wpseek.com
A WordPress-centric search engine for devs and theme authors



_wp_connectors_rest_settings_dispatch › WordPress Function

Since7.0.0
Deprecatedn/a
› _wp_connectors_rest_settings_dispatch ( $response, $server, $request )
Access:
  • private
Parameters: (3)
  • (WP_REST_Response) $response The response object.
    Required: Yes
  • (WP_REST_Server) $server The server instance.
    Required: Yes
  • (WP_REST_Request) $request The request object.
    Required: Yes
Returns:
  • (WP_REST_Response) The modified response with masked/validated keys.
Defined at:
Codex:

Masks and validates connector credentials in REST responses.

On every /wp/v2/settings response, masks connector API key values and the password field of default application-password credential objects. On POST or PUT requests, validates each updated AI provider API key before masking. If validation fails, the key is reverted to an empty string. Application password values are masked but not validated.


Related Functions: _wp_connectors_init, wp_convert_widget_settings, wp_is_connector_registered, wp_color_scheme_settings, _wp_register_default_connector_settings

Source 

function _wp_connectors_rest_settings_dispatch( WP_REST_Response $response, WP_REST_Server $server, WP_REST_Request $request ): WP_REST_Response {
	if ( '/wp/v2/settings' !== $request->get_route() ) {
		return $response;
	}

	$data = $response->get_data();
	if ( ! is_array( $data ) ) {
		return $response;
	}

	$is_update = 'POST' === $request->get_method() || 'PUT' === $request->get_method();

	foreach ( wp_get_connectors() as $connector_id => $connector_data ) {
		$auth = $connector_data['authentication'];

		if ( 'application_password' === $auth['method'] && ! empty( $auth['setting_name'] ) ) {
			$setting_name = $auth['setting_name'];
			if ( array_key_exists( $setting_name, $data ) && is_array( $data[ $setting_name ] ) ) {
				$password = $data[ $setting_name ]['password'] ?? '';
				if ( is_string( $password ) && '' !== $password ) {
					$data[ $setting_name ]['password'] = str_repeat( "\u{2022}", 16 );
				}
			}
			continue;
		}

		if ( 'api_key' !== $auth['method'] || empty( $auth['setting_name'] ) ) {
			continue;
		}

		$setting_name = $auth['setting_name'];
		if ( ! array_key_exists( $setting_name, $data ) ) {
			continue;
		}

		$value = $data[ $setting_name ];

		// On update, validate AI provider keys before masking.
		// Non-AI connectors accept keys as-is; the service plugin handles its own validation.
		if ( $is_update && is_string( $value ) && '' !== $value && 'ai_provider' === $connector_data['type'] ) {
			if ( true !== _wp_connectors_is_ai_api_key_valid( $value, $connector_id ) ) {
				update_option( $setting_name, '' );
				$data[ $setting_name ] = '';
				continue;
			}
		}

		// Mask the key in the response.
		if ( is_string( $value ) && '' !== $value ) {
			$data[ $setting_name ] = _wp_connectors_mask_api_key( $value );
		}
	}

	$response->set_data( $data );
	return $response;
}