| [ Index ] |
PHP Cross Reference of WordPress Trunk (Updated Daily) |
[Source view] [Print] [Project Stats]
Secrets API: WP_Secret class
| File Size: | 342 lines (10 kb) |
| Included or required: | 0 times |
| Referenced: | 0 times |
| Includes or requires: | 0 files |
| __construct( string $name, $value, string $fingerprint ) X-Ref |
| Constructor. Throws, where the rest of this API returns WP_Error for a caller mistake. That is not an inconsistency to be tidied up later: a constructor has no return channel, so the only alternatives are throwing or building a half-valid WP_Secret and letting it fail somewhere less obvious. Every function that *can* return WP_Error does – see this file's own reasoning below. The same rule covers the serialization and clone refusals below, which are magic methods with the same problem and an additional one: silently permitting them would leak a plaintext. Nothing outside this API constructs a WP_Secret in normal use; the values passed here come from _wp_secrets_get() having just decrypted them. param: string $name The secret's namespaced name. param: string $value The decrypted plaintext. param: string $fingerprint Keyed fingerprint of $value. |
| reveal() X-Ref |
| Returns the decrypted plaintext. This is the only path to the stored plaintext anywhere in the API. Returns WP_Error for a secret whose provider will not release the value to PHP at all – see withheld(). That case does not arise for the provider WordPress ships, which decrypts eagerly and therefore always has a value in hand, so most callers will never see it. It is in the signature because a return type cannot be widened after adoption: leaving reveal() as `string` would permanently foreclose brokered and use-only credentials, which is a decision better made deliberately than by omission. return: string|WP_Error The plaintext, or WP_Error if this provider does not |
| withheld( string $name, string $fingerprint, WP_Error $reason ) X-Ref |
| Builds a secret whose value exists but is not available to PHP. For a provider that can prove a credential exists, and can name and fingerprint it, but will not release it – typically because releasing it would defeat the point of where it is held. Everything except reveal() behaves normally, so such a secret still lists, still reports a stable fingerprint, and still masks itself in every output path. return: WP_Secret param: string $name The secret's name. param: string $fingerprint A stable per-site digest, from the provider. param: WP_Error $reason Why the value cannot be produced. Returned |
| fingerprint() X-Ref |
| Returns the keyed fingerprint of the plaintext. Stable for a given value on a given site; not a value-recovery oracle. return: string |
| get_name() X-Ref |
| Returns the secret's namespaced name. return: string |
| mask() X-Ref |
| Builds the masked placeholder used everywhere a plaintext would otherwise appear. return: string |
| __toString() X-Ref |
| Masks the instance for string conversion. Covers error_log( $secret ) and any other implicit string coercion. return: string |
| __debugInfo() X-Ref |
| Masks the instance for var_dump(). Note that print_r() and var_export() have no equivalent hook. They are safe regardless, because the plaintext is never a declared property for them to enumerate; they will surface the (non-sensitive) name and fingerprint rather than this placeholder. See docs/journal/open-questions.md for the documented var_export() limitation. return: array<string, string> |
| jsonSerialize() X-Ref |
| Masks the instance for json_encode(). return: string |
| __sleep() X-Ref |
| Refuses serialization outright. return: void |
| __wakeup() X-Ref |
| Refuses unserialization outright. return: void |
| __serialize() X-Ref |
| Refuses serialization outright. PHP calls this in preference to __sleep() when both are defined, so both must refuse independently. return: void |
| __unserialize( array $data ) X-Ref |
| Refuses unserialization outright. return: void param: array<mixed> $data Ignored. |
| __clone() X-Ref |
| Refuses cloning outright. A clone would be a second, unaudited reference to the same plaintext with an independent lifetime – and, since the vault is keyed by object id rather than copied, a bare `clone` would otherwise leave the clone's reveal() silently reading nothing. |
| __destruct() X-Ref |
| Zeroes the plaintext and removes it from the vault. |
| Generated : Wed Oct 14 08:20:33 2026 | Cross-referenced by PHPXref |