| [ Index ] |
PHP Cross Reference of WordPress Trunk (Updated Daily) |
[Source view] [Print] [Project Stats]
Secrets API: WP_Secrets_Libsodium_Provider class
| File Size: | 688 lines (23 kb) |
| Included or required: | 0 times |
| Referenced: | 0 times |
| Includes or requires: | 0 files |
| __construct( WP_Secrets_Store $store, WP_Secrets_Key_Manager $key_manager ) X-Ref |
| Composes the provider from its two replaceable halves. param: WP_Secrets_Store $store Where ciphertext records live. param: WP_Secrets_Key_Manager $key_manager Derives per-scope master keys. |
| get_label() X-Ref |
| A description of what is protecting these secrets, for Site Health. Reports the keyring's own description rather than a fixed string: "libsodium" is only half the answer, and which key source is in use is the half an operator cannot otherwise see. return: string |
| get_protection_boundary() X-Ref |
| Protection happens inside WordPress for this provider. return: string |
| is_writable() X-Ref |
| Always true. A store that cannot accept a write reports that from set() itself. There is no separate capability flag to consult, and the shipped store accepts writes unconditionally. return: bool |
| validate_record_shape( $record ) X-Ref |
| Validates the shape of a record read back from a store. Runs before any decryption is attempted. return: true|WP_Error param: mixed $record Candidate record. |
| read_prior_record( WP_Secrets_Store $store, string $name, bool $network ) X-Ref |
| Reads the record a write or delete is about to replace, tolerating corruption. A write path needs the prior record only to report the old fingerprint on the change hook. That is not worth refusing the operation over: if the stored record is unreadable, overwriting or deleting it is the only repair an operator has through this API, and returning WP_Error here would leave a corrupted secret permanently stuck – neither readable, nor fixable, nor removable without editing the database by hand. An unreachable *store* is different, and still aborts: that is an infrastructure failure, not a data problem, and continuing would mean writing blind. return: array<mixed>|null|WP_Error The prior record, null if absent or unreadable, param: WP_Secrets_Store $store The active store. param: string $name The secret's namespaced name. param: bool $network Whether this is a network-scope secret. |
| stored_fingerprint( $record ) X-Ref |
| Extracts the current slot's stored fingerprint from a record, if it has one. return: string The fingerprint, or '' if there is not a usable one. param: mixed $record A record previously read from the store, or null. |
| slot_fingerprint( $slot ) X-Ref |
| Extracts a single slot's stored fingerprint, if it has one. return: string The fingerprint, or '' if there is not a usable one. param: mixed $slot A slot previously read from the store. |
| demote_slot( WP_Secrets_Cipher $cipher, string $master_key, string $scope, int $site_id, string $name, array $current_slot ) X-Ref |
| Re-encrypts an outgoing current slot so it can be stored as the previous slot. A slot's ciphertext is bound, via AAD, to the exact position it was written to. Copying its stored bytes as-is into the other slot would leave it permanently undecryptable there: the authentication tag was computed for the slot it came from, and every future read asks for it under the other one. Demoting a slot means decrypting it under its old binding and re-encrypting the same plaintext under the new one. return: array|WP_Error The same value, re-encrypted and bound to param: WP_Secrets_Cipher $cipher A cipher instance. param: string $master_key 32-byte master key. param: string $scope 'site' or 'network'. param: int $site_id Blog id for site scope, 0 for network scope. param: string $name The secret's namespaced name. param: array<mixed> $current_slot The outgoing current slot, as stored. |
| set( string $name, $value, bool $network = false, bool $needs_rotation = false, ?string $action = null ) X-Ref |
| Shared implementation behind the three secret-writing functions. Backs wp_set_secret(), wp_set_network_secret(), and wp_import_option_as_secret(), which select their behavior through the last two parameters. return: true|WP_Error param: string $name The secret's namespaced name. param: string $value The plaintext value. param: bool $network Whether this is a network-scope secret. param: bool $needs_rotation Value for the new current slot's param: string|null $action When given, used as the $action reported to |
| get( string $name, string $version, bool $network = false ) X-Ref |
| Shared implementation behind wp_get_secret() and wp_get_network_secret(). return: WP_Secret|null|WP_Error param: string $name The secret's namespaced name. param: string $version A WP_Secret_Version constant. param: bool $network Whether this is a network-scope secret. |
| delete( string $name, bool $network = false ) X-Ref |
| Shared implementation behind wp_delete_secret() and wp_delete_network_secret(). return: true|WP_Error param: string $name The secret's namespaced name. param: bool $network Whether this is a network-scope secret. |
| retire_previous( string $name, bool $network = false ) X-Ref |
| Shared implementation behind the two version-retirement functions. Backs wp_retire_secret_version() and wp_retire_network_secret_version(). Beyond the API surface the proposal names. It states that retirement is "an explicit operator action" but names no function; this is this implementation's name for it, pending confirmation in the comments thread. return: true|WP_Error param: string $name The secret's namespaced name. param: bool $network Whether this is a network-scope secret. |
| list_secrets( string $name_prefix = '', bool $network = false ) X-Ref |
| Shared implementation behind wp_list_secrets() and wp_list_network_secrets(). Beyond the API surface the proposal names, and justified by its statement that "the hooks and accessors an admin screen would need are in scope now; the screen itself is not." Fingerprints returned here come directly from the stored record field, not recomputed by decrypting each secret. That is a deliberate difference from WP_Secret::fingerprint(), which always recomputes – recomputing here would mean decrypting every matching secret just to list them, defeating the point of a lightweight listing call. This is safe specifically because a list entry is documented as informational only and is never used to gate anything; nothing in this codebase performs a security decision based on a fingerprint returned from this function. return: array|WP_Error Array of associative arrays, each with keys 'name', param: string $name_prefix Only secrets whose name starts with "{$name_prefix}/" param: bool $network Whether to list network-scope secrets. |
| Generated : Wed Oct 14 08:20:33 2026 | Cross-referenced by PHPXref |