opt-in and reversible from the admin UI. Docs: ARCHITECTURE.md options + integrations tables updated; key decision #15 added. Uninstall is unaffected (wildcard prautoblogger_% delete). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
465 lines
16 KiB
PHP
465 lines
16 KiB
PHP
<?php
|
|
declare(strict_types=1);
|
|
|
|
/**
|
|
* OpenRouter API integration for all LLM calls (analysis, writing, editing).
|
|
*
|
|
* OpenRouter provides a unified API to access models from Anthropic, OpenAI,
|
|
* Google, Meta, and others. This lets users pick any model without us maintaining
|
|
* separate provider integrations.
|
|
*
|
|
* Triggered by: Content_Analyzer, Content_Generator, Chief_Editor, Metrics_Collector.
|
|
* Dependencies: PRAutoBlogger_Encryption (for API key decryption), wp_remote_post(), PRAutoBlogger_OpenRouter_Pricing.
|
|
*
|
|
* @see interface-llm-provider.php — Interface this class implements.
|
|
* @see class-open-router-pricing.php — Pricing and model list lookups.
|
|
* @see class-cost-tracker.php — Called after every request to log token usage.
|
|
* @see ARCHITECTURE.md — Data flow diagram showing where this fits.
|
|
*/
|
|
class PRAutoBlogger_OpenRouter_Provider implements PRAutoBlogger_LLM_Provider_Interface {
|
|
|
|
/**
|
|
* Default direct-to-OpenRouter endpoint. Used when no Cloudflare AI Gateway
|
|
* URL is configured. The active endpoint is resolved per-request via
|
|
* get_api_base_url() so admins can flip to an AI Gateway proxy without code.
|
|
*/
|
|
private const DEFAULT_API_BASE_URL = 'https://openrouter.ai/api/v1';
|
|
|
|
/**
|
|
* Resolve the API base URL.
|
|
*
|
|
* If an admin has configured a Cloudflare AI Gateway URL in settings,
|
|
* we route through that instead of hitting OpenRouter directly. The
|
|
* gateway is a transparent OpenAI/OpenRouter-compatible proxy that
|
|
* adds caching, cost logging, rate-limiting, and provider fallback
|
|
* — see ARCHITECTURE.md "External API Integrations".
|
|
*
|
|
* Expected gateway URL shape:
|
|
* https://gateway.ai.cloudflare.com/v1/{account_id}/{gateway_id}/openrouter
|
|
*
|
|
* @return string Base URL with no trailing slash.
|
|
*/
|
|
private function get_api_base_url(): string {
|
|
$override = trim( (string) get_option( 'prautoblogger_ai_gateway_base_url', '' ) );
|
|
if ( '' === $override ) {
|
|
return self::DEFAULT_API_BASE_URL;
|
|
}
|
|
// Only accept https to avoid plaintext-auth regressions.
|
|
if ( 0 !== stripos( $override, 'https://' ) ) {
|
|
return self::DEFAULT_API_BASE_URL;
|
|
}
|
|
return rtrim( $override, '/' );
|
|
}
|
|
|
|
/**
|
|
* Cache TTL (seconds) for AI Gateway response caching.
|
|
*
|
|
* Cloudflare honours the `cf-aig-cache-ttl` request header and serves
|
|
* cached responses for identical payloads within the TTL window. Only
|
|
* meaningful when a gateway base URL is configured; harmless otherwise.
|
|
*
|
|
* @return int Non-negative integer seconds; 0 disables caching.
|
|
*/
|
|
private function get_cache_ttl_seconds(): int {
|
|
$ttl = (int) get_option( 'prautoblogger_ai_gateway_cache_ttl', 0 );
|
|
return $ttl > 0 ? $ttl : 0;
|
|
}
|
|
|
|
/**
|
|
* Send a chat completion request to OpenRouter.
|
|
*
|
|
* Retries with exponential backoff on transient failures (5xx, timeout).
|
|
* Logs every attempt. Fails loudly after exhausting retries.
|
|
*
|
|
* Side effects: HTTP request to OpenRouter API.
|
|
*
|
|
* @param array<int, array{role: string, content: string}> $messages Chat messages.
|
|
* @param string $model Model identifier (e.g., 'anthropic/claude-sonnet-4').
|
|
* @param array{
|
|
* temperature?: float,
|
|
* max_tokens?: int,
|
|
* response_format?: array{type: string},
|
|
* } $options Optional parameters.
|
|
*
|
|
* @return array{
|
|
* content: string,
|
|
* model: string,
|
|
* prompt_tokens: int,
|
|
* completion_tokens: int,
|
|
* total_tokens: int,
|
|
* finish_reason: string,
|
|
* }
|
|
*
|
|
* @throws \RuntimeException On API error after retries exhausted.
|
|
*/
|
|
public function send_chat_completion( array $messages, string $model, array $options = [] ): array {
|
|
$api_key = $this->get_api_key();
|
|
if ( '' === $api_key ) {
|
|
throw new \RuntimeException(
|
|
__( 'OpenRouter API key is not configured. Go to PRAutoBlogger → Settings.', 'prautoblogger' )
|
|
);
|
|
}
|
|
|
|
// Validate key format — OpenRouter keys start with "sk-or-".
|
|
// A key that decrypts to garbage (e.g. after a salt change) won't match.
|
|
if ( 0 !== strpos( $api_key, 'sk-or-' ) ) {
|
|
PRAutoBlogger_Logger::instance()->error(
|
|
sprintf(
|
|
'Decrypted API key has unexpected format (prefix="%s", len=%d). Re-enter your key in settings.',
|
|
substr( $api_key, 0, 6 ),
|
|
strlen( $api_key )
|
|
),
|
|
'openrouter'
|
|
);
|
|
throw new \RuntimeException(
|
|
__( 'OpenRouter API key appears corrupted (unexpected format). Please re-enter your key in PRAutoBlogger → Settings.', 'prautoblogger' )
|
|
);
|
|
}
|
|
|
|
$body = [
|
|
'model' => $model,
|
|
'messages' => $messages,
|
|
];
|
|
|
|
if ( isset( $options['temperature'] ) ) {
|
|
$body['temperature'] = $options['temperature'];
|
|
}
|
|
if ( isset( $options['max_tokens'] ) ) {
|
|
$body['max_tokens'] = $options['max_tokens'];
|
|
}
|
|
if ( isset( $options['response_format'] ) ) {
|
|
$body['response_format'] = $options['response_format'];
|
|
}
|
|
|
|
$last_error = '';
|
|
|
|
$base_url = $this->get_api_base_url();
|
|
$base_host = (string) wp_parse_url( $base_url, PHP_URL_HOST );
|
|
$cache_ttl = $this->get_cache_ttl_seconds();
|
|
$via_gateway = self::DEFAULT_API_BASE_URL !== $base_url;
|
|
|
|
// Build headers once so the wp_remote_post call and the cURL belt-and-
|
|
// suspenders filter stay in lockstep. The cf-aig-* headers are only
|
|
// meaningful when going through a Cloudflare AI Gateway; they are
|
|
// ignored by direct OpenRouter calls, so sending them unconditionally
|
|
// when a gateway is configured is safe and keeps the code branch-free.
|
|
$request_headers = [
|
|
'Authorization' => 'Bearer ' . $api_key,
|
|
'Content-Type' => 'application/json',
|
|
'HTTP-Referer' => home_url(),
|
|
'X-Title' => 'PRAutoBlogger WordPress Plugin',
|
|
];
|
|
if ( $via_gateway && $cache_ttl > 0 ) {
|
|
$request_headers['cf-aig-cache-ttl'] = (string) $cache_ttl;
|
|
}
|
|
|
|
// Belt-and-suspenders: inject Authorization header at cURL level.
|
|
// Some hosting environments (Hostinger, certain proxies) strip the
|
|
// Authorization header from wp_remote_post's 'headers' array before
|
|
// the request is sent. The http_api_curl action fires after WordPress
|
|
// configures the cURL handle but before curl_exec — re-setting
|
|
// CURLOPT_HTTPHEADER here ensures the header reaches the upstream
|
|
// (either OpenRouter directly or the Cloudflare AI Gateway proxy).
|
|
$curl_auth_filter = function ( $handle, $parsed_args, $url ) use ( $request_headers, $base_host ): void {
|
|
// Scope to the configured upstream host only — never leak auth
|
|
// into unrelated outbound requests made elsewhere in WordPress.
|
|
if ( '' === $base_host || false === strpos( (string) $url, $base_host ) ) {
|
|
return;
|
|
}
|
|
$curl_headers = [];
|
|
foreach ( $request_headers as $name => $value ) {
|
|
$curl_headers[] = $name . ': ' . $value;
|
|
}
|
|
// phpcs:ignore WordPress.WP.AlternativeFunctions.curl_curl_setopt
|
|
curl_setopt( $handle, CURLOPT_HTTPHEADER, $curl_headers );
|
|
};
|
|
add_action( 'http_api_curl', $curl_auth_filter, 99, 3 );
|
|
|
|
try {
|
|
for ( $attempt = 1; $attempt <= PRAUTOBLOGGER_MAX_RETRIES; $attempt++ ) {
|
|
$response = wp_remote_post(
|
|
$base_url . '/chat/completions',
|
|
[
|
|
'timeout' => PRAUTOBLOGGER_API_TIMEOUT_SECONDS,
|
|
'headers' => $request_headers,
|
|
'body' => wp_json_encode( $body ),
|
|
]
|
|
);
|
|
|
|
if ( is_wp_error( $response ) ) {
|
|
$last_error = $response->get_error_message();
|
|
PRAutoBlogger_Logger::instance()->warning(
|
|
sprintf( 'OpenRouter request failed (attempt %d/%d): %s', $attempt, PRAUTOBLOGGER_MAX_RETRIES, $last_error ),
|
|
'openrouter'
|
|
);
|
|
|
|
if ( $attempt < PRAUTOBLOGGER_MAX_RETRIES ) {
|
|
$delay = PRAUTOBLOGGER_RETRY_BASE_DELAY_SECONDS * pow( 2, $attempt - 1 );
|
|
sleep( (int) $delay );
|
|
}
|
|
continue;
|
|
}
|
|
|
|
$status_code = wp_remote_retrieve_response_code( $response );
|
|
$body_raw = wp_remote_retrieve_body( $response );
|
|
$data = json_decode( $body_raw, true );
|
|
|
|
// Rate limited (429) or server error (5xx) — retry with backoff.
|
|
if ( 429 === $status_code || $status_code >= 500 ) {
|
|
$last_error = sprintf( 'HTTP %d: %s', $status_code, $body_raw );
|
|
PRAutoBlogger_Logger::instance()->warning(
|
|
sprintf( 'OpenRouter HTTP %d (attempt %d/%d): %s', $status_code, $attempt, PRAUTOBLOGGER_MAX_RETRIES, substr( $body_raw, 0, 500 ) ),
|
|
'openrouter'
|
|
);
|
|
|
|
if ( $attempt < PRAUTOBLOGGER_MAX_RETRIES ) {
|
|
// Respect Retry-After header if present.
|
|
$retry_after = wp_remote_retrieve_header( $response, 'retry-after' );
|
|
$delay = $retry_after
|
|
? min( (int) $retry_after, 60 )
|
|
: PRAUTOBLOGGER_RETRY_BASE_DELAY_SECONDS * pow( 2, $attempt - 1 );
|
|
sleep( (int) $delay );
|
|
}
|
|
continue;
|
|
}
|
|
|
|
// Client error — don't retry, fail immediately.
|
|
if ( $status_code >= 400 ) {
|
|
$error_msg = isset( $data['error']['message'] )
|
|
? $data['error']['message']
|
|
: 'HTTP ' . $status_code;
|
|
|
|
// Log detailed diagnostic info for auth errors to aid debugging.
|
|
if ( 401 === $status_code || 403 === $status_code ) {
|
|
PRAutoBlogger_Logger::instance()->error(
|
|
sprintf(
|
|
'Auth failure HTTP %d: key_prefix=%s, key_len=%d, error=%s',
|
|
$status_code,
|
|
substr( $api_key, 0, 8 ),
|
|
strlen( $api_key ),
|
|
$error_msg
|
|
),
|
|
'openrouter'
|
|
);
|
|
}
|
|
|
|
throw new \RuntimeException(
|
|
sprintf(
|
|
/* translators: %d: HTTP status code, %s: error message */
|
|
__( 'OpenRouter API error (HTTP %1$d): %2$s', 'prautoblogger' ),
|
|
$status_code,
|
|
$error_msg
|
|
)
|
|
);
|
|
}
|
|
|
|
// Success — parse response.
|
|
if ( ! isset( $data['choices'][0]['message']['content'] ) ) {
|
|
throw new \RuntimeException(
|
|
__( 'OpenRouter returned unexpected response format.', 'prautoblogger' )
|
|
);
|
|
}
|
|
|
|
$usage = $data['usage'] ?? [];
|
|
|
|
return [
|
|
'content' => $data['choices'][0]['message']['content'],
|
|
'model' => $data['model'] ?? $model,
|
|
'prompt_tokens' => (int) ( $usage['prompt_tokens'] ?? 0 ),
|
|
'completion_tokens' => (int) ( $usage['completion_tokens'] ?? 0 ),
|
|
'total_tokens' => (int) ( $usage['total_tokens'] ?? 0 ),
|
|
'finish_reason' => $data['choices'][0]['finish_reason'] ?? 'unknown',
|
|
];
|
|
}
|
|
|
|
// All retries exhausted.
|
|
throw new \RuntimeException(
|
|
sprintf(
|
|
/* translators: %d: max retries, %s: last error message */
|
|
__( 'OpenRouter API failed after %1$d attempts. Last error: %2$s', 'prautoblogger' ),
|
|
PRAUTOBLOGGER_MAX_RETRIES,
|
|
$last_error
|
|
)
|
|
);
|
|
} finally {
|
|
// Always clean up the cURL filter to avoid leaking into other requests.
|
|
remove_action( 'http_api_curl', $curl_auth_filter, 99 );
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Get available models from OpenRouter's /models endpoint.
|
|
*
|
|
* Caches the result in a transient for 24 hours to avoid repeated API calls.
|
|
*
|
|
* Side effects: HTTP request (if cache miss), sets transient.
|
|
*
|
|
* @return array<int, array{id: string, name: string, context_length: int, pricing: array{prompt: float, completion: float}}>
|
|
*/
|
|
public function get_available_models(): array {
|
|
$pricing = new PRAutoBlogger_OpenRouter_Pricing();
|
|
return $pricing->get_available_models();
|
|
}
|
|
|
|
/**
|
|
* Estimate the cost of an API call in USD.
|
|
*
|
|
* Uses hardcoded pricing first, falls back to cached model data.
|
|
*
|
|
* @param string $model Model identifier.
|
|
* @param int $prompt_tokens Input tokens.
|
|
* @param int $completion_tokens Output tokens.
|
|
*
|
|
* @return float Estimated cost in USD.
|
|
*/
|
|
public function estimate_cost( string $model, int $prompt_tokens, int $completion_tokens ): float {
|
|
$pricing = new PRAutoBlogger_OpenRouter_Pricing();
|
|
return $pricing->estimate_cost( $model, $prompt_tokens, $completion_tokens );
|
|
}
|
|
|
|
/**
|
|
* @return string
|
|
*/
|
|
public function get_provider_name(): string {
|
|
return 'OpenRouter';
|
|
}
|
|
|
|
/**
|
|
* Validate that the OpenRouter API key is configured and working.
|
|
*
|
|
* Makes a lightweight request to the /auth/key endpoint.
|
|
*
|
|
* Side effects: HTTP request to OpenRouter, logs diagnostic info.
|
|
*
|
|
* @return bool
|
|
*/
|
|
public function validate_credentials(): bool {
|
|
$diag = $this->validate_credentials_detailed();
|
|
return 'ok' === $diag['status'];
|
|
}
|
|
|
|
/**
|
|
* Validate credentials with detailed diagnostic info.
|
|
*
|
|
* Returns an array with status ('ok' or 'error') and a human-readable
|
|
* message explaining what went wrong if validation fails.
|
|
*
|
|
* Side effects: HTTP request to OpenRouter, logs diagnostic info.
|
|
*
|
|
* @return array{status: string, message: string, debug?: string}
|
|
*/
|
|
public function validate_credentials_detailed(): array {
|
|
$encrypted = get_option( 'prautoblogger_openrouter_api_key', '' );
|
|
if ( '' === $encrypted ) {
|
|
return [
|
|
'status' => 'error',
|
|
'message' => __( 'No API key saved. Enter your OpenRouter key in settings.', 'prautoblogger' ),
|
|
'debug' => 'option_empty',
|
|
];
|
|
}
|
|
|
|
$api_key = PRAutoBlogger_Encryption::decrypt( $encrypted );
|
|
if ( '' === $api_key ) {
|
|
return [
|
|
'status' => 'error',
|
|
'message' => __( 'API key decryption failed. Re-enter your key.', 'prautoblogger' ),
|
|
'debug' => 'decrypt_failed:encrypted_len=' . strlen( $encrypted ),
|
|
];
|
|
}
|
|
|
|
// Sanity check: OpenRouter keys typically start with "sk-or-".
|
|
$key_prefix = substr( $api_key, 0, 6 );
|
|
$key_len = strlen( $api_key );
|
|
|
|
if ( 0 !== strpos( $api_key, 'sk-or-' ) ) {
|
|
PRAutoBlogger_Logger::instance()->error(
|
|
sprintf(
|
|
'API key format invalid (prefix="%s", len=%d). Likely salt changed — re-enter key.',
|
|
$key_prefix,
|
|
$key_len
|
|
),
|
|
'openrouter'
|
|
);
|
|
return [
|
|
'status' => 'error',
|
|
'message' => __( 'API key appears corrupted (decryption produced invalid data). Your WordPress auth salt may have changed. Please re-enter your OpenRouter API key in settings.', 'prautoblogger' ),
|
|
'debug' => sprintf( 'bad_format:prefix=%s,len=%d', $key_prefix, $key_len ),
|
|
];
|
|
}
|
|
|
|
// Belt-and-suspenders: inject Authorization at cURL level (see send_chat_completion).
|
|
$base_url = $this->get_api_base_url();
|
|
$base_host = (string) wp_parse_url( $base_url, PHP_URL_HOST );
|
|
$auth_header_value = 'Bearer ' . $api_key;
|
|
$curl_auth_filter_cred = function ( $handle, $parsed_args, $url ) use ( $auth_header_value, $base_host ): void {
|
|
if ( '' === $base_host || false === strpos( (string) $url, $base_host ) ) {
|
|
return;
|
|
}
|
|
// phpcs:ignore WordPress.WP.AlternativeFunctions.curl_curl_setopt
|
|
curl_setopt( $handle, CURLOPT_HTTPHEADER, [
|
|
'Authorization: ' . $auth_header_value,
|
|
] );
|
|
};
|
|
add_action( 'http_api_curl', $curl_auth_filter_cred, 99, 3 );
|
|
|
|
$response = wp_remote_get(
|
|
$base_url . '/auth/key',
|
|
[
|
|
'timeout' => 15,
|
|
'headers' => [
|
|
'Authorization' => 'Bearer ' . $api_key,
|
|
],
|
|
]
|
|
);
|
|
|
|
remove_action( 'http_api_curl', $curl_auth_filter_cred, 99 );
|
|
|
|
if ( is_wp_error( $response ) ) {
|
|
$err_msg = $response->get_error_message();
|
|
PRAutoBlogger_Logger::instance()->error(
|
|
sprintf( 'OpenRouter credential check wp_error: %s (key_prefix=%s, key_len=%d)', $err_msg, $key_prefix, $key_len ),
|
|
'openrouter'
|
|
);
|
|
return [
|
|
'status' => 'error',
|
|
'message' => sprintf( __( 'Network error reaching OpenRouter: %s', 'prautoblogger' ), $err_msg ),
|
|
'debug' => 'wp_error:' . $err_msg,
|
|
];
|
|
}
|
|
|
|
$status_code = wp_remote_retrieve_response_code( $response );
|
|
$body_raw = wp_remote_retrieve_body( $response );
|
|
|
|
if ( 200 === $status_code ) {
|
|
return [
|
|
'status' => 'ok',
|
|
'message' => __( 'OpenRouter connected.', 'prautoblogger' ),
|
|
];
|
|
}
|
|
|
|
PRAutoBlogger_Logger::instance()->warning(
|
|
sprintf( 'OpenRouter credential check HTTP %d (key_prefix=%s, key_len=%d): %s', $status_code, $key_prefix, $key_len, substr( $body_raw, 0, 300 ) ),
|
|
'openrouter'
|
|
);
|
|
|
|
return [
|
|
'status' => 'error',
|
|
'message' => sprintf( __( 'OpenRouter returned HTTP %d. %s', 'prautoblogger' ), $status_code, substr( $body_raw, 0, 200 ) ),
|
|
'debug' => sprintf( 'http_%d:key_prefix=%s,key_len=%d', $status_code, $key_prefix, $key_len ),
|
|
];
|
|
}
|
|
|
|
/**
|
|
* Get the decrypted API key from options.
|
|
*
|
|
* @return string Decrypted API key, or empty string if not set.
|
|
*/
|
|
private function get_api_key(): string {
|
|
$encrypted = get_option( 'prautoblogger_openrouter_api_key', '' );
|
|
if ( '' === $encrypted ) {
|
|
return '';
|
|
}
|
|
return PRAutoBlogger_Encryption::decrypt( $encrypted );
|
|
}
|
|
}
|