Changeset 3484575

Timestamp:

03/17/2026 08:54:28 AM (11 days ago)

Author:

zeicaro

Message:

v2.0.1 — Bug fixes: rate limit race condition, KSES filter try/finally, JWT propagation in MCP proxy, WP_Error returns in AI providers, WP_Filesystem null check

Location:

wpraiz-content-api-tool

Files:

• tags/2.0.1 (copied) (copied from wpraiz-content-api-tool/trunk)
• tags/2.0.1/includes/admin/class-license-server.php (added)
• tags/2.0.1/includes/ai/class-deepseek-provider.php (modified) (2 diffs)
• tags/2.0.1/includes/ai/class-openrouter-provider.php (modified) (2 diffs)
• tags/2.0.1/includes/class-auth.php (modified) (1 diff)
• tags/2.0.1/includes/class-content-manager.php (modified) (2 diffs)
• tags/2.0.1/includes/class-media-handler.php (modified) (1 diff)
• tags/2.0.1/includes/mcp/class-mcp-server.php (modified) (1 diff)
• tags/2.0.1/includes/mcp/class-mcp-tools.php (modified) (2 diffs)
• trunk/includes/admin/class-license-server.php (added)
• trunk/includes/ai/class-deepseek-provider.php (modified) (2 diffs)
• trunk/includes/ai/class-openrouter-provider.php (modified) (2 diffs)
• trunk/includes/class-auth.php (modified) (1 diff)
• trunk/includes/class-content-manager.php (modified) (2 diffs)
• trunk/includes/class-media-handler.php (modified) (1 diff)
• trunk/includes/mcp/class-mcp-server.php (modified) (1 diff)
• trunk/includes/mcp/class-mcp-tools.php (modified) (2 diffs)

wpraiz-content-api-tool/tags/2.0.1/includes/ai/class-deepseek-provider.php

@@ -30 +30 @@
     }
 
-    public function generate( string $prompt, array $params = [] ): string {
+    public function generate( string $prompt, array $params = [] ) {
         if ( ! $this->is_configured() ) {
-            return '';
+            return new \WP_Error( 'deepseek_not_configured', 'DeepSeek API key is not configured.' );
         }
 
@@ -53 +53 @@
 
         if ( is_wp_error( $response ) ) {
-            return '';
+            return new \WP_Error( 'deepseek_request_failed', $response->get_error_message() );
         }
 
         $body = json_decode( wp_remote_retrieve_body( $response ), true );
 
-        return $body['choices'][0]['message']['content'] ?? '';
+        if ( empty( $body['choices'][0]['message']['content'] ) ) {
+            $err = $body['error']['message'] ?? wp_remote_retrieve_response_message( $response );
+            return new \WP_Error( 'deepseek_empty_response', $err ?: 'DeepSeek returned an empty response.' );
+        }
+
+        return $body['choices'][0]['message']['content'];
     }
 }

wpraiz-content-api-tool/tags/2.0.1/includes/ai/class-openrouter-provider.php

@@ -34 +34 @@
     }
 
-    public function generate( string $prompt, array $params = [] ): string {
+    public function generate( string $prompt, array $params = [] ) {
         $headers = [
             'Content-Type'    => 'application/json',
@@ -60 +60 @@
 
         if ( is_wp_error( $response ) ) {
-            return '';
+            return new \WP_Error( 'openrouter_request_failed', $response->get_error_message() );
         }
 
         $body = json_decode( wp_remote_retrieve_body( $response ), true );
 
-        return $body['choices'][0]['message']['content'] ?? '';
+        if ( empty( $body['choices'][0]['message']['content'] ) ) {
+            $err = $body['error']['message'] ?? wp_remote_retrieve_response_message( $response );
+            return new \WP_Error( 'openrouter_empty_response', $err ?: 'OpenRouter returned an empty response.' );
+        }
+
+        return $body['choices'][0]['message']['content'];
     }
 }

wpraiz-content-api-tool/tags/2.0.1/includes/class-auth.php

@@ -126 +126 @@
 
         $data['count']++;
-        set_transient( $key, $data, 60 - ( time() - $data['start'] ) );
+        set_transient( $key, $data, max( 1, 60 - ( time() - $data['start'] ) ) );
         return true;
     }

wpraiz-content-api-tool/tags/2.0.1/includes/class-content-manager.php

@@ -297 +297 @@
         }
         if ( ! empty( $params['content'] ) ) {
-            remove_filter( 'content_save_pre', 'wp_filter_post_kses' );
             $update_data['post_content'] = $params['content'];
         }
@@ -307 +306 @@
         }
 
-        $result = wp_update_post( $update_data, true );
-        add_filter( 'content_save_pre', 'wp_filter_post_kses' );
+        $had_kses = has_filter( 'content_save_pre', 'wp_filter_post_kses' );
+        if ( $had_kses ) {
+            remove_filter( 'content_save_pre', 'wp_filter_post_kses' );
+        }
+        try {
+            $result = wp_update_post( $update_data, true );
+        } finally {
+            if ( $had_kses ) {
+                add_filter( 'content_save_pre', 'wp_filter_post_kses' );
+            }
+        }
 
         if ( is_wp_error( $result ) ) {

wpraiz-content-api-tool/tags/2.0.1/includes/class-media-handler.php

@@ -68 +68 @@
         }
         WP_Filesystem();
+
+        if ( empty( $wp_filesystem ) ) {
+            return new \WP_Error( 'filesystem_unavailable', __( 'WordPress Filesystem API could not be initialized.', 'wpraiz-content-api' ) );
+        }
+
         $wp_filesystem->put_contents( $tmp_file, $image_data );
 

wpraiz-content-api-tool/tags/2.0.1/includes/mcp/class-mcp-server.php

@@ -45 +45 @@
         $params  = $body['params'] ?? [];
         $id      = $body['id'] ?? null;
+
+        // Forward auth header so proxy_rest can re-authenticate internal calls.
+        MCP_Tools::set_auth_context( $request->get_header( 'Authorization' ) );
 
         if ( $jsonrpc !== '2.0' || empty( $method ) ) {

wpraiz-content-api-tool/tags/2.0.1/includes/mcp/class-mcp-tools.php

@@ -137 +137 @@
     }
 
+    /** Authorization header forwarded from the incoming MCP request. */
+    private static ?string $current_auth_header = null;
+
+    /**
+     * Store the Authorization header for use in internal REST proxying.
+     * Call this once from MCP_Server before dispatching tool calls.
+     */
+    public static function set_auth_context( ?string $auth_header ): void {
+        self::$current_auth_header = $auth_header;
+    }
+
     /**
      * Execute a tool by name.
@@ -189 +200 @@
         $request->set_header( 'Content-Type', 'application/json' );
 
+        // Propagate the caller's Authorization so permission callbacks pass.
+        if ( self::$current_auth_header ) {
+            $request->set_header( 'Authorization', self::$current_auth_header );
+        }
+
         $response = rest_do_request( $request->set_route( '/' . $route ) );
 

wpraiz-content-api-tool/trunk/includes/ai/class-deepseek-provider.php

@@ -30 +30 @@
     }
 
-    public function generate( string $prompt, array $params = [] ): string {
+    public function generate( string $prompt, array $params = [] ) {
         if ( ! $this->is_configured() ) {
-            return '';
+            return new \WP_Error( 'deepseek_not_configured', 'DeepSeek API key is not configured.' );
         }
 
@@ -53 +53 @@
 
         if ( is_wp_error( $response ) ) {
-            return '';
+            return new \WP_Error( 'deepseek_request_failed', $response->get_error_message() );
         }
 
         $body = json_decode( wp_remote_retrieve_body( $response ), true );
 
-        return $body['choices'][0]['message']['content'] ?? '';
+        if ( empty( $body['choices'][0]['message']['content'] ) ) {
+            $err = $body['error']['message'] ?? wp_remote_retrieve_response_message( $response );
+            return new \WP_Error( 'deepseek_empty_response', $err ?: 'DeepSeek returned an empty response.' );
+        }
+
+        return $body['choices'][0]['message']['content'];
     }
 }

wpraiz-content-api-tool/trunk/includes/ai/class-openrouter-provider.php

@@ -34 +34 @@
     }
 
-    public function generate( string $prompt, array $params = [] ): string {
+    public function generate( string $prompt, array $params = [] ) {
         $headers = [
             'Content-Type'    => 'application/json',
@@ -60 +60 @@
 
         if ( is_wp_error( $response ) ) {
-            return '';
+            return new \WP_Error( 'openrouter_request_failed', $response->get_error_message() );
         }
 
         $body = json_decode( wp_remote_retrieve_body( $response ), true );
 
-        return $body['choices'][0]['message']['content'] ?? '';
+        if ( empty( $body['choices'][0]['message']['content'] ) ) {
+            $err = $body['error']['message'] ?? wp_remote_retrieve_response_message( $response );
+            return new \WP_Error( 'openrouter_empty_response', $err ?: 'OpenRouter returned an empty response.' );
+        }
+
+        return $body['choices'][0]['message']['content'];
     }
 }

wpraiz-content-api-tool/trunk/includes/class-auth.php

@@ -126 +126 @@
 
         $data['count']++;
-        set_transient( $key, $data, 60 - ( time() - $data['start'] ) );
+        set_transient( $key, $data, max( 1, 60 - ( time() - $data['start'] ) ) );
         return true;
     }

wpraiz-content-api-tool/trunk/includes/class-content-manager.php

@@ -297 +297 @@
         }
         if ( ! empty( $params['content'] ) ) {
-            remove_filter( 'content_save_pre', 'wp_filter_post_kses' );
             $update_data['post_content'] = $params['content'];
         }
@@ -307 +306 @@
         }
 
-        $result = wp_update_post( $update_data, true );
-        add_filter( 'content_save_pre', 'wp_filter_post_kses' );
+        $had_kses = has_filter( 'content_save_pre', 'wp_filter_post_kses' );
+        if ( $had_kses ) {
+            remove_filter( 'content_save_pre', 'wp_filter_post_kses' );
+        }
+        try {
+            $result = wp_update_post( $update_data, true );
+        } finally {
+            if ( $had_kses ) {
+                add_filter( 'content_save_pre', 'wp_filter_post_kses' );
+            }
+        }
 
         if ( is_wp_error( $result ) ) {

wpraiz-content-api-tool/trunk/includes/class-media-handler.php

@@ -68 +68 @@
         }
         WP_Filesystem();
+
+        if ( empty( $wp_filesystem ) ) {
+            return new \WP_Error( 'filesystem_unavailable', __( 'WordPress Filesystem API could not be initialized.', 'wpraiz-content-api' ) );
+        }
+
         $wp_filesystem->put_contents( $tmp_file, $image_data );
 

wpraiz-content-api-tool/trunk/includes/mcp/class-mcp-server.php

@@ -45 +45 @@
         $params  = $body['params'] ?? [];
         $id      = $body['id'] ?? null;
+
+        // Forward auth header so proxy_rest can re-authenticate internal calls.
+        MCP_Tools::set_auth_context( $request->get_header( 'Authorization' ) );
 
         if ( $jsonrpc !== '2.0' || empty( $method ) ) {

wpraiz-content-api-tool/trunk/includes/mcp/class-mcp-tools.php

@@ -137 +137 @@
     }
 
+    /** Authorization header forwarded from the incoming MCP request. */
+    private static ?string $current_auth_header = null;
+
+    /**
+     * Store the Authorization header for use in internal REST proxying.
+     * Call this once from MCP_Server before dispatching tool calls.
+     */
+    public static function set_auth_context( ?string $auth_header ): void {
+        self::$current_auth_header = $auth_header;
+    }
+
     /**
      * Execute a tool by name.
@@ -189 +200 @@
         $request->set_header( 'Content-Type', 'application/json' );
 
+        // Propagate the caller's Authorization so permission callbacks pass.
+        if ( self::$current_auth_header ) {
+            $request->set_header( 'Authorization', self::$current_auth_header );
+        }
+
         $response = rest_do_request( $request->set_route( '/' . $route ) );