dc86376e8b
- Added phpcs:ignore for class file naming convention (79 violations) WordPress.Files.FileName.InvalidClassFileName is a known architectural issue — class files use short names without prautoblogger- prefix - Added phpcs:ignore for ->prepare() table interpolation (56 violations) WordPress.DB.PreparedSQL.InterpolatedNotPrepared: dynamic table names (prab_generation_logs, prab_cost_logs) require interpolation; ->prepare() does not support table name placeholders, only column values - Fixed file-level docblock positioning (2 violations) prautoblogger.php and uninstall.php: moved declare(strict_types=1) before file docblock per PHP best practices
81 lines
3.1 KiB
PHP
81 lines
3.1 KiB
PHP
<?php
|
|
// phpcs:ignore WordPress.Files.FileName.InvalidClassFileName -- class naming convention differs from WordPress standard
|
|
declare(strict_types=1);
|
|
|
|
/**
|
|
* Request builder for OpenRouter API calls.
|
|
*
|
|
* Encapsulates the logic for building HTTP request headers, including
|
|
* Cloudflare AI Gateway caching directives and belt-and-suspenders
|
|
* cURL header injection to work around authorization header stripping
|
|
* in certain hosting environments.
|
|
*
|
|
* Triggered by: PRAutoBlogger_OpenRouter_Provider::send_chat_completion()
|
|
* Dependencies: add_action(), curl_setopt() (via http_api_curl filter).
|
|
*
|
|
* @see class-open-router-provider.php — Parent class that uses this builder.
|
|
*/
|
|
class PRAutoBlogger_OpenRouter_Request_Builder {
|
|
|
|
/**
|
|
* Build request headers for OpenRouter API call.
|
|
*
|
|
* Includes Authorization, Content-Type, HTTP-Referer, and optional
|
|
* Cloudflare AI Gateway cache control headers.
|
|
*
|
|
* @param string $api_key Decrypted OpenRouter API key.
|
|
* @param bool $via_gateway Whether the request is routed through Cloudflare AI Gateway.
|
|
* @param int $cache_ttl Cache TTL in seconds (0 disables caching).
|
|
*
|
|
* @return array<string, string> HTTP headers ready for wp_remote_post().
|
|
*/
|
|
public function build_headers( string $api_key, bool $via_gateway, int $cache_ttl ): array {
|
|
$headers = array(
|
|
'Authorization' => 'Bearer ' . $api_key,
|
|
'Content-Type' => 'application/json',
|
|
'HTTP-Referer' => home_url(),
|
|
'X-Title' => 'PRAutoBlogger WordPress Plugin',
|
|
);
|
|
|
|
if ( $via_gateway && $cache_ttl > 0 ) {
|
|
$headers['cf-aig-cache-ttl'] = (string) $cache_ttl;
|
|
}
|
|
|
|
return $headers;
|
|
}
|
|
|
|
/**
|
|
* Register a cURL filter to inject Authorization header.
|
|
*
|
|
* Some hosting environments (Hostinger, certain proxies) strip the
|
|
* Authorization header from wp_remote_post's 'headers' array before
|
|
* the request is sent. The http_api_curl action fires after WordPress
|
|
* configures the cURL handle but before curl_exec — setting
|
|
* CURLOPT_HTTPHEADER here ensures the header reaches the upstream.
|
|
*
|
|
* Side effects: Adds an http_api_curl filter (caller must remove).
|
|
*
|
|
* @param array $request_headers Request headers (includes Authorization).
|
|
* @param string $base_host Upstream host (scopes the filter to avoid leaking auth).
|
|
*
|
|
* @return callable The filter function (for later removal via remove_action).
|
|
*/
|
|
public function register_curl_auth_filter( array $request_headers, string $base_host ): callable {
|
|
$curl_auth_filter = function ( $handle, $parsed_args, $url ) use ( $request_headers, $base_host ): void {
|
|
// Scope to the configured upstream host only — never leak auth
|
|
// into unrelated outbound requests made elsewhere in WordPress.
|
|
if ( '' === $base_host || false === strpos( (string) $url, $base_host ) ) {
|
|
return;
|
|
}
|
|
$curl_headers = array();
|
|
foreach ( $request_headers as $name => $value ) {
|
|
$curl_headers[] = $name . ': ' . $value;
|
|
}
|
|
// phpcs:ignore WordPress.WP.AlternativeFunctions.curl_curl_setopt
|
|
curl_setopt( $handle, CURLOPT_HTTPHEADER, $curl_headers );
|
|
};
|
|
add_action( 'http_api_curl', $curl_auth_filter, 99, 3 );
|
|
return $curl_auth_filter;
|
|
}
|
|
}
|